agentic-workflow-manager 3.4.0 → 3.6.0

package/dist/tests/commands/sensors/exec.test.js

@@ -0,0 +1,91 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const exec_1 = require("../../../src/commands/sensors/exec");
+const onPosix = process.platform !== 'win32' ? describe : describe.skip;
+/** Poll until `fn()` is true or the budget runs out. Avoids fixed sleeps. */
+async function until(fn, budgetMs = 4000) {
+    const deadline = Date.now() + budgetMs;
+    while (Date.now() < deadline) {
+        if (fn())
+            return true;
+        await new Promise(r => setTimeout(r, 25));
+    }
+    return fn();
+}
+describe('runCommand — exit codes and output', () => {
+    it('returns stdout and code 0 for a clean command', async () => {
+        const r = await (0, exec_1.runCommand)('echo hello', { timeout: 5000, cwd: process.cwd() });
+        expect(r.code).toBe(0);
+        expect(r.stdout.trim()).toBe('hello');
+        expect(r.timedOut).toBe(false);
+        expect(r.overflowed).toBe(false);
+    });
+    it('captures stderr and a non-zero exit code without throwing', async () => {
+        const r = await (0, exec_1.runCommand)('echo oops 1>&2; exit 3', { timeout: 5000, cwd: process.cwd() });
+        expect(r.code).toBe(3);
+        expect(r.stderr).toMatch(/oops/);
+        expect(r.timedOut).toBe(false);
+    });
+    it('reports 127 for a command that does not exist', async () => {
+        const r = await (0, exec_1.runCommand)('awm-definitely-not-a-real-binary-xyz', { timeout: 5000, cwd: process.cwd() });
+        expect(r.code).toBe(127);
+    });
+});
+describe('runCommand — output cap', () => {
+    it('stops at maxBuffer, flags overflow, and keeps what it read', async () => {
+        // 200 lines of ~50 bytes each, capped at 1KB.
+        const r = await (0, exec_1.runCommand)(`for i in $(seq 1 200); do echo "line-$i-padding-padding-padding-padding"; done`, {
+            timeout: 10_000, cwd: process.cwd(), maxBuffer: 1024,
+        });
+        expect(r.overflowed).toBe(true);
+        expect(r.stdout.length).toBeLessThanOrEqual(1024);
+        // The point of the cap change: what was read is still usable, not discarded.
+        expect(r.stdout).toMatch(/line-1-/);
+    });
+});
+onPosix('runCommand — timeout', () => {
+    it('flags the timeout and returns the output produced before the deadline', async () => {
+        const r = await (0, exec_1.runCommand)('echo partial-finding; sleep 30', { timeout: 700, cwd: process.cwd() });
+        expect(r.timedOut).toBe(true);
+        // This is the whole point of dropping execSync: 700ms of work is not thrown away.
+        expect(r.stdout).toMatch(/partial-finding/);
+    });
+    it('kills the grandchild process, not just the shell it spawned', async () => {
+        // Models `npx tsc --noEmit`: the sensor command is a wrapper that spawns the
+        // real tool. execSync SIGTERMs only the shell it started, leaving the tool
+        // running and reparented to init — the leak that compounds across retries.
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-exec-group-'));
+        const beat = path_1.default.join(dir, 'beat');
+        const worker = path_1.default.join(dir, 'worker.js');
+        fs_1.default.writeFileSync(worker, `
+            const fs = require('fs');
+            setInterval(() => fs.writeFileSync(${JSON.stringify(beat)}, String(Date.now())), 30);
+            setTimeout(() => {}, 60000);
+        `);
+        try {
+            const r = await (0, exec_1.runCommand)(`sh -c "node ${worker} & wait"`, { timeout: 800, cwd: dir });
+            expect(r.timedOut).toBe(true);
+            // The worker must have been alive before the kill, or the test proves nothing.
