agentic-workflow-manager 3.13.5 → 3.13.6

package/dist/tests/commands/pin.test.js

@@ -34,7 +34,7 @@ describe('pin/unpin (editores de preferences)', () => {
     it('setPin escribe pins.base normalizado (acepta prefijo v)', () => {
         const { setPin } = require('../../src/commands/pin');
         setPin('base', 'v1.2.0');
-        expect(readPrefs().pins).toEqual({ base: '1.2.0' });
+        expect(readPrefs().pins).toEqual({ baseline: '1.2.0' });
     });
     it('setPin acepta un registry adicional configurado', () => {
         const { writeRegistriesConfig } = require('../../src/core/registries');
@@ -66,7 +66,34 @@ describe('pin/unpin (editores de preferences)', () => {
         writeRegistriesConfig([{ name: 'equipo', remote: '/tmp/x' }]);
         setPin('equipo', '2.0.0');
         const prefs = readPrefs();
-        expect(prefs.pins).toEqual({ base: '1.0.0', equipo: '2.0.0' });
+        expect(prefs.pins).toEqual({ baseline: '1.0.0', equipo: '2.0.0' });
         expect(prefs.defaultAgent).toBeDefined();
     });
 });
+describe('awm pin base: el alias tiene que llegar a la clave que el resolutor lee', () => {
+    // Regresion: el registry base se llama `baseline` en disco, pero la ayuda
+    // del comando siempre documento `awm pin base <v>`. `base` se aceptaba y se
+    // persistia tal cual — en una clave que NADA lee. El comando reportaba
+    // "✓ base pinned to v1.0.0" y no cambiaba nada, incluso siendo la salida
+    // documentada de un bloqueo por `minCliVersion`, donde el usuario queda sin
+    // poder correr `awm update` ni `awm sync`.
+    it('setPin("base") persiste bajo "baseline", que es lo que consulta el resolutor', () => {
+        const { setPin } = require('../../src/commands/pin');
+        setPin('base', '1.5.0');
+        const { getPreferences } = require('../../src/utils/config');
+        expect(getPreferences().pins).toEqual({ baseline: '1.5.0' });
+    });
+    it('removePin("base") borra ese mismo pin (no una clave fantasma)', () => {
+        const { setPin, removePin } = require('../../src/commands/pin');
+        setPin('base', '1.5.0');
+        expect(removePin('base')).toBe(true);
+        const { getPreferences } = require('../../src/utils/config');
+        expect(getPreferences().pins).toEqual({});
+    });
+    it('"baseline" explicito sigue funcionando igual', () => {
+        const { setPin } = require('../../src/commands/pin');
+        setPin('baseline', '2.0.0');
+        const { getPreferences } = require('../../src/utils/config');
+        expect(getPreferences().pins).toEqual({ baseline: '2.0.0' });
+    });
+});

