agentic-workflow-manager 3.13.5 → 3.13.7

package/dist/src/core/skill-integrity.js

@@ -3,12 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.classifyGlobalSkills = classifyGlobalSkills;
-exports.repairGlobalSkills = repairGlobalSkills;
+exports.classifySkillLinks = classifySkillLinks;
+exports.repairSkillLinks = repairSkillLinks;
 exports.reconcileAllSkillLinks = reconcileAllSkillLinks;
+exports.reconcileProjectSkillLinks = reconcileProjectSkillLinks;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const providers_1 = require("../providers");
+const paths_1 = require("./paths");
 function findRegistrySkillPath(registryContentDirs, name) {
     for (const root of registryContentDirs) {
         const p = path_1.default.join(root, 'skills', name);
@@ -17,8 +19,11 @@ function findRegistrySkillPath(registryContentDirs, name) {
     }
     return null;
 }
-/** Clasifica cada entrada de `skillsDir` (read-only, no muta nada). */
-function classifyGlobalSkills(skillsDir, registryContentDirs) {
+/** Clasifica cada entrada de `skillsDir` (read-only, no muta nada).
+ *  Agnostico al alcance: `skillsDir` es global (`provider.skill.global`) o de
+ *  proyecto (`<projectRoot>/<provider.skill.local>`) — el nombre decia "Global" y
+ *  eso basto para que nadie lo apuntara nunca a un dir de proyecto. */
+function classifySkillLinks(skillsDir, registryContentDirs) {
     const out = { valid: [], repairable: [], dead: [] };
     let entries;
     try {
@@ -51,10 +56,11 @@ function classifyGlobalSkills(skillsDir, registryContentDirs) {
     return out;
 }
 /** Re-linkea los repairable al primer root que tenga la skill y poda los dead. Idempotente. Cada
- *  symlink aislado en try/catch — una falla no aborta el resto. */
-function repairGlobalSkills(skillsDir, registryContentDirs) {
+ *  symlink aislado en try/catch — una falla no aborta el resto. Agnostico al alcance:
+ *  ver la nota de `classifySkillLinks`. */
+function repairSkillLinks(skillsDir, registryContentDirs) {
     const result = { relinked: [], pruned: [], failed: [] };
-    const { repairable, dead } = classifyGlobalSkills(skillsDir, registryContentDirs);
+    const { repairable, dead } = classifySkillLinks(skillsDir, registryContentDirs);
     for (const name of repairable) {
         const p = path_1.default.join(skillsDir, name);
         try {
@@ -63,8 +69,35 @@ function repairGlobalSkills(skillsDir, registryContentDirs) {
                 result.failed.push(name);
                 continue;
             }
-            fs_1.default.rmSync(p, { force: true });
-            fs_1.default.symlinkSync(target, p, 'dir');
+            // Dos correcciones, ambas criticas en Windows:
+            //
+            // 1. `'junction'` en win32, no `'dir'`. Un symlink de directorio
+            //    exige SeCreateSymbolicLinkPrivilege, denegado por defecto en
+            //    cuentas sin privilegios (incluido el runner windows-latest);
+            //    una junction la puede crear cualquiera y libuv la reporta
+            //    igual. `executor.ts` ya documenta esto en extenso — este sitio
+            //    nunca recibio el fix.
+            //
+            // 2. Se crea el link NUEVO antes de retirar el viejo. Antes el
+            //    `rmSync` iba primero, asi que en Windows el link se borraba y
+            //    la recreacion fallaba: el usuario quedaba PEOR que antes, y
+            //    con la entrada ya ausente el proximo `awm init` ni siquiera
+            //    podia verla como reparable. Un fallo ahora deja el estado
+            //    original intacto.
+            const staged = path_1.default.join(skillsDir, `.${name}.${process.pid}.relink`);
+            try {
+                fs_1.default.rmSync(staged, { recursive: true, force: true });
+                fs_1.default.symlinkSync(target, staged, (0, paths_1.isWindowsNative)() ? 'junction' : 'dir');
+                fs_1.default.rmSync(p, { recursive: true, force: true });
+                fs_1.default.renameSync(staged, p);
+            }
+            finally {
+                // El staging jamas debe sobrevivir a esta iteracion: si quedara,
+                // `classifySkillLinks` lo veria como un symlink valido (apunta
+                // al registry, que existe) y nunca lo clasificaria como muerto,
+                // asi que se quedaria en el directorio para siempre.
+                fs_1.default.rmSync(staged, { recursive: true, force: true });
+            }
             result.relinked.push(name);
         }
         catch {
@@ -92,7 +125,35 @@ function reconcileAllSkillLinks(registryContentDirs) {
         const skillsDir = (0, providers_1.providerFor)(agent).skill.global;
         if (skillsDir === null || !fs_1.default.existsSync(skillsDir))
             continue;
-        out.push({ agent, result: repairGlobalSkills(skillsDir, registryContentDirs) });
+        out.push({ agent, result: repairSkillLinks(skillsDir, registryContentDirs) });
+    }
+    return out;
+}
+/**
+ * El equivalente de `reconcileAllSkillLinks` para el alcance de PROYECTO: reconcilia
+ * los symlinks de skills bajo `<projectRoot>/<provider.skill.local>` de cada agente
+ * pedido. Es la mitad que faltaba — todo lo de arriba servia igual para un dir local,
+ * pero ningun llamador lo apuntaba ahi, asi que un link colgante de proyecto no se
+ * curaba, no se podaba y no se reportaba en ninguna superficie. Para Copilot
+ * (`skill.global === null`) esto no era una mitad sino el total: TODAS sus skills son
+ * de proyecto.
+ *
+ * Un dir inexistente se omite (no hay nada que reconciliar y crearlo seria instalar,
+ * no reparar). Solo toca symlinks colgantes: los archivos y directorios reales del
+ * usuario, y los links vivos, quedan intactos — ver `classifySkillLinks`.
+ */
+function reconcileProjectSkillLinks(projectRoot, agents, registryContentDirs) {
+    const out = [];
+    const seen = new Set();
+    for (const agent of agents) {
+        // Varios providers comparten dir local (opencode y codex → `.agents/skills`).
+        // Reconciliar dos veces el mismo dir reportaria las mismas curaciones por
+        // duplicado, y la segunda pasada las veria ya sanas: se hace una sola vez.
+        const skillsDir = path_1.default.join(projectRoot, (0, providers_1.providerFor)(agent).skill.local);
+        if (seen.has(skillsDir) || !fs_1.default.existsSync(skillsDir))
+            continue;
+        seen.add(skillsDir);
+        out.push({ agent, result: repairSkillLinks(skillsDir, registryContentDirs) });
     }
     return out;
 }

