agentic-workflow-manager 3.13.5 → 3.13.7

package/dist/src/core/diagnostics/context.js

@@ -9,6 +9,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const providers_1 = require("../../providers");
+const registry_1 = require("../renderers/registry");
 const registries_1 = require("../registries");
 const orchestrator_1 = require("../context/orchestrator");
 const status_1 = require("../../commands/hooks/status");
@@ -31,15 +32,29 @@ function linkState(dir, skill) {
         return fs_1.default.existsSync(p) ? 'present' : 'broken';
     return 'present'; // un dir/archivo real también cuenta como presente
 }
-function classifyLinks(skillNames, dir) {
+/** Clasifica artefactos por su presencia en disco.
+ *
+ *  `renderer` NO es opcional a proposito. El escritor (`physicalTarget`) estampa
+ *  la extension del renderer sobre el nombre — `using-awm.mdc`,
+ *  `using-awm.instructions.md` — y este lector buscaba el nombre pelado
+ *  (`using-awm`), asi que para Cursor y Copilot NADA figuraba nunca como
+ *  instalado: `awm init` reinstalaba el baseline completo en cada corrida (2
+ *  directorios de backup sin podar por corrida) y `awm doctor` mostraba un rojo
+ *  permanente cuyo remedio no podia satisfacerlo. Exigir el renderer obliga a
+ *  cada caller a declarar de que artefacto habla, y `renderedFilename` es la
+ *  misma funcion que usa el escritor — no pueden volver a discrepar.
+ *
+ *  Los nombres devueltos son los LOGICOS (los de entrada), no los fisicos: los
+ *  consumidores comparan contra listas de nombres de bundle. */
+function classifyLinks(names, dir, renderer) {
     const linked = [];
     const broken = [];
-    for (const s of skillNames) {
-        const st = linkState(dir, s);
+    for (const name of names) {
+        const st = linkState(dir, (0, registry_1.renderedFilename)(name, renderer));
         if (st === 'present')
-            linked.push(s);
+            linked.push(name);
         else if (st === 'broken')
-            broken.push(s);
+            broken.push(name);
     }
     return { linked, broken };
 }
@@ -91,7 +106,7 @@ function gatherContextInjection() {
     }
     return out;
 }
-function gatherMachine(bundles, agent = 'claude-code') {
+function gatherMachine(bundles, agent = 'claude-code', projectRoot) {
     // registryCache: estado del primer registry configurado (baseline en una máquina sembrada)
     const regs = (0, registries_1.listRegistries)();
     const first = regs[0];
@@ -105,21 +120,33 @@ function gatherMachine(bundles, agent = 'claude-code') {
     // caught while building this task's real end-to-end init test).
     let hookPresent = false;
     let hookDegraded = false;
-    try {
-        const hs = (0, status_1.computeHookStatus)(agent);
-        hookPresent = hs.checks.settingsEntry.ok;
-        hookDegraded = hs.overall === 'DEGRADED';
+    // La aplicabilidad se computa DONDE el provider esta en alcance, no se
+    // infiere de que `computeHookStatus` haya tirado (un throw puede ser "no
+    // soporta hooks" o un error real, y confundirlos fue el bug).
+    const hookApplicable = (0, providers_1.providerFor)(agent).hooks !== undefined;
+    if (hookApplicable) {
+        try {
+            const hs = (0, status_1.computeHookStatus)(agent);
+            hookPresent = hs.checks.settingsEntry.ok;
+            hookDegraded = hs.overall === 'DEGRADED';
+        }
+        catch { /* soporta hooks pero no se pudo leer el estado → ausente */ }
     }
-    catch { /* sin soporte de hooks → ausente */ }
     // devCore (bundle baseline) — skillsDir is null only for providers with no global skill
     // discovery mechanism (today: Copilot); for those, there is no global-scope devCore
     // concept to satisfy at all, so it's treated as trivially satisfied (see below).
     const skillsDir = (0, providers_1.providerFor)(agent).skill.global;
-    const baseline = bundles.find((b) => b.scope === 'baseline');
+    // TODOS los baseline, igual que `stepDevCore` los instala y que
+    // `reconciliation.ts` los reconcilia. Con `find`, el hecho que decide si el
+    // baseline esta satisfecho miraba solo el primero, asi que un segundo bundle
+    // baseline sin instalar reportaba `healthy` — y el step, que lee este mismo
+    // hecho, nunca lo instalaba.
