agentic-workflow-manager 3.13.5 → 3.13.6

package/dist/src/core/diagnostics/provider-checks.js

@@ -17,19 +17,12 @@ exports.gatherProviderChecks = gatherProviderChecks;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const providers_1 = require("../../providers");
+const skill_integrity_1 = require("../skill-integrity");
 const provider_version_1 = require("../provider-version");
 const status_1 = require("../../commands/hooks/status");
 const orchestrator_1 = require("../context/orchestrator");
 const registries_1 = require("../registries");
-/** File extension a healthy AWM install actually produces for each non-`'link'` renderer —
- *  used by `skillsGlobalCheck` to require AWM-shaped evidence, not just an arbitrary
- *  non-empty directory (a user's own unrelated file in `~/.cursor/rules` would otherwise
- *  read as `'supported'`). Renderers absent from this map (i.e. `'link'`) never reach the
- *  branch that reads it. */
-const RENDERED_SKILL_EXTENSIONS = {
-    'cursor-mdc': '.mdc',
-    'copilot-instructions': '.instructions.md',
-};
+const registry_1 = require("../renderers/registry");
 /** Structural classification, computed purely from `provider`'s config shape — see
  *  `ProviderTier`'s doc comment in `types.ts` for what each tier means. */
 function providerTier(provider) {
@@ -66,7 +59,7 @@ function binaryVersionCheck(agent) {
  *  `dir` is null — i.e. the provider has no global skill discovery mechanism at all
  *  (today: Copilot, see `globalUnsupportedReason` in providers/index.ts).
  *
- *  `renderer` gates which verification is possible: `classifyGlobalSkills` (via `integrity`)
+ *  `renderer` gates which verification is possible: `classifySkillLinks` (via `integrity`)
  *  only ever sees symlinks — `if (!lst.isSymbolicLink()) continue;` — so for a rendered
  *  format (`cursor-mdc`, `copilot-instructions`) it scans a directory of real files and
  *  finds nothing, which would make `broken` silently read 0 regardless of whether the
@@ -87,7 +80,7 @@ function skillsGlobalCheck(dir, owners, integrity, renderer) {
             // `remediationCode: 'awm-init'` is a worse remedy than none, but this
             // check has no channel to report "can't tell" separately from "absent"
             // (same tradeoff already made by this file's agentsNativeCheck and by
-            // skill-integrity.ts's classifyGlobalSkills — a systemic, pre-existing
+            // skill-integrity.ts's classifySkillLinks — a systemic, pre-existing
             // pattern in this codebase, not introduced here).
             entries = [];
         }
@@ -97,7 +90,12 @@ function skillsGlobalCheck(dir, owners, integrity, renderer) {
         // Still not full integrity verification (a stray file with the right extension but
         // wrong content still passes) — that residual gap is the same honest tradeoff this
         // function's doc comment already accepts for the non-`'link'` branch generally.
-        const ext = RENDERED_SKILL_EXTENSIONS[renderer];
+        // `rendererExtension` (core/renderers/registry.ts) is the ONE table mapping a
+        // renderer to the file it produces. This site used to keep its own partial copy —
+        // the fourth such copy in the codebase, and the exact drift that made a rendered
+        // artifact invisible to the "is it installed" check for a whole release. A new
+        // renderer must not be able to be added without this reading it.
+        const ext = (0, registry_1.rendererExtension)(renderer);
         const present = ext ? entries.some((e) => e.endsWith(ext)) : entries.length > 0;
         return {
             id: 'skills.global',
@@ -165,20 +163,69 @@ function tomlAgentsHealthy(dir, entries) {
  * run (e.g. claude-code-only, opencode-only, antigravity-only) would always render