+            expect(await until(() => fs_1.default.existsSync(beat))).toBe(true);
+            const atKill = fs_1.default.readFileSync(beat, 'utf-8');
+            const stillBeating = await until(() => fs_1.default.readFileSync(beat, 'utf-8') !== atKill, 1000);
+            expect(stillBeating).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    }, 15_000);
+});
+describe('runCommand — spawn failure', () => {
+    it('surfaces a spawn error instead of hanging', async () => {
+        const r = await (0, exec_1.runCommand)('echo hi', { timeout: 5000, cwd: path_1.default.join(os_1.default.tmpdir(), 'awm-no-such-dir-xyz') });
+        expect(r.spawnError).toBeDefined();
+        expect(r.code).not.toBe(0);
+    });
+});

package/dist/tests/commands/sensors/run-inconclusive.test.js

@@ -6,10 +6,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
-const mockExecSyncFn = jest.fn();
-jest.mock('child_process', () => ({
-    execSync: (...args) => mockExecSyncFn(...args),
+const mockRunCommand = jest.fn();
+jest.mock('../../../src/commands/sensors/exec', () => ({
+    runCommand: (...args) => mockRunCommand(...args),
 }));
+const { ok, exited, timedOut, overflowed } = require('./exec-fixtures');
 /** Sensors run in manifest insertion order, so mocks are queued in that order. */
 const MANIFEST = {
     pack: 'js-ts',
@@ -18,14 +19,14 @@ const MANIFEST = {
         security: { cmd: 'semgrep .', fast: false },
     },
 };
-const timeoutError = () => { throw Object.assign(new Error('killed'), { code: 'ETIMEDOUT' }); };
+const timeoutError = () => timedOut();
 describe('runSensors — inconclusive: a sensor that could not certify is never green', () => {
     let root;
     let fakeAwmHome;
     let prevAwmHome;
     beforeEach(() => {
         jest.resetModules();
-        mockExecSyncFn.mockReset();
+        mockRunCommand.mockReset();
         root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-inconclusive-'));
         fs_1.default.mkdirSync(path_1.default.join(root, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify(MANIFEST));
@@ -40,55 +41,51 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
         fs_1.default.rmSync(fakeAwmHome, { recursive: true, force: true });
     });
     const load = () => require('../../../src/commands/sensors/run');
-    it('reports a timed-out sensor as inconclusive, keeping its reason', () => {
-        mockExecSyncFn
-            .mockReturnValueOnce('') // typecheck: clean
-            .mockImplementationOnce(timeoutError); // security: times out
+    it('reports a timed-out sensor as inconclusive, keeping its reason', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(ok()) // typecheck: clean
+            .mockResolvedValueOnce(timeoutError()); // security: times out
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         const security = out.sensors.find((s) => s.name === 'security');
         expect(security.status).toBe('inconclusive');
         expect(security.skipReason).toMatch(/timeout/);
     });
-    it('does not let a healthy sensor carry the run to pass while another could not certify', () => {
-        mockExecSyncFn
-            .mockReturnValueOnce('')
-            .mockImplementationOnce(timeoutError);
+    it('does not let a healthy sensor carry the run to pass while another could not certify', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(ok())
+            .mockResolvedValueOnce(timeoutError());
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         expect(out.sensors.find((s) => s.name === 'typecheck').status).toBe('pass');
         expect(out.overall).toBe('not_certified');
     });
-    it('reports a sensor whose output was truncated as inconclusive', () => {
-        mockExecSyncFn
-            .mockReturnValueOnce('')
-            .mockImplementationOnce(() => { throw Object.assign(new Error('too big'), { code: 'ENOBUFS' }); });
+    it('reports a sensor whose output was truncated as inconclusive', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(ok())
+            .mockResolvedValueOnce(overflowed());
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         const security = out.sensors.find((s) => s.name === 'security');
         expect(security.status).toBe('inconclusive');
         expect(security.skipReason).toMatch(/exceeded/);
         expect(out.overall).toBe('not_certified');
     });
-    it('reports an uninterpretable non-zero exit as inconclusive', () => {
-        mockExecSyncFn
-            .mockReturnValueOnce('')
-            .mockImplementationOnce(() => {
+    it('reports an uninterpretable non-zero exit as inconclusive', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(ok())
             // semgrep formatter yields no findings for non-JSON output, the
             // tool is present (exit 2, not 127), and `security` is not an
             // exit-code sensor — the residual "I don't know" case.
