agentic-workflow-manager 3.5.0 → 3.7.0

package/dist/tests/commands/sensors/changed.test.js

@@ -0,0 +1,114 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const changed_1 = require("../../../src/commands/sensors/changed");
+/** A throwaway repo. Real git, not a mock: the whole value of this module is that its
+ *  understanding of "changed" matches git's, which a mock would define into existence. */
+function repo() {
+    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-changed-'));
+    const run = (args) => (0, child_process_1.execFileSync)('git', args, { cwd: dir, stdio: 'ignore' });
+    run(['init', '-q']);
+    run(['config', 'user.email', 'test@example.com']);
+    run(['config', 'user.name', 'test']);
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'base.ts'), 'export const a = 1;\n');
+    run(['add', 'base.ts']);
+    run(['commit', '-qm', 'base']);
+    return dir;
+}
+describe('changedFiles', () => {
+    const dirs = [];
+    const make = () => { const d = repo(); dirs.push(d); return d; };
+    afterAll(() => dirs.forEach(d => fs_1.default.rmSync(d, { recursive: true, force: true })));
+    it('sees unstaged, staged and untracked files, not just committed ones', () => {
+        // The gate runs mid-work, before anything is committed. A committed-only diff
+        // would scope the run to a stale set and certify files nobody is editing —
+        // exactly the files least likely to be broken right now.
+        const dir = make();
+        fs_1.default.appendFileSync(path_1.default.join(dir, 'base.ts'), 'export const b = 2;\n'); // unstaged
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'staged.ts'), 'export const c = 3;\n');
+        (0, child_process_1.execFileSync)('git', ['add', 'staged.ts'], { cwd: dir, stdio: 'ignore' }); // staged
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'untracked.ts'), 'export const d = 4;\n'); // untracked
+        expect((0, changed_1.changedFiles)(dir).files).toEqual(['base.ts', 'staged.ts', 'untracked.ts']);
+    });
+    it('excludes gitignored files so build output never enters the scope', () => {
+        const dir = make();
+        fs_1.default.writeFileSync(path_1.default.join(dir, '.gitignore'), 'dist/\n');
+        fs_1.default.mkdirSync(path_1.default.join(dir, 'dist'));
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'dist', 'bundle.js'), 'noise');
+        expect((0, changed_1.changedFiles)(dir).files).not.toContain('dist/bundle.js');
+    });
+    it('omits deleted files — a sensor cannot read a path that is gone', () => {
+        const dir = make();
+        fs_1.default.rmSync(path_1.default.join(dir, 'base.ts'));
+        expect((0, changed_1.changedFiles)(dir).files).not.toContain('base.ts');
+    });
+    it('compares against the merge base, not the branch tip', () => {
+        // Guards the case where the branch is merely BEHIND its base. Diffing against
+        // the tip would report every file the base moved on as "changed by this
+        // branch", scoping the run to files this branch never touched.
+        const dir = make();
+        const run = (args) => (0, child_process_1.execFileSync)('git', args, { cwd: dir, stdio: 'ignore' });
+        run(['checkout', '-qb', 'feature']);
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'mine.ts'), 'export const mine = 1;\n');
+        run(['add', 'mine.ts']);
+        run(['commit', '-qm', 'mine']);
+        // main moves on independently, so `feature` is behind it.
+        run(['checkout', '-q', 'master']);
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'theirs.ts'), 'export const theirs = 1;\n');
+        run(['add', 'theirs.ts']);
+        run(['commit', '-qm', 'theirs']);
+        run(['checkout', '-q', 'feature']);
+        const files = (0, changed_1.changedFiles)(dir, 'master').files;
+        expect(files).toContain('mine.ts');
+        expect(files).not.toContain('theirs.ts');
+    });
+    it('reports an error instead of an empty scope when git cannot answer', () => {
+        // An empty file list and a failed lookup are the same value structurally but
+        // opposite in meaning: one says "nothing to check", the other "I do not know".
+        // Collapsing them would silently scope a run to zero files and report clean.
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-nogit-'));
+        dirs.push(dir);
+        const res = (0, changed_1.changedFiles)(dir);
+        expect(res.error).toBeDefined();
+        expect(res.files).toEqual([]);
+    });
+});
+describe('applyChangedCmd', () => {
+    it('substitutes the file list into the template', () => {
+        expect((0, changed_1.applyChangedCmd)('eslint --format json {files}', ['a.ts', 'b.ts']))
+            .toBe(`eslint --format json 'a.ts' 'b.ts'`);
+    });
+    it('quotes paths so a space cannot split one argument into two', () => {
+        expect((0, changed_1.applyChangedCmd)('eslint {files}', ['my dir/a.ts']))
+            .toBe(`eslint 'my dir/a.ts'`);
+    });
+    it("escapes a single quote in a path instead of ending the quoting", () => {
+        // Without the '\'' form the rest of the filename would be read as shell syntax.
+        expect((0, changed_1.applyChangedCmd)('eslint {files}', ["it's.ts"]))
+            .toBe(`eslint 'it'\\''s.ts'`);
+    });
+});
+describe('filterByExtension', () => {
+    it('drops files the sensor cannot be handed', () => {
+        // Editing a README must not turn the lint gate red: eslint given a .md fails
+        // rather than skipping it.
+        expect((0, changed_1.filterByExtension)(['src/a.ts', 'README.md', 'logo.png'], ['.ts']))
+            .toEqual(['src/a.ts']);
+    });
+    it('matches extensions case-insensitively', () => {
+        // Windows and macOS checkouts carry .TS. A case-sensitive match would drop them
+        // from the scope silently — the sensor would report clean over files it never saw.
+        expect((0, changed_1.filterByExtension)(['src/A.TS'], ['.ts'])).toEqual(['src/A.TS']);
+    });
+    it('passes everything through when the sensor declares no filter', () => {
+        const files = ['a.ts', 'b.md'];
+        expect((0, changed_1.filterByExtension)(files, undefined)).toEqual(files);
+        expect((0, changed_1.filterByExtension)(files, [])).toEqual(files);
+    });
+});

