agentic-workflow-manager 3.5.0 → 3.7.0

package/dist/src/commands/sensors/changed.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.changedFiles = changedFiles;
+exports.applyChangedCmd = applyChangedCmd;
+exports.filterByExtension = filterByExtension;
+const child_process_1 = require("child_process");
+const path_1 = __importDefault(require("path"));
+function git(args, cwd) {
+    return (0, child_process_1.execFileSync)('git', args, {
+        cwd,
+        encoding: 'utf-8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+}
+/**
+ * The default comparison point. `merge-base HEAD <base>` — not `base` directly —
+ * so a branch that is merely *behind* its base does not report every file the base
+ * moved on as "changed" by this branch.
+ */
+function mergeBase(base, cwd) {
+    return git(['merge-base', 'HEAD', base], cwd).trim();
+}
+/**
+ * Files this working tree changed relative to `base`.
+ *
+ * Deliberately a union of four sources: the committed diff since the merge base,
+ * plus staged, unstaged and untracked files. A sensor gate runs mid-work, where the
+ * interesting edits are usually not committed yet — a committed-only diff would scope
+ * the run to a stale set and certify files nobody is editing.
+ *
+ * Untracked files are included but ignored files are not (`--exclude-standard`), so
+ * `node_modules` and build output never enter the scope.
+ *
+ * Never throws: a failure to resolve the scope returns `error`, and the caller
+ * degrades to the unscoped command rather than guessing at a narrower one.
+ */
+function changedFiles(cwd, base = 'HEAD') {
+    let out = [];
+    try {
+        // `HEAD` means "everything not yet committed" — no merge-base needed, and it
+        // is the right default for a gate that runs before the work is committed.
+        if (base !== 'HEAD') {
+            const from = mergeBase(base, cwd);
+            out = out.concat(git(['diff', '--name-only', '--diff-filter=d', from, 'HEAD'], cwd).split('\n'));
+        }
+        out = out.concat(git(['diff', '--name-only', '--diff-filter=d', 'HEAD'], cwd).split('\n'));
+        out = out.concat(git(['diff', '--name-only', '--diff-filter=d', '--cached'], cwd).split('\n'));
+        out = out.concat(git(['ls-files', '--others', '--exclude-standard'], cwd).split('\n'));
+    }
+    catch (e) {
+        return { files: [], error: e.message.split('\n')[0] };
+    }
+    const files = Array.from(new Set(out.map(s => s.trim()).filter(Boolean))).sort();
+    return { files };
+}
+/**
+ * Quote a path for a shell command line. Sensor commands are strings run through a
+ * shell, so a path with a space or a quote in it would otherwise split into two
+ * arguments — or, worse, end the quoting and let the rest of the name be read as
+ * shell syntax. Single quotes with the `'\''` escape are the only form POSIX shells
+ * treat as fully literal.
+ */
+function shellQuote(file) {
+    return `'${file.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Substitute the file list into a `changedCmd` template.
+ *
+ * The template must contain `{files}`. A template without it would silently run over
+ * the whole repo while the output claimed the run was scoped, so that case is
+ * rejected by the caller rather than papered over here.
+ */
+function applyChangedCmd(template, files) {
+    return template.replace('{files}', files.map(shellQuote).join(' '));
+}
+/**
+ * Narrow the changed set to what a given sensor can be handed.
+ *
+ * The changed set is everything the tree touched — a README, a lockfile, a PNG. The
+ * tools do not shrug those off: eslint given a `.md` fails rather than skipping it,
+ * so an unfiltered scoped run would turn "you edited the docs" into a red gate.
+ *
+ * Case-insensitive because Windows and macOS checkouts routinely carry `.TS`/`.Ts`,
+ * and a case-sensitive match would silently drop those files from the scope — the
+ * quiet direction of wrong, where the sensor reports clean over files it never saw.