package/dist/src/core/update-check.js

@@ -21,6 +21,18 @@ const picocolors_1 = __importDefault(require("picocolors"));
 const prompts_1 = require("@clack/prompts");
 const cli_version_1 = require("./cli-version");
 const versioning_1 = require("./versioning");
+/** El aviso de actualizacion es cosmetico: una version ilegible (de la cache o
+ *  del registro de npm) no debe romper el comando que el usuario pidio — solo
+ *  se omite el aviso. El gate de `minCliVersion`, en cambio, falla CERRADO
+ *  (ver verifyMinCliVersions). */
+function isNewer(a, b) {
+    try {
+        return (0, versioning_1.compareSemver)(a, b) > 0;
+    }
+    catch {
+        return false;
+    }
+}
 const paths_1 = require("./paths");
 const TTL_MS = 24 * 60 * 60 * 1000;
 const REGISTRY_URL = `https://registry.npmjs.org/${cli_version_1.CLI_PACKAGE_NAME}/latest`;
@@ -70,7 +82,7 @@ function maybeNotifyUpdate(opts) {
     const now = opts?.now ?? Date.now();
     const spawnWorker = opts?.spawnWorker ?? spawnRefreshWorker;
     const cache = readUpdateCache();
-    if (cache?.latest && (0, versioning_1.compareSemver)(cache.latest, (0, cli_version_1.cliVersion)()) > 0) {
+    if (cache?.latest && isNewer(cache.latest, (0, cli_version_1.cliVersion)())) {
         console.log(picocolors_1.default.dim(`\n⬆ awm v${cache.latest} available → npm i -g ${cli_version_1.CLI_PACKAGE_NAME}`));
     }
     if (!cache || now - cache.lastCheck > TTL_MS)
@@ -83,7 +95,7 @@ async function offerSelfUpdate(deps = {}) {
     const current = deps.current ?? (0, cli_version_1.cliVersion)();
     const latest = deps.latest !== undefined ? deps.latest : await fetchLatestVersion(deps.fetchImpl ?? fetch);
     writeUpdateCache({ lastCheck: Date.now(), latest: latest ?? null });
-    if (!latest || (0, versioning_1.compareSemver)(latest, current) <= 0)
+    if (!latest || !isNewer(latest, current))
         return;
     const confirmImpl = deps.confirmImpl ?? (async (message) => {
         const r = await (0, prompts_1.confirm)({ message });