-            throw Object.assign(new Error('failed'), {
-                stdout: '', stderr: 'internal error: rule engine crashed\n', status: 2,
-            });
-        });
+            .mockResolvedValueOnce(exited(2, '', 'internal error: rule engine crashed\n'));
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         const security = out.sensors.find((s) => s.name === 'security');
         expect(security.status).toBe('inconclusive');
         expect(security.skipReason).toMatch(/exit 2/);
         expect(out.overall).toBe('not_certified');
     });
-    it('reports an enabled sensor with no cmd as inconclusive', () => {
+    it('reports an enabled sensor with no cmd as inconclusive', async () => {
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: {
@@ -96,29 +93,25 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
                 depcheck: { fast: false }, // enabled, but nothing to run
             },
         }));
-        mockExecSyncFn.mockReturnValueOnce(''); // typecheck: clean
+        mockRunCommand.mockResolvedValueOnce(ok()); // typecheck: clean
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         const depcheck = out.sensors.find((s) => s.name === 'depcheck');
         expect(depcheck.status).toBe('inconclusive');
         expect(depcheck.skipReason).toBe('no cmd configured');
         expect(out.overall).toBe('not_certified');
     });
-    it('reports fail, not not_certified, when something is broken and something could not run', () => {
-        mockExecSyncFn
-            .mockImplementationOnce(() => {
-            throw Object.assign(new Error(), {
-                stdout: 'src/a.ts(1,1): error TS0001: Bad type.', stderr: '', status: 1,
-            });
-        })
-            .mockImplementationOnce(timeoutError); // security: times out
+    it('reports fail, not not_certified, when something is broken and something could not run', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(exited(1, 'src/a.ts(1,1): error TS0001: Bad type.')) // typecheck: real findings
+            .mockResolvedValueOnce(timeoutError()); // security: times out
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         expect(out.sensors.find((s) => s.name === 'typecheck').status).toBe('fail');
         expect(out.sensors.find((s) => s.name === 'security').status).toBe('inconclusive');
         expect(out.overall).toBe('fail');
     });
-    it('never emits an overall value outside the published domain', () => {
+    it('never emits an overall value outside the published domain', async () => {
         // `inconclusive` is a per-sensor status only. External consumers (the
         // registry skills) read `overall`, whose domain must not grow — this
         // pins that invariant at runtime on a three-sensor pass+fail+inconclusive
@@ -137,20 +130,16 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
             },
         }));
         const DOMAIN = ['pass', 'fail', 'skipped', 'not_certified'];
-        mockExecSyncFn
-            .mockImplementationOnce(() => {
-            throw Object.assign(new Error(), {
-                stdout: 'src/a.ts(1,1): error TS0001: Bad type.', stderr: '', status: 1,
-            });
-        })
-            .mockReturnValueOnce('') // lint: clean → pass
-            .mockImplementationOnce(timeoutError); // security: times out → inconclusive
+        mockRunCommand
+            .mockResolvedValueOnce(exited(1, 'src/a.ts(1,1): error TS0001: Bad type.')) // typecheck: real findings → fail
+            .mockResolvedValueOnce(ok()) // lint: clean → pass
+            .mockResolvedValueOnce(timeoutError()); // security: times out → inconclusive
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         expect(DOMAIN).toContain(out.overall);
         expect(out.overall).not.toBe('inconclusive');
     });
-    it('keeps a deliberately disabled sensor apart from one that could not certify', () => {
+    it('keeps a deliberately disabled sensor apart from one that could not certify', async () => {
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: {
@@ -158,17 +147,17 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
                 mutation: { cmd: 'npx stryker run', enabled: false },
             },
         }));
-        mockExecSyncFn.mockImplementationOnce(timeoutError); // security: times out
+        mockRunCommand.mockResolvedValueOnce(timeoutError()); // security: times out
         // mutation: never invoked
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         // Same run, two different meanings — the whole point of the split.
