agentic-workflow-manager 3.10.0 → 3.11.0

package/dist/src/commands/preflight/checks.js

@@ -64,6 +64,19 @@ function checkManifest(cwd, manifest) {
     }
     const total = Object.keys(manifest.sensors ?? {}).length;
     const enabled = Object.values(manifest.sensors ?? {}).filter(s => s.enabled !== false).length;
+    // total === 0 is NOT an opt-out: a deliberate opt-out lists every known sensor NAME
+    // explicitly with `enabled: false` (total > 0, enabled === 0). Zero entries means
+    // nothing was ever configured — most commonly because the registry had no pack.json
+    // for the detected stack, so `awm sensors init` built an honest, empty manifest
+    // rather than inventing defaults. That must not read as "all sensors disabled".
+    if (total === 0) {
+        return {
+            id: 'manifest',
+            ok: false,
+            detail: `pack '${manifest.pack}' has no sensors — the registry has no pack.json for it`,
+            remedy: `registry has no pack for '${manifest.pack}': run \`awm update\` or add a registry that has it`,
+        };
+    }
     return {
         id: 'manifest',
         ok: true,
@@ -77,6 +90,20 @@ function checkTools(cwd) {
     if (status.overall === 'NOT_CONFIGURED') {
         return { id: 'tools', ok: false, detail: 'no manifest to check', remedy: 'run `awm sensors init`' };
     }
+    // A manifest with zero sensor entries (honest-degraded — no pack.json reachable in
+    // the registry for this stack) makes `Object.entries({}).filter(...)` vacuously
+    // empty, which used to read as "0 broken out of 0" — a clean pass for a manifest
+    // that checks nothing at all. Mirrors the same zero-sensors signal `checkManifest`
+    // already guards against; this defends the invariant independently rather than
+    // relying solely on `checkManifest`'s gate to catch this exact manifest shape.
+    if (Object.keys(status.checks).length === 0) {
+        return {
+            id: 'tools',
+            ok: false,
+            detail: 'no sensors configured to check (0 sensor entries in the manifest)',
+            remedy: `registry has no pack for '${status.pack}': run \`awm update\` or add a registry that has it`,
+        };
+    }
     const broken = Object.entries(status.checks).filter(([, c]) => !c.ok);
     if (broken.length > 0) {
         return {

package/dist/src/commands/sensors/formatters/mypy.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseMypyOutput = parseMypyOutput;
+// mypy's plain-text output (no --output json flag in this pack's defaultCmd), one
+// finding per line: `file:line: error: message  [code]`. The `[code]` suffix is
+// separated from the message by two spaces and is OPTIONAL — some mypy error kinds
+// omit it. No column: this pack's defaultCmd has no --show-column-numbers.
+//
+// Deliberately excluded, not matched by this pattern:
+//   - `note:` lines (e.g. `reveal_type` output, supplementary context) — not failures.
+//   - the trailing summary line (`Found N errors in M files…` / `Success: …`).
+const MYPY_LINE = /^(.+):(\d+): error: (.*?)(?:  \[(\S+)\])?$/;
+function parseMypyOutput(raw) {
+    const errors = [];
+    for (const line of raw.split('\n')) {
+        if (!line)
+            continue;
+        const m = MYPY_LINE.exec(line);
+        if (!m)
+            continue;
+        const [, file, lineStr, msg, code] = m;
+        errors.push({
+            file,
+            line: parseInt(lineStr, 10),
+            rule: code,
+            message: `SENSOR[typecheck] ${file}:${lineStr} — ${msg} Fix: review the type annotation. Error code: ${code ?? 'n/a'}.`,
+        });
+    }
+    return errors;
+}

package/dist/src/commands/sensors/formatters/ruff.js

@@ -0,0 +1,45 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRuffOutput = parseRuffOutput;
+const path_1 = __importDefault(require("path"));
+function parseRuffOutput(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    // Valid JSON syntax does not guarantee the expected shape — `{}`, `null`, `42` all
+    // parse successfully but are not arrays, and an array element can itself be `null`
+    // or missing the fields this parser reads. Guard both, or a well-formed-but-wrong
+    // shape from `ruff --output-format=json` throws instead of degrading to [].
+    if (!Array.isArray(parsed))
+        return [];
+    const cwd = process.cwd();
+    const errors = [];
+    for (const item of parsed) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const msg = item;
+        if (typeof msg.filename !== 'string')
+            continue;
+        if (!msg.location || typeof msg.location !== 'object'
+            || typeof msg.location.row !== 'number' || typeof msg.location.column !== 'number')
+            continue;
+        const rel = msg.filename.startsWith(cwd + path_1.default.sep)
+            ? path_1.default.relative(cwd, msg.filename)
+            : msg.filename;
+        errors.push({
+            file: rel,
+            line: msg.location.row,
+            column: msg.location.column,
+            rule: msg.code ?? 'unknown',
+            message: `SENSOR[lint] ${rel}:${msg.location.row} — ${msg.message ?? ''} Fix: check rule ${msg.code ?? 'unknown'}.`,
+        });
+    }
+    return errors;
+}

package/dist/src/commands/sensors/formatters/shellcheck.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseShellcheckOutput = parseShellcheckOutput;
+// shellcheck's own levels, from most to least severe: error, warning, info, style.
+// `info`/`style` are advisory — quoting preferences, portability nits — not genuine
+// problems (mirrors eslint.ts's `severity < 2` filter, which drops eslint's "warn" the
+// same way: findings should be real breakage, not 100% of the tool's advisory noise).
+// Only `error`/`warning` are reported as SensorErrors.
+const FAILING_LEVELS = new Set(['error', 'warning']);
+function parseShellcheckOutput(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    // Valid JSON syntax does not guarantee the expected shape — `{}`, `null`, `42` all
+    // parse successfully but are not arrays, and an array element can itself be `null`
+    // or missing the fields this parser reads. Guard both, or a well-formed-but-wrong
+    // shape from `shellcheck -f json` throws instead of degrading to [].
+    if (!Array.isArray(parsed))
+        return [];
+    const errors = [];
+    for (const item of parsed) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const msg = item;
+        if (typeof msg.file !== 'string' || typeof msg.line !== 'number'
+            || typeof msg.column !== 'number' || typeof msg.code !== 'number'
+            || !msg.level)
+            continue;
+        if (!FAILING_LEVELS.has(msg.level))
+            continue;
+        const rule = `SC${msg.code}`;
+        errors.push({
+            file: msg.file,
+            line: msg.line,
+            column: msg.column,
+            rule,
+            message: `SENSOR[lint] ${msg.file}:${msg.line} — ${msg.message ?? ''} Fix: see https://www.shellcheck.net/wiki/${rule}.`,
+        });
+    }
+    return errors;
+}

