agentic-workflow-manager 3.13.5 → 3.13.7

package/dist/scripts/support-matrix.js

@@ -0,0 +1,138 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DOC_PATH = exports.END_MARKER = exports.BEGIN_MARKER = void 0;
+exports.homeRelative = homeRelative;
+exports.renderProviderTables = renderProviderTables;
+exports.spliceGenerated = spliceGenerated;
+// Generador de la matriz de soporte que vive en `docs/support-matrix.md`.
+//
+// Existe porque la tabla escrita a mano ya mintio: decia que Antigravity instalaba en
+// `~/.agents/skills` y `.agents/skills` cuando el codigo dice `~/.gemini/antigravity/skills`
+// y `.agent/skills` (singular), y omitia que es el unico provider con `global_workflows`.
+// Una tabla de soporte que no coincide con el codigo es peor que no tenerla: se cita en
+// una presentacion, se planifica encima, y nadie la vuelve a chequear.
+//
+// El bloque generado esta delimitado por marcadores en el .md, y
+// `tests/structural/support-matrix-is-current.test.ts` regenera y compara — asi que un
+// cambio en `providers/index.ts` que no se refleje en el doc pone la CI en rojo. La
+// verificabilidad no depende de que alguien se acuerde.
+const path_1 = __importDefault(require("path"));
+const providers_1 = require("../src/providers");
+const paths_1 = require("../src/core/paths");
+exports.BEGIN_MARKER = '<!-- BEGIN GENERATED: provider-capabilities -->';
+exports.END_MARKER = '<!-- END GENERATED: provider-capabilities -->';
+/** Cualquier separador → `/`. Las rutas que produce `providers()` traen el separador
+ *  nativo, y el `home` puede traer otro (en win32, un `HOME` de entorno con `/` frente a
+ *  un `path.join` que devuelve `\`). Normalizar los dos lados ANTES de compararlos es lo
+ *  unico que hace la comparacion valida. */
+const toPosix = (p) => p.split(path_1.default.sep).join('/').split('\\').join('/');
+/** Rutas absolutas → `~/…`, con separadores POSIX, para que la tabla sea la misma en
+ *  cualquier maquina y en cualquier sistema operativo que la regenere.
+ *
+ *  La version anterior comparaba con `startsWith` ANTES de normalizar, asi que en Windows
+ *  —donde `path.join` devuelve `\` y el home podia venir con `/`— el prefijo no
+ *  coincidia nunca, no abreviaba nada, y la tabla regenerada ahi no era la misma que la
+ *  comiteada. Es decir: el documento prometia ser independiente de la maquina y no lo era.
+ *  Lo encontro la CI de Windows, no el desarrollo en Linux. */
+function homeRelative(p, home) {
+    const target = toPosix(p);
+    const prefix = toPosix(home);
+    return target.startsWith(prefix) ? `~${target.slice(prefix.length)}` : target;
+}
+function cell(value, absent, home) {
+    if (value === null)
+        return absent;
+    return `\`${homeRelative(value, home)}\``;
+}
+/** El tier declarado por la forma de la config — la misma derivacion que `providerTier`
+ *  en `core/diagnostics/provider-checks.ts`, no una segunda opinion. */
+function tier(c) {
+    if (c.hooks)
+        return 'hooks-native';
+    if (c.injection?.type === 'config-instructions')
+        return 'config-managed';
+    if (c.injection)
+        return 'agents-md-managed';
+    return 'context-only';
+}
+function injectionCell(c, home) {
+    const inj = c.injection;
+    if (!inj)
+        return '— (ninguna)';
+    if (inj.type === 'cc-settings-merge')
+        return 'hook `SessionStart`';
+    if (inj.type === 'config-instructions')
+        return `\`${homeRelative(inj.configPath, home)}\` → campo \`${inj.field}\``;
+    return inj.globalPath === null
+        ? `\`${inj.localFile}\` del proyecto (sin equivalente global)`
+        : `\`${inj.localFile}\` + \`${homeRelative(inj.globalPath, home)}\``;
+}
+function renderProviderTables() {