+ */
+function filterByExtension(files, extensions) {
+    if (!extensions || extensions.length === 0)
+        return files;
+    const allowed = new Set(extensions.map(e => e.toLowerCase()));
+    return files.filter(f => allowed.has(path_1.default.extname(f).toLowerCase()));
+}

package/dist/src/commands/sensors/exec.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCommand = runCommand;
+const child_process_1 = require("child_process");
+const DEFAULT_MAX_BUFFER = 64 * 1024 * 1024;
+const DEFAULT_KILL_GRACE_MS = 2_000;
+/** After SIGKILL, resolve regardless. A sensor must never hang the gate. */
+const POST_KILL_GRACE_MS = 1_000;
+/**
+ * Kill an entire process tree, not just its root.
+ *
+ * This is the reason `execSync` had to go. `execSync(cmd, { timeout })` spawns
+ * `/bin/sh -c cmd` and, on the deadline, SIGTERMs *that shell only*. A sensor
+ * command is almost always a wrapper (`npx tsc --noEmit`, `npm test`), so the
+ * tool doing the actual work is a grandchild: it survives, gets reparented to
+ * init, and keeps burning CPU. Every timeout then leaves a full tsc/eslint
+ * running, which makes the next run slower, which makes it time out too. The
+ * leak compounds — a repo that was fine at 200 files becomes ungateable at 2000
+ * for reasons that have nothing to do with its size.
+ *
+ * `detached: true` puts the child in its own process group (pgid === pid) so a
+ * negative-pid kill reaches every descendant at once.
+ */
+function killTree(pid, signal) {
+    if (process.platform === 'win32') {
+        // Windows has no process groups in the POSIX sense; taskkill /T walks the tree.
+        try {
+            (0, child_process_1.execFile)('taskkill', ['/pid', String(pid), '/T', '/F'], () => { });
+        }
+        catch { /* ignore */ }
+        return;
+    }
+    try {
+        process.kill(-pid, signal); // negative pid → the whole group
+    }
+    catch {
+        // Group already gone (normal race with a process exiting on its own),
+        // or we never became a group leader. Fall back to the direct child.
+        try {
+            process.kill(pid, signal);
+        }
+        catch { /* already dead */ }
+    }
+}
+/**
+ * Run a shell command to completion, a deadline, or an output cap — whichever
+ * comes first — and always return what was collected.
+ *
+ * Two guarantees `execSync` could not give:
+ *  1. Cutting a run short kills the whole process tree (see `killTree`).
+ *  2. Output produced before the cut is returned, not discarded. A timeout that
+ *     throws away 60s of eslint output costs double: the wall clock, and then
+ *     the re-run the caller has to do to learn anything at all.
+ */
+function runCommand(cmd, opts) {
+    const maxBuffer = opts.maxBuffer ?? DEFAULT_MAX_BUFFER;
+    const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
+    return new Promise((resolve) => {
+        let stdout = '';
+        let stderr = '';
+        let timedOut = false;
+        let overflowed = false;
+        let settled = false;
+        const timers = [];
+        const child = (0, child_process_1.spawn)(cmd, {
+            shell: true,
+            cwd: opts.cwd,
+            detached: process.platform !== 'win32',
+            // stdin closed: a sensor must never block waiting for input, and the
+            // EOF also tells watch-mode-capable tools (vitest, jest) to run once.
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const later = (fn, ms) => {
+            const t = setTimeout(fn, ms);
+            t.unref?.();
+            timers.push(t);
+            return t;
+        };
+        const finish = (extra) => {
+            if (settled)
+                return;
+            settled = true;
+            timers.forEach(clearTimeout);
+            resolve({ stdout, stderr, code: null, signal: null, timedOut, overflowed, ...extra });
+        };
+        /** Cut the run short: kill the tree, escalate, and never hang waiting for it. */
+        const cutShort = () => {
+            if (settled || child.pid === undefined)
+                return;
+            const pid = child.pid;
+            killTree(pid, 'SIGTERM');
+            later(() => killTree(pid, 'SIGKILL'), killGraceMs);
+            // If `close` still has not fired after the escalation, stop waiting.
+            // Whatever is holding the pipe open is no longer our problem to block on.
