agentic-workflow-manager 3.13.4 → 3.13.6

package/dist/src/commands/add.js

@@ -80,5 +80,10 @@ function runAddBundleCore(options, prefs, bundles, deps = {}) {
         ? `\n\n${picocolors_1.default.dim('Recorded as a project extension in .awm/profile.json (commit it; symlinks are gitignored).')}`
         : '';
     console.log(`✅ Installed bundle ${picocolors_1.default.cyan(matchedBundle.name)}:\n  ${lines}${recordNote}`);
+    // Same reason as in sync.ts: without printing it, `awm backup restore` has no
+    // name to be given and the transaction may as well not have an id.
+    if (result.transactionId) {
+        console.log(picocolors_1.default.dim(`  transaction ${result.transactionId} — undo with \`awm backup restore ${result.transactionId}\``));
+    }
     return { code: 0, selectedAgents, result };
 }

package/dist/src/commands/doctor.js

@@ -64,6 +64,7 @@ const CHECK_LABELS = {
     'binary.version': 'binary/version',
     'skills.global': 'global skills',
     'agents.native': 'native agents',
+    'workflows.global': 'global workflows',
     'context.global': 'global context',
     'hook.trust': 'hook SessionStart',
     'guidance.project': 'project guidance',

package/dist/src/commands/hooks/claude.js

@@ -46,7 +46,7 @@ function installClaudeHook(options) {
     }
     catch { /* not exists */ }
     try {
-        fs_1.default.symlinkSync(sourceSkill, skillDest);
+        fs_1.default.symlinkSync(sourceSkill, skillDest, 'file'); // ver shared.ts: el tipo no se infiere
     }
     catch {
         // best-effort: copy the single skill file; 'awm update' will not auto-propagate
@@ -180,7 +180,20 @@ function resyncClaudeHookFiles(config, registryRoot, method) {
         fs_1.default.unlinkSync(skillDest);
     }
     catch { /* not exists */ }
-    fs_1.default.symlinkSync(sourceSkill, skillDest);
+    // Mismo fallback a copia que `installClaudeHook` (arriba). Sin el, en
+    // Windows sin Developer Mode este symlink tira EPERM, `resyncInstalledHooks`
+    // propaga el throw y `awm update` devuelve 1 — PARA SIEMPRE: el install
+    // funcionaba (tenia el fallback) y el update no, en una plataforma que la
+    // matriz de soporte declara verificada en CI. Dos escritores del mismo
+    // archivo, solo uno endurecido.
+    try {
+        fs_1.default.symlinkSync(sourceSkill, skillDest, 'file'); // ver shared.ts: el tipo no se infiere
+    }
+    catch {
+        // best-effort: `awm update` no auto-propagara cambios de esta skill,
+        // pero el hook queda funcional en vez de dejar el comando inservible.
+        fs_1.default.copyFileSync(sourceSkill, skillDest);
+    }
 }
 /** True when the registry has everything needed to resync the Claude hook files. */
 function claudeResyncSourcesExist(registryRoot) {

package/dist/src/commands/hooks/shared.js

@@ -30,7 +30,12 @@ function syncExecutable(source, dest, method) {
     fs_1.default.mkdirSync(path_1.default.dirname(dest), { recursive: true });
     if (method === 'symlink') {
         try {
-            fs_1.default.symlinkSync(source, dest);
+            // 'file' explicito: el destino es un archivo. Sin el tipo, Node lo INFIERE
+            // del target y en Windows puede crear un symlink de DIRECTORIO, que
+            // exige SeCreateSymbolicLinkPrivilege. El fallback a copia de abajo lo
+            // cubria, pero el tipo correcto en la llamada no depende de que alguien
+            // conserve el try/catch al editarla.
+            fs_1.default.symlinkSync(source, dest, 'file');
         }
         catch {
             // best-effort: a FILE symlink needs SeCreateSymbolicLinkPrivilege on

package/dist/src/commands/init.js

@@ -218,6 +218,7 @@ async function runInit(opts = {}) {
                 contentDir: (0, registries_1.contentRoots)()[0] ?? '',
                 sensorPacksRoot: (0, registries_1.capabilityRoot)('sensor-packs') ?? '',
                 confirmExtensions,
+                machineOnly: !!opts.machineOnly,
                 actions: mergedActions,
             });
             pipelineOutcome = outcome;