+    // `homeDir()`, la MISMA funcion de la que `providers()` deriva sus rutas. Tomarlo
+    // por parametro daba dos fuentes para el mismo dato: el generador abreviaba contra
+    // el home real y el test contra uno inventado, asi que ninguna ruta empezaba con el
+    // prefijo esperado y la tabla salia con rutas absolutas de la maquina que la corrio.
+    const home = (0, paths_1.homeDir)();
+    const p = (0, providers_1.providers)();
+    const row = (a) => p[a];
+    const lines = [];
+    lines.push('### Dónde aterriza cada artefacto');
+    lines.push('');
+    lines.push('| Agente | Tier | Skills (global) | Skills (proyecto) | Formato |');
+    lines.push('|---|---|---|---|---|');
+    for (const a of providers_1.AGENT_TARGETS) {
+        const c = row(a);
+        lines.push(`| \`${a}\` | ${tier(c)} | ${cell(c.skill.global, '**no soportado**', home)} | \`${c.skill.local}\` | \`${c.skill.renderer}\` |`);
+    }
+    lines.push('');
+    lines.push('### Perfiles de agente, workflows, hooks y contexto');
+    lines.push('');
+    lines.push('| Agente | Perfiles de agente | Workflows | Hooks | Entrega de contexto | Versión mínima |');
+    lines.push('|---|---|---|---|---|---|');
+    for (const a of providers_1.AGENT_TARGETS) {
+        const c = row(a);
+        const agentCell = c.agent === null
+            ? '— (no aplica)'
+            : `${cell(c.agent.global, '**no soportado**', home)} · \`${c.agent.renderer}\``;
+        const wfCell = c.workflow === null
+            ? '— (no aplica)'
+            : cell(c.workflow.global, '**no soportado**', home);
+        lines.push(`| \`${a}\` | ${agentCell} | ${wfCell} | ${c.hooks ? `\`${c.hooks.type}\`` : '— (no tiene)'} ` +
+            `| ${injectionCell(c, home)} | ${c.minimumVersion ?? '— (sin gate)'} |`);
+    }
+    lines.push('');
+    lines.push('> Generado desde `cli/src/providers/index.ts`. **No editar a mano** — `npm run docs:matrix` lo regenera y');
+    lines.push('> `tests/structural/support-matrix-is-current.test.ts` falla si el documento y el código se separan.');
+    return lines.join('\n');
+}
+/** Reemplaza el bloque entre marcadores. Falla ruidosamente si faltan: un doc sin
+ *  marcadores no se "arregla" agregando la tabla al final, se arregla avisando.
+ *
+ *  Respeta el fin de linea del documento que recibe. Emitia LF siempre, asi que en un
+ *  checkout de Windows —donde git entrega el .md con CRLF por defecto— regenerar producia
+ *  un archivo de finales mezclados, y la comparacion del test fallaba por bytes que no
+ *  tienen nada que ver con el contenido de la tabla. */
+function spliceGenerated(markdown, generated) {
+    const begin = markdown.indexOf(exports.BEGIN_MARKER);
+    const end = markdown.indexOf(exports.END_MARKER);
+    if (begin === -1 || end === -1 || end < begin) {
+        throw new Error(`support-matrix.md no tiene los marcadores ${exports.BEGIN_MARKER} / ${exports.END_MARKER}`);
+    }
+    const eol = markdown.includes('\r\n') ? '\r\n' : '\n';
+    const block = generated.split('\n').join(eol);
+    return markdown.slice(0, begin + exports.BEGIN_MARKER.length)
+        + eol + eol + block + eol + eol
+        + markdown.slice(end);
+}
+exports.DOC_PATH = path_1.default.join(__dirname, '..', '..', 'docs', 'support-matrix.md');
+/* istanbul ignore next — entrypoint de CLI, ejercitado por el test via las funciones puras */
+if (require.main === module) {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const fs = require('fs');
+    const current = fs.readFileSync(exports.DOC_PATH, 'utf-8');
+    fs.writeFileSync(exports.DOC_PATH, spliceGenerated(current, renderProviderTables()), 'utf-8');
+    process.stdout.write(`support-matrix.md regenerado desde providers/index.ts\n`);
+}

