agentic-workflow-manager 3.2.1 → 3.3.0

package/dist/src/commands/sensors/run.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyBaseline = applyBaseline;
 exports.reconcilePack = reconcilePack;
 exports.findManifestDir = findManifestDir;
 exports.runSensors = runSensors;
@@ -26,11 +27,13 @@ const DEFAULT_SLOW_TIMEOUT = 120_000;
 const MAX_BUFFER = 64 * 1024 * 1024;
 /**
  * Apply the baseline to a sensor result: keep only findings not already accepted.
- * `status` becomes 'pass' when every finding was baseline-suppressed. Skipped
- * sensors are returned untouched.
+ * `status` becomes 'pass' when every finding was baseline-suppressed. Results
+ * without a verdict of their own — skipped and inconclusive — are returned
+ * untouched: there is nothing to ratchet, and letting them through here would
+ * hand back a `pass` for a sensor that never reported anything.
  */
 function applyBaseline(result, accepted) {
-    if (result.status === 'skipped')
+    if (result.status === 'skipped' || result.status === 'inconclusive')
         return result;
     const { newErrors, suppressed } = (0, baseline_1.partition)(result.name, result.errors, accepted);
     if (suppressed === 0)
@@ -131,12 +134,14 @@ function runSensor(name, cmd, timeout, cwd) {
     catch (err) {
         // Output exceeded maxBuffer — child is killed before output can be read.
         // Check this BEFORE the SIGTERM branch (ENOBUFS kills with SIGTERM too).
+        // Nothing could be read, so nothing was certified.
         if (err.code === 'ENOBUFS') {
-            return { name, status: 'skipped', errors: [], skipReason: `output exceeded ${MAX_BUFFER} bytes` };
+            return { name, status: 'inconclusive', errors: [], skipReason: `output exceeded ${MAX_BUFFER} bytes` };
         }
-        // Genuine timeout: execSync kills with SIGTERM after `timeout` ms.
+        // Genuine timeout: execSync kills with SIGTERM after `timeout` ms. The
+        // sensor produced no verdict — inconclusive, not a benign skip.
         if (err.code === 'ETIMEDOUT' || (err.killed && err.signal === 'SIGTERM')) {
-            return { name, status: 'skipped', errors: [], skipReason: `timeout after ${timeout}ms` };
+            return { name, status: 'inconclusive', errors: [], skipReason: `timeout after ${timeout}ms` };
         }
         // Non-zero exit — the normal path for linters/typecheckers that found
         // findings. Parse the output; if it yields findings, that's a fail.
@@ -146,9 +151,28 @@ function runSensor(name, cmd, timeout, cwd) {
             return { name, status: 'fail', errors };
         // A missing tool (binary not installed) must NOT pass silently — the gate
         // cannot certify what it could not run. Treat it as a fail with a clear message.
+        //
+        // Exit 127 is the POSIX signal for "command not found" and is the only check
+        // here that holds across shells and locales: bash writes `command not found`
+        // but dash — `/bin/sh` on Debian/Ubuntu, hence most CI runners and containers
+        // — writes `not found`, so matching shell text alone read an absent tool as a
+        // benign skip. `err.code` does not cover it either: that is ENOENT only when
+        // spawning the shell itself fails, not when the shell starts and the command
+        // inside it is missing. The ENOBUFS and timeout branches are evaluated above,
+        // so reaching here with status 127 means the command did not exist.
+        //
+        // A wrapper (`npm test`, `npx …`) that exits 127 because a binary it invokes
+        // is absent is classified the same way, deliberately: the gate still ran
+        // nothing and still cannot certify anything.
         const lower = raw.toLowerCase();
-        const toolMissing = err.code === 'ENOENT' || // execSync spawn failure (no shell)
-            lower.includes('command not found') ||
+        const toolMissing = err.status === 127 || // POSIX: command not found
+            err.code === 'ENOENT' || // execSync spawn failure (no shell)
+            lower.includes('command not found') || // bash, zsh
+            // cmd.exe reports an absent binary with exit 1, so 127 does not cover
+            // Windows; this exact phrase does. Kept narrow on purpose — a loose
+            // `not found` would also match a tool that ran and said "not found"
+            // for reasons of its own.