+    const baselines = bundles.filter((b) => b.scope === 'baseline');
+    const baseline = baselines[0];
     let devCorePresent = false;
     let brokenLinks = [];
     if (baseline) {
-        const skillNames = (0, bundles_1.resolveBundleSkills)(baseline.name, bundles);
+        const skillNames = [...new Set(baselines.flatMap((b) => (0, bundles_1.resolveBundleSkills)(b.name, bundles)))];
         if (skillsDir === null) {
             // No global skill directory for this agent (today: Copilot) — there is no
             // global-scope devCore/baseline-bundle concept to satisfy for it at all, so
@@ -131,10 +158,28 @@ function gatherMachine(bundles, agent = 'claude-code') {
             // (init/steps.ts) would fall through on every run and call installBundle at
             // global scope, which throws (skill.global === null), rolling back the
             // ENTIRE `awm init -a copilot` transaction, 100% of the time.
-            devCorePresent = true;
+            // Sin directorio global de skills (hoy: Copilot) el baseline se
+            // instala a nivel PROYECTO — `stepDevCore` lo hace con
+            // scopeOverride 'local'. Antes esto se declaraba "trivialmente
+            // satisfecho" incondicionalmente: eso evitaba el crash-loop del
+            // install global, pero significaba que Copilot terminaba con CERO
+            // skills mientras init imprimia `✔ dev-core` y doctor decia
+            // `healthy`. Ahora se mira donde el artefacto REALMENTE va.
+            if (projectRoot) {
+                const localDir = path_1.default.join(projectRoot, (0, providers_1.providerFor)(agent).skill.local);
+                const { linked, broken } = classifyLinks(skillNames, localDir, (0, providers_1.providerFor)(agent).skill.renderer);
+                const absent = skillNames.filter((s) => !linked.includes(s) && !broken.includes(s));
+                devCorePresent = skillNames.length > 0 && (linked.length + broken.length) > 0;
+                brokenLinks = [...broken, ...absent];
+            }
+            else {
+                // Fuera de un proyecto no hay destino local: no hay nada que
+                // reclamar como faltante.
+                devCorePresent = true;
+            }
         }
         else {
-            const { linked, broken } = classifyLinks(skillNames, skillsDir);
+            const { linked, broken } = classifyLinks(skillNames, skillsDir, (0, providers_1.providerFor)(agent).skill.renderer);
             const absent = skillNames.filter((s) => !linked.includes(s) && !broken.includes(s));
             devCorePresent = skillNames.length > 0 && (linked.length + broken.length) > 0;
             brokenLinks = [...broken, ...absent];
@@ -151,12 +196,24 @@ function gatherMachine(bundles, agent = 'claude-code') {
         // (tests/integration/codex-provider-isolated.test.ts).
         const agentConfig = (0, providers_1.providerFor)(agent).agent;
         if (agentConfig && agentConfig.global !== null) {
-            const agentNames = (0, bundles_1.resolveBundleAgents)(baseline.name, bundles);
+            const agentNames = [...new Set(baselines.flatMap((b) => (0, bundles_1.resolveBundleAgents)(b.name, bundles)))];
             if (agentNames.length > 0) {
-                const filenames = agentNames.map((n) => agentConfig.renderer === 'codex-agent-toml' ? `${n}.toml` : n);
-                const { linked: agentLinked, broken: agentBroken } = classifyLinks(filenames, agentConfig.global);
+                // El installName real de un artefacto `agent` es `<n>.md`
+                // (bundle-install.ts), y el renderer decide la extension final:
+                // `.toml` para codex, `.md` tal cual para los renderers `link`.
+                // El ternario anterior devolvia `n` pelado para `link`, asi que
+                // `machine.devCore` quedaba permanentemente roto para
+                // claude-code — el provider por DEFECTO — contra el registry real.