  * inapplicable rows as red ✖ and `overall` could never be 'healthy'.
  */
+/**
+ * Workflows installed at machine scope. Today only Antigravity declares a `workflow`
+ * config at all (`~/.gemini/antigravity/global_workflows`), and nothing verified it:
+ * `awm init` installed the baseline's workflows there and every diagnostic looked only
+ * at skills and native agents, so a broken or emptied workflow directory reported
+ * `healthy` forever on the one provider that uses it.
+ *
+ * Same N/A discipline as `agentsNativeCheck`: a provider with no workflow config, or a
+ * registry that ships no `workflows/`, emits NO row rather than a red one nobody can
+ * act on — an absent row means "nothing to verify", not "verified fine".
+ */
+function workflowsGlobalCheck(agent) {
+    const provider = (0, providers_1.providerFor)(agent);
+    if (!provider.workflow || provider.workflow.global === null)
+        return null;
+    const dir = provider.workflow.global;
+    let entries;
+    try {
+        entries = fs_1.default.readdirSync(dir);
+    }
+    catch {
+        return null;
+    }
+    if (entries.length === 0)
+        return null;
+    // Los workflows se instalan con el renderer `link`, asi que un symlink colgante es
+    // exactamente la misma clase de rotura que en skills — y se clasifica con la misma
+    // funcion, no con una copia local que pueda divergir.
+    const integrity = (0, skill_integrity_1.classifySkillLinks)(dir, (0, registries_1.contentRoots)());
+    const broken = integrity.repairable.length + integrity.dead.length;
+    return {
+        id: 'workflows.global',
+        state: broken > 0 ? 'broken' : 'healthy',
+        target: dir,
+        detail: broken > 0 ? `${broken} broken link(s)` : undefined,
+        remediationCode: broken > 0 ? 'awm-init' : undefined,
+    };
+}
 function agentsNativeCheck(agent) {
     const provider = (0, providers_1.providerFor)(agent);
     if (!provider.agent || provider.agent.global === null)
         return null;
     const dir = provider.agent.global;
     let entries;
+    // `absent` degrada el estado global, asi que sin `remediationCode` doctor
+    // salia 1 sin decir que hacer — y para un registry que simplemente no trae
+    // `agents/` (lo normal) ese rojo no tiene accion posible. Se reporta como
+    // `unsupported`, que describe la realidad: no hay artefactos nativos que
+    // verificar, y no es culpa de la instalacion.
+    // Un registry que simplemente no trae `agents/` es lo normal, no un defecto
+    // de la instalacion — y no hay accion que el usuario pueda tomar. Antes esto
+    // devolvia `absent`, un estado que DEGRADA, y sin `remediationCode`: doctor
+    // salia 1 mostrando `✖ native agents` sin decir que hacer, justo despues de
+    // un `awm init` exitoso. Cuando no hay nada nativo que verificar, no se
+    // emite fila — el mismo criterio que ya usan los demas casos N/A de aca.
     try {
         entries = fs_1.default.readdirSync(dir);
     }
     catch {
-        return { id: 'agents.native', state: 'absent', target: dir };
+        return null;
     }
     if (entries.length === 0)
-        return { id: 'agents.native', state: 'absent', target: dir };
+        return null;
     if (provider.agent.renderer === 'codex-agent-toml') {
         const { broken } = tomlAgentsHealthy(dir, entries);
         return {
@@ -292,6 +339,7 @@ function gatherProviderChecks(agents, scanSkills, projectRoot) {
             binaryVersionCheck(agent),
             skillsGlobalCheck(dir, owners, integrity, provider.skill.renderer),
             agentsNativeCheck(agent),
+            workflowsGlobalCheck(agent),
             hookTrustCheck(agent),
             contextGlobalCheck(agent, projectRoot),
         ].filter((check) => check !== null);