         expect(out.sensors.find((s) => s.name === 'mutation').status).toBe('skipped');
         expect(out.sensors.find((s) => s.name === 'mutation').skipReason).toBe('disabled');
         expect(out.sensors.find((s) => s.name === 'security').status).toBe('inconclusive');
         expect(out.overall).toBe('not_certified');
     });
-    it('does not degrade the verdict for a disabled sensor alongside healthy ones', () => {
+    it('does not degrade the verdict for a disabled sensor alongside healthy ones', async () => {
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: {
@@ -176,12 +165,12 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
                 mutation: { cmd: 'npx stryker run', enabled: false },
             },
         }));
-        mockExecSyncFn.mockReturnValueOnce('');
+        mockRunCommand.mockResolvedValueOnce(ok());
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         expect(out.overall).toBe('pass');
     });
-    it('still refuses to certify a tree whose sensors are all disabled', () => {
+    it('still refuses to certify a tree whose sensors are all disabled', async () => {
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: {
@@ -191,25 +180,25 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
         }));
         fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}'); // real stack indicator
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         expect(out.sensors.every((s) => s.status === 'skipped')).toBe(true);
         expect(out.overall).toBe('not_certified');
-        expect(mockExecSyncFn).not.toHaveBeenCalled();
+        expect(mockRunCommand).not.toHaveBeenCalled();
     });
-    it('leaves an inconclusive result untouched when a baseline is applied', () => {
+    it('leaves an inconclusive result untouched when a baseline is applied', async () => {
         const { writeBaseline } = require('../../../src/commands/sensors/baseline');
         writeBaseline(root, { security: ['some-accepted-fingerprint'] });
-        mockExecSyncFn
-            .mockReturnValueOnce('')
-            .mockImplementationOnce(timeoutError);
+        mockRunCommand
+            .mockResolvedValueOnce(ok())
+            .mockResolvedValueOnce(timeoutError());
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         const security = out.sensors.find((s) => s.name === 'security');
         expect(security.status).toBe('inconclusive');
         expect(security.baselineCount).toBeUndefined();
         expect(out.overall).toBe('not_certified');
     });
-    it('applyBaseline leaves an inconclusive result untouched even if it somehow carried findings', () => {
+    it('applyBaseline leaves an inconclusive result untouched even if it somehow carried findings', async () => {
         // Every current `inconclusive` producer sets `errors: []`, so a test built
         // on the public `runSensors()` API can't tell "the explicit guard fired"
         // apart from "fell through to partition() and incidentally suppressed 0

package/dist/tests/commands/sensors/run-partial.test.js

@@ -0,0 +1,225 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const mockRunCommand = jest.fn();
+jest.mock('../../../src/commands/sensors/exec', () => ({
+    runCommand: (...args) => mockRunCommand(...args),
+}));
+const { ok, timedOut, overflowed } = require('./exec-fixtures');
+const TS_FINDING = 'src/a.ts(1,1): error TS0001: Bad type.';
+function project(sensors) {
+    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-partial-'));
+    fs_1.default.mkdirSync(path_1.default.join(dir, '.awm'), { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), JSON.stringify({ pack: 'js-ts', sensors }));
+    return dir;
+}
+describe('runSensors — a cut-short run keeps the findings it did produce', () => {
+    let dir;
+    let prevAwmHome;
+    let fakeAwmHome;
+    beforeEach(() => {
+        jest.resetModules();
+        mockRunCommand.mockReset();
+        // CLAUDE.md: no test may reach the real ~/.awm.
+        fakeAwmHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-home-'));
+        prevAwmHome = process.env.AWM_HOME;
+        process.env.AWM_HOME = fakeAwmHome;
+    });
+    afterEach(() => {
+        process.env.AWM_HOME = prevAwmHome;
+        if (dir)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        fs_1.default.rmSync(fakeAwmHome, { recursive: true, force: true });
+    });
+    const load = () => require('../../../src/commands/sensors/run');
+    it('reports findings from partial output as fail instead of discarding them', async () => {
+        // The regression this guards: the old runner threw away everything a
+        // timed-out sensor had printed, so a 60s lint run that had already found
+        // real errors reported zero — and the caller re-ran it by hand to learn
+        // what it had just paid for.
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true } });
+        mockRunCommand.mockResolvedValueOnce(timedOut(TS_FINDING));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.status).toBe('fail');
+        expect(tc.errors).toHaveLength(1);
+        expect(tc.errors[0].message).toMatch(/Bad type/);
+        expect(out.overall).toBe('fail');
+    });
+    it('marks the partial fail as incomplete so absence of findings is not read as coverage', async () => {
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true, timeout: 30000 } });
+        mockRunCommand.mockResolvedValueOnce(timedOut(TS_FINDING));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.incomplete).toMatch(/timeout after 30000ms/);
+        expect(tc.incomplete).toMatch(/did not finish/);
+    });
+    it('still refuses to certify when the partial output is clean', async () => {
+        // A clean partial proves nothing — the findings could all be in the part
+        // that never ran. This must stay inconclusive, never pass.