+            lower.includes('is not recognized as an internal or external command') ||
             lower.includes('enoent') ||
             lower.includes('could not determine executable');
         if (toolMissing) {
@@ -163,7 +187,10 @@ function runSensor(name, cmd, timeout, cwd) {
         if (isExitCodeSensor(name)) {
             return { name, status: 'fail', errors: [{ message: `SENSOR[${name}] failed (exit ${err.status})` }] };
         }
-        return { name, status: 'skipped', errors: [], skipReason: `exit ${err.status}: ${raw.slice(0, 200)}` };
+        // Residual case: it exited non-zero, the tool exists, and no finding
+        // could be parsed. We do not know what happened — say so instead of
+        // reporting a benign skip.
+        return { name, status: 'inconclusive', errors: [], skipReason: `exit ${err.status}: ${raw.slice(0, 200)}` };
     }
 }
 function runSensors(opts = {}) {
@@ -191,7 +218,9 @@ function runSensors(opts = {}) {
             continue;
         }
         if (!config.cmd) {
-            results.push({ name, status: 'skipped', errors: [], skipReason: 'no cmd configured' });
+            // Enabled but with nothing to run: broken config, not a deliberate
+            // opt-out. `enabled: false` is how a sensor is turned off.
+            results.push({ name, status: 'inconclusive', errors: [], skipReason: 'no cmd configured' });
             continue;
         }
         const timeout = config.timeout ?? (isFast ? DEFAULT_FAST_TIMEOUT : DEFAULT_SLOW_TIMEOUT);
@@ -200,10 +229,13 @@ function runSensors(opts = {}) {
             result = applyBaseline(result, baseline[name]);
         results.push(result);
     }
+    // `fail` outranks `inconclusive`: when something is broken AND something
+    // could not be measured, the broken thing is the actionable verdict.
     let overall = results.some(r => r.status === 'fail') ? 'fail'
-        : results.length > 0 && results.every(r => r.status === 'skipped') ? 'skipped'
-            : results.length === 0 ? 'skipped'
-                : 'pass';
+        : results.some(r => r.status === 'inconclusive') ? 'not_certified'
+            : results.length > 0 && results.every(r => r.status === 'skipped') ? 'skipped'
+                : results.length === 0 ? 'skipped'
+                    : 'pass';
     // Honest floor: a benign-green 'skipped' over a tree that clearly HAS a stack
     // (indicators present) is a false green — the gate ran nothing real. Never green.
     if (overall === 'skipped' && reconciled.detection.pack !== 'generic') {

package/dist/src/core/init/orchestrator.js

@@ -42,7 +42,26 @@ async function runInitSteps(deps) {
         steps.push(await wrapStep('project.constitutionInjection', 'project', () => (0, steps_1.stepConstitutionInjection)(deps)));
         steps.push(await wrapStep('project.context', 'project', () => (0, steps_1.stepContext)(deps)));
     }
+    // Re-gather fresh so the report reflects whatever the steps above just
+    // installed. `results` deliberately keeps every check — including project
+    // ones — so the render still shows real project state (e.g. "run awm sync")
+    // when one exists; only `overall`, the exit-code verdict, needs scoping.