+                const filenames = agentNames.map((n) => `${n}.md`);
+                const { linked: agentLinked, broken: agentBroken } = classifyLinks(filenames, agentConfig.global, agentConfig.renderer);
                 const agentAbsent = filenames.filter((f) => !agentLinked.includes(f) && !agentBroken.includes(f));
-                brokenLinks = [...brokenLinks, ...agentBroken, ...agentAbsent];
+                // `brokenLinks` es de diagnostico: se le muestra al usuario para
+                // que vaya a buscar ese archivo. Por eso se reportan los nombres
+                // FISICOS (`development-process.toml`), aunque la clasificacion
+                // trabaje con los logicos — que es lo que necesitan las
+                // comparaciones por cantidad de arriba.
+                const physical = (n) => (0, registry_1.renderedFilename)(n, agentConfig.renderer);
+                brokenLinks = [...brokenLinks, ...agentBroken.map(physical), ...agentAbsent.map(physical)];
             }
         }
     }
@@ -183,17 +240,17 @@ function gatherMachine(bundles, agent = 'claude-code') {
         const skillNames = (0, bundles_1.resolveBundleSkills)(name, bundles);
         if (skillNames.length === 0)
             return false;
-        const { linked } = classifyLinks(skillNames, skillsDir);
+        const { linked } = classifyLinks(skillNames, skillsDir, (0, providers_1.providerFor)(agent).skill.renderer);
         return linked.length === skillNames.length;
     });
     return {
         registryCache: { present: cachePresent, gitState },
-        hook: { present: hookPresent, degraded: hookDegraded },
+        hook: { present: hookPresent, degraded: hookDegraded, applicable: hookApplicable },
         devCore: { present: devCorePresent, brokenLinks },
         ambient: { wanted, installed },
         contextInjection: gatherContextInjection(),
         globalSkills: skillsDir !== null
-            ? (0, skill_integrity_1.classifyGlobalSkills)(skillsDir, (0, registries_1.contentRoots)())
+            ? (0, skill_integrity_1.classifySkillLinks)(skillsDir, (0, registries_1.contentRoots)())
             : { valid: [], repairable: [], dead: [] },
     };
 }
@@ -207,7 +264,15 @@ function gatherProject(root, bundles, agent = 'claude-code') {
             if (!expected.includes(s))
                 expected.push(s);
     }
-    const { linked, broken } = classifyLinks(expected, localSkillsDir);
+    const { linked, broken } = classifyLinks(expected, localSkillsDir, (0, providers_1.providerFor)(agent).skill.renderer);
+    // Huerfanos: symlinks colgantes que el profile ya no reclama. Se clasifican sobre
+    // el dir REAL, no sobre la lista esperada — que es justamente lo que `linked`/
+    // `broken` de arriba no pueden ver. `awm sync` los cura o los poda.
+    const orphanScan = (0, skill_integrity_1.classifySkillLinks)(localSkillsDir, (0, registries_1.contentRoots)());
+    const orphanLinks = {
+        repairable: orphanScan.repairable.filter((n) => !expected.includes(n)),
+        dead: orphanScan.dead.filter((n) => !expected.includes(n)),
+    };
     let context = { present: false };
     if (fs_1.default.existsSync(path_1.default.join(root, 'CLAUDE.md')))
         context = { present: true, file: 'CLAUDE.md' };
@@ -217,6 +282,7 @@ function gatherProject(root, bundles, agent = 'claude-code') {
         root,
         profile: { present: profilePresent, extensions: profile.extensions },
         activeBundles: { expected, linked, broken },
+        orphanLinks,
         sensors: { present: fs_1.default.existsSync(path_1.default.join(root, '.awm', 'sensors.json')) },
         constitution: { present: fs_1.default.existsSync(path_1.default.join(root, 'CONSTITUTION.md')) },
         context,
@@ -228,9 +294,9 @@ function gatherContext(opts = {}) {
     const agent = opts.agent ?? 'claude-code';
     const root = (0, profile_1.findProjectRoot)(cwd);
     const agents = opts.agents ?? [agent];
-    const scanSkills = opts.scanSkills ?? ((dir) => (0, skill_integrity_1.classifyGlobalSkills)(dir, (0, registries_1.contentRoots)()));
+    const scanSkills = opts.scanSkills ?? ((dir) => (0, skill_integrity_1.classifySkillLinks)(dir, (0, registries_1.contentRoots)()));