package/dist/tests/commands/sensors/exec-fixtures.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spawnFailed = exports.overflowed = exports.timedOut = exports.exited = exports.ok = void 0;
+/**
+ * Builders for the `ExecResult` shape that `runCommand` returns. Sensor tests
+ * mock the exec boundary rather than `child_process` directly: `runCommand`
+ * never throws, so a mocked run is a value, not an exception.
+ */
+const base = { stdout: '', stderr: '', code: null, signal: null, timedOut: false, overflowed: false };
+/** Clean run: exit 0. */
+const ok = (stdout = '') => ({ ...base, stdout, code: 0 });
+exports.ok = ok;
+/** Ran to completion with a non-zero exit code. */
+const exited = (code, stdout = '', stderr = '') => ({ ...base, stdout, stderr, code });
+exports.exited = exited;
+/** Cut short by the deadline. `stdout` is whatever it managed to print first. */
+const timedOut = (stdout = '', stderr = '') => ({ ...base, stdout, stderr, signal: 'SIGKILL', timedOut: true });
+exports.timedOut = timedOut;
+/** Cut short by the output cap. */
+const overflowed = (stdout = '') => ({ ...base, stdout, signal: 'SIGKILL', overflowed: true });
+exports.overflowed = overflowed;
+/** The shell itself never started. */
+const spawnFailed = (message = 'ENOENT') => ({ ...base, spawnError: Object.assign(new Error(message), { code: 'ENOENT' }) });
+exports.spawnFailed = spawnFailed;