package/dist/src/commands/pin.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalRegistryName = canonicalRegistryName;
 exports.setPin = setPin;
 exports.removePin = removePin;
 exports.registerPinCommands = registerPinCommands;
@@ -11,8 +12,24 @@ const config_1 = require("../utils/config");
 const registries_1 = require("../core/registries");
 const versioning_1 = require("../core/versioning");
 const VERSION_RE = /^v?\d+\.\d+\.\d+$/;
+/** El registry base se llama `baseline` en disco (core/registries.ts), pero la
+ *  ayuda del comando siempre documento `awm pin base <v>` — y `base` era
+ *  aceptado y persistido como una clave de pin que NADA lee. El pin reportaba
+ *  exito y no hacia absolutamente nada, incluso cuando es la salida documentada
+ *  de un bloqueo por `minCliVersion`. Se acepta como ALIAS y se normaliza. */
+const BASE_ALIAS = 'base';
+const BASE_REGISTRY = 'baseline';
+/** Nombre real en disco para lo que el usuario escribio. */
+function canonicalRegistryName(name) {
+    return name === BASE_ALIAS ? BASE_REGISTRY : name;
+}
 function knownRegistryNames() {
-    return ['base', ...(0, registries_1.readRegistriesConfig)().map((r) => r.name)];
+    // Ambos nombres son validos: el alias historico que documenta la ayuda del
+    // comando, y el nombre real en disco — que antes se rechazaba si todavia no
+    // habia registries.json, o sea justo cuando un usuario bloqueado intenta
+    // salir del paso.
+    const names = [BASE_ALIAS, BASE_REGISTRY, ...(0, registries_1.readRegistriesConfig)().map((r) => r.name)];
+    return Array.from(new Set(names));
 }
 function assertKnownRegistry(name) {
     const known = knownRegistryNames();
@@ -28,17 +45,20 @@ function setPin(name, version) {
     }
     const normalized = (0, versioning_1.normalizePin)(version);
     const prefs = (0, config_1.getPreferences)();
-    prefs.pins = { ...(prefs.pins ?? {}), [name]: normalized };
+    // Se persiste bajo el nombre REAL del registry; si no, el pin queda en una
+    // clave que el resolutor de versiones nunca consulta.
+    prefs.pins = { ...(prefs.pins ?? {}), [canonicalRegistryName(name)]: normalized };
     (0, config_1.savePreferences)(prefs);
     return normalized;
 }
 /** Borra pins[name]; devuelve true si existía. */
 function removePin(name) {
     assertKnownRegistry(name);
+    const key = canonicalRegistryName(name);
     const prefs = (0, config_1.getPreferences)();
-    if (!prefs.pins || !(name in prefs.pins))
+    if (!prefs.pins || !(key in prefs.pins))
         return false;
-    delete prefs.pins[name];
+    delete prefs.pins[key];
     (0, config_1.savePreferences)(prefs);
     return true;
 }

package/dist/src/commands/preflight/checks.js

@@ -130,8 +130,9 @@ function checkTools(cwd) {
 /**
  * A manifest pinned to `generic` on a tree that clearly has a stack means the real
  * sensors for that stack are simply absent — the gate runs, reports green, and has
- * checked almost nothing. `runSensors` self-heals this at run time via `reconcilePack`,
- * but only when a registry is reachable; saying it out loud here costs nothing.
+ * checked almost nothing. Nothing heals this on its own: `awm sensors run` reports the
+ * same drift (`packDrift`) but never rewrites the manifest, so this is the blocking
+ * surface, and `awm sensors init` is the only thing that adopts the real pack.
  */
 function checkPack(cwd, manifest) {
     if (!manifest)

package/dist/src/commands/registry/add.js

@@ -38,7 +38,7 @@ async function addRegistry(remote, nameOverride) {
     if (fs_1.default.existsSync(dest)) {
         return { ok: false, name, error: `Destination already exists on disk: ${dest}` };
     }
-    fs_1.default.mkdirSync(registries_1.REGISTRIES_DIR, { recursive: true });
+    fs_1.default.mkdirSync((0, registries_1.registriesDir)(), { recursive: true });
     try {
         await (0, simple_git_1.default)().clone(remote, dest);
     }