     return {
-        machine: gatherMachine(bundles, agent),
+        machine: gatherMachine(bundles, agent, root ?? undefined),
         project: root ? gatherProject(root, bundles, agent) : null,
         providers: (0, provider_checks_1.gatherProviderChecks)(agents, scanSkills, root ?? undefined),
     };

package/dist/src/core/diagnostics/provider-checks.js

@@ -17,19 +17,12 @@ exports.gatherProviderChecks = gatherProviderChecks;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const providers_1 = require("../../providers");
+const skill_integrity_1 = require("../skill-integrity");
 const provider_version_1 = require("../provider-version");
 const status_1 = require("../../commands/hooks/status");
 const orchestrator_1 = require("../context/orchestrator");
 const registries_1 = require("../registries");
-/** File extension a healthy AWM install actually produces for each non-`'link'` renderer —
- *  used by `skillsGlobalCheck` to require AWM-shaped evidence, not just an arbitrary
- *  non-empty directory (a user's own unrelated file in `~/.cursor/rules` would otherwise
- *  read as `'supported'`). Renderers absent from this map (i.e. `'link'`) never reach the
- *  branch that reads it. */
-const RENDERED_SKILL_EXTENSIONS = {
-    'cursor-mdc': '.mdc',
-    'copilot-instructions': '.instructions.md',
-};
+const registry_1 = require("../renderers/registry");
 /** Structural classification, computed purely from `provider`'s config shape — see
  *  `ProviderTier`'s doc comment in `types.ts` for what each tier means. */
 function providerTier(provider) {
@@ -66,7 +59,7 @@ function binaryVersionCheck(agent) {
  *  `dir` is null — i.e. the provider has no global skill discovery mechanism at all
  *  (today: Copilot, see `globalUnsupportedReason` in providers/index.ts).
  *
- *  `renderer` gates which verification is possible: `classifyGlobalSkills` (via `integrity`)
+ *  `renderer` gates which verification is possible: `classifySkillLinks` (via `integrity`)
  *  only ever sees symlinks — `if (!lst.isSymbolicLink()) continue;` — so for a rendered
  *  format (`cursor-mdc`, `copilot-instructions`) it scans a directory of real files and
  *  finds nothing, which would make `broken` silently read 0 regardless of whether the
@@ -87,7 +80,7 @@ function skillsGlobalCheck(dir, owners, integrity, renderer) {
             // `remediationCode: 'awm-init'` is a worse remedy than none, but this
             // check has no channel to report "can't tell" separately from "absent"
             // (same tradeoff already made by this file's agentsNativeCheck and by
-            // skill-integrity.ts's classifyGlobalSkills — a systemic, pre-existing
+            // skill-integrity.ts's classifySkillLinks — a systemic, pre-existing
             // pattern in this codebase, not introduced here).
             entries = [];
         }
@@ -97,7 +90,12 @@ function skillsGlobalCheck(dir, owners, integrity, renderer) {
         // Still not full integrity verification (a stray file with the right extension but
         // wrong content still passes) — that residual gap is the same honest tradeoff this
         // function's doc comment already accepts for the non-`'link'` branch generally.
-        const ext = RENDERED_SKILL_EXTENSIONS[renderer];
+        // `rendererExtension` (core/renderers/registry.ts) is the ONE table mapping a
+        // renderer to the file it produces. This site used to keep its own partial copy —
+        // the fourth such copy in the codebase, and the exact drift that made a rendered
+        // artifact invisible to the "is it installed" check for a whole release. A new
+        // renderer must not be able to be added without this reading it.
+        const ext = (0, registry_1.rendererExtension)(renderer);
         const present = ext ? entries.some((e) => e.endsWith(ext)) : entries.length > 0;
         return {
             id: 'skills.global',
@@ -165,20 +163,69 @@ function tomlAgentsHealthy(dir, entries) {
  * run (e.g. claude-code-only, opencode-only, antigravity-only) would always render
  * inapplicable rows as red ✖ and `overall` could never be 'healthy'.