package/dist/src/commands/sensors/index.js

@@ -46,12 +46,19 @@ function registerSensorsCommand(program) {
         .description('detect stack and write .awm/sensors.json (+ copy pack config files)')
         .option('--no-configure', 'skip copying sensor pack config files into the project')
         .option('--registry-root <path>', 'path to AWM registry root')
+        .option('--pack <name>', 'skip auto-detection, use this pack explicitly')
         .action((opts) => {
         const registryRoot = opts.registryRoot ?? (0, registries_1.capabilityRoot)('sensor-packs') ?? undefined;
-        const result = (0, init_1.initSensors)({ configure: opts.configure, registryRoot });
-        prompts_1.log.success(`Detected: ${result.detection.pack} (${result.detection.indicators.join(', ') || 'fallback'})`);
-        prompts_1.log.success('Wrote .awm/sensors.json');
-        result.configured.forEach((f) => prompts_1.log.info(`  Installed ${f}`));
+        try {
+            const result = (0, init_1.initSensors)({ configure: opts.configure, registryRoot, pack: opts.pack });
+            prompts_1.log.success(`Detected: ${result.detection.pack} (${result.detection.indicators.join(', ') || 'fallback'})`);
+            prompts_1.log.success('Wrote .awm/sensors.json');
+            result.configured.forEach((f) => prompts_1.log.info(`  Installed ${f}`));
+        }
+        catch (e) {
+            prompts_1.log.error(e instanceof Error ? e.message : String(e));
+            process.exit(1);
+        }
     });
     sensors
         .command('baseline')

package/dist/src/commands/sensors/init.js

@@ -11,14 +11,37 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const STACK_DETECTORS = [
     { pack: 'js-ts', files: ['package.json'] },
-    { pack: 'python', files: ['pyproject.toml', 'setup.py', 'setup.cfg'] },
+    { pack: 'python', files: ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt', 'Pipfile'] },
 ];
+// Shell detection is a glob (`*.sh` in the repo root or in `scripts/`), unlike the
+// exact-filename matches above — so it needs its own scan rather than fitting the
+// STACK_DETECTORS table. Tried last, after js-ts and python both fail: a Python
+// project that also ships a root `deploy.sh` must still detect as `python`, never
+// `shell`. Order of specificity: js-ts > python > shell > generic.
+const SHELL_SCAN_DIRS = ['.', 'scripts'];
+function findShellIndicators(cwd) {
+    const found = [];
+    for (const dir of SHELL_SCAN_DIRS) {
+        const full = path_1.default.join(cwd, dir);
+        if (!fs_1.default.existsSync(full) || !fs_1.default.statSync(full).isDirectory())
+            continue;
+        for (const entry of fs_1.default.readdirSync(full, { withFileTypes: true })) {
+            if (entry.isFile() && entry.name.endsWith('.sh')) {
+                found.push(dir === '.' ? entry.name : path_1.default.join(dir, entry.name));
+            }
+        }
+    }
+    return found;
+}
 function detectStack(cwd) {
     for (const { pack, files } of STACK_DETECTORS) {
         const found = files.filter(f => fs_1.default.existsSync(path_1.default.join(cwd, f)));
         if (found.length > 0)
             return { pack, indicators: found };
     }
+    const shellIndicators = findShellIndicators(cwd);
+    if (shellIndicators.length > 0)
+        return { pack: 'shell', indicators: shellIndicators };
     return { pack: 'generic', indicators: [] };
 }
 // Candidate source dirs in priority order. `depcheck` analyzes the ones that
@@ -31,17 +54,6 @@ function detectSourceDirs(cwd) {
     });
     return found.length > 0 ? found : ['src'];
 }
-// Fallback defaults for packs that don't yet ship a pack.json in the registry
-// (today: python). js-ts/generic are sourced from
-// registry/sensor-packs/<pack>/pack.json — single source of truth.
-const FALLBACK_DEFAULTS = {
-    python: {
-        typecheck: { cmd: 'mypy .', fast: true },
-        lint: { cmd: 'ruff check . --output-format json', fast: true },
-        security: { cmd: 'semgrep --config .semgrep.awm.yml --json .', fast: false },
-        mutation: { enabled: false },
-    },
-};
 /**
  * Read sensor defaults from the pack's pack.json (the single source of truth).
  * Maps `defaultCmd` → `cmd` and substitutes the `{{SOURCE_DIRS}}` placeholder
@@ -76,21 +88,74 @@ function readPackDefaults(pack, registryRoot, cwd) {
             entry.changedCmd = def.changedCmd;
         if (def.changedExtensions)
             entry.changedExtensions = def.changedExtensions;
+        // Carries the real tool name (`mypy`, `ruff`, `shellcheck`…) so the runner can
+        // dispatch to the right output parser instead of guessing from the sensor name —
+        // see `SensorConfig.formatter`.
+        if (def.formatter)
+            entry.formatter = def.formatter;
         sensors[name] = entry;
     }
     return sensors;
 }
 function buildManifest(pack, existing, registryRoot, cwd = process.cwd()) {
     const fromPack = registryRoot ? readPackDefaults(pack, registryRoot, cwd) : null;
-    const defaults = fromPack ?? FALLBACK_DEFAULTS[pack] ?? {};
+    // No registry root, or the pack has no pack.json there → `{}` is the honest floor,
+    // not a bug to paper over with CLI-hardcoded defaults. `checkManifest` (preflight)
+    // and `computeSensorStatus` both surface a zero-sensor manifest as degraded, with a
+    // remedy pointing at the registry — never silently inventing sensors here instead.
+    const defaults = fromPack ?? {};
     const existingSensors = existing?.sensors ?? {};
-    return { pack, sensors: { ...defaults, ...existingSensors } };
+    // Per-FIELD merge, not whole-sensor-object replacement: if `existingSensors.foo`
+    // exists at all, a naive `{ ...defaults, ...existingSensors }` would replace
+    // `defaults.foo` wholesale, permanently dropping any field that only lives in the
+    // (newer) pack default — e.g. a pre-`formatter`-era manifest re-merged against a
+    // pack.json that now declares `formatter` would silently lose it forever. Merging
+    // field-by-field within each sensor entry lets a user's hand-edited field (e.g. a
+    // custom `cmd`) win, while still inheriting any field the existing manifest doesn't
+    // specify.
+    const sensorNames = new Set([...Object.keys(defaults), ...Object.keys(existingSensors)]);
+    const sensors = {};
+    for (const name of sensorNames) {
+        sensors[name] = { ...defaults[name], ...existingSensors[name] };
+    }
+    return { pack, sensors };
+}
+/**
+ * Validate that `pack` exists as a directory under `<registryRoot>/sensor-packs/`.
+ * Throws (not a swallow-and-return) so `awm sensors init --pack bogus` actually stops
+ * instead of silently writing a manifest for a pack that doesn't exist. Lists every
+ * pack directory actually present, sorted, so the user immediately sees valid options.
+ */
+function assertPackExists(pack, registryRoot) {
+    const packsDir = path_1.default.join(registryRoot, 'sensor-packs');
+    if (!fs_1.default.existsSync(packsDir) || !fs_1.default.statSync(packsDir).isDirectory()) {
+        throw new Error('registry has no sensor-packs directory');
+    }
+    const available = fs_1.default.readdirSync(packsDir, { withFileTypes: true })
+        .filter(e => e.isDirectory())
+        .map(e => e.name)
+        .sort();
+    if (!available.includes(pack)) {
+        throw new Error(`pack '${pack}' not found in registry (available: ${available.join(', ')})`);
+    }
 }
 function initSensors(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const configure = opts.configure ?? true; // configure (copy pack config files) by default
     const manifestPath = path_1.default.join(cwd, '.awm', 'sensors.json');
-    const detection = detectStack(cwd);
+    // --pack skips the heuristic entirely. Only validate against the registry when a
+    // registryRoot was actually given — same tolerance pattern as readPackDefaults /
+    // buildManifest elsewhere in this file for a missing registry: nothing to validate
+    // against, so nothing is validated.
+    let detection;
+    if (opts.pack) {
+        if (opts.registryRoot)
+            assertPackExists(opts.pack, opts.registryRoot);
+        detection = { pack: opts.pack, indicators: ['--pack override'] };
+    }
+    else {
+        detection = detectStack(cwd);
+    }
     let existing;
     if (fs_1.default.existsSync(manifestPath)) {
         try {