package/dist/src/core/discovery.js

@@ -94,7 +94,7 @@ function discoverWorkflows(roots = (0, registries_1.contentRoots)()) {
         for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
             if (entry.isDirectory() || !entry.name.endsWith('.md'))
                 continue;
-            const name = entry.name.replace('.md', '');
+            const name = entry.name.replace(/\.md$/, '');
             const filePath = path_1.default.join(dir, entry.name);
             mergeEntry('workflow', byName, {
                 name,
@@ -120,7 +120,7 @@ function discoverAgents(roots = (0, registries_1.contentRoots)()) {
         for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
             if (entry.isDirectory() || !entry.name.endsWith('.md'))
                 continue;
-            const name = entry.name.replace('.md', '');
+            const name = entry.name.replace(/\.md$/, '');
             const filePath = path_1.default.join(dir, entry.name);
             mergeEntry('agent', byName, {
                 name,

package/dist/src/core/init/mutation-targets.js

@@ -110,6 +110,17 @@ function planInitMutationTargets(params) {
     for (const b of machineBundles) {
         addBundleTargets(targets, b.name, bundles, agent, 'global', cwd, contentDir);
     }
+    // Providers whose context injection is itself project-scope (managed-agents-md
+    // with a null globalPath — Cursor, Copilot) write AGENTS.md and the materialized
+    // .awm/context/ file. `stepContextInjection` now refuses to write those without a
+    // discovered project root, but enumerating them against `cwd` unconditionally
+    // costs nothing (a target that goes unwritten is a no-op backup entry, per this
+    // module's opening note) and keeps the guarantee from resting on a single site:
+    // under-enumeration here is the one failure mode that silently defeats rollback.
+    if (injection?.type === 'managed-agents-md' && injection.globalPath === null) {
+        targets.add(path_1.default.join(cwd, path_1.default.basename(injection.localFile)));
+        targets.add((0, materializer_1.projectContextPath)(cwd));
+    }
     // project-level: profile, sensors manifest, project injection, and every
     // extension currently recorded in .awm/profile.json
     const projectRoot = (0, profile_1.findProjectRoot)(cwd);