package/dist/src/commands/sensors/index.js

@@ -52,6 +52,13 @@ function registerSensorsCommand(program) {
         try {
             const result = (0, init_1.initSensors)({ configure: opts.configure, registryRoot, pack: opts.pack });
             prompts_1.log.success(`Detected: ${result.detection.pack} (${result.detection.indicators.join(', ') || 'fallback'})`);
+            // Said BEFORE "Wrote .awm/sensors.json": the manifest about to be
+            // reported as written is not the one the detection implied.
+            if (result.unavailablePack) {
+                prompts_1.log.warn(`No '${result.unavailablePack}' sensor-pack in the registry — wrote the `
+                    + `'${result.manifest.pack}' pack instead (${Object.keys(result.manifest.sensors).length} sensors). `
+                    + 'Run `awm update`, or add a registry that ships it, then re-run `awm sensors init`.');
+            }
             prompts_1.log.success('Wrote .awm/sensors.json');
             result.configured.forEach((f) => prompts_1.log.info(`  Installed ${f}`));
         }

package/dist/src/commands/sensors/init.js

@@ -120,6 +120,44 @@ function buildManifest(pack, existing, registryRoot, cwd = process.cwd()) {
     }
     return { pack, sensors };
 }
+/** Pack names present as directories under `<registryRoot>/sensor-packs/`, sorted. */
+function availablePacks(registryRoot) {
+    const packsDir = path_1.default.join(registryRoot, 'sensor-packs');
+    if (!fs_1.default.existsSync(packsDir) || !fs_1.default.statSync(packsDir).isDirectory())
+        return [];
+    return fs_1.default.readdirSync(packsDir, { withFileTypes: true })
+        .filter(e => e.isDirectory())
+        .map(e => e.name)
+        .sort();
+}
+/** The last-resort pack, used when the detected one is absent from the registry. */
+const FALLBACK_PACK = 'generic';
+/**
+ * Resolve the detected pack against what the registry actually ships.
+ *
+ * `--pack <name>` has always thrown here (`assertPackExists`), but auto-detection had
+ * no such check: it wrote `{"pack":"python","sensors":{}}` and said nothing, so the
+ * operator learned the gate was empty from an unrelated command days later. The two
+ * paths now reach the same conclusion; only the remedy differs, because an explicit
+ * `--pack` is a typo to correct while a detection is a fact about the tree that the
+ * registry simply cannot serve yet.
+ *
+ * Falling back to `generic` keeps the gate measuring *something* real rather than
+ * nothing. When the registry has no `generic` either, the detected pack is kept: the
+ * manifest is then honestly empty, and preflight's `manifest`/`tools` checks both fail
+ * on `total === 0` with a remedy pointing at the registry.
+ */
+function resolvePack(detected, registryRoot) {
+    if (!registryRoot)
+        return { pack: detected }; // nothing to validate against
+    const available = availablePacks(registryRoot);
+    if (available.length === 0 || available.includes(detected))
+        return { pack: detected };
+    return {
+        pack: available.includes(FALLBACK_PACK) ? FALLBACK_PACK : detected,
+        unavailablePack: detected,
+    };
+}
 /**
  * Validate that `pack` exists as a directory under `<registryRoot>/sensor-packs/`.
  * Throws (not a swallow-and-return) so `awm sensors init --pack bogus` actually stops
@@ -131,10 +169,7 @@ function assertPackExists(pack, registryRoot) {
     if (!fs_1.default.existsSync(packsDir) || !fs_1.default.statSync(packsDir).isDirectory()) {
         throw new Error('registry has no sensor-packs directory');
     }
-    const available = fs_1.default.readdirSync(packsDir, { withFileTypes: true })
-        .filter(e => e.isDirectory())
-        .map(e => e.name)
-        .sort();
+    const available = availablePacks(registryRoot);
     if (!available.includes(pack)) {
         throw new Error(`pack '${pack}' not found in registry (available: ${available.join(', ')})`);
     }
@@ -163,14 +198,20 @@ function initSensors(opts = {}) {
         }
         catch { /* ignore corrupt manifest */ }
     }
-    const manifest = buildManifest(detection.pack, existing, opts.registryRoot, cwd);
+    // `detection` keeps saying what the tree IS; `pack` is what the registry can serve
+    // for it. They diverge only when the registry lacks the detected pack.
+    const { pack: resolvedPack, unavailablePack } = resolvePack(detection.pack, opts.registryRoot);
+    const manifest = buildManifest(resolvedPack, existing, opts.registryRoot, cwd);
     fs_1.default.mkdirSync(path_1.default.join(cwd, '.awm'), { recursive: true });
     const tmpPath = manifestPath + '.tmp';
     fs_1.default.writeFileSync(tmpPath, JSON.stringify(manifest, null, 2), 'utf-8');
     fs_1.default.renameSync(tmpPath, manifestPath);
     const configured = [];
     if (configure && opts.registryRoot) {
-        const packDir = path_1.default.join(opts.registryRoot, 'sensor-packs', detection.pack);
+        // The pack whose defaults the manifest was actually built from — copying the
+        // detected pack's config files here would drop files for sensors that are not
+        // in the manifest, and miss the ones that are.
+        const packDir = path_1.default.join(opts.registryRoot, 'sensor-packs', resolvedPack);
         if (fs_1.default.existsSync(packDir)) {
             for (const file of fs_1.default.readdirSync(packDir).filter(f => f !== 'pack.json')) {
                 const dst = path_1.default.join(cwd, file);
@@ -181,5 +222,5 @@ function initSensors(opts = {}) {
             }
         }
     }
-    return { manifest, detection, configured };
+    return { manifest, detection, configured, ...(unavailablePack ? { unavailablePack } : {}) };
 }