package/dist/src/core/versioning.js

@@ -105,8 +105,23 @@ function machineVersionOpts(registryName) {
     }
 }
 /** Compara "X.Y.Z" vs "X.Y.Z" (sin prefijo v) numéricamente. <0, 0, >0. */
+/** Compara dos semver X.Y.Z.
+ *
+ *  Antes devolvia `NaN` ante una entrada malformada (`'1.2'`, `'x.y.z'`), y como
+ *  `NaN > 0` y `NaN < 0` son AMBOS false, el gate de version fallaba ABIERTO:
+ *  `verifyMinCliVersions` dejaba pasar en silencio un CLI por debajo del minimo,
+ *  y el aviso de actualizacion no disparaba nunca. Para un gate, la direccion
+ *  correcta de fallo es la contraria. Ahora una entrada que no es semver lanza,
+ *  nombrando el valor: es el llamador quien decide como tratarlo, con
+ *  informacion suficiente para hacerlo. */
 function compareSemver(a, b) {
-    const pa = a.split('.').map(Number);
-    const pb = b.split('.').map(Number);
+    const parse = (v) => {
+        const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(v).trim());
+        if (!m)
+            throw new Error(`not a semver version: ${JSON.stringify(v)}`);
+        return [Number(m[1]), Number(m[2]), Number(m[3])];
+    };
+    const pa = parse(a);
+    const pb = parse(b);
     return (pa[0] - pb[0]) || (pa[1] - pb[1]) || (pa[2] - pb[2]);
 }