+            later(() => { child.unref(); finish({ signal: 'SIGKILL' }); }, killGraceMs + POST_KILL_GRACE_MS);
+        };
+        const collect = (into) => (chunk) => {
+            if (settled || overflowed)
+                return;
+            const text = String(chunk);
+            const current = into === 'out' ? stdout : stderr;
+            const room = maxBuffer - current.length;
+            const next = current + (text.length > room ? text.slice(0, room) : text);
+            if (into === 'out')
+                stdout = next;
+            else
+                stderr = next;
+            if (next.length >= maxBuffer) {
+                overflowed = true;
+                cutShort();
+            }
+        };
+        child.stdout?.on('data', collect('out'));
+        child.stderr?.on('data', collect('err'));
+        child.stdout?.on('error', () => { });
+        child.stderr?.on('error', () => { });
+        child.on('error', (err) => finish({ spawnError: err }));
+        child.on('close', (code, signal) => finish({ code, signal }));
+        later(() => { timedOut = true; cutShort(); }, opts.timeout);
+    });
+}

package/dist/src/commands/sensors/index.js

@@ -27,8 +27,13 @@ function registerSensorsCommand(program) {
         .option('--fast', 'run fast sensors only (tsc, lint)')
         .option('--slow', 'run slow sensors only (semgrep, mutation)')
         .option('--all', 'run all sensors regardless of speed')
-        .action((opts) => {
-        const output = (0, run_1.runSensors)({ fast: opts.fast, slow: opts.slow, all: opts.all });
+        .option('--changed', 'scope sensors that support it to the files changed vs --base')
+        .option('--base <ref>', 'comparison point for --changed (default: HEAD, i.e. uncommitted work)')
+        .action(async (opts) => {
+        const output = await (0, run_1.runSensors)({
+            fast: opts.fast, slow: opts.slow, all: opts.all,
+            changed: opts.changed, base: opts.base,
+        });
         // Emit the verdict ALWAYS — an empty `sensors` with overall:'not_certified'
         // must be visible, never a silent exit-0 that reads as "clean".
         process.stdout.write(JSON.stringify(output, null, 2) + '\n');
@@ -51,9 +56,9 @@ function registerSensorsCommand(program) {
     sensors
         .command('baseline')
         .description('snapshot current findings as accepted — sensors then fail only on NEW ones')
-        .action(() => {
+        .action(async () => {
         const manifestDir = (0, run_1.findManifestDir)(process.cwd());
-        const output = (0, run_1.runSensors)({ all: true, ignoreBaseline: true });
+        const output = await (0, run_1.runSensors)({ all: true, ignoreBaseline: true });
         const baseline = (0, baseline_1.buildBaseline)(output.sensors.map(s => ({ name: s.name, errors: s.errors })));
         const writeDir = manifestDir ?? process.cwd();
         (0, baseline_1.writeBaseline)(writeDir, baseline);

package/dist/src/commands/sensors/init.js

@@ -68,6 +68,14 @@ function readPackDefaults(pack, registryRoot, cwd) {
             entry.fast = def.fast;
         if (def.enabled !== undefined)
             entry.enabled = def.enabled;
+        // Carried through verbatim: without these in the written manifest, a pack can
+        // declare a sensor scopable and `--changed` would silently run it in full —
+        // the flag would look supported and do nothing. `{{SOURCE_DIRS}}` is not
+        // substituted here on purpose: a scoped command takes an explicit file list.