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true } });
+        mockRunCommand.mockResolvedValueOnce(timedOut('Checking 400 files...\n'));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.status).toBe('inconclusive');
+        expect(tc.skipReason).toMatch(/timeout/);
+        expect(tc.incomplete).toBeUndefined();
+        expect(out.overall).toBe('not_certified');
+    });
+    it('applies the same rule to output-cap overflow', async () => {
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true } });
+        mockRunCommand.mockResolvedValueOnce(overflowed(TS_FINDING));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.status).toBe('fail');
+        expect(tc.incomplete).toMatch(/exceeded/);
+    });
+    it('fails the sensor when the shell could not be started', async () => {
+        const { spawnFailed } = require('./exec-fixtures');
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true } });
+        mockRunCommand.mockResolvedValueOnce(spawnFailed('spawn /bin/sh ENOENT'));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.status).toBe('fail');
+        expect(tc.errors[0].message).toMatch(/could not be started/);
+        expect(out.overall).toBe('fail');
+    });
+    it('lets the baseline suppress a finding that came from partial output', async () => {
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true } });
+        const { buildBaseline, writeBaseline } = require('../../../src/commands/sensors/baseline');
+        const { parseTscOutput } = require('../../../src/commands/sensors/formatters/tsc');
+        writeBaseline(dir, buildBaseline([{ name: 'typecheck', errors: parseTscOutput(TS_FINDING) }]));
+        mockRunCommand.mockResolvedValueOnce(timedOut(TS_FINDING));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.status).toBe('pass');
+        expect(tc.baselineCount).toBe(1);
+    });
+});
+describe('runSensors — sensors run concurrently', () => {
+    let dir;
+    let prevAwmHome;
+    let prevConcurrency;
+    let fakeAwmHome;
+    beforeEach(() => {
+        jest.resetModules();
+        mockRunCommand.mockReset();
+        fakeAwmHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-home-'));
+        prevAwmHome = process.env.AWM_HOME;
+        prevConcurrency = process.env.AWM_SENSORS_CONCURRENCY;
+        process.env.AWM_HOME = fakeAwmHome;
+    });
+    afterEach(() => {
+        process.env.AWM_HOME = prevAwmHome;
+        if (prevConcurrency === undefined)
+            delete process.env.AWM_SENSORS_CONCURRENCY;
+        else
+            process.env.AWM_SENSORS_CONCURRENCY = prevConcurrency;
+        if (dir)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        fs_1.default.rmSync(fakeAwmHome, { recursive: true, force: true });
+    });
+    const load = () => require('../../../src/commands/sensors/run');
+    /** Resolves after `ms`, recording when it started and finished. */
+    const timed = (log, label, ms) => () => new Promise((resolve) => {
+        log.push([`${label}:start`, Date.now()]);
+        setTimeout(() => { log.push([`${label}:end`, Date.now()]); resolve(ok()); }, ms);
+    });
+    const THREE = {
+        typecheck: { cmd: 'a', fast: true },
+        lint: { cmd: 'b', fast: true },
+        security: { cmd: 'c', fast: true },
+    };
+    it('starts every sensor before the first one finishes', async () => {
+        process.env.AWM_SENSORS_CONCURRENCY = '3';
+        dir = project(THREE);
+        const log = [];
+        mockRunCommand
+            .mockImplementationOnce(timed(log, 'typecheck', 120))
+            .mockImplementationOnce(timed(log, 'lint', 120))
+            .mockImplementationOnce(timed(log, 'security', 120));
+        const { runSensors } = load();
+        await runSensors({ cwd: dir });
+        const order = log.map(([label]) => label);
+        // All three starts precede the first end — that is what serial execution
+        // could not do, and the reason wall clock stops being the sum.
+        expect(order.slice(0, 3)).toEqual(['typecheck:start', 'lint:start', 'security:start']);
+        expect(order[3]).toMatch(/:end$/);
+    });
+    it('honours a concurrency of 1 by running them strictly one at a time', async () => {
+        process.env.AWM_SENSORS_CONCURRENCY = '1';
+        dir = project(THREE);
+        const log = [];
+        mockRunCommand
+            .mockImplementationOnce(timed(log, 'typecheck', 30))
+            .mockImplementationOnce(timed(log, 'lint', 30))
+            .mockImplementationOnce(timed(log, 'security', 30));
+        const { runSensors } = load();
+        await runSensors({ cwd: dir });
+        expect(log.map(([label]) => label)).toEqual([
+            'typecheck:start', 'typecheck:end',
+            'lint:start', 'lint:end',
+            'security:start', 'security:end',
+        ]);
+    });
+    it('reports results in manifest order regardless of which sensor finishes first', async () => {
+        process.env.AWM_SENSORS_CONCURRENCY = '3';
+        dir = project(THREE);
+        const log = [];
+        // Deliberately inverted durations: security finishes first, typecheck last.