package/dist/tests/commands/preflight/preflight.test.js

@@ -163,18 +163,34 @@ describe('preflight', () => {
         // sensor configuration, and an empty sensors object now fails `checkManifest`
         // (see the `total === 0` branch), which would drag `report.status` off 'ready'
         // for reasons unrelated to what these tests exercise.
-        beforeEach(() => { mockExecSync.mockReset(); });
+        // `resolveOnPath` resuelve PATH en proceso (ya no invoca un shell — ver la
+        // nota de seguridad en core/paths.ts), asi que la disponibilidad de `gh`/
+        // `glab` se simula con un PATH aislado, no mockeando `execSync`. Ademas de
+        // reflejar el mecanismo real, esto vuelve deterministas los casos de
+        // "no esta en PATH", que antes dependian de que la maquina no lo tuviera.
+        let pathDir;
+        let originalPath;
+        beforeEach(() => {
+            pathDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-path-'));
+            originalPath = process.env.PATH;
+            process.env.PATH = pathDir;
+        });
+        afterEach(() => {
+            if (originalPath === undefined)
+                delete process.env.PATH;
+            else
+                process.env.PATH = originalPath;
+            fs_1.default.rmSync(pathDir, { recursive: true, force: true });
+        });
+        function installOnPath(tool) {
+            const f = path_1.default.join(pathDir, tool);
+            fs_1.default.writeFileSync(f, '#!/bin/sh\nexit 0\n');
+            fs_1.default.chmodSync(f, 0o755);
+        }
         it('reports github + gh available, and does not affect status', () => {
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@github.com:kodria/agentic-workflow.git');
-            // `resolveOnPath('gh')` runs `command -v gh` on POSIX but `where gh` on
-            // win32 (see paths.ts) — match both invocation forms so this test's
-            // "gh is available" fixture holds on windows-latest CI too.
-            mockExecSync.mockImplementation(((cmd) => {
-                if (cmd === 'command -v gh' || cmd === 'where gh')
-                    return Buffer.from('/usr/bin/gh');
-                throw new Error(`not found: ${cmd}`);
-            }));
+            installOnPath('gh');
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
             expect(check(report, 'host').detail).toBe('github detected, gh available');
@@ -185,9 +201,7 @@ describe('preflight', () => {
             // advisory contract: it must not drag an otherwise-clean repo to `degraded`.
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://gitlab.com/kodria/agentic-workflow.git');
-            mockExecSync.mockImplementation((() => {
-                throw new Error('not found');
-            }));
+            // PATH aislado y vacio => glab no resuelve.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
             expect(check(report, 'host').detail).toContain('glab not on PATH');
@@ -254,7 +268,7 @@ describe('preflight', () => {
             // test guards is that it must never again read as gitlab.
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'ssh://gitlab@github.company-internal.com:22/team/repo.git');
-            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            // PATH real: estos casos no dependen de gh/glab.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
             expect(check(report, 'host').detail).toContain('github detected');
@@ -289,28 +303,28 @@ describe('preflight', () => {
         it('still detects github.com over HTTPS', () => {
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://github.com/org/repo.git');