+        if (def.changedCmd)
+            entry.changedCmd = def.changedCmd;
+        if (def.changedExtensions)
+            entry.changedExtensions = def.changedExtensions;
         sensors[name] = entry;
     }
     return sensors;

package/dist/src/commands/sensors/run.js

@@ -6,25 +6,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyBaseline = applyBaseline;
 exports.reconcilePack = reconcilePack;
 exports.findManifestDir = findManifestDir;
+exports.resolveConcurrency = resolveConcurrency;
 exports.runSensors = runSensors;
-const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const exec_1 = require("./exec");
 const tsc_1 = require("./formatters/tsc");
 const eslint_1 = require("./formatters/eslint");
 const semgrep_1 = require("./formatters/semgrep");
 const generic_1 = require("./formatters/generic");
 const test_1 = require("./formatters/test");
 const baseline_1 = require("./baseline");
+const changed_1 = require("./changed");
 const init_1 = require("./init");
 const registries_1 = require("../../core/registries");
 const MANIFEST_FILE = '.awm/sensors.json';
 const DEFAULT_FAST_TIMEOUT = 10_000;
 const DEFAULT_SLOW_TIMEOUT = 120_000;
 // Sensor JSON output can be several MB on large repos (e.g. `eslint --format json`
-// with thousands of findings). execSync defaults to a 1MB buffer and kills the
-// child with SIGTERM when exceeded — which previously surfaced as a false "timeout".
+// with thousands of findings). A 1MB cap killed the child with SIGTERM when
+// exceeded — which previously surfaced as a false "timeout".
 const MAX_BUFFER = 64 * 1024 * 1024;
+/** Hard ceiling on parallel sensors: past this, they only contend for the same cores. */
+const MAX_CONCURRENCY = 4;
 /**
  * Apply the baseline to a sensor result: keep only findings not already accepted.
  * `status` becomes 'pass' when every finding was baseline-suppressed. Results
@@ -125,75 +130,117 @@ function getFormatter(name) {
 function isExitCodeSensor(name) {
     return name === 'test';
 }
-function runSensor(name, cmd, timeout, cwd) {
-    try {
-        const raw = (0, child_process_1.execSync)(cmd, { encoding: 'utf-8', timeout, cwd, maxBuffer: MAX_BUFFER, stdio: ['pipe', 'pipe', 'pipe'] });
-        const errors = getFormatter(name)(raw);
-        return { name, status: errors.length > 0 ? 'fail' : 'pass', errors };
+async function runSensor(name, cmd, timeout, cwd) {
+    const res = await (0, exec_1.runCommand)(cmd, { timeout, cwd, maxBuffer: MAX_BUFFER });
+    const format = getFormatter(name);
+    // The shell itself never started (bad cwd, no shell). Nothing ran.
+    if (res.spawnError) {
+        return {
+            name,
+            status: 'fail',
+            errors: [{ message: `sensor could not be started: ${res.spawnError.message}` }],
+        };
     }
-    catch (err) {
-        // Output exceeded maxBuffer — child is killed before output can be read.
-        // Check this BEFORE the SIGTERM branch (ENOBUFS kills with SIGTERM too).
-        // Nothing could be read, so nothing was certified.
-        if (err.code === 'ENOBUFS') {
-            return { name, status: 'inconclusive', errors: [], skipReason: `output exceeded ${MAX_BUFFER} bytes` };
-        }
-        // Genuine timeout: execSync kills with SIGTERM after `timeout` ms. The
-        // sensor produced no verdict — inconclusive, not a benign skip.
-        if (err.code === 'ETIMEDOUT' || (err.killed && err.signal === 'SIGTERM')) {
-            return { name, status: 'inconclusive', errors: [], skipReason: `timeout after ${timeout}ms` };
-        }
-        // Non-zero exit — the normal path for linters/typecheckers that found
-        // findings. Parse the output; if it yields findings, that's a fail.
-        const raw = String((err.stdout ?? '') + (err.stderr ?? ''));
-        const errors = getFormatter(name)(raw);
-        if (errors.length > 0)
-            return { name, status: 'fail', errors };
-        // A missing tool (binary not installed) must NOT pass silently — the gate
-        // cannot certify what it could not run. Treat it as a fail with a clear message.
-        //
-        // Exit 127 is the POSIX signal for "command not found" and is the only check
-        // here that holds across shells and locales: bash writes `command not found`
-        // but dash — `/bin/sh` on Debian/Ubuntu, hence most CI runners and containers
-        // — writes `not found`, so matching shell text alone read an absent tool as a
-        // benign skip. `err.code` does not cover it either: that is ENOENT only when
-        // spawning the shell itself fails, not when the shell starts and the command
-        // inside it is missing. The ENOBUFS and timeout branches are evaluated above,
-        // so reaching here with status 127 means the command did not exist.