package/dist/src/core/init/steps.js

@@ -55,6 +55,7 @@ exports.defaultActions = {
         method: o.method,
         projectRoot: o.projectRoot,
         contentDir: o.contentDir,
+        scopeOverride: o.scopeOverride,
     }),
     // Same as installBundle above — defaults to the real applyInstallPlan.
     syncProfile: (o) => (0, bundle_install_1.syncProfile)({
@@ -66,14 +67,21 @@ exports.defaultActions = {
     }),
     initSensors: (o) => {
         const result = (0, init_1.initSensors)({ cwd: o.cwd, registryRoot: o.registryRoot, configure: o.configure });
-        return { detection: result.detection };
+        // `unavailablePack`/`manifest` viajan a proposito: `stepSensors` los reporta.
+        // Este wrapper proyectaba solo `detection`, asi que cualquier hallazgo nuevo de
+        // initSensors moria aca en silencio antes de llegar al step que lo muestra.
+        return {
+            detection: result.detection,
+            manifest: { pack: result.manifest.pack },
+            ...(result.unavailablePack ? { unavailablePack: result.unavailablePack } : {}),
+        };
     },
     addExtension: (root, name) => { (0, profile_1.addExtension)(root, name); },
     ensureProfile: (root) => { (0, profile_1.ensureProfile)(root); },
     gatherProject: (cwd, bundles, agent) => (0, context_1.gatherContext)({ cwd, bundles, agent }).project,
     contextStatus: (op) => realInjectionOrchestrator.contextStatus(op),
     installContext: (op) => { realInjectionOrchestrator.installContext(op); },
-    repairGlobalSkills: (skillsDir, registryContentDirs) => (0, skill_integrity_1.repairGlobalSkills)(skillsDir, registryContentDirs),
+    repairGlobalSkills: (skillsDir, registryContentDirs) => (0, skill_integrity_1.repairSkillLinks)(skillsDir, registryContentDirs),
     injectProjectConstitution: (o) => {
         if ((0, providers_1.getInjection)(o.agent)?.type === 'managed-agents-md') {
             return new codex_agents_1.CodexAgentsStrategy().injectProject(o.projectRoot, (0, providers_1.providerFor)(o.agent), o.agent) === 'injected' ? 'injected' : 'already';
@@ -113,8 +121,12 @@ function failed(id, level, error) {
  * physical operation and simply re-confirms ownership — it does not change
  * the co-owner's installed content.
  */
-function sharedInstallAgents(d) {
-    const group = (0, install_planner_1.agentsSharingSkillTarget)(d.agent, d.enabledAgents, 'global', d.cwd);
+function sharedInstallAgents(d, scope = 'global') {
+    // El scope tiene que ser el MISMO con el que se va a instalar: para un
+    // provider sin directorio global (Copilot) el baseline va a scope local, y
+    // preguntar por el grupo compartido en 'global' devolvia un grupo calculado
+    // sobre un destino que para el no existe.
+    const group = (0, install_planner_1.agentsSharingSkillTarget)(d.agent, d.enabledAgents, scope, d.cwd);
     return group.includes(d.agent) ? group : [d.agent, ...group];
 }
 /**
@@ -188,18 +200,34 @@ function stepDevCore(d) {
     if (devCore.present && devCore.brokenLinks.length === 0) {
         return ok('machine.devCore', 'machine', 'skipped');
     }
-    // Find the baseline bundle (there may be several; pick first baseline)
-    const baselineBundle = d.bundles.find((b) => b.scope === 'baseline');
-    const bundleName = baselineBundle?.name ?? 'dev';
-    d.actions.installBundle({
-        bundleName,
-        bundles: d.bundles,
-        agents: sharedInstallAgents(d),
-        method: d.installMethod,
-        projectRoot: d.cwd,
-        contentDir: d.contentDir,
-    });
-    return ok('machine.devCore', 'machine', 'applied');
+    // TODOS los bundles baseline, no el primero. `scope: 'baseline'` es una propiedad
+    // que un bundle TIENE, no un lugar que solo uno puede ocupar — y
+    // `reconciliation.ts` (`awm update`) siempre los filtro todos. Con `find` aca, un
+    // registry con dos baselines instalaba uno en `awm init` y aparecia el segundo, de
+    // la nada, en el siguiente `awm update`; nada antes lo habia reportado como
+    // faltante. El fallback a 'dev' se conserva para un registry sin ningun baseline.
+    const baselineNames = d.bundles.filter((b) => b.scope === 'baseline').map((b) => b.name);
+    const toInstall = baselineNames.length > 0 ? baselineNames : ['dev'];