+    //
+    // If this run started with project scope nulled — `--machine-only`
+    // (init.ts's effectiveCtx), or genuinely no project at this cwd — `overall`
+    // must reflect only what THIS run attempted. `runChecks` otherwise mixes
+    // machine + project results into one flat `overall` (checks.ts), so a
+    // `--machine-only` bootstrap into an already-initialized project with
+    // unrelated unsynced bundles reports "degraded" and callers gating on it
+    // (`runInit`'s exit code) fail a run that fully succeeded at everything it
+    // was asked to do — the exact shape of a real Codex Cloud bootstrap script
+    // aborting under `set -euo pipefail` right after `awm init`.
     const after = (0, checks_1.runChecks)((0, context_1.gatherContext)({ cwd: deps.cwd, bundles: deps.bundles, agent: deps.agent }));
+    if (deps.ctx.project === null) {
+        after.overall = after.results
+            .filter((r) => r.level === 'machine')
+            .some((r) => r.status === 'missing') ? 'degraded' : 'healthy';
+    }
     return {
         steps,
         applied: steps.filter((s) => s.action === 'applied').length,

package/dist/tests/commands/sensors/run-inconclusive.test.js

@@ -0,0 +1,237 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const mockExecSyncFn = jest.fn();
+jest.mock('child_process', () => ({
+    execSync: (...args) => mockExecSyncFn(...args),
+}));
+/** Sensors run in manifest insertion order, so mocks are queued in that order. */
+const MANIFEST = {
+    pack: 'js-ts',
+    sensors: {
+        typecheck: { cmd: 'npx tsc --noEmit', fast: true },
+        security: { cmd: 'semgrep .', fast: false },
+    },
+};
+const timeoutError = () => { throw Object.assign(new Error('killed'), { code: 'ETIMEDOUT' }); };
+describe('runSensors — inconclusive: a sensor that could not certify is never green', () => {
+    let root;
+    let fakeAwmHome;
+    let prevAwmHome;
+    beforeEach(() => {
+        jest.resetModules();
+        mockExecSyncFn.mockReset();
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-inconclusive-'));
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify(MANIFEST));
+        // CLAUDE.md: no test may reach the real ~/.awm.
+        fakeAwmHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-home-'));
+        prevAwmHome = process.env.AWM_HOME;
+        process.env.AWM_HOME = fakeAwmHome;
+    });
+    afterEach(() => {
+        process.env.AWM_HOME = prevAwmHome;
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+        fs_1.default.rmSync(fakeAwmHome, { recursive: true, force: true });
+    });
+    const load = () => require('../../../src/commands/sensors/run');
+    it('reports a timed-out sensor as inconclusive, keeping its reason', () => {
+        mockExecSyncFn
+            .mockReturnValueOnce('') // typecheck: clean
+            .mockImplementationOnce(timeoutError); // security: times out
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        const security = out.sensors.find((s) => s.name === 'security');
+        expect(security.status).toBe('inconclusive');
+        expect(security.skipReason).toMatch(/timeout/);
+    });
+    it('does not let a healthy sensor carry the run to pass while another could not certify', () => {
+        mockExecSyncFn
+            .mockReturnValueOnce('')
+            .mockImplementationOnce(timeoutError);
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        expect(out.sensors.find((s) => s.name === 'typecheck').status).toBe('pass');
+        expect(out.overall).toBe('not_certified');
+    });
+    it('reports a sensor whose output was truncated as inconclusive', () => {
+        mockExecSyncFn
+            .mockReturnValueOnce('')
+            .mockImplementationOnce(() => { throw Object.assign(new Error('too big'), { code: 'ENOBUFS' }); });
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        const security = out.sensors.find((s) => s.name === 'security');
+        expect(security.status).toBe('inconclusive');
+        expect(security.skipReason).toMatch(/exceeded/);
+        expect(out.overall).toBe('not_certified');
+    });
+    it('reports an uninterpretable non-zero exit as inconclusive', () => {
+        mockExecSyncFn
+            .mockReturnValueOnce('')
+            .mockImplementationOnce(() => {
+            // semgrep formatter yields no findings for non-JSON output, the
+            // tool is present (exit 2, not 127), and `security` is not an
+            // exit-code sensor — the residual "I don't know" case.