+        mockRunCommand
+            .mockImplementationOnce(timed(log, 'typecheck', 90))
+            .mockImplementationOnce(timed(log, 'lint', 50))
+            .mockImplementationOnce(timed(log, 'security', 10));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        expect(out.sensors.map((s) => s.name)).toEqual(['typecheck', 'lint', 'security']);
+    });
+});
+describe('resolveConcurrency', () => {
+    const load = () => require('../../../src/commands/sensors/run');
+    let prev;
+    beforeEach(() => { jest.resetModules(); prev = process.env.AWM_SENSORS_CONCURRENCY; });
+    afterEach(() => {
+        if (prev === undefined)
+            delete process.env.AWM_SENSORS_CONCURRENCY;
+        else
+            process.env.AWM_SENSORS_CONCURRENCY = prev;
+    });
+    it('never exceeds the number of sensors to run', () => {
+        delete process.env.AWM_SENSORS_CONCURRENCY;
+        const { resolveConcurrency } = load();
+        expect(resolveConcurrency({ pack: 'js-ts', sensors: {} }, 1)).toBe(1);
+    });
+    it('caps at 4 even on a large box', () => {
+        delete process.env.AWM_SENSORS_CONCURRENCY;
+        const { resolveConcurrency } = load();
+        expect(resolveConcurrency({ pack: 'js-ts', sensors: {} }, 32)).toBeLessThanOrEqual(4);
+    });
+    it('lets the manifest pin it', () => {
+        delete process.env.AWM_SENSORS_CONCURRENCY;
+        const { resolveConcurrency } = load();
+        expect(resolveConcurrency({ pack: 'js-ts', sensors: {}, concurrency: 2 }, 8)).toBe(2);
+    });
+    it('lets the environment override the manifest', () => {
+        process.env.AWM_SENSORS_CONCURRENCY = '1';
+        const { resolveConcurrency } = load();
+        expect(resolveConcurrency({ pack: 'js-ts', sensors: {}, concurrency: 4 }, 8)).toBe(1);
+    });
+    it('ignores nonsense and falls back to the derived cap', () => {
+        process.env.AWM_SENSORS_CONCURRENCY = 'banana';
+        const { resolveConcurrency } = load();
+        expect(resolveConcurrency({ pack: 'js-ts', sensors: {} }, 8)).toBeGreaterThanOrEqual(1);
+    });
+});

package/dist/tests/commands/sensors/run-tool-missing.test.js

@@ -36,23 +36,23 @@ describe('runSensors — an absent tool never reads as green (real /bin/sh)', ()
         roots.push(root);
         return root;
     };
-    it('marks a sensor whose binary is absent as fail, not skipped', () => {
+    it('marks a sensor whose binary is absent as fail, not skipped', async () => {
         const root = project({ security: { cmd: `${MISSING_BIN} .`, fast: true } });
-        const out = (0, run_1.runSensors)({ cwd: root });
+        const out = await (0, run_1.runSensors)({ cwd: root });
         const security = out.sensors.find(s => s.name === 'security');
         expect(security.status).toBe('fail');
         expect(security.errors[0].message).toMatch(/not available/i);
     });
-    it('does not let a healthy sensor carry the run to pass while another tool is absent', () => {
+    it('does not let a healthy sensor carry the run to pass while another tool is absent', async () => {
         const root = project({
             typecheck: { cmd: 'node -e ""', fast: true },
             security: { cmd: `${MISSING_BIN} .`, fast: true },
         });
-        const out = (0, run_1.runSensors)({ cwd: root });
+        const out = await (0, run_1.runSensors)({ cwd: root });
         expect(out.sensors.find(s => s.name === 'typecheck').status).toBe('pass');
         expect(out.overall).toBe('fail');
     });
-    it('does not misread a tool that ran and merely printed "not found" as an absent tool', () => {
+    it('does not misread a tool that ran and merely printed "not found" as an absent tool', async () => {
         // Exits 1, not 127: the binary existed and reported something of its own.
         // Classifying this as a missing tool would be a false accusation. It also
         // must not read as a benign 'skipped': the formatter parsed no findings
@@ -61,7 +61,7 @@ describe('runSensors — an absent tool never reads as green (real /bin/sh)', ()
         const root = project({
             security: { cmd: `node -e "console.error('rule pack not found'); process.exit(1)"`, fast: true },
         });
-        const out = (0, run_1.runSensors)({ cwd: root });
+        const out = await (0, run_1.runSensors)({ cwd: root });
         const security = out.sensors.find(s => s.name === 'security');
         expect(security.status).toBe('inconclusive');
         expect(security.errors).toEqual([]);