package/dist/src/index.js

@@ -18,6 +18,9 @@ const provider_preflight_1 = require("./ui/provider-preflight");
 const discovery_1 = require("./core/discovery");
 const bundles_1 = require("./core/bundles");
 const registries_1 = require("./core/registries");
+const install_planner_1 = require("./core/install-planner");
+const install_transaction_1 = require("./core/install-transaction");
+const profile_1 = require("./core/profile");
 const path_1 = __importDefault(require("path"));
 const picocolors_1 = __importDefault(require("picocolors"));
 const fs_1 = __importDefault(require("fs"));
@@ -166,31 +169,33 @@ program.command('add [name]')
             (0, prompts_1.outro)(picocolors_1.default.yellow('No artifacts available.'));
             return;
         }
-        const preflightOk = (0, provider_preflight_1.preflightLinkArtifactsForCli)(targetAgents.flatMap((agent) => artifactsToInstall.map((artifact) => ({ agent, artifact }))));
-        if (!preflightOk)
-            return;
         const installSpinner = (0, prompts_1.spinner)();
         installSpinner.start('Installing artifacts...');
         try {
-            const installed = [];
-            const skipped = [];
-            for (const currentAgent of targetAgents) {
-                for (const artifact of artifactsToInstall) {
-                    const config = (0, providers_1.assertLinkRenderer)(artifact.type, currentAgent);
-                    if (config === null) {
-                        skipped.push(`${artifact.name} (${currentAgent})`);
-                        continue;
-                    }
-                    const targetDir = config[scopeVal];
-                    if (targetDir === null) {
-                        skipped.push(`${artifact.name} (${currentAgent})`);
-                        continue;
-                    }
-                    const finalDest = path_1.default.join(targetDir, artifact.name);
-                    (0, executor_1.installArtifact)(artifact.sourcePath, finalDest, methodVal);
-                    installed.push(`${artifact.name} → ${currentAgent} (${scopeVal})`);
-                }
-            }
+            // Se delega en el MISMO pipeline que `awm add <bundle>`
+            // (planInstall + applyInstallPlan): transaccional, con backups,
+            // rollback y soporte real de renderers.
+            //
+            // Antes esto instalaba a mano y pasaba por `assertLinkRenderer`,
+            // que TIRA para cualquier renderer que no sea `link` — asi que
+            // `awm add --all` moria con "Renderer 'cursor-mdc' … is not
+            // implemented yet" para cursor y copilot, y para CODEX era puro
+            // dano colateral: sus skills son `link` e instalan bien, pero un
+            // solo artefacto `agent` mataba la corrida entera. El pipeline
+            // real ya soporta los tres renderers — `awm add <bundle> -a cursor`
+            // lo demuestra — asi que el unico problema era este camino paralelo.
+            const summary = (0, install_transaction_1.applyInstallPlan)((0, install_planner_1.planInstall)({
+                artifacts: artifactsToInstall.map((a) => ({
+                    name: a.name, type: a.type, installName: a.name, sourcePath: a.sourcePath,
+                })),
+                selectedAgents: targetAgents,
+                enabledAgents: prefs.enabledAgents,
+                scope: scopeVal,
+                projectRoot: (0, profile_1.findProjectRoot)(process.cwd()) ?? process.cwd(),
+                method: methodVal,
+            }));
+            const installed = summary.installed;
+            const skipped = summary.skipped;
             const updatedPrefs = targetAgents.reduce((current, agent) => (0, config_1.enableAgent)(current, agent), prefs);
             (0, config_1.savePreferences)({
                 ...updatedPrefs,
@@ -497,7 +502,10 @@ program.command('remove')
     });
     handleCancel(scopeChoice);
     const scopeVal = scopeChoice;
-    const installed = (0, provider_artifacts_1.scanLegacyArtifacts)(targetAgents, scopeVal);
+    // projectRoot explicito: `config.local` es relativo, y resolverlo contra
+    // `process.cwd()` hacia que `awm remove` no encontrara nada desde un
+    // subdirectorio — y que le pasara rutas RELATIVAS a fs.rmSync cuando si.
+    const installed = (0, provider_artifacts_1.scanLegacyArtifacts)(targetAgents, scopeVal, (0, profile_1.findProjectRoot)(process.cwd()) ?? process.cwd());
     if (installed.length === 0) {
         (0, prompts_1.outro)(picocolors_1.default.yellow('No installed artifacts found for the selected agents/scope.'));
         process.exit(0);

package/dist/src/providers/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UnsupportedRendererError = exports.AGENT_TARGETS = void 0;
+exports.UnsupportedRendererError = exports.RENDERER_IDS = exports.AGENT_TARGETS = void 0;
 exports.isAgentTarget = isAgentTarget;
 exports.requireAgentTarget = requireAgentTarget;
 exports.unsupportedScopeError = unsupportedScopeError;
@@ -18,6 +18,11 @@ exports.getInjection = getInjection;
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../core/paths");
 exports.AGENT_TARGETS = ['antigravity', 'opencode', 'claude-code', 'codex', 'cursor', 'copilot'];
+/** Runtime-enumerable, so the renderer table in `core/renderers/registry.ts` can be
+ *  checked for completeness against it (tests/structural/renderer-table-is-single-source).
+ *  A type-only union cannot be iterated, which is part of why four partial copies of the
+ *  renderer→extension mapping could drift apart unnoticed. */
+exports.RENDERER_IDS = ['link', 'codex-agent-toml', 'cursor-mdc', 'copilot-instructions'];
 function isAgentTarget(value) {
     return typeof value === 'string' &&
         exports.AGENT_TARGETS.includes(value);
@@ -102,7 +107,7 @@ function providers() {
         codex: {
             label: 'Codex',
             minimumVersion: '0.145.0',
-            versionCommand: { command: 'codex', args: ['--version'] },
+            versionCommand: { command: 'codex', args: ['--version'], versionPattern: /^codex-cli (\d+\.\d+\.\d+)$/ },
             skill: {
                 global: path_1.default.join(home, '.agents/skills'),
                 local: '.agents/skills',