+    // Un provider sin directorio global de skills (hoy: Copilot) no tiene donde
+    // poner el baseline a nivel maquina — y el hecho `devCore` lo reporta como
+    // "trivialmente satisfecho" para no volver a intentar un install global
+    // condenado a tirar. Pero nada instalaba nunca nada en su lugar: Copilot
+    // terminaba con CERO skills mientras `awm init` imprimia `✔ dev-core` y
+    // `awm doctor` decia `healthy`. Su propio `globalUnsupportedReason` ya dice
+    // que hay que instalar por proyecto, asi que eso es lo que se hace.
+    const localOnly = (0, providers_1.providerFor)(d.agent).skill.global === null;
+    for (const bundleName of toInstall) {
+        d.actions.installBundle({
+            bundleName,
+            bundles: d.bundles,
+            agents: sharedInstallAgents(d, localOnly ? 'local' : 'global'),
+            method: d.installMethod,
+            projectRoot: d.cwd,
+            contentDir: d.contentDir,
+            ...(localOnly ? { scopeOverride: 'local' } : {}),
+        });
+    }
+    return ok('machine.devCore', 'machine', 'applied', localOnly ? 'installed at project scope (no global skill dir)' : undefined);
 }
 /** Step 3.5 – Repair broken global skill symlinks (orphans outside the baseline). */
 function stepGlobalSkillsRepair(d) {
@@ -294,7 +322,14 @@ function stepSensors(d) {
         return ok('project.sensors', 'project', 'skipped', 'no project');
     if (proj.sensors.present)
         return ok('project.sensors', 'project', 'skipped');
-    d.actions.initSensors({ cwd: proj.root, registryRoot: d.sensorPacksRoot, configure: true });
+    const res = d.actions.initSensors({ cwd: proj.root, registryRoot: d.sensorPacksRoot, configure: true });
+    // A registry without the detected pack yields a fallback (or empty) manifest. The
+    // step still succeeded — a manifest was written — but reporting a bare 'applied'
+    // would let `awm init` hand back a quality gate that measures less than the
+    // operator has any reason to expect. Say which pack was missing, here, once.
+    if (res.unavailablePack) {
+        return ok('project.sensors', 'project', 'applied', `registry has no '${res.unavailablePack}' sensor-pack — wrote '${res.manifest?.pack ?? 'fallback'}' instead; run \`awm update\``);
+    }
     return ok('project.sensors', 'project', 'applied');
 }
 /** Step 8 – Signal that the agent should run the project-constitution skill. */
@@ -348,8 +383,24 @@ function stepContextInjection(d) {
     // AGENTS.md backup target via the same findProjectRoot(cwd) call, so using d.cwd here
     // whenever it differs from the walked-up project root (e.g. `awm init` run from a
     // subdirectory) would write to a path the backup session never snapshotted — a failed
-    // init couldn't roll it back. Falls back to d.cwd only when there's no discovered
-    // project yet, matching this op's own pre-existing behavior in that case.
+    // init couldn't roll it back.
+    //
+    // The `?? d.cwd` fallback below is the legitimate case: a provider whose ONLY
+    // delivery channel is project-scope (Copilot), run in a directory the user means
+    // as their project but which carries no marker yet (no .git, no package.json).
+    // Removing it would leave Copilot with no context at all there. What made it a bug
+    // was that mutation-targets.ts enumerated the AGENTS.md / .awm/context/ backup
+    // targets only inside `if (projectRoot)`, so this write landed outside the backup
+    // session and survived a rollback that reported a clean restore. That is fixed
+    // where it belongs — in the enumeration, which now covers `cwd` unconditionally
+    // for these providers.
+    //
+    // `--machine-only` is the case that genuinely must not write. It nulls
+    // `ctx.project` on purpose, and this MACHINE-level step read that as "no project
+    // found" and wrote into cwd anyway — under the one flag that promises not to.
+    if (scope === 'local' && d.machineOnly) {
+        return ok('machine.contextInjection', 'machine', 'skipped', `${(0, providers_1.providerFor)(d.agent).label} delivers context at project scope — skipped by --machine-only`);
+    }
     const op = {
         agent: d.agent,
         scope,