package/dist/src/commands/sensors/run.js

@@ -17,6 +17,9 @@ const eslint_1 = require("./formatters/eslint");
 const semgrep_1 = require("./formatters/semgrep");
 const generic_1 = require("./formatters/generic");
 const test_1 = require("./formatters/test");
+const mypy_1 = require("./formatters/mypy");
+const ruff_1 = require("./formatters/ruff");
+const shellcheck_1 = require("./formatters/shellcheck");
 const baseline_1 = require("./baseline");
 const changed_1 = require("./changed");
 const init_1 = require("./init");
@@ -117,7 +120,35 @@ function shouldRun(isFast, opts) {
         return true;
     return false;
 }
-function getFormatter(name) {
+/**
+ * Dispatch by the pack's `formatter` field (the real tool behind the sensor slot —
+ * `lint` is eslint on js-ts but ruff on python, shellcheck on shell) when present.
+ * Manifests written before this field existed carry no `formatter`, so they fall back
+ * to the pre-existing name-based dispatch — nothing already installed breaks.
+ */
+function getFormatter(name, formatterField) {
+    // A `formatter` field that is PRESENT but unrecognized (a typo in a pack.json, or a
+    // future pack declaring a tool this CLI version doesn't know about yet) is a
+    // different situation from no field at all. Falling through to name-based dispatch
+    // in that case would silently misparse a foreign output shape via the wrong parser
+    // (e.g. a `bandit` formatter falling through to `parseSemgrepOutput`, reading
+    // bandit's differently-shaped JSON and producing garbage findings). Only the
+    // ABSENT case (old manifest, written before this field existed) gets name-based
+    // backward-compat dispatch; a present-but-unknown value degrades honestly to the
+    // generic raw-wrap formatter instead.
+    if (formatterField !== undefined) {
+        switch (formatterField) {
+            case 'tsc': return tsc_1.parseTscOutput;
+            case 'eslint-llm': return eslint_1.parseEslintOutput;
+            case 'semgrep': return semgrep_1.parseSemgrepOutput;
+            case 'test': return test_1.parseTestOutput;
+            case 'mypy': return mypy_1.parseMypyOutput;
+            case 'ruff': return ruff_1.parseRuffOutput;
+            case 'shellcheck': return shellcheck_1.parseShellcheckOutput;
+            case 'generic': return generic_1.parseGenericOutput;
+            default: return generic_1.parseGenericOutput;
+        }
+    }
     if (name === 'typecheck')
         return tsc_1.parseTscOutput;
     if (name === 'lint')
@@ -131,9 +162,9 @@ function getFormatter(name) {
 function isExitCodeSensor(name) {
     return name === 'test';
 }
-async function runSensor(name, cmd, timeout, cwd) {
+async function runSensor(name, cmd, timeout, cwd, formatterField) {
     const res = await (0, exec_1.runCommand)(cmd, { timeout, cwd, maxBuffer: MAX_BUFFER });
-    const format = getFormatter(name);
+    const format = getFormatter(name, formatterField);
     // The shell itself never started (bad cwd, no shell). Nothing ran.
     if (res.spawnError) {
         return {
@@ -290,7 +321,7 @@ async function runSensors(opts = {}) {
     // in manifest order, so the reported order stays stable.
     const tasks = [];
     const settled = (r) => () => Promise.resolve(r);
-    for (const [name, config] of Object.entries(activeManifest.sensors)) {
+    for (const [name, config] of Object.entries(activeManifest.sensors ?? {})) {
         const isFast = config.fast ?? false;
         if (!shouldRun(isFast, opts))
             continue;
@@ -336,7 +367,7 @@ async function runSensors(opts = {}) {
         }
         const timeout = config.timeout ?? (isFast ? DEFAULT_FAST_TIMEOUT : DEFAULT_SLOW_TIMEOUT);
         tasks.push(async () => {
-            const result = await runSensor(name, cmd, timeout, cwd);
+            const result = await runSensor(name, cmd, timeout, cwd, config.formatter);
             const scoped = scope ? { ...result, scope } : result;
             return baseline ? applyBaseline(scoped, baseline[name]) : scoped;
         });

package/dist/src/commands/sensors/status.js

@@ -66,7 +66,7 @@ function computeSensorStatus(cwd = process.cwd()) {
         return { overall: 'NOT_CONFIGURED', pack: null, checks: {} };
     }
     const checks = {};
-    for (const [name, config] of Object.entries(manifest.sensors)) {
+    for (const [name, config] of Object.entries(manifest.sensors ?? {})) {
         if (config.enabled === false) {
             checks[name] = { ok: true, detail: 'disabled' };
             continue;
@@ -77,6 +77,13 @@ function computeSensorStatus(cwd = process.cwd()) {
         }
         checks[name] = checkCmd(config.cmd, cwd);
     }
+    // `Object.values({}).every(...)` is vacuously true — a manifest with zero sensor
+    // entries (the registry had no pack.json for this stack; see init.ts) must not read
+    // as HEALTHY just because there was nothing to fail. Same false-green `checkManifest`
+    // guards against in preflight.
+    if (Object.keys(manifest.sensors ?? {}).length === 0) {
+        return { overall: 'DEGRADED', pack: manifest.pack, checks };
+    }
     const allOk = Object.values(checks).every(c => c.ok);
     return { overall: allOk ? 'HEALTHY' : 'DEGRADED', pack: manifest.pack, checks };
 }