  */
+/**
+ * Workflows installed at machine scope. Today only Antigravity declares a `workflow`
+ * config at all (`~/.gemini/antigravity/global_workflows`), and nothing verified it:
+ * `awm init` installed the baseline's workflows there and every diagnostic looked only
+ * at skills and native agents, so a broken or emptied workflow directory reported
+ * `healthy` forever on the one provider that uses it.
+ *
+ * Same N/A discipline as `agentsNativeCheck`: a provider with no workflow config, or a
+ * registry that ships no `workflows/`, emits NO row rather than a red one nobody can
+ * act on — an absent row means "nothing to verify", not "verified fine".
+ */
+function workflowsGlobalCheck(agent) {
+    const provider = (0, providers_1.providerFor)(agent);
+    if (!provider.workflow || provider.workflow.global === null)
+        return null;
+    const dir = provider.workflow.global;
+    let entries;
+    try {
+        entries = fs_1.default.readdirSync(dir);
+    }
+    catch {
+        return null;
+    }
+    if (entries.length === 0)
+        return null;
+    // Los workflows se instalan con el renderer `link`, asi que un symlink colgante es
+    // exactamente la misma clase de rotura que en skills — y se clasifica con la misma
+    // funcion, no con una copia local que pueda divergir.
+    const integrity = (0, skill_integrity_1.classifySkillLinks)(dir, (0, registries_1.contentRoots)());
+    const broken = integrity.repairable.length + integrity.dead.length;
+    return {
+        id: 'workflows.global',
+        state: broken > 0 ? 'broken' : 'healthy',
+        target: dir,
+        detail: broken > 0 ? `${broken} broken link(s)` : undefined,
+        remediationCode: broken > 0 ? 'awm-init' : undefined,
+    };
+}
 function agentsNativeCheck(agent) {
     const provider = (0, providers_1.providerFor)(agent);
     if (!provider.agent || provider.agent.global === null)
         return null;
     const dir = provider.agent.global;
     let entries;
+    // `absent` degrada el estado global, asi que sin `remediationCode` doctor
+    // salia 1 sin decir que hacer — y para un registry que simplemente no trae
+    // `agents/` (lo normal) ese rojo no tiene accion posible. Se reporta como
+    // `unsupported`, que describe la realidad: no hay artefactos nativos que
+    // verificar, y no es culpa de la instalacion.
+    // Un registry que simplemente no trae `agents/` es lo normal, no un defecto
+    // de la instalacion — y no hay accion que el usuario pueda tomar. Antes esto
+    // devolvia `absent`, un estado que DEGRADA, y sin `remediationCode`: doctor
+    // salia 1 mostrando `✖ native agents` sin decir que hacer, justo despues de
+    // un `awm init` exitoso. Cuando no hay nada nativo que verificar, no se
+    // emite fila — el mismo criterio que ya usan los demas casos N/A de aca.
     try {
         entries = fs_1.default.readdirSync(dir);
     }
     catch {
-        return { id: 'agents.native', state: 'absent', target: dir };
+        return null;
     }
     if (entries.length === 0)
-        return { id: 'agents.native', state: 'absent', target: dir };
+        return null;
     if (provider.agent.renderer === 'codex-agent-toml') {
         const { broken } = tomlAgentsHealthy(dir, entries);
         return {
@@ -292,6 +339,7 @@ function gatherProviderChecks(agents, scanSkills, projectRoot) {
             binaryVersionCheck(agent),
             skillsGlobalCheck(dir, owners, integrity, provider.skill.renderer),
             agentsNativeCheck(agent),
+            workflowsGlobalCheck(agent),
             hookTrustCheck(agent),
             contextGlobalCheck(agent, projectRoot),
         ].filter((check) => check !== null);

package/dist/src/core/discovery.js

@@ -94,7 +94,7 @@ function discoverWorkflows(roots = (0, registries_1.contentRoots)()) {
         for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
             if (entry.isDirectory() || !entry.name.endsWith('.md'))
                 continue;
-            const name = entry.name.replace('.md', '');
+            const name = entry.name.replace(/\.md$/, '');
             const filePath = path_1.default.join(dir, entry.name);
             mergeEntry('workflow', byName, {
                 name,
@@ -120,7 +120,7 @@ function discoverAgents(roots = (0, registries_1.contentRoots)()) {
         for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
             if (entry.isDirectory() || !entry.name.endsWith('.md'))
                 continue;
-            const name = entry.name.replace('.md', '');
+            const name = entry.name.replace(/\.md$/, '');
             const filePath = path_1.default.join(dir, entry.name);
             mergeEntry('agent', byName, {
                 name,

package/dist/src/core/init/mutation-targets.js

@@ -17,6 +17,7 @@ exports.planInitMutationTargets = planInitMutationTargets;
 // entry when nothing exists there yet). The one failure mode that matters is
 // under-enumeration: a real write to a path NOT in this list would land
 // outside the backup session and survive a rollback.