package/dist/src/utils/config.js

@@ -13,6 +13,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const providers_1 = require("../providers");
 const paths_1 = require("../core/paths");
+const atomic_file_1 = require("../core/atomic-file");
 const DEFAULT_PREFS = {
     // claude-code matches `awm init`'s own documented default (see init.ts / `awm init --help`).
     // Previously 'antigravity', which silently mis-installed bundles in claude-code
@@ -118,14 +119,12 @@ function loadPreferences(initialAgent = 'claude-code') {
 }
 function savePreferences(prefs) {
     const normalized = normalizePreferences(prefs, false).prefs;
-    const file = prefsFile();
-    fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
-    const temp = `${file}.${process.pid}.tmp`;
-    fs_1.default.writeFileSync(temp, JSON.stringify(normalized, null, 2) + '\n', {
-        encoding: 'utf8',
-        mode: 0o600,
-    });
-    fs_1.default.renameSync(temp, file);
+    // `writeFileAtomic`, not a second hand-rolled write-temp-then-rename. The local copy
+    // predated the primitive and had drifted below it: no fsync, a pid-only temp name,
+    // and none of the guards the shared one grew. Same 0o600 intent and same
+    // mode-preservation semantics as `artifact-state.ts`, the other 0o600 file written
+    // through it — a file of this sensitivity has an established treatment here.
+    (0, atomic_file_1.writeFileAtomic)(prefsFile(), JSON.stringify(normalized, null, 2) + '\n', 0o600);
 }
 function enableAgent(prefs, agent) {
     normalizePreferences(prefs);

package/dist/tests/commands/doctor.test.js

@@ -148,6 +148,12 @@ describe('runDoctor', () => {
         expect(code).toBe(1);
     });
     it('reports every enabled provider and stable remediation codes in JSON', () => {
+        // El check `agents.native` solo se emite si hay artefactos nativos que
+        // verificar: un registry sin `agents/` ya no produce una fila roja sin
+        // remedio. Se siembra uno para que el check sea genuino en vez de
+        // asertar sobre una fila que hoy, con razon, no existiria.
+        fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.codex', 'agents'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.codex', 'agents', 'demo.toml'), 'name = "demo"\n');
         writePrefs(prefsWith(['claude-code', 'opencode', 'codex']));
         const code = (0, doctor_1.runDoctor)({ cwd: tmpWork, json: true });
         const report = JSON.parse(stdout());