package/dist/tests/commands/preflight/preflight.test.js

@@ -96,6 +96,36 @@ describe('preflight', () => {
         expect(report.status).toBe('ready');
         expect(check(report, 'manifest').detail).toContain('opt-out');
     });
+    it('flags a manifest with zero sensor entries as degraded, distinct from a deliberate opt-out', () => {
+        // Genuinely different manifest shape from the opt-out test above: no sensor
+        // NAMES at all, vs. an opt-out which lists every known sensor explicitly with
+        // `enabled: false`. This is the honest-floor case from init.ts — the registry
+        // had no pack.json for the detected stack — and must never read as "opted out".
+        const noPack = make({
+            manifest: { pack: 'python', sensors: {} },
+        });
+        const report = (0, checks_1.preflight)(noPack);
+        expect(report.status).toBe('degraded');
+        expect(check(report, 'manifest').ok).toBe(false);
+        expect(check(report, 'manifest').detail).not.toContain('opt-out');
+        expect(check(report, 'manifest').detail).toContain('python');
+        expect(check(report, 'manifest').remedy).toContain('python');
+    });
+    it('flags the tools check as failing (not "0/0 runnable") for a manifest with zero sensor entries', () => {
+        // Regression for Finding 6: `checkTools` independently inspects
+        // `status.checks`, which is also `{}` for a zero-sensor manifest —
+        // `Object.entries({}).filter(...)` is vacuously `[]`, so before the fix this
+        // read as "0 broken out of 0 sensors" -> ok: true, a clean pass for a manifest
+        // that checks nothing at all. `checkManifest`'s own `total === 0` gate happens
+        // to also catch this exact manifest shape and keeps overall status degraded —
+        // but `checkTools` must defend the same invariant on its own.
+        const noPack = make({
+            manifest: { pack: 'python', sensors: {} },
+        });
+        const report = (0, checks_1.preflight)(noPack);
+        expect(check(report, 'tools').ok).toBe(false);
+        expect(report.status).toBe('degraded');
+    });
     it('flags a manifest stuck on generic while the tree has a real stack', () => {
         // The gate would run, report green, and have checked almost nothing.
         const dir = make({
@@ -128,9 +158,14 @@ describe('preflight', () => {
         expect((0, preflight_1.exitCodeFor)({ status: 'ready', checks: [] })).toBe(0);
     });
     describe('host check (advisory — never changes the exit code)', () => {
+        // Fixtures below use a non-empty, deliberately-opted-out manifest (one sensor
+        // entry, `enabled: false`), not `sensors: {}` — the host check is orthogonal to
+        // sensor configuration, and an empty sensors object now fails `checkManifest`
+        // (see the `total === 0` branch), which would drag `report.status` off 'ready'
+        // for reasons unrelated to what these tests exercise.
         beforeEach(() => { mockExecSync.mockReset(); });
         it('reports github + gh available, and does not affect status', () => {
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@github.com:kodria/agentic-workflow.git');
             mockExecSync.mockImplementation(((cmd) => {
                 if (cmd === 'command -v gh')
@@ -145,7 +180,7 @@ describe('preflight', () => {
         it('is still ok:true (advisory only) when gitlab is detected but glab is not on PATH, and status stays ready', () => {
             // The only thing "wrong" in this fixture is the missing `glab` — proving the
             // advisory contract: it must not drag an otherwise-clean repo to `degraded`.
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://gitlab.com/kodria/agentic-workflow.git');
             mockExecSync.mockImplementation((() => {
                 throw new Error('not found');
@@ -157,7 +192,7 @@ describe('preflight', () => {
             expect(report.status).toBe('ready');
         });
         it('handles no origin remote gracefully — no throw, ok:true, minimal detail', () => {
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             // Not a git repo at all — the common case for `execFileSync` failing here.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
@@ -166,14 +201,14 @@ describe('preflight', () => {
             expect(report.status).toBe('ready');
         });
         it('handles a git repo with no origin remote configured gracefully', () => {
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir); // git init, no remote
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
             expect(check(report, 'host').detail).toContain('no git remote detected');
         });
         it('does not overclaim support for an unrecognized host', () => {
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@bitbucket.org:kodria/agentic-workflow.git');
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
@@ -185,7 +220,7 @@ describe('preflight', () => {
             // string, so an org/repo name containing "gitlab" false-positives even though
             // the actual host is unrelated. Hostname must be extracted first and matched
             // in isolation.
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@github.enterprise.internal:kodria/gitlab-migration-tool.git');
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
@@ -195,7 +230,7 @@ describe('preflight', () => {
         it('does not misclassify a non-GitHub host whose repo NAME contains "github"', () => {
             // Same class of bug on the github side: "something-github-tool" is a repo
             // name, not the host.
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://example.com/kodria/something-github-tool.git');
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
@@ -214,7 +249,7 @@ describe('preflight', () => {
             // correctly classifies as github (checkHost's own substring matching is a
             // separate, pre-existing design, not part of this fix). The regression this
             // test guards is that it must never again read as gitlab.
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'ssh://gitlab@github.company-internal.com:22/team/repo.git');
             mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
             const report = (0, checks_1.preflight)(dir);
@@ -228,7 +263,7 @@ describe('preflight', () => {
             // `git remote set-url origin https://x-access-token:$TOKEN@host/...`. If the
             // token or password happens to contain "gitlab", it must not leak into the
             // matched host either.
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://user:gitlab@example-host.com/org/repo.git');
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
@@ -241,7 +276,7 @@ describe('preflight', () => {
             // not let a bogus "host@evil"-shaped capture slip past the colon check —
             // the host-capture group excludes "@", so this fails to match at all and
             // falls through to "unrecognized" rather than misclassifying as gitlab.
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'user@github.com@gitlab.evil:org/repo.git');
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
@@ -249,28 +284,28 @@ describe('preflight', () => {
             expect(report.status).toBe('ready');
         });
         it('still detects github.com over HTTPS', () => {
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://github.com/org/repo.git');
             mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('github detected');
         });
         it('still detects github.com over SSH shorthand', () => {
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@github.com:org/repo.git');
             mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('github detected');
         });
         it('still detects gitlab over HTTPS', () => {
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://gitlab.example.com/org/repo.git');
             mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('gitlab detected');
         });
         it('still detects gitlab over SSH shorthand', () => {
-            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@gitlab.example.com:org/repo.git');
             mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
             const report = (0, checks_1.preflight)(dir);