package/dist/src/commands/add.js

@@ -80,5 +80,10 @@ function runAddBundleCore(options, prefs, bundles, deps = {}) {
         ? `\n\n${picocolors_1.default.dim('Recorded as a project extension in .awm/profile.json (commit it; symlinks are gitignored).')}`
         : '';
     console.log(`✅ Installed bundle ${picocolors_1.default.cyan(matchedBundle.name)}:\n  ${lines}${recordNote}`);
+    // Same reason as in sync.ts: without printing it, `awm backup restore` has no
+    // name to be given and the transaction may as well not have an id.
+    if (result.transactionId) {
+        console.log(picocolors_1.default.dim(`  transaction ${result.transactionId} — undo with \`awm backup restore ${result.transactionId}\``));
+    }
     return { code: 0, selectedAgents, result };
 }

package/dist/src/commands/doctor.js

@@ -64,6 +64,7 @@ const CHECK_LABELS = {
     'binary.version': 'binary/version',
     'skills.global': 'global skills',
     'agents.native': 'native agents',
+    'workflows.global': 'global workflows',
     'context.global': 'global context',
     'hook.trust': 'hook SessionStart',
     'guidance.project': 'project guidance',

package/dist/src/commands/hooks/claude.js

@@ -46,7 +46,7 @@ function installClaudeHook(options) {
     }
     catch { /* not exists */ }
     try {
-        fs_1.default.symlinkSync(sourceSkill, skillDest);
+        fs_1.default.symlinkSync(sourceSkill, skillDest, 'file'); // ver shared.ts: el tipo no se infiere
     }
     catch {
         // best-effort: copy the single skill file; 'awm update' will not auto-propagate
@@ -180,7 +180,20 @@ function resyncClaudeHookFiles(config, registryRoot, method) {
         fs_1.default.unlinkSync(skillDest);
     }
     catch { /* not exists */ }
-    fs_1.default.symlinkSync(sourceSkill, skillDest);
+    // Mismo fallback a copia que `installClaudeHook` (arriba). Sin el, en
+    // Windows sin Developer Mode este symlink tira EPERM, `resyncInstalledHooks`
+    // propaga el throw y `awm update` devuelve 1 — PARA SIEMPRE: el install
+    // funcionaba (tenia el fallback) y el update no, en una plataforma que la
+    // matriz de soporte declara verificada en CI. Dos escritores del mismo
+    // archivo, solo uno endurecido.
+    try {
+        fs_1.default.symlinkSync(sourceSkill, skillDest, 'file'); // ver shared.ts: el tipo no se infiere
+    }
+    catch {
+        // best-effort: `awm update` no auto-propagara cambios de esta skill,
+        // pero el hook queda funcional en vez de dejar el comando inservible.
+        fs_1.default.copyFileSync(sourceSkill, skillDest);
+    }
 }
 /** True when the registry has everything needed to resync the Claude hook files. */
 function claudeResyncSourcesExist(registryRoot) {

package/dist/src/commands/hooks/shared.js

@@ -30,7 +30,12 @@ function syncExecutable(source, dest, method) {
     fs_1.default.mkdirSync(path_1.default.dirname(dest), { recursive: true });
     if (method === 'symlink') {
         try {
-            fs_1.default.symlinkSync(source, dest);
+            // 'file' explicito: el destino es un archivo. Sin el tipo, Node lo INFIERE
+            // del target y en Windows puede crear un symlink de DIRECTORIO, que
+            // exige SeCreateSymbolicLinkPrivilege. El fallback a copia de abajo lo
+            // cubria, pero el tipo correcto en la llamada no depende de que alguien
+            // conserve el try/catch al editarla.
+            fs_1.default.symlinkSync(source, dest, 'file');
         }
         catch {
             // best-effort: a FILE symlink needs SeCreateSymbolicLinkPrivilege on

package/dist/src/commands/init.js

@@ -218,6 +218,7 @@ async function runInit(opts = {}) {
                 contentDir: (0, registries_1.contentRoots)()[0] ?? '',
                 sensorPacksRoot: (0, registries_1.capabilityRoot)('sensor-packs') ?? '',
                 confirmExtensions,
+                machineOnly: !!opts.machineOnly,
                 actions: mergedActions,
             });
             pipelineOutcome = outcome;