-            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            // PATH real: estos casos no dependen de gh/glab.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('github detected');
         });
         it('still detects github.com over SSH shorthand', () => {
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@github.com:org/repo.git');
-            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            // PATH real: estos casos no dependen de gh/glab.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('github detected');
         });
         it('still detects gitlab over HTTPS', () => {
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://gitlab.example.com/org/repo.git');
-            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            // PATH real: estos casos no dependen de gh/glab.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('gitlab detected');
         });
         it('still detects gitlab over SSH shorthand', () => {
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@gitlab.example.com:org/repo.git');
-            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            // PATH real: estos casos no dependen de gh/glab.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('gitlab detected');
         });

package/dist/tests/commands/registry/install-bundles.test.js

@@ -38,8 +38,8 @@ describe('installBundlesFromRegistry', () => {
         fs_1.default.rmSync(tmpWork, { recursive: true, force: true });
     });
     it('installs all ambient bundles of the given registry root for the agent', () => {
-        const { REGISTRIES_DIR } = require('../../../src/core/registries');
-        const regRoot = path_1.default.join(REGISTRIES_DIR, 'team');
+        const { registriesDir } = require('../../../src/core/registries');
+        const regRoot = path_1.default.join(registriesDir(), 'team');
         writeBundleRoot(regRoot, 'team-pack', 'team-skill');
         fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.awm', 'registries.json'), JSON.stringify([{ name: 'team', remote: 'r' }]));
@@ -52,8 +52,8 @@ describe('installBundlesFromRegistry', () => {
         expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.claude', 'skills', 'team-skill'))).toBe(true);
     });
     it('returns empty when the registry has no bundles', () => {
-        const { REGISTRIES_DIR } = require('../../../src/core/registries');
-        const regRoot = path_1.default.join(REGISTRIES_DIR, 'empty');
+        const { registriesDir } = require('../../../src/core/registries');
+        const regRoot = path_1.default.join(registriesDir(), 'empty');
         fs_1.default.mkdirSync(path_1.default.join(regRoot, 'skills', 's'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(regRoot, 'skills', 's', 'SKILL.md'), `---\nname: s\ndescription: d\n---\n`);
         fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm'), { recursive: true });
@@ -62,8 +62,8 @@ describe('installBundlesFromRegistry', () => {
         expect(installBundlesFromRegistry(regRoot, 'all', ['claude-code'], tmpWork)).toEqual([]);
     });
     it('installs only the named bundles when a list is given', () => {
-        const { REGISTRIES_DIR } = require('../../../src/core/registries');
-        const regRoot = path_1.default.join(REGISTRIES_DIR, 'team');
+        const { registriesDir } = require('../../../src/core/registries');
+        const regRoot = path_1.default.join(registriesDir(), 'team');
         writeBundleRoot(regRoot, 'wanted', 'skill-w');
         // second bundle in same catalog
         fs_1.default.mkdirSync(path_1.default.join(regRoot, 'bundles', 'unwanted'), { recursive: true });