package/dist/tests/commands/sensors/formatters/mypy.test.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const mypy_1 = require("../../../../src/commands/sensors/formatters/mypy");
+describe('parseMypyOutput', () => {
+    it('parses a single mypy error line (real captured output)', () => {
+        const raw = 'bad.py:6: error: Incompatible return value type (got "int", expected "str")  [return-value]\n'
+            + 'Found 1 error in 1 file (checked 1 source file)';
+        const errors = (0, mypy_1.parseMypyOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].file).toBe('bad.py');
+        expect(errors[0].line).toBe(6);
+        expect(errors[0].rule).toBe('return-value');
+        expect(errors[0].message).toMatch('SENSOR[typecheck]');
+        expect(errors[0].message).toMatch('Fix:');
+        expect(errors[0].column).toBeUndefined(); // plain mypy output has no column
+    });
+    it('parses multiple error lines and ignores the trailing summary', () => {
+        const raw = 'multi.py:2: error: Incompatible return value type (got "int", expected "str")  [return-value]\n'
+            + 'multi.py:5: error: Incompatible return value type (got "str", expected "int")  [return-value]\n'
+            + 'multi.py:7: error: Incompatible types in assignment (expression has type "str", variable has type "int")  [assignment]\n'
+            + 'Found 3 errors in 1 file (checked 1 source file)';
+        const errors = (0, mypy_1.parseMypyOutput)(raw);
+        expect(errors).toHaveLength(3);
+        expect(errors.map(e => e.line)).toEqual([2, 5, 7]);
+        expect(errors[2].rule).toBe('assignment');
+    });
+    it('excludes `note:` lines — only `error:` lines are findings', () => {
+        // Real captured output: `reveal_type()` prints a note line ahead of the actual
+        // error, and an incompatible override reports without a trailing summary change.
+        const raw = 'notetest.py:2: note: Revealed type is "builtins.int"\n'
+            + 'notetest.py:10: error: Return type "str" of "foo" incompatible with return type "int" in supertype "A"  [override]\n'
+            + 'Found 1 error in 1 file (checked 1 source file)';
+        const errors = (0, mypy_1.parseMypyOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].line).toBe(10);
+        expect(errors[0].rule).toBe('override');
+    });
+    it('handles an error line with no trailing [code] bracket', () => {
+        // Synthetic case: attempted to reproduce a real mypy output line missing the
+        // bracketed error code against mypy 1.19.1 (syntax errors, import errors,
+        // `--warn-unused-ignores`, `--warn-redundant-casts`, unterminated strings,
+        // deep generic instantiation) — every error line this environment's mypy
+        // 1.19.1 produced included the `[code]` suffix (error codes have been attached
+        // to essentially all builtin error messages since they were introduced in
+        // mypy 0.730, per the mypy changelog). No real bracket-less line was found, so
+        // this fixture stays synthetic. The regex's optional bracket is kept
+        // defensively regardless — a plugin-emitted error, a third-party mypy
+        // extension, or an older mypy version could plausibly still omit it, and the
+        // parser must not crash or misparse if so.
+        const raw = 'foo.py:3: error: some mypy error kinds omit the bracketed code';
+        const errors = (0, mypy_1.parseMypyOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].rule).toBeUndefined();
+        expect(errors[0].message).toContain('n/a');
+    });
+    it('returns empty array for a clean run (real captured success line)', () => {
+        expect((0, mypy_1.parseMypyOutput)('Success: no issues found in 1 source file')).toEqual([]);
+        expect((0, mypy_1.parseMypyOutput)('')).toEqual([]);
+    });
+});

package/dist/tests/commands/sensors/formatters/ruff.test.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ruff_1 = require("../../../../src/commands/sensors/formatters/ruff");
+// Real `ruff check . --output-format json` output, captured against a fabricated
+// fixture (unused import + unused local variable).
+const SAMPLE = JSON.stringify([
+    {
+        cell: null,
+        code: 'F401',
+        end_location: { column: 10, row: 1 },
+        filename: '/home/user/project/bad.py',
+        fix: {
+            applicability: 'safe',
+            edits: [{ content: '', end_location: { column: 1, row: 2 }, location: { column: 1, row: 1 } }],
+            message: 'Remove unused import: `os`',
+        },
+        location: { column: 8, row: 1 },
+        message: '`os` imported but unused',
+        noqa_row: 1,
+        severity: 'error',
+        url: 'https://docs.astral.sh/ruff/rules/unused-import',
+    },
+    {
+        cell: null,
+        code: 'F841',
+        end_location: { column: 6, row: 4 },
+        filename: '/home/user/project/bad.py',
+        fix: {
+            applicability: 'unsafe',
+            edits: [{ content: '', end_location: { column: 1, row: 5 }, location: { column: 1, row: 4 } }],
+            message: 'Remove assignment to unused variable `x`',
+        },
+        location: { column: 5, row: 4 },
+        message: 'Local variable `x` is assigned to but never used',
+        noqa_row: 4,
+        severity: 'error',
+        url: 'https://docs.astral.sh/ruff/rules/unused-variable',
+    },
+]);
+describe('parseRuffOutput', () => {
+    let cwdSpy;
+    beforeEach(() => { cwdSpy = jest.spyOn(process, 'cwd').mockReturnValue('/home/user/project'); });
+    afterEach(() => { cwdSpy.mockRestore(); });
+    it('parses ruff JSON output into SensorErrors', () => {
+        const errors = (0, ruff_1.parseRuffOutput)(SAMPLE);
+        expect(errors).toHaveLength(2);
+        expect(errors[0].file).toBe('bad.py'); // relativized against cwd
+        expect(errors[0].line).toBe(1);
+        expect(errors[0].column).toBe(8);
+        expect(errors[0].rule).toBe('F401');
+        expect(errors[0].message).toMatch('SENSOR[lint]');
+        expect(errors[0].message).toMatch('Fix:');
+        expect(errors[1].rule).toBe('F841');
+    });
+    it('returns empty array for a clean run ([])', () => {
+        expect((0, ruff_1.parseRuffOutput)('[]')).toEqual([]);
+    });
+    it('returns empty array for malformed JSON', () => {
+        expect((0, ruff_1.parseRuffOutput)('not json')).toEqual([]);
+    });
+    // Regression for Finding 2: valid JSON that isn't the expected shape (object, null,
+    // number) must not throw when iterated — `JSON.parse` succeeding is not the same as
+    // the result being an array.
+    it.each([['{}'], ['null'], ['42'], ['"a string"']])('returns empty array for valid-but-non-array JSON: %s', (raw) => {
+        expect(() => (0, ruff_1.parseRuffOutput)(raw)).not.toThrow();
+        expect((0, ruff_1.parseRuffOutput)(raw)).toEqual([]);
+    });
+    it('skips a null array element instead of crashing', () => {
+        expect(() => (0, ruff_1.parseRuffOutput)('[null]')).not.toThrow();
+        expect((0, ruff_1.parseRuffOutput)('[null]')).toEqual([]);
+    });
+    it('skips an element with a null/missing location instead of crashing on .row/.column', () => {
+        const raw = JSON.stringify([
+            { code: 'F401', filename: '/home/user/project/a.py', location: null, message: 'x' },
+        ]);
+        expect(() => (0, ruff_1.parseRuffOutput)(raw)).not.toThrow();
+        expect((0, ruff_1.parseRuffOutput)(raw)).toEqual([]);
+    });
+    it('skips a malformed element but still returns valid elements from the same array', () => {
+        const raw = JSON.stringify([
+            null,
+            { code: 'F401', filename: '/home/user/project/a.py', location: null, message: 'bad' },
+            {
+                code: 'F841', filename: '/home/user/project/bad.py',
+                location: { column: 5, row: 4 }, message: 'Local variable `x` is assigned to but never used',
+            },
+        ]);
+        const errors = (0, ruff_1.parseRuffOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].rule).toBe('F841');
+    });
+});