package/dist/src/commands/pin.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalRegistryName = canonicalRegistryName;
 exports.setPin = setPin;
 exports.removePin = removePin;
 exports.registerPinCommands = registerPinCommands;
@@ -11,8 +12,24 @@ const config_1 = require("../utils/config");
 const registries_1 = require("../core/registries");
 const versioning_1 = require("../core/versioning");
 const VERSION_RE = /^v?\d+\.\d+\.\d+$/;
+/** El registry base se llama `baseline` en disco (core/registries.ts), pero la
+ *  ayuda del comando siempre documento `awm pin base <v>` — y `base` era
+ *  aceptado y persistido como una clave de pin que NADA lee. El pin reportaba
+ *  exito y no hacia absolutamente nada, incluso cuando es la salida documentada
+ *  de un bloqueo por `minCliVersion`. Se acepta como ALIAS y se normaliza. */
+const BASE_ALIAS = 'base';
+const BASE_REGISTRY = 'baseline';
+/** Nombre real en disco para lo que el usuario escribio. */
+function canonicalRegistryName(name) {
+    return name === BASE_ALIAS ? BASE_REGISTRY : name;
+}
 function knownRegistryNames() {
-    return ['base', ...(0, registries_1.readRegistriesConfig)().map((r) => r.name)];
+    // Ambos nombres son validos: el alias historico que documenta la ayuda del
+    // comando, y el nombre real en disco — que antes se rechazaba si todavia no
+    // habia registries.json, o sea justo cuando un usuario bloqueado intenta
+    // salir del paso.
+    const names = [BASE_ALIAS, BASE_REGISTRY, ...(0, registries_1.readRegistriesConfig)().map((r) => r.name)];
+    return Array.from(new Set(names));
 }
 function assertKnownRegistry(name) {
     const known = knownRegistryNames();
@@ -28,17 +45,20 @@ function setPin(name, version) {
     }
     const normalized = (0, versioning_1.normalizePin)(version);
     const prefs = (0, config_1.getPreferences)();
-    prefs.pins = { ...(prefs.pins ?? {}), [name]: normalized };
+    // Se persiste bajo el nombre REAL del registry; si no, el pin queda en una
+    // clave que el resolutor de versiones nunca consulta.
+    prefs.pins = { ...(prefs.pins ?? {}), [canonicalRegistryName(name)]: normalized };
     (0, config_1.savePreferences)(prefs);
     return normalized;
 }
 /** Borra pins[name]; devuelve true si existía. */
 function removePin(name) {
     assertKnownRegistry(name);
+    const key = canonicalRegistryName(name);
     const prefs = (0, config_1.getPreferences)();
-    if (!prefs.pins || !(name in prefs.pins))
+    if (!prefs.pins || !(key in prefs.pins))
         return false;
-    delete prefs.pins[name];
+    delete prefs.pins[key];
     (0, config_1.savePreferences)(prefs);
     return true;
 }

package/dist/src/commands/preflight/checks.js

@@ -130,8 +130,9 @@ function checkTools(cwd) {
 /**
  * A manifest pinned to `generic` on a tree that clearly has a stack means the real
  * sensors for that stack are simply absent — the gate runs, reports green, and has
- * checked almost nothing. `runSensors` self-heals this at run time via `reconcilePack`,
- * but only when a registry is reachable; saying it out loud here costs nothing.
+ * checked almost nothing. Nothing heals this on its own: `awm sensors run` reports the
+ * same drift (`packDrift`) but never rewrites the manifest, so this is the blocking
+ * surface, and `awm sensors init` is the only thing that adopts the real pack.
  */
 function checkPack(cwd, manifest) {
     if (!manifest)

package/dist/src/commands/registry/add.js

@@ -38,7 +38,7 @@ async function addRegistry(remote, nameOverride) {
     if (fs_1.default.existsSync(dest)) {
         return { ok: false, name, error: `Destination already exists on disk: ${dest}` };
     }
-    fs_1.default.mkdirSync(registries_1.REGISTRIES_DIR, { recursive: true });
+    fs_1.default.mkdirSync((0, registries_1.registriesDir)(), { recursive: true });
     try {
         await (0, simple_git_1.default)().clone(remote, dest);
     }

package/dist/src/commands/sensors/index.js

@@ -52,6 +52,13 @@ function registerSensorsCommand(program) {
         try {
             const result = (0, init_1.initSensors)({ configure: opts.configure, registryRoot, pack: opts.pack });
             prompts_1.log.success(`Detected: ${result.detection.pack} (${result.detection.indicators.join(', ') || 'fallback'})`);
+            // Said BEFORE "Wrote .awm/sensors.json": the manifest about to be
+            // reported as written is not the one the detection implied.
+            if (result.unavailablePack) {
+                prompts_1.log.warn(`No '${result.unavailablePack}' sensor-pack in the registry — wrote the `
+                    + `'${result.manifest.pack}' pack instead (${Object.keys(result.manifest.sensors).length} sensors). `
+                    + 'Run `awm update`, or add a registry that ships it, then re-run `awm sensors init`.');
+            }
             prompts_1.log.success('Wrote .awm/sensors.json');
             result.configured.forEach((f) => prompts_1.log.info(`  Installed ${f}`));
         }