package/dist/src/commands/sensors/install.js

@@ -8,21 +8,30 @@ exports.uninstallSensorHook = uninstallSensorHook;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../../core/paths");
+const shared_1 = require("../hooks/shared");
+const atomic_file_1 = require("../../core/atomic-file");
+const providers_1 = require("../../providers");
 const POST_TOOL_USE_EVENT = 'PostToolUse';
 const POST_TOOL_USE_MATCHER = 'Write|Edit|MultiEdit';
 const AWM_SENSOR_CMD = 'awm sensors run --fast';
 function defaultSettingsPath() {
-    return path_1.default.join((0, paths_1.homeDir)(), '.claude', 'settings.json');
+    // Se toma de la config del provider, no de una ruta hardcodeada: era la
+    // cuarta copia de este path en el codigo.
+    return (0, providers_1.getSettingsMergeHookConfig)('claude-code').settingsPath;
 }
+/** Lectura ESTRICTA, compartida con los demas escritores de este archivo.
+ *
+ *  Antes esto era `try { JSON.parse(...) } catch { return {} }` y el `{}` se
+ *  escribia de vuelta — asi que un JSON malformado (una coma de mas, el error
+ *  de edicion a mano mas comun) BORRABA el settings.json entero del usuario y
+ *  la operacion reportaba exito. Verificado destruyendo `model`, `permissions`
+ *  y el propio hook SessionStart de AWM. El escritor hermano
+ *  (`installClaudeHook`) ya se negaba correctamente ante el mismo archivo.
+ *
+ *  AWM hace MERGE sobre archivos que son del usuario; nunca los clobberea. Ante
+ *  un archivo que no se puede parsear, la unica accion segura es negarse. */
 function readSettings(p) {
-    if (!fs_1.default.existsSync(p))
-        return {};
-    try {
-        return JSON.parse(fs_1.default.readFileSync(p, 'utf-8'));
-    }
-    catch {
-        return {};
-    }
+    return (0, shared_1.readStrictJson)(p);
 }
 function isAwmEntry(e) {
     return e.matcher === POST_TOOL_USE_MATCHER &&
@@ -56,7 +65,7 @@ function installSensorHook(settingsPath = defaultSettingsPath()) {
         },
     };
     fs_1.default.mkdirSync(path_1.default.dirname(settingsPath), { recursive: true });
-    fs_1.default.writeFileSync(settingsPath, JSON.stringify(updated, null, 2), 'utf-8');
+    (0, atomic_file_1.writeFileAtomic)(settingsPath, `${JSON.stringify(updated, null, 2)}\n`);
     return { status: 'installed', backupPath };
 }
 function uninstallSensorHook(settingsPath = defaultSettingsPath()) {
@@ -72,6 +81,6 @@ function uninstallSensorHook(settingsPath = defaultSettingsPath()) {
         delete updated.hooks[POST_TOOL_USE_EVENT];
     if (Object.keys(updated.hooks).length === 0)
         delete updated.hooks;
-    fs_1.default.writeFileSync(settingsPath, JSON.stringify(updated, null, 2), 'utf-8');
+    (0, atomic_file_1.writeFileAtomic)(settingsPath, `${JSON.stringify(updated, null, 2)}\n`);
     return { status: 'removed' };
 }