+const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const providers_1 = require("../../providers");
 const bundles_1 = require("../bundles");
@@ -40,6 +41,17 @@ function physicalTarget(type, agent, scope, installName, projectRoot) {
         return null;
     }
 }
+/** La forma canonica de un directorio: resuelve symlinks si existe, y si no existe
+ *  todavia devuelve la entrada tal cual — enumerar un destino aun inexistente es
+ *  deliberado en este modulo (un backup vacio no es un problema; no enumerarlo si). */
+function canonicalDir(dir) {
+    try {
+        return fs_1.default.realpathSync(dir);
+    }
+    catch {
+        return dir;
+    }
+}
 function addBundleTargets(targets, bundleName, bundles, agent, scope, projectRoot, contentDir) {
     let intents;
     try {
@@ -72,7 +84,17 @@ function addBundleTargets(targets, bundleName, bundles, agent, scope, projectRoo
  * read the project profile, but never writes).
  */
 function planInitMutationTargets(params) {
-    const { cwd, agent, bundles } = params;
+    const { agent, bundles } = params;
+    // `cwd` canonico ANTES de derivar nada de el. Algunos destinos salen de `cwd` tal
+    // cual y otros de `findProjectRoot(cwd)`, que hace `realpathSync`: mientras las dos
+    // formas coincidan el `Set` deduplica y no se nota, pero en macOS `/var/folders/…`
+    // es un symlink a `/private/var/folders/…` y entonces NO coinciden — la CI de macOS
+    // mostro `AGENTS.md` y `.awm/context/awm-context.md` dos veces, una por forma.
+    //
+    // Esta lista es la que `beginBackupSession` respalda y la que el rollback restaura.
+    // Un archivo con dos entradas es un archivo respaldado dos veces y restaurado dos
+    // veces, en el mecanismo cuyo unico trabajo es dejar el disco como estaba.
+    const cwd = canonicalDir(params.cwd);
     const targets = new Set();
     // preferences.json + the artifact ownership ledger (state/artifacts.json)
     targets.add(path_1.default.join((0, paths_1.awmHome)(), 'preferences.json'));
@@ -110,6 +132,17 @@ function planInitMutationTargets(params) {
     for (const b of machineBundles) {
         addBundleTargets(targets, b.name, bundles, agent, 'global', cwd, contentDir);
     }
+    // Providers whose context injection is itself project-scope (managed-agents-md
+    // with a null globalPath — Cursor, Copilot) write AGENTS.md and the materialized
+    // .awm/context/ file. `stepContextInjection` now refuses to write those without a
+    // discovered project root, but enumerating them against `cwd` unconditionally
+    // costs nothing (a target that goes unwritten is a no-op backup entry, per this
+    // module's opening note) and keeps the guarantee from resting on a single site:
+    // under-enumeration here is the one failure mode that silently defeats rollback.
+    if (injection?.type === 'managed-agents-md' && injection.globalPath === null) {
+        targets.add(path_1.default.join(cwd, path_1.default.basename(injection.localFile)));
+        targets.add((0, materializer_1.projectContextPath)(cwd));
+    }
     // project-level: profile, sensors manifest, project injection, and every
     // extension currently recorded in .awm/profile.json
     const projectRoot = (0, profile_1.findProjectRoot)(cwd);

package/dist/src/core/init/steps.js

@@ -55,6 +55,7 @@ exports.defaultActions = {
         method: o.method,
         projectRoot: o.projectRoot,
         contentDir: o.contentDir,
+        scopeOverride: o.scopeOverride,
     }),
     // Same as installBundle above — defaults to the real applyInstallPlan.
     syncProfile: (o) => (0, bundle_install_1.syncProfile)({
@@ -66,14 +67,21 @@ exports.defaultActions = {
     }),
     initSensors: (o) => {
         const result = (0, init_1.initSensors)({ cwd: o.cwd, registryRoot: o.registryRoot, configure: o.configure });
-        return { detection: result.detection };
+        // `unavailablePack`/`manifest` viajan a proposito: `stepSensors` los reporta.