package/dist/src/core/install-planner.js

@@ -23,6 +23,7 @@ exports.planRemoval = planRemoval;
 // persistence (artifact-state.ts). This module only computes the plan.
 const path_1 = __importDefault(require("path"));
 const providers_1 = require("../providers");
+const registry_1 = require("./renderers/registry");
 /** Resolves the single physical filesystem location an intent renders to for one agent. */
 /**
  * Resolves the physical target path + renderer for one artifact intent on one
@@ -44,21 +45,27 @@ function physicalTarget(intent, agent, scope, projectRoot) {
     // trailing `.md` (if any) on intent.installName, so e.g. `using-awm`
     // (skills carry no extension) or `using-awm.md` both become
     // `using-awm.instructions.md`, never `using-awm.md.instructions.md`.
-    // Deliberately NOT path.parse(...).name: it strips everything after the
-    // LAST dot, not just a real trailing extension — a skill literally named
-    // `v1.2-migration` would silently truncate to `v1.mdc`, dropping
-    // `2-migration` and risking a collision with any other skill named `v1`.
-    // `.md` is the only extension a skill's installName is ever expected to
-    // carry (skills are markdown files), so stripping that literal suffix is
-    // both sufficient and precise.
-    const baseName = intent.installName.endsWith('.md')
-        ? intent.installName.slice(0, -'.md'.length)
-        : intent.installName;
-    const filename = config.renderer === 'codex-agent-toml' ? `${baseName}.toml`
-        : config.renderer === 'cursor-mdc' ? `${baseName}.mdc`
-            : config.renderer === 'copilot-instructions' ? `${baseName}.instructions.md`
-                : intent.installName;
-    return { targetPath: path_1.default.join(dir, filename), renderer: config.renderer };
+    // `renderedFilename` (core/renderers/registry.ts) es la unica fuente de
+    // verdad de este mapeo. Antes vivia inline aca y re-derivado a mano en tres
+    // lectores mas, uno de los cuales lo omitia por completo — y ese era
+    // justamente el que decidia si un artefacto estaba instalado.
+    const filename = (0, registry_1.renderedFilename)(intent.installName, config.renderer);
+    const targetPath = path_1.default.join(dir, filename);
+    // Asercion de contencion: el destino resuelto DEBE caer dentro del
+    // directorio del provider. `dir` es el ancla de confianza real (sale de la
+    // config del provider, no del contenido), asi que verificarlo aca atrapa
+    // cualquier camino — presente o futuro — que construya un `installName` sin
+    // pasar por `assertSafeArtifactName`. Los nombres llegan desde el
+    // `bundle.json` de un registry, y el instalador borra el destino de forma
+    // recursiva antes de enlazar: un escape aca no es un archivo mal ubicado,
+    // es borrado arbitrario fuera del sandbox.
+    const resolvedDir = path_1.default.resolve(dir);
+    const resolved = path_1.default.resolve(targetPath);
+    if (resolved !== resolvedDir && !resolved.startsWith(resolvedDir + path_1.default.sep)) {
+        throw new Error(`refusing to install outside the target directory: ${JSON.stringify(intent.installName)} ` +
+            `resolves to ${resolved}, which is not inside ${resolvedDir}`);
+    }
+    return { targetPath, renderer: config.renderer };
 }
 /**
  * The physical directory `agent`'s skill artifacts resolve to at `scope` —
@@ -121,7 +128,19 @@ function assertCompleteSharedGroup(intent, selected, enabled, scope, projectRoot
     if (intent.type !== 'skill')
         return;
     for (const agent of selected) {
-        const target = physicalTarget(intent, agent, scope, projectRoot).targetPath;
+        // El `.filter()` de abajo ya tenia esta guarda; esta linea no — y es la
+        // que corre PRIMERO. Con copilot en `selected` (que es lo que hace
+        // `awm update`, que apunta a todos los agentes habilitados) tiraba aca,
+        // antes de llegar al loop de planificacion, rompiendo el comando para
+        // TODOS los demas agentes de la maquina. Un agente que no soporta este
+        // scope no tiene grupo compartido que verificar: no es parte del grupo.
+        let target;
+        try {
+            target = physicalTarget(intent, agent, scope, projectRoot).targetPath;
+        }
+        catch {
+            continue;
+        }
         // Same reasoning as agentsSharingSkillTarget above: a candidate in
         // `enabled` that doesn't support this scope (e.g. Copilot at `global`)
         // can't be part of the shared-target group — it just isn't a
@@ -172,7 +191,33 @@ function planInstall(params) {
     }
     const groups = new Map();
     for (const intent of artifacts) {
-        for (const agent of selectedAgents) {
+        // Agentes que estructuralmente NO pueden recibir este artefacto en este
+        // scope — hoy: copilot en scope global, que no tiene mecanismo de
+        // descubrimiento de skills a nivel usuario.
+        //
+        // Se saltean, pero SOLO si algun otro agente seleccionado si puede. La
+        // distincion es deliberada:
+        //  - `awm update` / `awm add <bundle>` corren sobre TODOS los agentes
+        //    habilitados. Que uno no pueda no es un error del usuario, y hacer
+        //    tirar todo el plan rompia el comando para TODOS los demas agentes
+        //    de la maquina — incluido el re-sync de hooks, que ni se alcanzaba.
+        //  - `awm add x -a copilot -s global` es una peticion EXPLICITA. Ahi no
+        //    hay a quien saltear, asi que sigue tirando con la explicacion
+        //    (`globalUnsupportedReason`), que es justo lo que el usuario
+        //    necesita leer.
+        const capable = selectedAgents.filter((agent) => {
+            if (!(0, providers_1.providerFor)(agent)[intent.type])
+                return false;
+            try {
+                physicalTarget(intent, agent, scope, projectRoot);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+        const effectiveAgents = capable.length > 0 ? capable : selectedAgents;
+        for (const agent of effectiveAgents) {
             const config = (0, providers_1.providerFor)(agent)[intent.type];
             if (!config)
                 continue;