package/dist/src/commands/sensors/run.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyBaseline = applyBaseline;
-exports.reconcilePack = reconcilePack;
+exports.detectPackDrift = detectPackDrift;
 exports.findManifestDir = findManifestDir;
 exports.resolveConcurrency = resolveConcurrency;
 exports.runSensors = runSensors;
@@ -22,8 +22,9 @@ const ruff_1 = require("./formatters/ruff");
 const shellcheck_1 = require("./formatters/shellcheck");
 const baseline_1 = require("./baseline");
 const changed_1 = require("./changed");
+// Solo `detectStack` (puro, lee el arbol) — NO `initSensors`, que escribe. `run` es un
+// verbo de lectura: no debe tener a mano ninguna funcion capaz de mutar el proyecto.
 const init_1 = require("./init");
-const registries_1 = require("../../core/registries");
 const paths_1 = require("../../core/paths");
 const MANIFEST_FILE = '.awm/sensors.json';
 const DEFAULT_FAST_TIMEOUT = 10_000;
@@ -67,31 +68,32 @@ function readManifest(cwd) {
     }
 }
 /**
- * Upgrade-only, idempotent pack reconciliation. If the manifest sits on the
- * `generic` fallback but the tree now has real stack indicators (package.json,
- * pyproject.toml…), re-detect and rebuild via initSensors — which merges existing
- * custom sensors and copies the pack's config files. Never downgrades, never
- * touches a real pack. FS/registry failures degrade to a no-op (the honest floor
- * in runSensors covers the gap).
+ * Detect — and only detect — that the manifest's pack no longer describes the tree:
+ * it sits on the `generic` fallback while real stack indicators (package.json,
+ * pyproject.toml, a root `*.sh`…) are present, so the gate is measuring almost
+ * nothing. Pure: reads the tree, writes nothing, consults no registry.
+ *
+ * It used to *heal* this, by calling `initSensors(..., configure: true)` — which
+ * overwrites the committed `.awm/sensors.json` and copies the pack's config files
+ * into the project root. That made `awm sensors run`, a read verb, leave a dirty
+ * working tree, and swapped in sensors whose tools the project never installed
+ * (one root `deploy.sh` pulls in the whole shell pack), turning a green run red.
+ * Rewriting the manifest is `awm sensors init`'s job — the verb whose name says so.
+ * Here the drift is only named: reported as `packDrift` on the run's own output,
+ * and failed on by preflight's `pack` check.
  */
-function reconcilePack(manifestDir, manifest, registryRoot) {
-    if (manifest.pack !== 'generic') {
-        const detection = (0, init_1.detectStack)(manifestDir);
-        return { manifest, detection };
-    }
+function detectPackDrift(manifestDir, manifest) {
     const detection = (0, init_1.detectStack)(manifestDir);
-    if (detection.pack === 'generic')
-        return { manifest, detection }; // truly generic — stay honest
-    const root = registryRoot ?? (0, registries_1.capabilityRoot)('sensor-packs');
-    if (!root || !fs_1.default.existsSync(root))
-        return { manifest, detection }; // can't rebuild without registry
-    try {
-        const { manifest: rebuilt } = (0, init_1.initSensors)({ cwd: manifestDir, registryRoot: root, configure: true });
-        return { manifest: rebuilt, upgradedFrom: 'generic', detection };
-    }
-    catch {
-        return { manifest, detection }; // never abort the run on a reconcile failure
-    }
+    if (manifest.pack !== 'generic' || detection.pack === 'generic')
+        return { detection };
+    return {
+        detection,
+        drift: {
+            manifest: manifest.pack,
+            detected: detection.pack,
+            remedy: `run \`awm sensors init\` to adopt the '${detection.pack}' pack for this stack`,
+        },
+    };
 }
 /**
  * Walk up from `startCwd` looking for the nearest ancestor that contains
@@ -280,8 +282,8 @@ async function runSensors(opts = {}) {
     const manifest = readManifest(manifestDir);
     if (!manifest)
         return { sensors: [], overall: 'not_certified' };
-    const reconciled = reconcilePack(manifestDir, manifest);
-    const activeManifest = reconciled.manifest;
+    const drift = detectPackDrift(manifestDir, manifest);
+    const activeManifest = manifest; // el manifest COMITEADO es lo que se corre; `run` no lo reescribe
     const cwd = manifestDir; // ejecutar sensores y baseline desde donde vive el manifest
     // Baseline suppresses already-accepted findings so sensors fail only on NEW
     // ones (essential on repos with a large pre-existing baseline). Absent file or
@@ -382,13 +384,13 @@ async function runSensors(opts = {}) {
                     : 'pass';
     // Honest floor: a benign-green 'skipped' over a tree that clearly HAS a stack
     // (indicators present) is a false green — the gate ran nothing real. Never green.
-    if (overall === 'skipped' && reconciled.detection.pack !== 'generic') {
+    if (overall === 'skipped' && drift.detection.pack !== 'generic') {
         overall = 'not_certified';
     }
     return {
         sensors: results,
         overall,
-        ...(reconciled.upgradedFrom ? { packUpgraded: `${reconciled.upgradedFrom}→${activeManifest.pack}` } : {}),
+        ...(drift.drift ? { packDrift: drift.drift } : {}),
         // Always emitted on a --changed run, including when the scope failed to
         // resolve: a green that came back from an unscoped fallback and a green from a
         // genuinely scoped run are different claims, and the caller cannot tell them