package/dist/tests/commands/pin.test.js

@@ -34,7 +34,7 @@ describe('pin/unpin (editores de preferences)', () => {
     it('setPin escribe pins.base normalizado (acepta prefijo v)', () => {
         const { setPin } = require('../../src/commands/pin');
         setPin('base', 'v1.2.0');
-        expect(readPrefs().pins).toEqual({ base: '1.2.0' });
+        expect(readPrefs().pins).toEqual({ baseline: '1.2.0' });
     });
     it('setPin acepta un registry adicional configurado', () => {
         const { writeRegistriesConfig } = require('../../src/core/registries');
@@ -66,7 +66,34 @@ describe('pin/unpin (editores de preferences)', () => {
         writeRegistriesConfig([{ name: 'equipo', remote: '/tmp/x' }]);
         setPin('equipo', '2.0.0');
         const prefs = readPrefs();
-        expect(prefs.pins).toEqual({ base: '1.0.0', equipo: '2.0.0' });
+        expect(prefs.pins).toEqual({ baseline: '1.0.0', equipo: '2.0.0' });
         expect(prefs.defaultAgent).toBeDefined();
     });
 });
+describe('awm pin base: el alias tiene que llegar a la clave que el resolutor lee', () => {
+    // Regresion: el registry base se llama `baseline` en disco, pero la ayuda
+    // del comando siempre documento `awm pin base <v>`. `base` se aceptaba y se
+    // persistia tal cual — en una clave que NADA lee. El comando reportaba
+    // "✓ base pinned to v1.0.0" y no cambiaba nada, incluso siendo la salida
+    // documentada de un bloqueo por `minCliVersion`, donde el usuario queda sin
+    // poder correr `awm update` ni `awm sync`.
+    it('setPin("base") persiste bajo "baseline", que es lo que consulta el resolutor', () => {
+        const { setPin } = require('../../src/commands/pin');
+        setPin('base', '1.5.0');
+        const { getPreferences } = require('../../src/utils/config');
+        expect(getPreferences().pins).toEqual({ baseline: '1.5.0' });
+    });
+    it('removePin("base") borra ese mismo pin (no una clave fantasma)', () => {
+        const { setPin, removePin } = require('../../src/commands/pin');
+        setPin('base', '1.5.0');
+        expect(removePin('base')).toBe(true);
+        const { getPreferences } = require('../../src/utils/config');
+        expect(getPreferences().pins).toEqual({});
+    });
+    it('"baseline" explicito sigue funcionando igual', () => {
+        const { setPin } = require('../../src/commands/pin');
+        setPin('baseline', '2.0.0');
+        const { getPreferences } = require('../../src/utils/config');
+        expect(getPreferences().pins).toEqual({ baseline: '2.0.0' });
+    });
+});

package/dist/tests/commands/preflight/preflight.test.js

@@ -163,18 +163,34 @@ describe('preflight', () => {
         // sensor configuration, and an empty sensors object now fails `checkManifest`
         // (see the `total === 0` branch), which would drag `report.status` off 'ready'
         // for reasons unrelated to what these tests exercise.
-        beforeEach(() => { mockExecSync.mockReset(); });
+        // `resolveOnPath` resuelve PATH en proceso (ya no invoca un shell — ver la
+        // nota de seguridad en core/paths.ts), asi que la disponibilidad de `gh`/
+        // `glab` se simula con un PATH aislado, no mockeando `execSync`. Ademas de
+        // reflejar el mecanismo real, esto vuelve deterministas los casos de
+        // "no esta en PATH", que antes dependian de que la maquina no lo tuviera.
+        let pathDir;
+        let originalPath;
+        beforeEach(() => {
+            pathDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-path-'));
+            originalPath = process.env.PATH;
+            process.env.PATH = pathDir;
+        });
+        afterEach(() => {
+            if (originalPath === undefined)
+                delete process.env.PATH;
+            else
+                process.env.PATH = originalPath;
+            fs_1.default.rmSync(pathDir, { recursive: true, force: true });
+        });
+        function installOnPath(tool) {
+            const f = path_1.default.join(pathDir, tool);
+            fs_1.default.writeFileSync(f, '#!/bin/sh\nexit 0\n');
+            fs_1.default.chmodSync(f, 0o755);
+        }
         it('reports github + gh available, and does not affect status', () => {
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@github.com:kodria/agentic-workflow.git');
-            // `resolveOnPath('gh')` runs `command -v gh` on POSIX but `where gh` on
-            // win32 (see paths.ts) — match both invocation forms so this test's
-            // "gh is available" fixture holds on windows-latest CI too.
-            mockExecSync.mockImplementation(((cmd) => {
-                if (cmd === 'command -v gh' || cmd === 'where gh')
-                    return Buffer.from('/usr/bin/gh');
-                throw new Error(`not found: ${cmd}`);
-            }));
+            installOnPath('gh');
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
             expect(check(report, 'host').detail).toBe('github detected, gh available');
@@ -185,9 +201,7 @@ describe('preflight', () => {
             // advisory contract: it must not drag an otherwise-clean repo to `degraded`.
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://gitlab.com/kodria/agentic-workflow.git');
-            mockExecSync.mockImplementation((() => {
-                throw new Error('not found');
-            }));
+            // PATH aislado y vacio => glab no resuelve.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
             expect(check(report, 'host').detail).toContain('glab not on PATH');
@@ -254,7 +268,7 @@ describe('preflight', () => {
             // test guards is that it must never again read as gitlab.
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'ssh://gitlab@github.company-internal.com:22/team/repo.git');
-            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            // PATH real: estos casos no dependen de gh/glab.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').ok).toBe(true);
             expect(check(report, 'host').detail).toContain('github detected');
@@ -289,28 +303,28 @@ describe('preflight', () => {
         it('still detects github.com over HTTPS', () => {
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://github.com/org/repo.git');
-            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            // PATH real: estos casos no dependen de gh/glab.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('github detected');
         });
         it('still detects github.com over SSH shorthand', () => {
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@github.com:org/repo.git');
-            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            // PATH real: estos casos no dependen de gh/glab.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('github detected');
         });
         it('still detects gitlab over HTTPS', () => {
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'https://gitlab.example.com/org/repo.git');
-            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            // PATH real: estos casos no dependen de gh/glab.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('gitlab detected');
         });
         it('still detects gitlab over SSH shorthand', () => {
             const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
             gitRepo(dir, 'git@gitlab.example.com:org/repo.git');
-            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            // PATH real: estos casos no dependen de gh/glab.
             const report = (0, checks_1.preflight)(dir);
             expect(check(report, 'host').detail).toContain('gitlab detected');
         });