+            throw Object.assign(new Error('failed'), {
+                stdout: '', stderr: 'internal error: rule engine crashed\n', status: 2,
+            });
+        });
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        const security = out.sensors.find((s) => s.name === 'security');
+        expect(security.status).toBe('inconclusive');
+        expect(security.skipReason).toMatch(/exit 2/);
+        expect(out.overall).toBe('not_certified');
+    });
+    it('reports an enabled sensor with no cmd as inconclusive', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts',
+            sensors: {
+                typecheck: { cmd: 'npx tsc --noEmit', fast: true },
+                depcheck: { fast: false }, // enabled, but nothing to run
+            },
+        }));
+        mockExecSyncFn.mockReturnValueOnce(''); // typecheck: clean
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        const depcheck = out.sensors.find((s) => s.name === 'depcheck');
+        expect(depcheck.status).toBe('inconclusive');
+        expect(depcheck.skipReason).toBe('no cmd configured');
+        expect(out.overall).toBe('not_certified');
+    });
+    it('reports fail, not not_certified, when something is broken and something could not run', () => {
+        mockExecSyncFn
+            .mockImplementationOnce(() => {
+            throw Object.assign(new Error(), {
+                stdout: 'src/a.ts(1,1): error TS0001: Bad type.', stderr: '', status: 1,
+            });
+        })
+            .mockImplementationOnce(timeoutError); // security: times out
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        expect(out.sensors.find((s) => s.name === 'typecheck').status).toBe('fail');
+        expect(out.sensors.find((s) => s.name === 'security').status).toBe('inconclusive');
+        expect(out.overall).toBe('fail');
+    });
+    it('never emits an overall value outside the published domain', () => {
+        // `inconclusive` is a per-sensor status only. External consumers (the
+        // registry skills) read `overall`, whose domain must not grow — this
+        // pins that invariant at runtime on a three-sensor pass+fail+inconclusive
+        // mix, a combination neither R8 (pass+inconclusive) nor R9
+        // (fail+inconclusive) exercises. R9's own assertion already catches a
+        // fail/inconclusive precedence regression specifically; what this test
+        // adds is runtime coverage of the domain claim itself, on a fixture
+        // neither of those covers — not independent detection of every
+        // aggregation mutation.
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts',
+            sensors: {
+                typecheck: { cmd: 'npx tsc --noEmit', fast: true },
+                lint: { cmd: 'npx eslint . --format json', fast: true },
+                security: { cmd: 'semgrep .', fast: false },
+            },
+        }));
+        const DOMAIN = ['pass', 'fail', 'skipped', 'not_certified'];
+        mockExecSyncFn
+            .mockImplementationOnce(() => {
+            throw Object.assign(new Error(), {
+                stdout: 'src/a.ts(1,1): error TS0001: Bad type.', stderr: '', status: 1,
+            });
+        })
+            .mockReturnValueOnce('') // lint: clean → pass
+            .mockImplementationOnce(timeoutError); // security: times out → inconclusive
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        expect(DOMAIN).toContain(out.overall);
+        expect(out.overall).not.toBe('inconclusive');
+    });
+    it('keeps a deliberately disabled sensor apart from one that could not certify', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts',
+            sensors: {
+                security: { cmd: 'semgrep .', fast: false },
+                mutation: { cmd: 'npx stryker run', enabled: false },
+            },
+        }));
+        mockExecSyncFn.mockImplementationOnce(timeoutError); // security: times out
+        // mutation: never invoked
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        // Same run, two different meanings — the whole point of the split.