package/dist/src/commands/sync.js

@@ -24,12 +24,27 @@ const bundle_install_1 = require("../core/bundle-install");
 const profile_pins_1 = require("../core/profile-pins");
 const config_1 = require("../utils/config");
 const agent_targets_1 = require("../core/agent-targets");
+const skill_integrity_1 = require("../core/skill-integrity");
+const registries_2 = require("../core/registries");
 const defaultDeps = {
     syncRegistries: registries_1.syncRegistries,
     verifyMinCliVersions: registries_1.verifyMinCliVersions,
     verifyProjectPins: profile_pins_1.verifyProjectPins,
     syncProfile: bundle_install_1.syncProfile,
+    reconcileProjectSkillLinks: skill_integrity_1.reconcileProjectSkillLinks,
 };
+/** Un link curado o podado es un cambio en el arbol del usuario: se dice siempre.
+ *  El silencio es lo que dejo este mantenimiento invisible durante todo su ciclo. */
+function reportProjectLinkRepair(results) {
+    for (const { agent, result } of results) {
+        for (const n of result.relinked)
+            console.log(picocolors_1.default.green(`  ↻  Re-linked ${n} (${agent}, project scope)`));
+        for (const n of result.pruned)
+            console.log(picocolors_1.default.yellow(`  ✂  Pruned dangling ${n} (${agent}, project scope)`));
+        for (const n of result.failed)
+            console.warn(picocolors_1.default.yellow(`  ⚠  Could not repair ${n} (${agent}, project scope)`));
+    }
+}
 /** Core, UI-free `awm sync` logic — see `runSync` for the Commander-facing wrapper. */
 async function runSyncCore(options, deps = {}) {
     // Fires at most once per `awm sync` run, native Windows only — the single
@@ -93,6 +108,14 @@ async function runSyncCore(options, deps = {}) {
             return { code: 1, selectedAgents };
         }
     }
+    // Antes de instalar: sanear los links de skills que YA estan en el proyecto. Es lo
+    // simetrico de `stepGlobalSkillsRepair` en `awm init`, que solo cubria el dir
+    // global — un link colgante de proyecto (registry re-clonado, skill renombrada
+    // upstream, bundle sacado del profile) no se curaba ni se podaba nunca. Corre
+    // ANTES del early-return de "sin extensiones": un profile vacio es precisamente el
+    // caso donde quedan huerfanos de una extension retirada, y era el unico camino que
+    // salia sin tocar nada. Solo toca symlinks colgantes (`classifySkillLinks`).
+    reportProjectLinkRepair(d.reconcileProjectSkillLinks(projectRoot, selectedAgents, (0, registries_2.contentRoots)()));
     if (profile.extensions.length === 0) {
         console.log(picocolors_1.default.yellow('No extensions in .awm/profile.json — nothing to sync. Use `awm add <bundle>` first.'));
         return { code: 0, selectedAgents };
@@ -113,5 +136,11 @@ async function runSyncCore(options, deps = {}) {
     const lines = result.installed.map((n) => picocolors_1.default.green(n)).join('\n  ');
     const installedNote = lines ? `\n  ${lines}` : picocolors_1.default.dim(' (all up to date)');
     console.log(`✅ Synced extensions [${result.extensions.join(', ')}]:${installedNote}`);
+    // The transaction id is the ONLY handle `awm backup restore` accepts. It was
+    // computed, returned in `transactionIds`, and then dropped on the floor by every
+    // caller — so the operator who wanted to undo a sync had no name to give it.
+    for (const id of result.transactionIds) {
+        console.log(picocolors_1.default.dim(`  transaction ${id} — undo with \`awm backup restore ${id}\``));
+    }
     return { code: 0, selectedAgents, result };
 }