package/dist/src/commands/sensors/init.js

@@ -120,6 +120,44 @@ function buildManifest(pack, existing, registryRoot, cwd = process.cwd()) {
     }
     return { pack, sensors };
 }
+/** Pack names present as directories under `<registryRoot>/sensor-packs/`, sorted. */
+function availablePacks(registryRoot) {
+    const packsDir = path_1.default.join(registryRoot, 'sensor-packs');
+    if (!fs_1.default.existsSync(packsDir) || !fs_1.default.statSync(packsDir).isDirectory())
+        return [];
+    return fs_1.default.readdirSync(packsDir, { withFileTypes: true })
+        .filter(e => e.isDirectory())
+        .map(e => e.name)
+        .sort();
+}
+/** The last-resort pack, used when the detected one is absent from the registry. */
+const FALLBACK_PACK = 'generic';
+/**
+ * Resolve the detected pack against what the registry actually ships.
+ *
+ * `--pack <name>` has always thrown here (`assertPackExists`), but auto-detection had
+ * no such check: it wrote `{"pack":"python","sensors":{}}` and said nothing, so the
+ * operator learned the gate was empty from an unrelated command days later. The two
+ * paths now reach the same conclusion; only the remedy differs, because an explicit
+ * `--pack` is a typo to correct while a detection is a fact about the tree that the
+ * registry simply cannot serve yet.
+ *
+ * Falling back to `generic` keeps the gate measuring *something* real rather than
+ * nothing. When the registry has no `generic` either, the detected pack is kept: the
+ * manifest is then honestly empty, and preflight's `manifest`/`tools` checks both fail
+ * on `total === 0` with a remedy pointing at the registry.
+ */
+function resolvePack(detected, registryRoot) {
+    if (!registryRoot)
+        return { pack: detected }; // nothing to validate against
+    const available = availablePacks(registryRoot);
+    if (available.length === 0 || available.includes(detected))
+        return { pack: detected };
+    return {
+        pack: available.includes(FALLBACK_PACK) ? FALLBACK_PACK : detected,
+        unavailablePack: detected,
+    };
+}
 /**
  * Validate that `pack` exists as a directory under `<registryRoot>/sensor-packs/`.
  * Throws (not a swallow-and-return) so `awm sensors init --pack bogus` actually stops
@@ -131,10 +169,7 @@ function assertPackExists(pack, registryRoot) {
     if (!fs_1.default.existsSync(packsDir) || !fs_1.default.statSync(packsDir).isDirectory()) {
         throw new Error('registry has no sensor-packs directory');
     }
-    const available = fs_1.default.readdirSync(packsDir, { withFileTypes: true })
-        .filter(e => e.isDirectory())
-        .map(e => e.name)
-        .sort();
+    const available = availablePacks(registryRoot);
     if (!available.includes(pack)) {
         throw new Error(`pack '${pack}' not found in registry (available: ${available.join(', ')})`);
     }
@@ -163,14 +198,20 @@ function initSensors(opts = {}) {
         }
         catch { /* ignore corrupt manifest */ }
     }
-    const manifest = buildManifest(detection.pack, existing, opts.registryRoot, cwd);
+    // `detection` keeps saying what the tree IS; `pack` is what the registry can serve
+    // for it. They diverge only when the registry lacks the detected pack.
+    const { pack: resolvedPack, unavailablePack } = resolvePack(detection.pack, opts.registryRoot);
+    const manifest = buildManifest(resolvedPack, existing, opts.registryRoot, cwd);
     fs_1.default.mkdirSync(path_1.default.join(cwd, '.awm'), { recursive: true });
     const tmpPath = manifestPath + '.tmp';
     fs_1.default.writeFileSync(tmpPath, JSON.stringify(manifest, null, 2), 'utf-8');
     fs_1.default.renameSync(tmpPath, manifestPath);
     const configured = [];
     if (configure && opts.registryRoot) {
-        const packDir = path_1.default.join(opts.registryRoot, 'sensor-packs', detection.pack);
+        // The pack whose defaults the manifest was actually built from — copying the
+        // detected pack's config files here would drop files for sensors that are not
+        // in the manifest, and miss the ones that are.
+        const packDir = path_1.default.join(opts.registryRoot, 'sensor-packs', resolvedPack);
         if (fs_1.default.existsSync(packDir)) {
             for (const file of fs_1.default.readdirSync(packDir).filter(f => f !== 'pack.json')) {
                 const dst = path_1.default.join(cwd, file);
@@ -181,5 +222,5 @@ function initSensors(opts = {}) {
             }
         }
     }
-    return { manifest, detection, configured };
+    return { manifest, detection, configured, ...(unavailablePack ? { unavailablePack } : {}) };
 }