package/dist/tests/commands/sensors/init-pack-unavailable.test.js

@@ -0,0 +1,96 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// `awm sensors init` auto-detects the stack, then reads that pack's defaults out of
+// the registry. When the registry has no such pack — a pinned or stale registry, or one
+// that simply never shipped it — `readPackDefaults` returned null and the manifest was
+// written EMPTY, with no error and no warning:
+//
+//     $ awm sensors init          # python project, registry predates the python pack
+//     ✔ Detected: python (pyproject.toml)
+//     ✔ Wrote .awm/sensors.json          ← {"pack":"python","sensors":{}}
+//
+// Nothing in that output says the quality gate now checks nothing. The operator finds
+// out later, from an unrelated command (`awm preflight` exits 1, `awm sensors status`
+// reports DEGRADED), and the manifest is by then committed.
+//
+// `--pack <name>` has always validated against the registry and thrown (assertPackExists).
+// Auto-detection reaching the same dead end must not be quieter than the explicit path:
+// it now falls back to a pack the registry actually has, and says which pack was missing
+// so the operator hears it at the moment the decision is made.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const init_1 = require("../../../src/commands/sensors/init");
+function mkRegistry(packs) {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-packreg-'));
+    for (const [name, sensors] of Object.entries(packs)) {
+        const dir = path_1.default.join(root, 'sensor-packs', name);
+        fs_1.default.mkdirSync(dir, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'pack.json'), JSON.stringify({ name, sensors }));
+    }
+    return root;
+}
+function mkPythonProject() {
+    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-packproj-'));
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'pyproject.toml'), '[project]\nname = "x"\n');
+    return dir;
+}
+const GENERIC = { security: { defaultCmd: 'semgrep .', fast: false } };
+const PYTHON = { typecheck: { defaultCmd: 'mypy .', fast: true, formatter: 'mypy' } };
+describe('awm sensors init — detected pack missing from the registry', () => {
+    const made = [];
+    const registry = (packs) => { const r = mkRegistry(packs); made.push(r); return r; };
+    const project = () => { const p = mkPythonProject(); made.push(p); return p; };
+    const manifestOf = (dir) => JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), 'utf-8'));
+    afterAll(() => { for (const d of made)
+        fs_1.default.rmSync(d, { recursive: true, force: true }); });
+    it('names the missing pack instead of writing an empty manifest silently', () => {
+        const cwd = project();
+        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {}, generic: GENERIC }) });
+        expect(result.unavailablePack).toBe('python');
+        expect(result.detection.pack).toBe('python'); // what the tree actually is — unchanged
+    });
+    it('falls back to a pack the registry does have, so the gate still measures something', () => {
+        const cwd = project();
+        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {}, generic: GENERIC }) });
+        expect(result.manifest.pack).toBe('generic');
+        expect(Object.keys(result.manifest.sensors)).toEqual(['security']);
+        expect(manifestOf(cwd).pack).toBe('generic');
+    });
+    it('stays on the detected pack when the registry has no fallback either', () => {
+        // Nothing better exists. The manifest is honestly empty and still says so —
+        // preflight's `manifest` check fails on `total === 0` with a registry remedy.
+        const cwd = project();
+        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {} }) });
+        expect(result.unavailablePack).toBe('python');
+        expect(result.manifest.pack).toBe('python');
+        expect(result.manifest.sensors).toEqual({});
+    });
+    it('is quiet when the registry does have the detected pack', () => {
+        const cwd = project();
+        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ python: PYTHON, generic: GENERIC }) });
+        expect(result.unavailablePack).toBeUndefined();
+        expect(result.manifest.pack).toBe('python');
+        expect(Object.keys(result.manifest.sensors)).toEqual(['typecheck']);
+    });
+    it('does not fall back when there is no registry to check against', () => {
+        // No registryRoot means nothing to validate against, the same tolerance
+        // `--pack` already has — not evidence that the pack is missing.
+        const cwd = project();
+        const result = (0, init_1.initSensors)({ cwd });
+        expect(result.unavailablePack).toBeUndefined();
+        expect(result.manifest.pack).toBe('python');
+    });
+    it('keeps sensors the user already had when falling back', () => {
+        // The fallback must not be a way to lose hand-written configuration.
+        const cwd = project();
+        fs_1.default.mkdirSync(path_1.default.join(cwd, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(cwd, '.awm', 'sensors.json'), JSON.stringify({ pack: 'python', sensors: { test: { cmd: 'pytest -q', fast: false } } }));
+        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ generic: GENERIC }) });
+        expect(result.manifest.sensors.test?.cmd).toBe('pytest -q');
+        expect(Object.keys(result.manifest.sensors).sort()).toEqual(['security', 'test']);
+    });
+});