+        // Este wrapper proyectaba solo `detection`, asi que cualquier hallazgo nuevo de
+        // initSensors moria aca en silencio antes de llegar al step que lo muestra.
+        return {
+            detection: result.detection,
+            manifest: { pack: result.manifest.pack },
+            ...(result.unavailablePack ? { unavailablePack: result.unavailablePack } : {}),
+        };
     },
     addExtension: (root, name) => { (0, profile_1.addExtension)(root, name); },
     ensureProfile: (root) => { (0, profile_1.ensureProfile)(root); },
     gatherProject: (cwd, bundles, agent) => (0, context_1.gatherContext)({ cwd, bundles, agent }).project,
     contextStatus: (op) => realInjectionOrchestrator.contextStatus(op),
     installContext: (op) => { realInjectionOrchestrator.installContext(op); },
-    repairGlobalSkills: (skillsDir, registryContentDirs) => (0, skill_integrity_1.repairGlobalSkills)(skillsDir, registryContentDirs),
+    repairGlobalSkills: (skillsDir, registryContentDirs) => (0, skill_integrity_1.repairSkillLinks)(skillsDir, registryContentDirs),
     injectProjectConstitution: (o) => {
         if ((0, providers_1.getInjection)(o.agent)?.type === 'managed-agents-md') {
             return new codex_agents_1.CodexAgentsStrategy().injectProject(o.projectRoot, (0, providers_1.providerFor)(o.agent), o.agent) === 'injected' ? 'injected' : 'already';
@@ -113,8 +121,12 @@ function failed(id, level, error) {
  * physical operation and simply re-confirms ownership — it does not change
  * the co-owner's installed content.
  */
-function sharedInstallAgents(d) {
-    const group = (0, install_planner_1.agentsSharingSkillTarget)(d.agent, d.enabledAgents, 'global', d.cwd);
+function sharedInstallAgents(d, scope = 'global') {
+    // El scope tiene que ser el MISMO con el que se va a instalar: para un
+    // provider sin directorio global (Copilot) el baseline va a scope local, y
+    // preguntar por el grupo compartido en 'global' devolvia un grupo calculado
+    // sobre un destino que para el no existe.
+    const group = (0, install_planner_1.agentsSharingSkillTarget)(d.agent, d.enabledAgents, scope, d.cwd);
     return group.includes(d.agent) ? group : [d.agent, ...group];
 }
 /**
@@ -188,18 +200,34 @@ function stepDevCore(d) {
     if (devCore.present && devCore.brokenLinks.length === 0) {
         return ok('machine.devCore', 'machine', 'skipped');
     }
-    // Find the baseline bundle (there may be several; pick first baseline)
-    const baselineBundle = d.bundles.find((b) => b.scope === 'baseline');
-    const bundleName = baselineBundle?.name ?? 'dev';
-    d.actions.installBundle({
-        bundleName,
-        bundles: d.bundles,
-        agents: sharedInstallAgents(d),
-        method: d.installMethod,
-        projectRoot: d.cwd,
-        contentDir: d.contentDir,
-    });
-    return ok('machine.devCore', 'machine', 'applied');
+    // TODOS los bundles baseline, no el primero. `scope: 'baseline'` es una propiedad
+    // que un bundle TIENE, no un lugar que solo uno puede ocupar — y
+    // `reconciliation.ts` (`awm update`) siempre los filtro todos. Con `find` aca, un
+    // registry con dos baselines instalaba uno en `awm init` y aparecia el segundo, de
+    // la nada, en el siguiente `awm update`; nada antes lo habia reportado como
+    // faltante. El fallback a 'dev' se conserva para un registry sin ningun baseline.