-        //
-        // A wrapper (`npm test`, `npx …`) that exits 127 because a binary it invokes
-        // is absent is classified the same way, deliberately: the gate still ran
-        // nothing and still cannot certify anything.
-        const lower = raw.toLowerCase();
-        const toolMissing = err.status === 127 || // POSIX: command not found
-            err.code === 'ENOENT' || // execSync spawn failure (no shell)
-            lower.includes('command not found') || // bash, zsh
-            // cmd.exe reports an absent binary with exit 1, so 127 does not cover
-            // Windows; this exact phrase does. Kept narrow on purpose — a loose
-            // `not found` would also match a tool that ran and said "not found"
-            // for reasons of its own.
-            lower.includes('is not recognized as an internal or external command') ||
-            lower.includes('enoent') ||
-            lower.includes('could not determine executable');
-        if (toolMissing) {
+    // Cut short by the deadline or the output cap. The run is NOT a verdict — but
+    // whatever it printed before being cut is still evidence, and throwing it away
+    // is what forced the caller to re-run the same command by hand to learn
+    // anything. Findings in the partial output are real findings; their absence
+    // proves nothing, so a clean partial can never be `pass`.
+    if (res.timedOut || res.overflowed) {
+        const reason = res.timedOut
+            ? `timeout after ${timeout}ms`
+            : `output exceeded ${MAX_BUFFER} bytes`;
+        const errors = format(res.stdout + res.stderr);
+        if (errors.length > 0) {
             return {
                 name,
                 status: 'fail',
-                errors: [{ message: `sensor tool not available: ${raw.slice(0, 200)}` }],
+                errors,
+                incomplete: `${reason} — findings below are from partial output; the run did not finish`,
             };
         }
-        // Exit-code sensors (tests): any genuine non-zero exit is a real failure,
-        // even when no per-line findings can be parsed from the output.
-        if (isExitCodeSensor(name)) {
-            return { name, status: 'fail', errors: [{ message: `SENSOR[${name}] failed (exit ${err.status})` }] };
-        }
-        // Residual case: it exited non-zero, the tool exists, and no finding
-        // could be parsed. We do not know what happened — say so instead of
-        // reporting a benign skip.
-        return { name, status: 'inconclusive', errors: [], skipReason: `exit ${err.status}: ${raw.slice(0, 200)}` };
+        return { name, status: 'inconclusive', errors: [], skipReason: reason };
+    }
+    if (res.code === 0) {
+        const errors = format(res.stdout);
+        return { name, status: errors.length > 0 ? 'fail' : 'pass', errors };
+    }
+    // Non-zero exit — the normal path for linters/typecheckers that found
+    // findings. Parse the output; if it yields findings, that's a fail.
+    const raw = res.stdout + res.stderr;
+    const errors = format(raw);
+    if (errors.length > 0)
+        return { name, status: 'fail', errors };
+    // A missing tool (binary not installed) must NOT pass silently — the gate
+    // cannot certify what it could not run. Treat it as a fail with a clear message.
+    //
+    // Exit 127 is the POSIX signal for "command not found" and is the only check
+    // here that holds across shells and locales: bash writes `command not found`
+    // but dash — `/bin/sh` on Debian/Ubuntu, hence most CI runners and containers
+    // — writes `not found`, so matching shell text alone read an absent tool as a
+    // benign skip. A failure to spawn the shell itself is a different thing and
+    // is handled above via `spawnError`. The cut-short branches are evaluated
+    // above too, so reaching here with status 127 means the command did not exist.
+    //
+    // A wrapper (`npm test`, `npx …`) that exits 127 because a binary it invokes
+    // is absent is classified the same way, deliberately: the gate still ran
+    // nothing and still cannot certify anything.