package/dist/tests/commands/sensors/install-settings-safety.test.js

@@ -0,0 +1,87 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Regresion: `installSensorHook` leia `~/.claude/settings.json` con
+// `try { JSON.parse(...) } catch { return {} }` y despues escribia ese `{}` de
+// vuelta — o sea, ante un JSON malformado (una coma de mas, el error de edicion
+// a mano mas comun) BORRABA el archivo entero del usuario y reportaba exito.
+//
+// Verificado destruyendo `model`, `permissions` y el propio hook SessionStart de
+// AWM. El escritor hermano (`installClaudeHook`) ya se negaba correctamente ante
+// el mismo archivo: tres escritores del mismo archivo, tres niveles de dureza.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+describe('installSensorHook: nunca destruye settings.json del usuario', () => {
+    let home;
+    let settingsPath;
+    let originalHome;
+    let originalAwmHome;
+    beforeEach(() => {
+        home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-sensor-hook-'));
+        originalHome = process.env.HOME;
+        originalAwmHome = process.env.AWM_HOME;
+        process.env.HOME = home;
+        process.env.AWM_HOME = path_1.default.join(home, '.awm');
+        fs_1.default.mkdirSync(path_1.default.join(home, '.claude'), { recursive: true });
+        settingsPath = path_1.default.join(home, '.claude', 'settings.json');
+        jest.resetModules();
+    });
+    afterEach(() => {
+        if (originalHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = originalHome;
+        if (originalAwmHome === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = originalAwmHome;
+        fs_1.default.rmSync(home, { recursive: true, force: true });
+    });
+    it('ante JSON malformado NO reescribe el archivo — falla en vez de destruirlo', () => {
+        // Coma de mas: sintacticamente invalido, semanticamente el archivo real
+        // del usuario con toda su configuracion.
+        const malformed = `{
+  "model": "claude-opus-4",
+  "permissions": { "allow": ["Bash(npm test)"] },
+  "hooks": { "SessionStart": [{ "matcher": "startup", "hooks": [] }] },
+}`;
+        fs_1.default.writeFileSync(settingsPath, malformed);
+        const { installSensorHook } = require('../../../src/commands/sensors/install');
+        const result = (() => {
+            try {
+                return installSensorHook();
+            }
+            catch (e) {
+                return { threw: e };
+            }
+        })();
+        // El contrato es no-destruccion. Que lance o que reporte un fallo son
+        // dos formas aceptables de negarse; escribir sobre el archivo no lo es.
+        const after = fs_1.default.readFileSync(settingsPath, 'utf-8');
+        expect(after).toBe(malformed);
+        expect(after).toContain('"model"');
+        expect(after).toContain('"permissions"');
+        expect(JSON.stringify(result)).not.toContain('"status":"installed"');
+    });
+    it('sobre un settings.json valido, preserva las claves del usuario e instala el hook', () => {
+        fs_1.default.writeFileSync(settingsPath, JSON.stringify({
+            model: 'claude-opus-4',
+            permissions: { allow: ['Bash(npm test)'] },
+        }, null, 2));
+        const { installSensorHook } = require('../../../src/commands/sensors/install');
+        installSensorHook();
+        const after = JSON.parse(fs_1.default.readFileSync(settingsPath, 'utf-8'));
+        expect(after.model).toBe('claude-opus-4');
+        expect(after.permissions).toEqual({ allow: ['Bash(npm test)'] });
+        expect(after.hooks).toBeDefined();
+    });
+    it('sin settings.json previo, lo crea sin romper nada', () => {
+        const { installSensorHook } = require('../../../src/commands/sensors/install');
+        expect(() => installSensorHook()).not.toThrow();
+        expect(fs_1.default.existsSync(settingsPath)).toBe(true);
+        expect(() => JSON.parse(fs_1.default.readFileSync(settingsPath, 'utf-8'))).not.toThrow();
+    });
+});