+        expect(out.sensors.find((s) => s.name === 'mutation').status).toBe('skipped');
+        expect(out.sensors.find((s) => s.name === 'mutation').skipReason).toBe('disabled');
+        expect(out.sensors.find((s) => s.name === 'security').status).toBe('inconclusive');
+        expect(out.overall).toBe('not_certified');
+    });
+    it('does not degrade the verdict for a disabled sensor alongside healthy ones', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts',
+            sensors: {
+                typecheck: { cmd: 'npx tsc --noEmit', fast: true },
+                mutation: { cmd: 'npx stryker run', enabled: false },
+            },
+        }));
+        mockExecSyncFn.mockReturnValueOnce('');
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        expect(out.overall).toBe('pass');
+    });
+    it('still refuses to certify a tree whose sensors are all disabled', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts',
+            sensors: {
+                typecheck: { cmd: 'npx tsc --noEmit', enabled: false },
+                security: { cmd: 'semgrep .', enabled: false },
+            },
+        }));
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}'); // real stack indicator
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        expect(out.sensors.every((s) => s.status === 'skipped')).toBe(true);
+        expect(out.overall).toBe('not_certified');
+        expect(mockExecSyncFn).not.toHaveBeenCalled();
+    });
+    it('leaves an inconclusive result untouched when a baseline is applied', () => {
+        const { writeBaseline } = require('../../../src/commands/sensors/baseline');
+        writeBaseline(root, { security: ['some-accepted-fingerprint'] });
+        mockExecSyncFn
+            .mockReturnValueOnce('')
+            .mockImplementationOnce(timeoutError);
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        const security = out.sensors.find((s) => s.name === 'security');
+        expect(security.status).toBe('inconclusive');
+        expect(security.baselineCount).toBeUndefined();
+        expect(out.overall).toBe('not_certified');
+    });
+    it('applyBaseline leaves an inconclusive result untouched even if it somehow carried findings', () => {
+        // Every current `inconclusive` producer sets `errors: []`, so a test built
+        // on the public `runSensors()` API can't tell "the explicit guard fired"
+        // apart from "fell through to partition() and incidentally suppressed 0
+        // findings." This unit-tests applyBaseline directly, with a hand-built
+        // result that has `errors` populated, to prove the guard itself — not an
+        // accidental empty-array interaction — is what keeps inconclusive inert.
+        const { applyBaseline } = load();
+        const { buildBaseline } = require('../../../src/commands/sensors/baseline');
+        const result = {
+            name: 'security',
+            status: 'inconclusive',
+            errors: [{ message: 'hypothetical finding that should never be ratcheted', rule: 'some-rule', file: 'src/x.ts' }],
+            skipReason: 'timeout after 10000ms',
+        };
+        // Build a baseline that partition() WOULD genuinely match/suppress for
+        // this exact finding, so the old code (without the inconclusive guard)
+        // would have mutated the result — proving the new guard, not an
+        // incidental "suppressed === 0", is what keeps it untouched.
+        const accepted = buildBaseline([{ name: result.name, errors: result.errors }])[result.name];
+        const out = applyBaseline(result, accepted);
+        expect(out).toBe(result);
+        expect(out.status).toBe('inconclusive');
+        expect(out.baselineCount).toBeUndefined();
+    });
+});

package/dist/tests/commands/sensors/run-tool-missing.test.js

@@ -0,0 +1,69 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const run_1 = require("../../../src/commands/sensors/run");
+/**
+ * These tests deliberately do NOT mock `child_process`: the defect they pin only
+ * exists against a real shell. On Debian/Ubuntu `/bin/sh` is dash, which writes
+ * `not found` — not bash's `command not found` — so a string-matching heuristic
+ * reads a missing binary as a benign skip. What is being fixed here is the
+ * invariant "a tool that could not run is never green", NOT the wording of any
+ * particular shell, so no assertion below matches shell text.
+ *
+ * The sensor is named `security` on purpose. Sensors with a structured formatter
+ * (semgrep/tsc/eslint) return zero findings for unparseable shell noise and fall
+ * through to the tool-missing branch; a sensor with the generic formatter turns
+ * any stderr into a finding and never reaches it.