package/dist/src/core/install-transaction.js

@@ -41,8 +41,20 @@ const executor_1 = require("./executor");
  * accepts. Strips both `:` and `.` (an ISO timestamp has both) so the result
  * is filesystem- and regex-safe either way.
  */
+/** Id de transaccion: timestamp + sufijo aleatorio.
+ *
+ *  El timestamp solo tiene resolucion de 1 ms y NO era unico. Dos
+ *  transacciones en el mismo milisegundo (p. ej. `syncProfile`, que corre una
+ *  por extension en un loop) producian el mismo id, y como cada una reescribe
+ *  `manifest.json` con SUS entradas y numera los slots de backup desde 0, la
+ *  segunda pisaba el backup de la primera: el respaldo del archivo original del
+ *  usuario quedaba irrecuperable y `awm backup restore <id>` restauraba el
+ *  target equivocado. Es un agujero en el unico mecanismo del que depende toda
+ *  la promesa de "siempre se puede revertir". El regex de `restoreBackup` ya
+ *  acepta este formato. */
 function sanitizeTransactionTimestamp() {
-    return new Date().toISOString().replace(/[:.]/g, '-');
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    return `${stamp}-${crypto_1.default.randomBytes(4).toString('hex')}`;
 }
 function ensureBackupDir(backupDir) {
     fs_1.default.mkdirSync(backupDir, { recursive: true });

package/dist/src/core/journal/adapter.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.WATCH_PROVIDERS = void 0;
+exports.isWatchProvider = isWatchProvider;
 exports.adapterFor = adapterFor;
 const process_1 = require("./process");
 const RESUME_PROMPT_PREFIX = 'Sos el orquestador SDD de este repo. Corre `awm job reconcile` y ejecuta ';
@@ -18,10 +20,17 @@ const claudeAdapter = {
     activity: process_1.activitySnapshot,
     safeToReplace: baseSafeToReplace,
 };
+/** Los providers que `awm watch` sabe supervisar. Exportado para que el CLI valide en
+ *  el borde en vez de dejar que un `--provider` invalido llegue hasta el primer tick,
+ *  ya con el journal tocado y el lock tomado. */
+exports.WATCH_PROVIDERS = ['codex', 'claude-code'];
+function isWatchProvider(value) {
+    return typeof value === 'string' && exports.WATCH_PROVIDERS.includes(value);
+}
 function adapterFor(provider) {
     if (provider === 'codex')
         return codexAdapter;
     if (provider === 'claude-code')
         return claudeAdapter;
-    throw new Error(`provider desconocido: ${provider} (validos: codex, claude-code)`);
+    throw new Error(`provider desconocido: ${provider} (validos: ${exports.WATCH_PROVIDERS.join(', ')})`);
 }