package/dist/tests/commands/sensors/run.test.js

@@ -280,38 +280,12 @@ describe('runSensors — not_certified + auto-discovery', () => {
         expect(out.sensors.length).toBe(1);
     });
 });
-describe('reconcilePack', () => {
-    // Build a minimal fake registry in a tmpdir (registry/ no longer lives in this repo —
-    // content lives in awm-baseline-registry / awm-documentation-registry).
-    let FAKE_REGISTRY;
-    beforeAll(() => {
-        FAKE_REGISTRY = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-fake-reg-'));
-        const jstsPackDir = path_1.default.join(FAKE_REGISTRY, 'sensor-packs', 'js-ts');
-        const genericPackDir = path_1.default.join(FAKE_REGISTRY, 'sensor-packs', 'generic');
-        fs_1.default.mkdirSync(jstsPackDir, { recursive: true });
-        fs_1.default.mkdirSync(genericPackDir, { recursive: true });
-        // Minimal pack.json matching what the real js-ts pack ships
-        fs_1.default.writeFileSync(path_1.default.join(jstsPackDir, 'pack.json'), JSON.stringify({
-            name: 'js-ts',
-            description: 'JavaScript/TypeScript sensor pack (test fixture)',
-            sensors: {
-                typecheck: { defaultCmd: 'npx tsc --noEmit', fast: true },
-                lint: { defaultCmd: 'npx eslint . --format json', fast: true },
-                security: { defaultCmd: 'semgrep --config .semgrep.awm.yml --json .', fast: false },
-                mutation: { enabled: false },
-            },
-        }));
-        fs_1.default.writeFileSync(path_1.default.join(genericPackDir, 'pack.json'), JSON.stringify({
-            name: 'generic',
-            description: 'Generic sensor pack (test fixture)',
-            sensors: {
-                security: { defaultCmd: 'semgrep .', fast: false },
-            },
-        }));
-    });
-    afterAll(() => { fs_1.default.rmSync(FAKE_REGISTRY, { recursive: true, force: true }); });
+describe('detectPackDrift', () => {
+    // Pure detection: it reads the tree and reports. It does NOT rebuild the manifest
+    // and does NOT consult a registry — see run-is-read-only.test.ts for why the
+    // rebuild it used to do (`reconcilePack`) was removed.
     function tmpProject(pack, withPackageJson) {
-        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-reconcile-'));
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-drift-'));
         fs_1.default.mkdirSync(path_1.default.join(dir, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), JSON.stringify({ pack, sensors: pack === 'generic'
                 ? { security: { cmd: 'semgrep .', fast: false } }
@@ -320,46 +294,45 @@ describe('reconcilePack', () => {
             fs_1.default.writeFileSync(path_1.default.join(dir, 'package.json'), '{}');
         return dir;
     }
-    it('upgrades generic→js-ts when package.json is present', async () => {
-        const { reconcilePack } = require('../../../src/commands/sensors/run');
+    it('reports generic→js-ts drift when package.json is present', () => {
+        const { detectPackDrift } = require('../../../src/commands/sensors/run');
         const dir = tmpProject('generic', true);
         try {
             const manifest = JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), 'utf-8'));
-            const res = reconcilePack(dir, manifest, FAKE_REGISTRY);
-            expect(res.manifest.pack).toBe('js-ts');
-            expect(res.upgradedFrom).toBe('generic');
-            expect(Object.keys(res.manifest.sensors)).toContain('typecheck');
-            // custom sensor cmd preserved through merge
-            expect(res.manifest.sensors.security?.cmd).toBe('semgrep .');
-            // persisted to disk
+            const res = detectPackDrift(dir, manifest);
+            expect(res.detection.pack).toBe('js-ts');
+            expect(res.drift).toEqual({
+                manifest: 'generic',
+                detected: 'js-ts',
+                remedy: expect.stringContaining('awm sensors init'),
+            });
+            // the manifest on disk is untouched — reporting is not healing
             const onDisk = JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), 'utf-8'));
-            expect(onDisk.pack).toBe('js-ts');
+            expect(onDisk.pack).toBe('generic');
         }
         finally {
             fs_1.default.rmSync(dir, { recursive: true });
         }
     });
-    it('is a no-op when pack is already real (idempotent)', async () => {
-        const { reconcilePack } = require('../../../src/commands/sensors/run');
+    it('reports no drift when the pack is already real', () => {
+        const { detectPackDrift } = require('../../../src/commands/sensors/run');
         const dir = tmpProject('js-ts', true);
         try {
             const manifest = JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), 'utf-8'));
-            const res = reconcilePack(dir, manifest, FAKE_REGISTRY);
-            expect(res.manifest.pack).toBe('js-ts');
-            expect(res.upgradedFrom).toBeUndefined();
+            expect(detectPackDrift(dir, manifest).drift).toBeUndefined();
         }
         finally {
             fs_1.default.rmSync(dir, { recursive: true });
         }
     });
-    it('does not upgrade a truly generic project (no indicators)', async () => {
-        const { reconcilePack } = require('../../../src/commands/sensors/run');
+    it('reports no drift on a truly generic project (no indicators)', () => {
+        const { detectPackDrift } = require('../../../src/commands/sensors/run');
         const dir = tmpProject('generic', false);
         try {
             const manifest = JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), 'utf-8'));
-            const res = reconcilePack(dir, manifest, FAKE_REGISTRY);
-            expect(res.manifest.pack).toBe('generic');
-            expect(res.upgradedFrom).toBeUndefined();
+            const res = detectPackDrift(dir, manifest);
+            expect(res.detection.pack).toBe('generic');
+            expect(res.drift).toBeUndefined();
         }
         finally {
             fs_1.default.rmSync(dir, { recursive: true });