package/dist/tests/commands/registry/install-bundles.test.js

@@ -38,8 +38,8 @@ describe('installBundlesFromRegistry', () => {
         fs_1.default.rmSync(tmpWork, { recursive: true, force: true });
     });
     it('installs all ambient bundles of the given registry root for the agent', () => {
-        const { REGISTRIES_DIR } = require('../../../src/core/registries');
-        const regRoot = path_1.default.join(REGISTRIES_DIR, 'team');
+        const { registriesDir } = require('../../../src/core/registries');
+        const regRoot = path_1.default.join(registriesDir(), 'team');
         writeBundleRoot(regRoot, 'team-pack', 'team-skill');
         fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.awm', 'registries.json'), JSON.stringify([{ name: 'team', remote: 'r' }]));
@@ -52,8 +52,8 @@ describe('installBundlesFromRegistry', () => {
         expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.claude', 'skills', 'team-skill'))).toBe(true);
     });
     it('returns empty when the registry has no bundles', () => {
-        const { REGISTRIES_DIR } = require('../../../src/core/registries');
-        const regRoot = path_1.default.join(REGISTRIES_DIR, 'empty');
+        const { registriesDir } = require('../../../src/core/registries');
+        const regRoot = path_1.default.join(registriesDir(), 'empty');
         fs_1.default.mkdirSync(path_1.default.join(regRoot, 'skills', 's'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(regRoot, 'skills', 's', 'SKILL.md'), `---\nname: s\ndescription: d\n---\n`);
         fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm'), { recursive: true });
@@ -62,8 +62,8 @@ describe('installBundlesFromRegistry', () => {
         expect(installBundlesFromRegistry(regRoot, 'all', ['claude-code'], tmpWork)).toEqual([]);
     });
     it('installs only the named bundles when a list is given', () => {
-        const { REGISTRIES_DIR } = require('../../../src/core/registries');
-        const regRoot = path_1.default.join(REGISTRIES_DIR, 'team');
+        const { registriesDir } = require('../../../src/core/registries');
+        const regRoot = path_1.default.join(registriesDir(), 'team');
         writeBundleRoot(regRoot, 'wanted', 'skill-w');
         // second bundle in same catalog
         fs_1.default.mkdirSync(path_1.default.join(regRoot, 'bundles', 'unwanted'), { recursive: true });