package/dist/tests/commands/sensors/formatters/shellcheck.test.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const shellcheck_1 = require("../../../../src/commands/sensors/formatters/shellcheck");
+describe('parseShellcheckOutput', () => {
+    it('parses an error-level finding (real captured output: unbalanced if/then)', () => {
+        const raw = JSON.stringify([
+            { file: 'syntaxerr.sh', line: 2, endLine: 2, column: 1, endColumn: 1, level: 'error', code: 1049, message: "Did you forget the 'then' for this 'if'?", fix: null },
+        ]);
+        const errors = (0, shellcheck_1.parseShellcheckOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].file).toBe('syntaxerr.sh');
+        expect(errors[0].line).toBe(2);
+        expect(errors[0].column).toBe(1);
+        expect(errors[0].rule).toBe('SC1049'); // shellcheck's own stable SC-prefix convention
+        expect(errors[0].message).toMatch('SENSOR[lint]');
+        expect(errors[0].message).toMatch('https://www.shellcheck.net/wiki/SC1049');
+    });
+    it('parses a warning-level finding (real captured output: unused variable)', () => {
+        const raw = JSON.stringify([
+            { file: 'bad.sh', line: 7, endLine: 7, column: 1, endColumn: 4, level: 'warning', code: 2034, message: 'FOO appears unused. Verify use (or export if used externally).', fix: null },
+        ]);
+        const errors = (0, shellcheck_1.parseShellcheckOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].rule).toBe('SC2034');
+    });
+    // Deliberate choice, mirroring eslint.ts's `severity < 2` filter (which drops
+    // eslint's "warn"): shellcheck's `info`/`style` levels are advisory — quoting
+    // preferences, portability nits, not genuine breakage — and are excluded so
+    // findings stay real problems rather than 100% of shellcheck's advisory noise.
+    // Only `error`/`warning` are reported.
+    it('excludes info- and style-level findings (real captured output: SC2086, SC2268)', () => {
+        const raw = JSON.stringify([
+            { file: 'bad.sh', line: 4, endLine: 4, column: 6, endColumn: 9, level: 'style', code: 2268, message: 'Avoid x-prefix in comparisons as it no longer serves a purpose.', fix: null },
+            { file: 'bad.sh', line: 4, endLine: 4, column: 7, endColumn: 9, level: 'info', code: 2086, message: 'Double quote to prevent globbing and word splitting.', fix: null },
+        ]);
+        expect((0, shellcheck_1.parseShellcheckOutput)(raw)).toEqual([]);
+    });
+    it('returns empty array for a clean run (real captured output: [])', () => {
+        expect((0, shellcheck_1.parseShellcheckOutput)('[]')).toEqual([]);
+    });
+    it('returns empty array for malformed JSON', () => {
+        expect((0, shellcheck_1.parseShellcheckOutput)('not json')).toEqual([]);
+    });
+    // Regression for Finding 2: valid JSON that isn't the expected shape (object, null,
+    // number) must not throw when iterated — `JSON.parse` succeeding is not the same as
+    // the result being an array.
+    it.each([['{}'], ['null'], ['42'], ['"a string"']])('returns empty array for valid-but-non-array JSON: %s', (raw) => {
+        expect(() => (0, shellcheck_1.parseShellcheckOutput)(raw)).not.toThrow();
+        expect((0, shellcheck_1.parseShellcheckOutput)(raw)).toEqual([]);
+    });
+    it('skips a null array element instead of crashing', () => {
+        expect(() => (0, shellcheck_1.parseShellcheckOutput)('[null]')).not.toThrow();
+        expect((0, shellcheck_1.parseShellcheckOutput)('[null]')).toEqual([]);
+    });
+    it('skips a malformed element but still returns valid elements from the same array', () => {
+        const raw = JSON.stringify([
+            null,
+            { file: 'bad.sh', line: 7, column: 1, level: 'warning' }, // missing code/message
+            { file: 'bad.sh', line: 7, endLine: 7, column: 1, endColumn: 4, level: 'warning', code: 2034, message: 'FOO appears unused.', fix: null },
+        ]);
+        const errors = (0, shellcheck_1.parseShellcheckOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].rule).toBe('SC2034');
+    });
+});