package/dist/src/commands/watch/index.js

@@ -5,6 +5,7 @@ const child_process_1 = require("child_process");
 const init_1 = require("./init");
 const supervisor_1 = require("./supervisor");
 const process_1 = require("../../core/journal/process");
+const adapter_1 = require("../../core/journal/adapter");
 function currentBranch(cwd) {
     // stdio explicito (ver EXEC_STDIO en journal/process.ts): evita el relay
     // default de execFileSync del stderr de git hacia el stderr del llamante,
@@ -25,7 +26,7 @@ function registerWatchCommand(program) {
         .command('watch')
         .description('supervisor durable: ejecuta jobs, releva controladores caidos, nunca mata trabajo vivo')
         .option('--init', 'bootstrap: crea el journal de la rama actual, detecta verificadores y sale')
-        .option('--provider <p>', 'codex | claude-code', 'codex')
+        .option('--provider <p>', adapter_1.WATCH_PROVIDERS.join(' | '), 'codex')
         .option('--heartbeat-timeout <min>', 'minutos de silencio de heartbeat', '5')
         .option('--activity-window <min>', 'minutos extra sin actividad de proceso', '10')
         .action(async (opts) => {
@@ -36,6 +37,15 @@ function registerWatchCommand(program) {
             process.stdout.write(`journal inicializado para ${branch}; verificadores requeridos: ${JSON.stringify(out.requiredVerifiers)}\n`);
             return;
         }
+        // Validado ACA, antes de tocar nada: `adapterFor` ya rechazaba lo
+        // desconocido, pero recien en el primer tick — con el journal escrito y el
+        // lock tomado, y el error saliendo del supervisor en vez de del flag que lo
+        // causo. Un typo en `--provider` tiene que costar un mensaje, no un ciclo.
+        if (!(0, adapter_1.isWatchProvider)(opts.provider)) {
+            process.stderr.write(`--provider invalido: ${String(opts.provider)} (validos: ${adapter_1.WATCH_PROVIDERS.join(', ')})\n`);
+            process.exitCode = 1;
+            return;
+        }
         const cfg = {
             ...supervisor_1.DEFAULT_SUPERVISOR_CONFIG,
             provider: opts.provider,