+ */
+const MISSING_BIN = 'awm-nonexistent-binary-xyz';
+function mkProject(sensors) {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-tool-missing-'));
+    fs_1.default.mkdirSync(path_1.default.join(root, '.awm'));
+    fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({ pack: 'js-ts', sensors }));
+    return root;
+}
+describe('runSensors — an absent tool never reads as green (real /bin/sh)', () => {
+    const roots = [];
+    afterAll(() => { for (const r of roots)
+        fs_1.default.rmSync(r, { recursive: true, force: true }); });
+    const project = (sensors) => {
+        const root = mkProject(sensors);
+        roots.push(root);
+        return root;
+    };
+    it('marks a sensor whose binary is absent as fail, not skipped', () => {
+        const root = project({ security: { cmd: `${MISSING_BIN} .`, fast: true } });
+        const out = (0, run_1.runSensors)({ cwd: root });
+        const security = out.sensors.find(s => s.name === 'security');
+        expect(security.status).toBe('fail');
+        expect(security.errors[0].message).toMatch(/not available/i);
+    });
+    it('does not let a healthy sensor carry the run to pass while another tool is absent', () => {
+        const root = project({
+            typecheck: { cmd: 'node -e ""', fast: true },
+            security: { cmd: `${MISSING_BIN} .`, fast: true },
+        });
+        const out = (0, run_1.runSensors)({ cwd: root });
+        expect(out.sensors.find(s => s.name === 'typecheck').status).toBe('pass');
+        expect(out.overall).toBe('fail');
+    });
+    it('does not misread a tool that ran and merely printed "not found" as an absent tool', () => {
+        // Exits 1, not 127: the binary existed and reported something of its own.
+        // Classifying this as a missing tool would be a false accusation. It also
+        // must not read as a benign 'skipped': the formatter parsed no findings
+        // from a genuine non-zero exit, which is the residual "I don't know" case
+        // (Task 3) — 'inconclusive', not 'fail' and not 'skipped'.
+        const root = project({
+            security: { cmd: `node -e "console.error('rule pack not found'); process.exit(1)"`, fast: true },
+        });
+        const out = (0, run_1.runSensors)({ cwd: root });
+        const security = out.sensors.find(s => s.name === 'security');
+        expect(security.status).toBe('inconclusive');
+        expect(security.errors).toEqual([]);
+    });
+});

package/dist/tests/commands/sensors/run.test.js

@@ -68,13 +68,13 @@ describe('runSensors', () => {
         expect(tc.status).toBe('fail');
         expect(tc.errors[0].message).toMatch('SENSOR[typecheck]');
     });
-    it('marks sensor as skipped on timeout', () => {
+    it('marks sensor as inconclusive on timeout', () => {
         mockExecSyncFn.mockImplementationOnce(() => { throw Object.assign(new Error('killed'), { code: 'ETIMEDOUT' }); });
         mockExecSyncFn.mockReturnValueOnce('');
         const { runSensors } = load();
         const result = runSensors({ fast: true, cwd: tmpDir });
         const tc = result.sensors.find((s) => s.name === 'typecheck');
-        expect(tc.status).toBe('skipped');
+        expect(tc.status).toBe('inconclusive');
         expect(tc.skipReason).toMatch('timeout');
     });
     it('skips disabled sensors', () => {
@@ -134,26 +134,34 @@ describe('runSensors — missing tool is a fail, not a skip', () => {
     });
     beforeEach(() => {
         mockExecSyncFn.mockReset();
-        // Simulate shell exit 127 "command not found" — matches what Node's execSync
-        // captures in err.stderr when the binary does not exist on PATH.