+    const lower = raw.toLowerCase();
+    const toolMissing = res.code === 127 || // POSIX: command not found
+        lower.includes('command not found') || // bash, zsh
+        // cmd.exe reports an absent binary with exit 1, so 127 does not cover
+        // Windows; this exact phrase does. Kept narrow on purpose — a loose
+        // `not found` would also match a tool that ran and said "not found"
+        // for reasons of its own.
+        lower.includes('is not recognized as an internal or external command') ||
+        lower.includes('enoent') ||
+        lower.includes('could not determine executable');
+    if (toolMissing) {
+        return {
+            name,
+            status: 'fail',
+            errors: [{ message: `sensor tool not available: ${raw.slice(0, 200)}` }],
+        };
+    }
+    // Exit-code sensors (tests): any genuine non-zero exit is a real failure,
+    // even when no per-line findings can be parsed from the output.
+    if (isExitCodeSensor(name)) {
+        return { name, status: 'fail', errors: [{ message: `SENSOR[${name}] failed (exit ${res.code})` }] };
     }
+    // Residual case: it exited non-zero, the tool exists, and no finding
+    // could be parsed. We do not know what happened — say so instead of
+    // reporting a benign skip.
+    return { name, status: 'inconclusive', errors: [], skipReason: `exit ${res.code}: ${raw.slice(0, 200)}` };
 }
-function runSensors(opts = {}) {
+/**
+ * How many sensors may run at once. Sensors are separate processes over the same
+ * tree, so they parallelise cleanly — but each one (tsc, eslint, depcruise) is
+ * largely single-threaded, and oversubscribing the box just makes every sensor
+ * slower and more likely to hit its own deadline. Leave a core for the agent.
+ */
+function resolveConcurrency(manifest, sensorCount) {
+    const configured = Number(process.env.AWM_SENSORS_CONCURRENCY ?? manifest.concurrency);
+    if (Number.isFinite(configured) && configured >= 1)
+        return Math.min(Math.floor(configured), sensorCount);
+    const cores = os_1.default.cpus()?.length ?? 2;
+    return Math.max(1, Math.min(MAX_CONCURRENCY, cores - 1, sensorCount));
+}
+/** Run `tasks` with at most `limit` in flight, preserving input order in the output. */
+async function pooled(tasks, limit) {
+    const results = new Array(tasks.length);
+    let next = 0;
+    const worker = async () => {
+        while (true) {
+            const i = next++;
+            if (i >= tasks.length)
+                return;
+            results[i] = await tasks[i]();
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, tasks.length) }, worker));
+    return results;
+}
+async function runSensors(opts = {}) {
     const startCwd = opts.cwd ?? process.cwd();
     const manifestDir = findManifestDir(startCwd);
     if (!manifestDir)
@@ -204,31 +251,81 @@ function runSensors(opts = {}) {
     const reconciled = reconcilePack(manifestDir, manifest);
     const activeManifest = reconciled.manifest;
     const cwd = manifestDir; // ejecutar sensores y baseline desde donde vive el manifest
-    const results = [];
     // Baseline suppresses already-accepted findings so sensors fail only on NEW
     // ones (essential on repos with a large pre-existing baseline). Absent file or
     // --ignore-baseline → every finding counts (backward-compatible).
     const baseline = opts.ignoreBaseline ? null : (0, baseline_1.readBaseline)(cwd);
+    // A scoped run must never define the accepted set. `buildBaseline` snapshots the
+    // findings of the run it is given, so baselining a `--changed` run would write a
+    // baseline covering only the touched files and silently drop every accepted
+    // finding elsewhere in the repo — which then reports as NEW on the next full run.
+    // The two flags only ever meet by mistake, so refuse rather than pick a meaning.
+    if (opts.changed && opts.ignoreBaseline) {
+        throw new Error('refusing to combine --changed with a baseline capture: a partial run cannot define '
+            + 'the accepted set (it would drop every accepted finding outside the diff). '
+            + 'Run `awm sensors baseline` without --changed.');
+    }
+    // Resolved once for the whole run, not per sensor: `git` is cheap but the answer
+    // must be identical across sensors, or two of them scope to different file sets.