package/dist/tests/commands/sensors/init-pack-unavailable.test.js

@@ -0,0 +1,96 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// `awm sensors init` auto-detects the stack, then reads that pack's defaults out of
+// the registry. When the registry has no such pack — a pinned or stale registry, or one
+// that simply never shipped it — `readPackDefaults` returned null and the manifest was
+// written EMPTY, with no error and no warning:
+//
+//     $ awm sensors init          # python project, registry predates the python pack
+//     ✔ Detected: python (pyproject.toml)
+//     ✔ Wrote .awm/sensors.json          ← {"pack":"python","sensors":{}}
+//
+// Nothing in that output says the quality gate now checks nothing. The operator finds
+// out later, from an unrelated command (`awm preflight` exits 1, `awm sensors status`
+// reports DEGRADED), and the manifest is by then committed.
+//
+// `--pack <name>` has always validated against the registry and thrown (assertPackExists).
+// Auto-detection reaching the same dead end must not be quieter than the explicit path:
+// it now falls back to a pack the registry actually has, and says which pack was missing
+// so the operator hears it at the moment the decision is made.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const init_1 = require("../../../src/commands/sensors/init");
+function mkRegistry(packs) {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-packreg-'));
+    for (const [name, sensors] of Object.entries(packs)) {
+        const dir = path_1.default.join(root, 'sensor-packs', name);
+        fs_1.default.mkdirSync(dir, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'pack.json'), JSON.stringify({ name, sensors }));
+    }
+    return root;
+}
+function mkPythonProject() {
+    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-packproj-'));
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'pyproject.toml'), '[project]\nname = "x"\n');
+    return dir;
+}
+const GENERIC = { security: { defaultCmd: 'semgrep .', fast: false } };
+const PYTHON = { typecheck: { defaultCmd: 'mypy .', fast: true, formatter: 'mypy' } };
+describe('awm sensors init — detected pack missing from the registry', () => {
+    const made = [];
+    const registry = (packs) => { const r = mkRegistry(packs); made.push(r); return r; };
+    const project = () => { const p = mkPythonProject(); made.push(p); return p; };
+    const manifestOf = (dir) => JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), 'utf-8'));
+    afterAll(() => { for (const d of made)
+        fs_1.default.rmSync(d, { recursive: true, force: true }); });
+    it('names the missing pack instead of writing an empty manifest silently', () => {
+        const cwd = project();
+        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {}, generic: GENERIC }) });
+        expect(result.unavailablePack).toBe('python');
+        expect(result.detection.pack).toBe('python'); // what the tree actually is — unchanged
+    });
+    it('falls back to a pack the registry does have, so the gate still measures something', () => {
+        const cwd = project();
+        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {}, generic: GENERIC }) });
+        expect(result.manifest.pack).toBe('generic');
+        expect(Object.keys(result.manifest.sensors)).toEqual(['security']);
+        expect(manifestOf(cwd).pack).toBe('generic');
+    });
+    it('stays on the detected pack when the registry has no fallback either', () => {
+        // Nothing better exists. The manifest is honestly empty and still says so —
+        // preflight's `manifest` check fails on `total === 0` with a registry remedy.
+        const cwd = project();
+        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {} }) });
+        expect(result.unavailablePack).toBe('python');
+        expect(result.manifest.pack).toBe('python');
+        expect(result.manifest.sensors).toEqual({});
+    });
+    it('is quiet when the registry does have the detected pack', () => {
+        const cwd = project();
+        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ python: PYTHON, generic: GENERIC }) });
+        expect(result.unavailablePack).toBeUndefined();
+        expect(result.manifest.pack).toBe('python');
+        expect(Object.keys(result.manifest.sensors)).toEqual(['typecheck']);
+    });
+    it('does not fall back when there is no registry to check against', () => {
+        // No registryRoot means nothing to validate against, the same tolerance
+        // `--pack` already has — not evidence that the pack is missing.
+        const cwd = project();
+        const result = (0, init_1.initSensors)({ cwd });
+        expect(result.unavailablePack).toBeUndefined();
+        expect(result.manifest.pack).toBe('python');
+    });
+    it('keeps sensors the user already had when falling back', () => {
+        // The fallback must not be a way to lose hand-written configuration.
+        const cwd = project();
+        fs_1.default.mkdirSync(path_1.default.join(cwd, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(cwd, '.awm', 'sensors.json'), JSON.stringify({ pack: 'python', sensors: { test: { cmd: 'pytest -q', fast: false } } }));
+        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ generic: GENERIC }) });
+        expect(result.manifest.sensors.test?.cmd).toBe('pytest -q');
+        expect(Object.keys(result.manifest.sensors).sort()).toEqual(['security', 'test']);
+    });
+});