package/dist/src/core/artifact-name.js

@@ -0,0 +1,80 @@
+"use strict";
+// src/core/artifact-name.ts
+//
+// Modulo HOJA (sin imports de otros modulos del proyecto): validacion de los
+// nombres de artefacto que llegan desde CONTENIDO DE REGISTRY.
+//
+// Por que existe. Los nombres de `bundle.json` (`skills[]`, `workflows[]`,
+// `agents[]`) se usaban verbatim para construir rutas de instalacion:
+//
+//     path.join('~/.claude/skills', '../../.ssh/authorized_keys')
+//       => '~/.ssh/authorized_keys'
+//
+// y como `replaceArtifact` hace `fs.rmSync(targetPath, {recursive:true})` antes
+// de enlazar, un nombre como `../../.ssh` BORRABA recursivamente el ~/.ssh real
+// del usuario. Con `../../.config/autostart/x.desktop` se consigue ejecucion al
+// siguiente login. Confirmado end-to-end contra el binario real.
+//
+// El registry es contenido de terceros: un registry de equipo, uno interno, o
+// uno que alguien agrego con `awm registry add`. Todos los demas lectores de
+// contenido de registry de este repo (readRegistriesConfig, readRegistryManifest,
+// readProfile) ya rechazaban `..` y separadores — este camino era el unico sin
+// la guarda.
+//
+// Esta validacion es la PRIMERA de dos capas. La segunda es la asercion de
+// contencion en `physicalTarget` (install-planner.ts), que verifica que la ruta
+// resuelta caiga realmente dentro del directorio destino. Se mantienen las dos
+// a proposito: esta da un mensaje accionable que nombra el artefacto culpable;
+// aquella es el ancla estructural que atrapa cualquier camino futuro que
+// construya rutas sin pasar por aca.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafeArtifactName = isSafeArtifactName;
+exports.assertSafeArtifactName = assertSafeArtifactName;
+/** Nombres reservados de Windows: no pueden ser un archivo ni un directorio.
+ *  Se rechazan en TODA plataforma a proposito — el registry es contenido
+ *  compartido, y un nombre que solo rompe en las maquinas Windows del equipo es
+ *  peor que uno rechazado de forma consistente en todas. */
+const WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
+/** ¿Es seguro usar este nombre como UN componente de ruta dentro del directorio
+ *  de instalacion? Sin `..`, sin separadores, sin rutas absolutas, sin bytes de
+ *  control, sin nombres reservados. */
+function isSafeArtifactName(name) {
+    if (typeof name !== 'string')
+        return false;
+    const value = name.trim();
+    if (value === '' || value !== name)
+        return false; // vacio, o con espacios al borde
+    // Windows recorta en silencio el punto/espacio final, asi que `evil.` y
+    // `evil` terminan en el MISMO archivo — un nombre que apunta a otro destino
+    // del que aparenta.
+    if (/[. ]$/.test(value))
+        return false;
+    // Bytes de control y NUL: truncan la ruta a nivel syscall en algunos SO.
+    // eslint-disable-next-line no-control-regex
+    if (/[\u0000-\u001f\u007f]/.test(value))
+        return false;
+    // Cualquier separador (de ambas plataformas) convierte esto en una ruta,
+    // no en un nombre. Idem `..`/`.` como componente completo.
+    if (value.includes('/') || value.includes('\\'))
+        return false;
+    if (value === '.' || value === '..')
+        return false;
+    // Absolutos de Windows (`C:\...`, `C:algo`) y de UNC ya quedan cubiertos por
+    // el chequeo de separador, pero un `C:` pelado no — y sigue siendo una
+    // referencia de unidad, no un nombre.
+    if (/^[a-zA-Z]:/.test(value))
+        return false;
+    if (WINDOWS_RESERVED.test(value))
+        return false;
+    return true;
+}
+/** Forma asertiva: lanza con un mensaje que nombra el tipo y el valor ofensivo,
+ *  para que el operador pueda ubicarlo en el `bundle.json` del registry. */
+function assertSafeArtifactName(name, type) {
+    if (!isSafeArtifactName(name)) {
+        throw new Error(`unsafe ${type} name from registry content: ${JSON.stringify(name)}. ` +
+            `Artifact names must be a single path component — no "..", no path separators, ` +
+            `no absolute paths, no control characters, and not a Windows reserved name.`);
+    }
+    return name;
+}