+    const baselineNames = d.bundles.filter((b) => b.scope === 'baseline').map((b) => b.name);
+    const toInstall = baselineNames.length > 0 ? baselineNames : ['dev'];
+    // Un provider sin directorio global de skills (hoy: Copilot) no tiene donde
+    // poner el baseline a nivel maquina — y el hecho `devCore` lo reporta como
+    // "trivialmente satisfecho" para no volver a intentar un install global
+    // condenado a tirar. Pero nada instalaba nunca nada en su lugar: Copilot
+    // terminaba con CERO skills mientras `awm init` imprimia `✔ dev-core` y
+    // `awm doctor` decia `healthy`. Su propio `globalUnsupportedReason` ya dice
+    // que hay que instalar por proyecto, asi que eso es lo que se hace.
+    const localOnly = (0, providers_1.providerFor)(d.agent).skill.global === null;
+    for (const bundleName of toInstall) {
+        d.actions.installBundle({
+            bundleName,
+            bundles: d.bundles,
+            agents: sharedInstallAgents(d, localOnly ? 'local' : 'global'),
+            method: d.installMethod,
+            projectRoot: d.cwd,
+            contentDir: d.contentDir,
+            ...(localOnly ? { scopeOverride: 'local' } : {}),
+        });
+    }
+    return ok('machine.devCore', 'machine', 'applied', localOnly ? 'installed at project scope (no global skill dir)' : undefined);
 }
 /** Step 3.5 – Repair broken global skill symlinks (orphans outside the baseline). */
 function stepGlobalSkillsRepair(d) {
@@ -294,7 +322,14 @@ function stepSensors(d) {
         return ok('project.sensors', 'project', 'skipped', 'no project');
     if (proj.sensors.present)
         return ok('project.sensors', 'project', 'skipped');
-    d.actions.initSensors({ cwd: proj.root, registryRoot: d.sensorPacksRoot, configure: true });
+    const res = d.actions.initSensors({ cwd: proj.root, registryRoot: d.sensorPacksRoot, configure: true });
+    // A registry without the detected pack yields a fallback (or empty) manifest. The
+    // step still succeeded — a manifest was written — but reporting a bare 'applied'
+    // would let `awm init` hand back a quality gate that measures less than the
+    // operator has any reason to expect. Say which pack was missing, here, once.
+    if (res.unavailablePack) {
+        return ok('project.sensors', 'project', 'applied', `registry has no '${res.unavailablePack}' sensor-pack — wrote '${res.manifest?.pack ?? 'fallback'}' instead; run \`awm update\``);
+    }
     return ok('project.sensors', 'project', 'applied');
 }
 /** Step 8 – Signal that the agent should run the project-constitution skill. */
@@ -348,8 +383,24 @@ function stepContextInjection(d) {
     // AGENTS.md backup target via the same findProjectRoot(cwd) call, so using d.cwd here
     // whenever it differs from the walked-up project root (e.g. `awm init` run from a
     // subdirectory) would write to a path the backup session never snapshotted — a failed
-    // init couldn't roll it back. Falls back to d.cwd only when there's no discovered
-    // project yet, matching this op's own pre-existing behavior in that case.
+    // init couldn't roll it back.
+    //
+    // The `?? d.cwd` fallback below is the legitimate case: a provider whose ONLY
+    // delivery channel is project-scope (Copilot), run in a directory the user means
+    // as their project but which carries no marker yet (no .git, no package.json).
+    // Removing it would leave Copilot with no context at all there. What made it a bug
+    // was that mutation-targets.ts enumerated the AGENTS.md / .awm/context/ backup
+    // targets only inside `if (projectRoot)`, so this write landed outside the backup
+    // session and survived a rollback that reported a clean restore. That is fixed
+    // where it belongs — in the enumeration, which now covers `cwd` unconditionally
+    // for these providers.
+    //
+    // `--machine-only` is the case that genuinely must not write. It nulls
+    // `ctx.project` on purpose, and this MACHINE-level step read that as "no project
+    // found" and wrote into cwd anyway — under the one flag that promises not to.
+    if (scope === 'local' && d.machineOnly) {
+        return ok('machine.contextInjection', 'machine', 'skipped', `${(0, providers_1.providerFor)(d.agent).label} delivers context at project scope — skipped by --machine-only`);
+    }
     const op = {
         agent: d.agent,
         scope,