package/dist/src/commands/sensors/install.js

@@ -8,21 +8,30 @@ exports.uninstallSensorHook = uninstallSensorHook;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../../core/paths");
+const shared_1 = require("../hooks/shared");
+const atomic_file_1 = require("../../core/atomic-file");
+const providers_1 = require("../../providers");
 const POST_TOOL_USE_EVENT = 'PostToolUse';
 const POST_TOOL_USE_MATCHER = 'Write|Edit|MultiEdit';
 const AWM_SENSOR_CMD = 'awm sensors run --fast';
 function defaultSettingsPath() {
-    return path_1.default.join((0, paths_1.homeDir)(), '.claude', 'settings.json');
+    // Se toma de la config del provider, no de una ruta hardcodeada: era la
+    // cuarta copia de este path en el codigo.
+    return (0, providers_1.getSettingsMergeHookConfig)('claude-code').settingsPath;
 }
+/** Lectura ESTRICTA, compartida con los demas escritores de este archivo.
+ *
+ *  Antes esto era `try { JSON.parse(...) } catch { return {} }` y el `{}` se
+ *  escribia de vuelta — asi que un JSON malformado (una coma de mas, el error
+ *  de edicion a mano mas comun) BORRABA el settings.json entero del usuario y
+ *  la operacion reportaba exito. Verificado destruyendo `model`, `permissions`
+ *  y el propio hook SessionStart de AWM. El escritor hermano
+ *  (`installClaudeHook`) ya se negaba correctamente ante el mismo archivo.
+ *
+ *  AWM hace MERGE sobre archivos que son del usuario; nunca los clobberea. Ante
+ *  un archivo que no se puede parsear, la unica accion segura es negarse. */
 function readSettings(p) {
-    if (!fs_1.default.existsSync(p))
-        return {};
-    try {
-        return JSON.parse(fs_1.default.readFileSync(p, 'utf-8'));
-    }
-    catch {
-        return {};
-    }
+    return (0, shared_1.readStrictJson)(p);
 }
 function isAwmEntry(e) {
     return e.matcher === POST_TOOL_USE_MATCHER &&
@@ -56,7 +65,7 @@ function installSensorHook(settingsPath = defaultSettingsPath()) {
         },
     };
     fs_1.default.mkdirSync(path_1.default.dirname(settingsPath), { recursive: true });
-    fs_1.default.writeFileSync(settingsPath, JSON.stringify(updated, null, 2), 'utf-8');
+    (0, atomic_file_1.writeFileAtomic)(settingsPath, `${JSON.stringify(updated, null, 2)}\n`);
     return { status: 'installed', backupPath };
 }
 function uninstallSensorHook(settingsPath = defaultSettingsPath()) {
@@ -72,6 +81,6 @@ function uninstallSensorHook(settingsPath = defaultSettingsPath()) {
         delete updated.hooks[POST_TOOL_USE_EVENT];
     if (Object.keys(updated.hooks).length === 0)
         delete updated.hooks;
-    fs_1.default.writeFileSync(settingsPath, JSON.stringify(updated, null, 2), 'utf-8');
+    (0, atomic_file_1.writeFileAtomic)(settingsPath, `${JSON.stringify(updated, null, 2)}\n`);
     return { status: 'removed' };
 }