package/dist/src/core/paths.js

@@ -17,8 +17,8 @@ exports.resolveOnPath = resolveOnPath;
 // Functions are evaluated at CALL TIME (not require time) so env overrides are
 // always honored and tests need no jest.resetModules().
 const os_1 = __importDefault(require("os"));
+const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
-const child_process_1 = require("child_process");
 /** User home directory with a robust fallback. Never returns a raw, possibly-empty process.env.HOME. */
 function homeDir() {
     return process.env.HOME || os_1.default.homedir();
@@ -74,14 +74,67 @@ function noteWindowsCaveat(log) {
     if (isWindowsNative())
         log(exports.WINDOWS_KNOWN_GAP);
 }
-/** Resolve a binary on PATH portably: `where` on win32, POSIX `command -v` elsewhere. */
+/**
+ * Resolve a binary on PATH, IN PROCESS — no shell, no subprocess.
+ *
+ * SECURITY (this is the whole reason for the implementation below): this used
+ * to build `command -v ${bin}` / `where ${bin}` and hand it to `execSync`,
+ * which runs it through a shell. `bin` is the first token of a sensor's `cmd`,
+ * and that string comes from `.awm/sensors.json` — a file committed in the
+ * repo, and also regenerated from a registry sensor-pack's `defaultCmd`. So a
+ * cloned untrusted repo, or a third-party registry, could put shell syntax
+ * there. The token can't contain whitespace (it's a split token), but `${IFS}`
+ * and `$(...)` make that irrelevant. Confirmed against the real binary: a
+ * crafted `cmd` executed an arbitrary command during `awm sensors status` —
+ * a read-only inspection command — which then reported the sensor HEALTHY,
+ * because the injected command exited 0.
+ *
+ * Resolving PATH ourselves removes the interpreter entirely, so there is
+ * nothing left to inject into on any platform. It's also faster (no process
+ * spawn) and more predictable than depending on `where`/`command -v` being
+ * present and well-behaved.
+ */
 function resolveOnPath(bin) {
-    const cmd = isWindowsNative() ? `where ${bin}` : `command -v ${bin}`;
-    try {
-        (0, child_process_1.execSync)(cmd, { stdio: 'pipe' });
-        return true;
-    }
-    catch {
+    if (typeof bin !== 'string' || bin.trim() === '')
         return false;
+    // win32 resolves `eslint` to `eslint.cmd`/`eslint.exe` via PATHEXT. Missing
+    // this broke every npm-shim-backed sensor on Windows (real bug, published in
+    // v3.9.0). POSIX has no such concept — the name is the name.
+    const extensions = isWindowsNative()
+        ? (process.env.PATHEXT ?? '.COM;.EXE;.BAT;.CMD').split(';').filter(Boolean)
+        : [];
+    const isExecutable = (candidate) => {
+        try {
+            if (!fs_1.default.statSync(candidate).isFile())
+                return false;
+        }
+        catch {
+            return false;
+        }
+        // On win32 the executable bit doesn't exist; being a file with a PATHEXT
+        // extension is the whole contract.
+        if (isWindowsNative())
+            return true;
+        try {
+            fs_1.default.accessSync(candidate, fs_1.default.constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    // PATHEXT is conventionally uppercase (`.COM;.EXE;.BAT;.CMD`) while the files
+    // on disk are usually lowercase (`eslint.cmd`). On real Windows that's a
+    // non-issue because the filesystem is case-insensitive — but it IS an issue
+    // on any case-sensitive volume, so try both spellings rather than depend on
+    // filesystem behavior we don't control.
+    const matches = (base) => isExecutable(base) ||
+        extensions.some((ext) => isExecutable(base + ext) || isExecutable(base + ext.toLowerCase()));
+    // A name carrying a separator is a path, not a PATH lookup — resolve it
+    // directly instead of joining it onto every PATH entry.
+    if (bin.includes('/') || (isWindowsNative() && bin.includes('\\'))) {
+        return matches(path_1.default.resolve(bin));
     }
+    const entries = (process.env.PATH ?? '').split(path_1.default.delimiter).filter(Boolean);
+    return entries.some((dir) => matches(path_1.default.join(dir, bin)));
 }

package/dist/src/core/profile.js

@@ -125,6 +125,18 @@ function ensureSkillsGitignored(root, agents) {
             const config = provider[type];
             if (!config)
                 continue;
+            // Solo se ignoran los artefactos que son SYMLINKS especificos de la
+            // maquina (renderer `link`), que es lo que `awm sync` reconstruye.
+            // Un renderer que produce CONTENIDO (`.mdc` de cursor,
+            // `.instructions.md` de copilot) genera archivos reales que el
+            // equipo necesita commitear — y para copilot ese es su UNICO canal
+            // de entrega, asi que ignorarlos hacia que los companeros no
+            // recibieran absolutamente nada. Tambien arrastraba a
+            // `.cursor/rules/awm.mdc`, el carrier que existe justamente para
+            // que el contexto sobreviva al Background Agent de Cursor, que lee
+            // del checkout de git.
+            if (config.renderer !== 'link')
+                continue;
             const entry = config.local.endsWith('/') ? config.local : `${config.local}/`;
             if (!toIgnore.includes(entry))
                 toIgnore.push(entry);