package/dist/tests/commands/sensors/status-windows.test.js

@@ -6,50 +6,67 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
-const child_process_1 = require("child_process");
 const status_1 = require("../../../src/commands/sensors/status");
-jest.mock('child_process', () => ({ execSync: jest.fn() }));
-const mockExecSync = child_process_1.execSync;
+// `resolveOnPath` resuelve PATH en proceso (ya no invoca un shell — ver el
+// comentario de seguridad en core/paths.ts). Estos tests controlan un PATH
+// aislado en vez de mockear `execSync`: refleja el mecanismo real y los vuelve
+// deterministas. Lo que se verifica en win32 sigue siendo lo mismo que motivo
+// este archivo: que un shim `.cmd` de npm resuelva (bug real publicado en
+// v3.9.0, donde los sensores quedaban todos "no encontrados" en Windows).
 describe('computeSensorStatus — Windows PATH resolution', () => {
     let tmpDir;
+    let pathDir;
+    let originalPath;
+    let originalPathExt;
     const originalPlatform = process.platform;
     beforeEach(() => {
         tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-status-win-'));
-        mockExecSync.mockReset();
+        pathDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-status-win-path-'));
+        originalPath = process.env.PATH;
+        originalPathExt = process.env.PATHEXT;
+        process.env.PATH = pathDir;
+        process.env.PATHEXT = '.COM;.EXE;.BAT;.CMD';
         Object.defineProperty(process, 'platform', { value: 'win32' });
     });
     afterEach(() => {
-        fs_1.default.rmSync(tmpDir, { recursive: true });
+        if (originalPath === undefined)
+            delete process.env.PATH;
+        else
+            process.env.PATH = originalPath;
+        if (originalPathExt === undefined)
+            delete process.env.PATHEXT;
+        else
+            process.env.PATHEXT = originalPathExt;
+        fs_1.default.rmSync(tmpDir, { recursive: true, force: true });
+        fs_1.default.rmSync(pathDir, { recursive: true, force: true });
         Object.defineProperty(process, 'platform', { value: originalPlatform });
     });
-    it('resolves an installed binary on win32 using `where`, not `which`', () => {
+    function writeManifest() {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: { security: { cmd: 'semgrep --json .', fast: false } }
         }));
-        mockExecSync.mockImplementation(((cmd) => {
-            if (cmd.startsWith('where '))
-                return Buffer.from('C:\\tools\\semgrep.exe');
-            throw new Error(`not found: ${cmd}`);
-        }));
+    }
+    it('resuelve un binario instalado en win32 via PATHEXT (incluido un shim .cmd)', () => {
+        writeManifest();
+        // En win32 el usuario escribe `semgrep` y en disco existe `semgrep.cmd`.
+        fs_1.default.writeFileSync(path_1.default.join(pathDir, 'semgrep.cmd'), '@echo off\r\n');
         const result = (0, status_1.computeSensorStatus)(tmpDir);
         expect(result.overall).toBe('HEALTHY');
         expect(result.checks.security.ok).toBe(true);
     });
-    it('reports ok:false on win32 when `where` cannot find the binary', () => {
-        fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
-        fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
-            pack: 'js-ts',
-            sensors: { security: { cmd: 'semgrep --json .', fast: false } }
-        }));
-        mockExecSync.mockImplementation(((cmd) => {
-            if (cmd.startsWith('where '))
-                throw new Error(`not found: ${cmd}`);
-            throw new Error(`not found: ${cmd}`);
-        }));
+    it('reporta ok:false en win32 cuando el binario no esta en PATH', () => {
+        writeManifest();
+        // PATH aislado y vacio.
         const result = (0, status_1.computeSensorStatus)(tmpDir);
         expect(result.overall).toBe('DEGRADED');
         expect(result.checks.security.ok).toBe(false);
     });
+    it('en win32 no exige bit de ejecucion — un .exe sin permisos POSIX igual resuelve', () => {
+        writeManifest();
+        fs_1.default.writeFileSync(path_1.default.join(pathDir, 'semgrep.exe'), '');
+        fs_1.default.chmodSync(path_1.default.join(pathDir, 'semgrep.exe'), 0o644);
+        expect((0, status_1.computeSensorStatus)(tmpDir).checks.security.ok).toBe(true);
+    });
 });