package/dist/src/commands/sensors/run.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyBaseline = applyBaseline;
-exports.reconcilePack = reconcilePack;
+exports.detectPackDrift = detectPackDrift;
 exports.findManifestDir = findManifestDir;
 exports.resolveConcurrency = resolveConcurrency;
 exports.runSensors = runSensors;
@@ -22,8 +22,9 @@ const ruff_1 = require("./formatters/ruff");
 const shellcheck_1 = require("./formatters/shellcheck");
 const baseline_1 = require("./baseline");
 const changed_1 = require("./changed");
+// Solo `detectStack` (puro, lee el arbol) — NO `initSensors`, que escribe. `run` es un
+// verbo de lectura: no debe tener a mano ninguna funcion capaz de mutar el proyecto.
 const init_1 = require("./init");
-const registries_1 = require("../../core/registries");
 const paths_1 = require("../../core/paths");
 const MANIFEST_FILE = '.awm/sensors.json';
 const DEFAULT_FAST_TIMEOUT = 10_000;
@@ -67,31 +68,32 @@ function readManifest(cwd) {
     }
 }
 /**
- * Upgrade-only, idempotent pack reconciliation. If the manifest sits on the
- * `generic` fallback but the tree now has real stack indicators (package.json,
- * pyproject.toml…), re-detect and rebuild via initSensors — which merges existing
- * custom sensors and copies the pack's config files. Never downgrades, never
- * touches a real pack. FS/registry failures degrade to a no-op (the honest floor
- * in runSensors covers the gap).
+ * Detect — and only detect — that the manifest's pack no longer describes the tree:
+ * it sits on the `generic` fallback while real stack indicators (package.json,
+ * pyproject.toml, a root `*.sh`…) are present, so the gate is measuring almost
+ * nothing. Pure: reads the tree, writes nothing, consults no registry.
+ *
+ * It used to *heal* this, by calling `initSensors(..., configure: true)` — which
+ * overwrites the committed `.awm/sensors.json` and copies the pack's config files
+ * into the project root. That made `awm sensors run`, a read verb, leave a dirty
+ * working tree, and swapped in sensors whose tools the project never installed
+ * (one root `deploy.sh` pulls in the whole shell pack), turning a green run red.
+ * Rewriting the manifest is `awm sensors init`'s job — the verb whose name says so.
+ * Here the drift is only named: reported as `packDrift` on the run's own output,
+ * and failed on by preflight's `pack` check.
  */
-function reconcilePack(manifestDir, manifest, registryRoot) {
-    if (manifest.pack !== 'generic') {
-        const detection = (0, init_1.detectStack)(manifestDir);
-        return { manifest, detection };
-    }
+function detectPackDrift(manifestDir, manifest) {
     const detection = (0, init_1.detectStack)(manifestDir);
-    if (detection.pack === 'generic')
-        return { manifest, detection }; // truly generic — stay honest
-    const root = registryRoot ?? (0, registries_1.capabilityRoot)('sensor-packs');
-    if (!root || !fs_1.default.existsSync(root))
-        return { manifest, detection }; // can't rebuild without registry
-    try {
-        const { manifest: rebuilt } = (0, init_1.initSensors)({ cwd: manifestDir, registryRoot: root, configure: true });
-        return { manifest: rebuilt, upgradedFrom: 'generic', detection };
-    }
-    catch {
-        return { manifest, detection }; // never abort the run on a reconcile failure
-    }
+    if (manifest.pack !== 'generic' || detection.pack === 'generic')
+        return { detection };
+    return {
+        detection,
+        drift: {
+            manifest: manifest.pack,
+            detected: detection.pack,
+            remedy: `run \`awm sensors init\` to adopt the '${detection.pack}' pack for this stack`,
+        },
+    };
 }
 /**
  * Walk up from `startCwd` looking for the nearest ancestor that contains
@@ -280,8 +282,8 @@ async function runSensors(opts = {}) {
     const manifest = readManifest(manifestDir);
     if (!manifest)
         return { sensors: [], overall: 'not_certified' };
-    const reconciled = reconcilePack(manifestDir, manifest);
-    const activeManifest = reconciled.manifest;
+    const drift = detectPackDrift(manifestDir, manifest);
+    const activeManifest = manifest; // el manifest COMITEADO es lo que se corre; `run` no lo reescribe
     const cwd = manifestDir; // ejecutar sensores y baseline desde donde vive el manifest
     // Baseline suppresses already-accepted findings so sensors fail only on NEW
     // ones (essential on repos with a large pre-existing baseline). Absent file or
@@ -382,13 +384,13 @@ async function runSensors(opts = {}) {
                     : 'pass';
     // Honest floor: a benign-green 'skipped' over a tree that clearly HAS a stack
     // (indicators present) is a false green — the gate ran nothing real. Never green.
-    if (overall === 'skipped' && reconciled.detection.pack !== 'generic') {
+    if (overall === 'skipped' && drift.detection.pack !== 'generic') {
         overall = 'not_certified';
     }
     return {
         sensors: results,
         overall,
-        ...(reconciled.upgradedFrom ? { packUpgraded: `${reconciled.upgradedFrom}→${activeManifest.pack}` } : {}),
+        ...(drift.drift ? { packDrift: drift.drift } : {}),
         // Always emitted on a --changed run, including when the scope failed to
         // resolve: a green that came back from an unscoped fallback and a green from a
         // genuinely scoped run are different claims, and the caller cannot tell them