package/dist/tests/commands/sensors/init.test.js

@@ -16,14 +16,30 @@ function makeRegistry() {
     fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
         name: 'js-ts',
         sensors: {
-            typecheck: { fast: true, defaultCmd: 'npx tsc --noEmit' },
-            lint: { fast: true, defaultCmd: 'npx eslint . --config eslint.config.awm.mjs --cache --format json' },
+            typecheck: { fast: true, defaultCmd: 'npx tsc --noEmit', formatter: 'tsc' },
+            lint: { fast: true, defaultCmd: 'npx eslint . --config eslint.config.awm.mjs --cache --format json', formatter: 'eslint-llm' },
             depcheck: { fast: false, defaultCmd: 'npx depcruise --config .dep-cruiser.awm.js {{SOURCE_DIRS}}' },
             mutation: { fast: false, enabled: false, defaultCmd: 'npx stryker run' },
         },
     }));
     return registryRoot;
 }
+// Mirrors makeRegistry()'s js-ts shape but for a python pack.json that declares
+// `formatter` on `typecheck` — needed for the buildManifest per-field-merge
+// regression test (a pre-`formatter`-era existing manifest must still inherit it).
+function makePythonRegistry() {
+    const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-reg-py-'));
+    const packDir = path_1.default.join(registryRoot, 'sensor-packs', 'python');
+    fs_1.default.mkdirSync(packDir, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
+        name: 'python',
+        sensors: {
+            typecheck: { fast: true, defaultCmd: 'mypy .', formatter: 'mypy' },
+            lint: { fast: true, defaultCmd: 'ruff check --output-format=json .', formatter: 'ruff' },
+        },
+    }));
+    return registryRoot;
+}
 describe('detectStack', () => {
     let tmpDir;
     beforeEach(() => { tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-')); });
@@ -39,6 +55,60 @@ describe('detectStack', () => {
     it('falls back to generic when no indicators found', () => {
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('generic');
     });
+    it('detects shell from a root-level *.sh file when no js-ts/python marker exists', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
+        const result = (0, init_1.detectStack)(tmpDir);
+        expect(result.pack).toBe('shell');
+        expect(result.indicators).toEqual(['deploy.sh']);
+    });
+    it('detects shell from a scripts/*.sh file when root has nothing', () => {
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'scripts'));
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'scripts', 'build.sh'), '#!/bin/sh\n');
+        const result = (0, init_1.detectStack)(tmpDir);
+        expect(result.pack).toBe('shell');
+        expect(result.indicators).toEqual([path_1.default.join('scripts', 'build.sh')]);
+    });
+    it('js-ts wins over shell when both package.json and a root .sh file exist', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('js-ts');
+    });
+    it('python wins over shell when both a python marker and a root .sh file exist', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'pyproject.toml'), '');
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
+    });
+    it('falls through to generic when scripts/ has only non-.sh files (glob must not over-match)', () => {
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'scripts'));
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'scripts', 'notes.txt'), 'not shell');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('generic');
+    });
+    it('detects python from requirements.txt alone', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'requirements.txt'), '');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
+    });
+    it('detects python from Pipfile alone', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'Pipfile'), '');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
+    });
+    it('python (via Pipfile) wins over shell when both a Pipfile and a root .sh file exist', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'Pipfile'), '');
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
+    });
+    it('does not report a directory named "*.sh" as a shell indicator', () => {
+        // Directory literally named `something.sh` (not a file) — findShellIndicators'
+        // `entry.isFile()` guard must exclude it. Nothing else present → generic.
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'something.sh'));
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('generic');
+    });
+    it('ignores a directory named "*.sh" but still finds a real .sh file alongside it', () => {
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'notreal.sh'));
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
+        const result = (0, init_1.detectStack)(tmpDir);
+        expect(result.pack).toBe('shell');
+        expect(result.indicators).toEqual(['deploy.sh']);
+    });
 });
 describe('detectSourceDirs', () => {
     let tmpDir;
@@ -87,9 +157,45 @@ describe('buildManifest', () => {
         expect(m.sensors.typecheck.cmd).toBe('custom-tsc');
         expect(m.sensors.lint).toBeDefined();
     });
-    it('uses the python fallback when the pack has no pack.json', () => {
+    it('carries the formatter field through from pack.json into the built manifest', () => {
+        // readPackDefaults must copy `formatter` the same way it already copies
+        // `changedCmd`/`changedExtensions` — this is what lets run.ts's getFormatter
+        // dispatch by real tool (ruff/mypy/shellcheck) instead of guessing from the
+        // sensor name. Without this carry-through the field is read from pack.json but
+        // silently dropped before it ever reaches the manifest run.ts consumes.
+        const m = (0, init_1.buildManifest)('js-ts', undefined, registryRoot, cwd);
+        expect(m.sensors.typecheck.formatter).toBe('tsc');
+        expect(m.sensors.lint.formatter).toBe('eslint-llm');
+    });
+    it('returns an empty sensors object when the pack has no pack.json in the registry', () => {
+        // No FALLBACK_DEFAULTS anymore: `python` has no pack dir in this fixture
+        // registry (only js-ts does — see makeRegistry) → the honest floor is `{}`,
+        // never CLI-hardcoded commands that can drift from what the registry ships.
         const m = (0, init_1.buildManifest)('python', undefined, registryRoot, cwd);
-        expect(m.sensors.typecheck.cmd).toBe('mypy .');
+        expect(m.sensors).toEqual({});
+    });
+    it('per-field merge: an existing sensor missing a newer pack field still inherits it', () => {
+        // Regression for Finding 1: a manifest written by the old FALLBACK_DEFAULTS-era
+        // CLI has `typecheck: { cmd: 'mypy .', fast: true }` — no `formatter`, because
+        // that field didn't exist yet. A naive `{ ...defaults, ...existingSensors }`
+        // whole-sensor-object merge would replace `defaults.typecheck` wholesale,
+        // permanently dropping `formatter` even though the (upgraded) pack now declares
+        // it. The fix merges per FIELD within each sensor, so `formatter` — a field the
+        // existing manifest never specified — is inherited from the pack default.
+        const pyRegistryRoot = makePythonRegistry();
+        try {
+            const existing = {
+                pack: 'python',
+                sensors: { typecheck: { cmd: 'mypy .', fast: true } },
+            };
+            const m = (0, init_1.buildManifest)('python', existing, pyRegistryRoot, cwd);
+            expect(m.sensors.typecheck.formatter).toBe('mypy');
+            expect(m.sensors.typecheck.cmd).toBe('mypy .');
+            expect(m.sensors.typecheck.fast).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(pyRegistryRoot, { recursive: true });
+        }
     });
 });
 describe('initSensors', () => {
@@ -135,3 +241,52 @@ describe('initSensors', () => {
         expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'tsconfig.awm.json'))).toBe(false);
     });
 });
+describe('initSensors — --pack override', () => {
+    let tmpDir;
+    let registryRoot;
+    beforeEach(() => {
+        tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-pack-'));
+        registryRoot = makeRegistry(); // only ships a js-ts pack dir — see makeRegistry
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tmpDir, { recursive: true });
+        fs_1.default.rmSync(registryRoot, { recursive: true });
+    });
+    it('skips detection and uses the override pack when it exists in the registry', () => {
+        // No package.json/pyproject.toml here — if detection ran, this would be 'generic'.
+        const result = (0, init_1.initSensors)({ pack: 'js-ts', registryRoot, cwd: tmpDir });
+        expect(result.detection.pack).toBe('js-ts');
+        // Indicators must reflect an override, not file-based detection.
+        expect(result.detection.indicators).not.toEqual(['package.json']);
+        expect(result.detection.indicators.join(' ')).toMatch(/pack override/i);
+    });
+    it('throws listing available packs when the override pack is not in the registry', () => {
+        expect(() => (0, init_1.initSensors)({ pack: 'bogus', registryRoot, cwd: tmpDir })).toThrow(/js-ts/);
+        try {
+            (0, init_1.initSensors)({ pack: 'bogus', registryRoot, cwd: tmpDir });
+            throw new Error('expected initSensors to throw');
+        }
+        catch (e) {
+            expect(e.message).toContain('bogus');
+            expect(e.message).toContain('js-ts');
+        }
+    });
+    it('does not throw when no registryRoot is given — nothing to validate against', () => {
+        expect(() => (0, init_1.initSensors)({ pack: 'anything', cwd: tmpDir })).not.toThrow();
+        const result = (0, init_1.initSensors)({ pack: 'anything', cwd: tmpDir });
+        expect(result.detection.pack).toBe('anything');
+    });
+    it('throws a distinct message when the registry root has no sensor-packs directory at all', () => {
+        // Different failure shape from "pack not in the list": the registry root
+        // itself is missing sensor-packs/, so there's no list to show — must say
+        // so plainly instead of reporting an empty `available: `.
+        const emptyRegistryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-empty-reg-'));
+        try {
+            expect(() => (0, init_1.initSensors)({ pack: 'js-ts', registryRoot: emptyRegistryRoot, cwd: tmpDir }))
+                .toThrow(/no sensor-packs directory/);
+        }
+        finally {
+            fs_1.default.rmSync(emptyRegistryRoot, { recursive: true });
+        }
+    });
+});