+        // What Node's execSync actually throws when the binary is absent and `/bin/sh`
+        // is dash (Debian/Ubuntu, hence most CI runners): status 127, `not found`
+        // rather than bash's `command not found`, and no `code` — ENOENT is set only
+        // when spawning the shell itself fails, not the command inside it.
         mockExecSyncFn.mockImplementation(() => {
-            throw Object.assign(new Error('Command failed: awm-nonexistent-binary-xyz --check'), {
+            throw Object.assign(new Error('Command failed: awm-nonexistent-binary-xyz .'), {
                 stdout: '',
-                stderr: '/bin/sh: awm-nonexistent-binary-xyz: command not found\n',
+                stderr: '/bin/sh: 1: awm-nonexistent-binary-xyz: not found\n',
                 status: 127,
             });
         });
     });
+    // The sensor is named `security` so it uses the semgrep formatter, which returns
+    // zero findings for unparseable shell noise and lets execution reach the
+    // tool-missing branch. Under the generic formatter any stderr becomes a finding,
+    // so a sensor named `ghost` would report `fail` without that branch ever running —
+    // green for a reason unrelated to what this test claims to cover.
     it('marks a sensor whose binary is missing as fail', () => {
         root = mkTmp();
         fs_1.default.mkdirSync(path_1.default.join(root, '.awm'));
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
-            pack: 'test',
-            sensors: { ghost: { cmd: 'awm-nonexistent-binary-xyz --check', fast: true } },
+            pack: 'js-ts',
+            sensors: { security: { cmd: 'awm-nonexistent-binary-xyz .', fast: true } },
         }));
         const out = (0, run_1.runSensors)({ cwd: root });
-        const ghost = out.sensors.find((s) => s.name === 'ghost');
-        expect(ghost?.status).toBe('fail');
+        const security = out.sensors.find((s) => s.name === 'security');
+        expect(security?.status).toBe('fail');
+        expect(security?.errors[0].message).toMatch(/not available/i);
         expect(out.overall).toBe('fail');
     });
 });

package/dist/tests/core/init/orchestrator.test.js

@@ -96,6 +96,34 @@ describe('runInitSteps — orchestrator', () => {
             fs_1.default.rmSync(bareCwd, { recursive: true, force: true });
         }
     });
+    it('machine-only inside an already-initialized project with unsynced bundles still reaches overall healthy', async () => {
+        // Reproduces a real Codex Cloud bootstrap: `awm init --agent codex --yes
+        // --machine-only` run with cwd inside an existing, previously-initialized
+        // project (its own `.awm/profile.json` already committed, declaring bundles
+        // this machine-only run was never asked to sync). The bare-cwd test above
+        // can't catch this — there, `ctx.project` is null for two reasons at once
+        // (machineOnly AND no project exists), so it never exercises "machineOnly
+        // nulled a project that actually has real, degraded content."
+        const root = path_1.default.join(tmpHome, 'existing-project');
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), JSON.stringify({ dependencies: { next: '14.0.0' } }));
+        // Declares the "dev" bundle active, but its skills were never symlinked —
+        // exactly `active bundles (N missing)` in the real report the user saw.
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'profile.json'), JSON.stringify({ extensions: ['dev'] }));
+        const deps = buildDeps(root);
+        deps.ctx.project = null; // what init.ts's effectiveCtx does for --machine-only
+        const { runInitSteps } = require('../../../src/core/init/orchestrator');
+        const out = await runInitSteps(deps);
+        // The steps this run actually attempted (machine-only) all succeeded —
+        // that must be reflected in the caller's exit code.
+        expect(out.steps.every((s) => s.action !== 'failed')).toBe(true);
+        expect(out.after.results.find((r) => r.id === 'machine.devCore')?.status).toBe('ok');
+        // Project state exists and IS genuinely degraded, and it must stay visible
+        // in the report (the CLI's own render still shows it) — but it must not
+        // drag down the overall verdict for a run that never touched project scope.
+        expect(out.after.results.some((r) => r.id === 'project.activation' && r.status === 'missing')).toBe(true);
+        expect(out.after.overall).toBe('healthy');
+    });
     it('project repo: applies activation/sensors, flags constitution+context as pending', async () => {
         const root = path_1.default.join(tmpHome, 'repo');
         fs_1.default.mkdirSync(path_1.default.join(root, '.awm'), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"