package/dist/src/commands/sync.js

@@ -24,12 +24,27 @@ const bundle_install_1 = require("../core/bundle-install");
 const profile_pins_1 = require("../core/profile-pins");
 const config_1 = require("../utils/config");
 const agent_targets_1 = require("../core/agent-targets");
+const skill_integrity_1 = require("../core/skill-integrity");
+const registries_2 = require("../core/registries");
 const defaultDeps = {
     syncRegistries: registries_1.syncRegistries,
     verifyMinCliVersions: registries_1.verifyMinCliVersions,
     verifyProjectPins: profile_pins_1.verifyProjectPins,
     syncProfile: bundle_install_1.syncProfile,
+    reconcileProjectSkillLinks: skill_integrity_1.reconcileProjectSkillLinks,
 };
+/** Un link curado o podado es un cambio en el arbol del usuario: se dice siempre.
+ *  El silencio es lo que dejo este mantenimiento invisible durante todo su ciclo. */
+function reportProjectLinkRepair(results) {
+    for (const { agent, result } of results) {
+        for (const n of result.relinked)
+            console.log(picocolors_1.default.green(`  ↻  Re-linked ${n} (${agent}, project scope)`));
+        for (const n of result.pruned)
+            console.log(picocolors_1.default.yellow(`  ✂  Pruned dangling ${n} (${agent}, project scope)`));
+        for (const n of result.failed)
+            console.warn(picocolors_1.default.yellow(`  ⚠  Could not repair ${n} (${agent}, project scope)`));
+    }
+}
 /** Core, UI-free `awm sync` logic — see `runSync` for the Commander-facing wrapper. */
 async function runSyncCore(options, deps = {}) {
     // Fires at most once per `awm sync` run, native Windows only — the single
@@ -93,6 +108,14 @@ async function runSyncCore(options, deps = {}) {
             return { code: 1, selectedAgents };
         }
     }
+    // Antes de instalar: sanear los links de skills que YA estan en el proyecto. Es lo
+    // simetrico de `stepGlobalSkillsRepair` en `awm init`, que solo cubria el dir
+    // global — un link colgante de proyecto (registry re-clonado, skill renombrada
+    // upstream, bundle sacado del profile) no se curaba ni se podaba nunca. Corre
+    // ANTES del early-return de "sin extensiones": un profile vacio es precisamente el
+    // caso donde quedan huerfanos de una extension retirada, y era el unico camino que
+    // salia sin tocar nada. Solo toca symlinks colgantes (`classifySkillLinks`).
+    reportProjectLinkRepair(d.reconcileProjectSkillLinks(projectRoot, selectedAgents, (0, registries_2.contentRoots)()));
     if (profile.extensions.length === 0) {
         console.log(picocolors_1.default.yellow('No extensions in .awm/profile.json — nothing to sync. Use `awm add <bundle>` first.'));
         return { code: 0, selectedAgents };
@@ -113,5 +136,11 @@ async function runSyncCore(options, deps = {}) {
     const lines = result.installed.map((n) => picocolors_1.default.green(n)).join('\n  ');
     const installedNote = lines ? `\n  ${lines}` : picocolors_1.default.dim(' (all up to date)');
     console.log(`✅ Synced extensions [${result.extensions.join(', ')}]:${installedNote}`);
+    // The transaction id is the ONLY handle `awm backup restore` accepts. It was
+    // computed, returned in `transactionIds`, and then dropped on the floor by every
+    // caller — so the operator who wanted to undo a sync had no name to give it.
+    for (const id of result.transactionIds) {
+        console.log(picocolors_1.default.dim(`  transaction ${id} — undo with \`awm backup restore ${id}\``));
+    }
     return { code: 0, selectedAgents, result };
 }