package/dist/tests/commands/sensors/run.test.js

@@ -86,6 +86,79 @@ describe('runSensors', () => {
         expect(sec.status).toBe('skipped');
         expect(sec.skipReason).toBe('disabled');
     });
+    it('dispatches by the formatter field, not the sensor name — ruff on a `lint` sensor', async () => {
+        // The whole point of the `formatter` field: a `lint` sensor is eslint for
+        // js-ts but ruff for python. Old name-based dispatch (lint -> eslint parser)
+        // would choke on ruff's flat JSON array (no `.messages` — TypeError) instead
+        // of parsing it. Real captured `ruff --output-format json` shape.
+        const pythonManifest = {
+            pack: 'python',
+            sensors: {
+                lint: { cmd: 'ruff check . --output-format json', fast: true, formatter: 'ruff' },
+            },
+        };
+        fs_1.default.writeFileSync(path.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify(pythonManifest));
+        const ruffJson = JSON.stringify([{
+                code: 'F401',
+                filename: path.join(tmpDir, 'bad.py'),
+                location: { row: 1, column: 8 },
+                message: '`os` imported but unused',
+            }]);
+        mockRunCommand.mockResolvedValueOnce(exited(1, ruffJson));
+        const { runSensors } = load();
+        const result = await runSensors({ fast: true, cwd: tmpDir });
+        const lint = result.sensors.find((s) => s.name === 'lint');
+        expect(lint.status).toBe('fail');
+        expect(lint.errors[0].rule).toBe('F401');
+        expect(lint.errors[0].message).toMatch('SENSOR[lint]');
+        expect(lint.errors[0].message).toMatch('imported but unused');
+    });
+    it('falls back to name-based dispatch when formatter is absent (pre-existing manifest)', async () => {
+        // A manifest written before the `formatter` field existed must keep working
+        // exactly as before: `lint` -> eslint parser, no `formatter` key anywhere.
+        mockRunCommand
+            .mockResolvedValueOnce(exited(1, 'src/a.ts(1,1): error TS0001: Bad type.'))
+            .mockResolvedValueOnce(exited(1, JSON.stringify([{ filePath: '/x/a.js', messages: [{ ruleId: 'no-unused-vars', severity: 2, message: 'unused', line: 1, column: 1 }] }])));
+        const { runSensors } = load();
+        const result = await runSensors({ fast: true, cwd: tmpDir });
+        const lint = result.sensors.find((s) => s.name === 'lint');
+        expect(lint.status).toBe('fail');
+        expect(lint.errors[0].rule).toBe('no-unused-vars');
+    });
+    it('degrades to the generic formatter (never a wrong-shape misparse) for an unrecognized formatter value', async () => {
+        // Regression for Finding 5: `formatter: 'bandit'` is present but not one of the
+        // 8 known values. The OLD behavior fell through to name-based dispatch — sensor
+        // name 'security' -> parseSemgrepOutput — which would silently misparse
+        // bandit's differently-shaped `results` entries (no `path`/`start`/`check_id`
+        // keys) into garbage findings (`file: undefined, line: 0`). The fix must use
+        // parseGenericOutput instead: an honest raw-wrap, never a wrong-shape guess.
+        const banditManifest = {
+            pack: 'python',
+            sensors: {
+                security: { cmd: 'bandit -r . -f json', fast: false, formatter: 'bandit' },
+            },
+        };
+        fs_1.default.writeFileSync(path.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify(banditManifest));
+        // Real bandit JSON shape (fields semgrep's parser does not know how to read).
+        const banditJson = JSON.stringify({
+            results: [
+                { filename: 'app.py', line_number: 12, test_id: 'B105', issue_text: 'hardcoded password' },
+            ],
+        });
+        mockRunCommand.mockResolvedValueOnce(exited(1, banditJson));
+        const { runSensors } = load();
+        const result = await runSensors({ all: true, cwd: tmpDir });
+        const sec = result.sensors.find((s) => s.name === 'security');
+        expect(sec.status).toBe('fail');
+        expect(sec.errors).toHaveLength(1);
+        // Never the semgrep-misparse shape (file: undefined, line: 0, rule: undefined).
+        expect(sec.errors[0].file).toBeUndefined();
+        expect(sec.errors[0].line).toBeUndefined();
+        expect(sec.errors[0].rule).toBeUndefined();
+        // The honest generic raw-wrap: the raw JSON, verbatim, inside one message.
+        expect(sec.errors[0].message).toMatch('SENSOR[raw]');
+        expect(sec.errors[0].message).toContain('B105');
+    });
     const tcError = () => exited(1, 'src/a.ts(1,1): error TS0001: Bad type.');
     it('baseline suppresses accepted findings — sensor passes on no NEW findings', async () => {
         const { runSensors } = load();
@@ -160,6 +233,24 @@ describe('runSensors — missing tool is a fail, not a skip', () => {
         expect(out.overall).toBe('fail');
     });
 });
+describe('runSensors — sensors: null in a hand-edited manifest', () => {
+    // Regression for Finding 3: `checkManifest` (preflight) already guards
+    // `manifest.sensors ?? {}` — runSensors' `Object.entries(activeManifest.sensors)`
+    // needs the same guard, or a corrupted/hand-edited `.awm/sensors.json` with
+    // `"sensors": null` crashes `Object.entries(null)`, taking down the whole run.
+    it('degrades gracefully instead of throwing when sensors is null', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-null-sensors-'));
+        fs_1.default.mkdirSync(path_1.default.join(dir, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), JSON.stringify({ pack: 'python', sensors: null }));
+        try {
+            const result = await (0, run_1.runSensors)({ cwd: dir, all: true });
+            expect(result.sensors).toEqual([]);
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true });
+        }
+    });
+});
 describe('runSensors — not_certified + auto-discovery', () => {
     let tmpDir;
     beforeEach(() => {

package/dist/tests/commands/sensors/status.test.js

@@ -109,6 +109,35 @@ describe('computeSensorStatus', () => {
             expect(result.checks.security.ok).toBe(true);
         });
     });
+    it('is DEGRADED (never HEALTHY) when the manifest has zero sensor entries', () => {
+        // `Object.values({}).every(...)` is vacuously true — guard against reading an
+        // empty manifest (the honest floor when the registry had no pack.json for the
+        // detected stack) as a clean run that found nothing wrong.
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'python',
+            sensors: {},
+        }));
+        const result = (0, status_1.computeSensorStatus)(tmpDir);
+        expect(result.overall).toBe('DEGRADED');
+        expect(result.pack).toBe('python');
+    });
+    it('degrades gracefully (never throws) when sensors is null in a hand-edited manifest', () => {
+        // Regression for Finding 3: `checkManifest` (preflight) already guards
+        // `manifest.sensors ?? {}` — computeSensorStatus needs the same guard, or a
+        // corrupted/hand-edited manifest with `"sensors": null` crashes
+        // `Object.entries(null)`.
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'python',
+            sensors: null,
+        }));
+        expect(() => (0, status_1.computeSensorStatus)(tmpDir)).not.toThrow();
+        const result = (0, status_1.computeSensorStatus)(tmpDir);
+        expect(result.overall).toBe('DEGRADED');
+        expect(result.pack).toBe('python');
+        expect(result.checks).toEqual({});
+    });
     it('marks disabled sensors as ok', () => {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.10.0",
+  "version": "3.11.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"