+    const changed = opts.changed ? (0, changed_1.changedFiles)(cwd, opts.base ?? 'HEAD') : null;
+    // Sensors are independent processes over the same tree, so they run
+    // concurrently rather than one-after-another: wall clock becomes the slowest
+    // sensor instead of the sum of all of them. Tasks are built — and dispatched —
+    // in manifest order, so the reported order stays stable.
+    const tasks = [];
+    const settled = (r) => () => Promise.resolve(r);
     for (const [name, config] of Object.entries(activeManifest.sensors)) {
         const isFast = config.fast ?? false;
         if (!shouldRun(isFast, opts))
             continue;
         if (config.enabled === false) {
-            results.push({ name, status: 'skipped', errors: [], skipReason: 'disabled' });
+            tasks.push(settled({ name, status: 'skipped', errors: [], skipReason: 'disabled' }));
             continue;
         }
         if (!config.cmd) {
             // Enabled but with nothing to run: broken config, not a deliberate
             // opt-out. `enabled: false` is how a sensor is turned off.
-            results.push({ name, status: 'inconclusive', errors: [], skipReason: 'no cmd configured' });
+            tasks.push(settled({ name, status: 'inconclusive', errors: [], skipReason: 'no cmd configured' }));
             continue;
         }
+        // Scoping applies only where the pack opted in AND the scope resolved. Any
+        // other combination falls back to the full command: slower, never wrong.
+        let cmd = config.cmd;
+        let scope;
+        if (changed && !changed.error && config.changedCmd) {
+            if (!config.changedCmd.includes('{files}')) {
+                // Running the template as-is would cover the whole repo while the
+                // result claimed to be scoped — a mislabel, not a slow path.
+                tasks.push(settled({
+                    name,
+                    status: 'inconclusive',
+                    errors: [],
+                    skipReason: 'changedCmd has no {files} placeholder',
+                }));
+                continue;
+            }
+            const inScope = (0, changed_1.filterByExtension)(changed.files, config.changedExtensions);
+            if (inScope.length === 0) {
+                tasks.push(settled({
+                    name,
+                    status: 'skipped',
+                    errors: [],
+                    skipReason: 'no changed files in scope',
+                    scope: 'changed',
+                }));
+                continue;
+            }
+            cmd = (0, changed_1.applyChangedCmd)(config.changedCmd, inScope);
+            scope = 'changed';
+        }
         const timeout = config.timeout ?? (isFast ? DEFAULT_FAST_TIMEOUT : DEFAULT_SLOW_TIMEOUT);
-        let result = runSensor(name, config.cmd, timeout, cwd);
-        if (baseline)
-            result = applyBaseline(result, baseline[name]);
-        results.push(result);
+        tasks.push(async () => {
+            const result = await runSensor(name, cmd, timeout, cwd);
+            const scoped = scope ? { ...result, scope } : result;
+            return baseline ? applyBaseline(scoped, baseline[name]) : scoped;
+        });
     }
+    const results = await pooled(tasks, resolveConcurrency(activeManifest, tasks.length));
     // `fail` outranks `inconclusive`: when something is broken AND something
     // could not be measured, the broken thing is the actionable verdict.
     let overall = results.some(r => r.status === 'fail') ? 'fail'
@@ -245,5 +342,10 @@ function runSensors(opts = {}) {
         sensors: results,
         overall,
         ...(reconciled.upgradedFrom ? { packUpgraded: `${reconciled.upgradedFrom}→${activeManifest.pack}` } : {}),
+        // Always emitted on a --changed run, including when the scope failed to
+        // resolve: a green that came back from an unscoped fallback and a green from a
+        // genuinely scoped run are different claims, and the caller cannot tell them
+        // apart from the sensor list alone.
+        ...(changed ? { changedScope: { files: changed.files.length, ...(changed.error ? { error: changed.error } : {}) } } : {}),
     };
 }