package/dist/tests/commands/sensors/exec.test.js

@@ -0,0 +1,91 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const exec_1 = require("../../../src/commands/sensors/exec");
+const onPosix = process.platform !== 'win32' ? describe : describe.skip;
+/** Poll until `fn()` is true or the budget runs out. Avoids fixed sleeps. */
+async function until(fn, budgetMs = 4000) {
+    const deadline = Date.now() + budgetMs;
+    while (Date.now() < deadline) {
+        if (fn())
+            return true;
+        await new Promise(r => setTimeout(r, 25));
+    }
+    return fn();
+}
+describe('runCommand — exit codes and output', () => {
+    it('returns stdout and code 0 for a clean command', async () => {
+        const r = await (0, exec_1.runCommand)('echo hello', { timeout: 5000, cwd: process.cwd() });
+        expect(r.code).toBe(0);
+        expect(r.stdout.trim()).toBe('hello');
+        expect(r.timedOut).toBe(false);
+        expect(r.overflowed).toBe(false);
+    });
+    it('captures stderr and a non-zero exit code without throwing', async () => {
+        const r = await (0, exec_1.runCommand)('echo oops 1>&2; exit 3', { timeout: 5000, cwd: process.cwd() });
+        expect(r.code).toBe(3);
+        expect(r.stderr).toMatch(/oops/);
+        expect(r.timedOut).toBe(false);
+    });
+    it('reports 127 for a command that does not exist', async () => {
+        const r = await (0, exec_1.runCommand)('awm-definitely-not-a-real-binary-xyz', { timeout: 5000, cwd: process.cwd() });
+        expect(r.code).toBe(127);
+    });
+});
+describe('runCommand — output cap', () => {
+    it('stops at maxBuffer, flags overflow, and keeps what it read', async () => {
+        // 200 lines of ~50 bytes each, capped at 1KB.
+        const r = await (0, exec_1.runCommand)(`for i in $(seq 1 200); do echo "line-$i-padding-padding-padding-padding"; done`, {
+            timeout: 10_000, cwd: process.cwd(), maxBuffer: 1024,
+        });
+        expect(r.overflowed).toBe(true);
+        expect(r.stdout.length).toBeLessThanOrEqual(1024);
+        // The point of the cap change: what was read is still usable, not discarded.
+        expect(r.stdout).toMatch(/line-1-/);
+    });
+});
+onPosix('runCommand — timeout', () => {
+    it('flags the timeout and returns the output produced before the deadline', async () => {
+        const r = await (0, exec_1.runCommand)('echo partial-finding; sleep 30', { timeout: 700, cwd: process.cwd() });
+        expect(r.timedOut).toBe(true);
+        // This is the whole point of dropping execSync: 700ms of work is not thrown away.
+        expect(r.stdout).toMatch(/partial-finding/);
+    });
+    it('kills the grandchild process, not just the shell it spawned', async () => {
+        // Models `npx tsc --noEmit`: the sensor command is a wrapper that spawns the
+        // real tool. execSync SIGTERMs only the shell it started, leaving the tool
+        // running and reparented to init — the leak that compounds across retries.
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-exec-group-'));
+        const beat = path_1.default.join(dir, 'beat');
+        const worker = path_1.default.join(dir, 'worker.js');
+        fs_1.default.writeFileSync(worker, `
+            const fs = require('fs');
+            setInterval(() => fs.writeFileSync(${JSON.stringify(beat)}, String(Date.now())), 30);
+            setTimeout(() => {}, 60000);
+        `);
+        try {
+            const r = await (0, exec_1.runCommand)(`sh -c "node ${worker} & wait"`, { timeout: 800, cwd: dir });
+            expect(r.timedOut).toBe(true);
+            // The worker must have been alive before the kill, or the test proves nothing.
+            expect(await until(() => fs_1.default.existsSync(beat))).toBe(true);
+            const atKill = fs_1.default.readFileSync(beat, 'utf-8');
+            const stillBeating = await until(() => fs_1.default.readFileSync(beat, 'utf-8') !== atKill, 1000);
+            expect(stillBeating).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    }, 15_000);
+});
+describe('runCommand — spawn failure', () => {
+    it('surfaces a spawn error instead of hanging', async () => {
+        const r = await (0, exec_1.runCommand)('echo hi', { timeout: 5000, cwd: path_1.default.join(os_1.default.tmpdir(), 'awm-no-such-dir-xyz') });
+        expect(r.spawnError).toBeDefined();
+        expect(r.code).not.toBe(0);
+    });
+});

package/dist/tests/commands/sensors/run-changed.test.js

@@ -0,0 +1,136 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const mockRunCommand = jest.fn();
+jest.mock('../../../src/commands/sensors/exec', () => ({
+    runCommand: (...args) => mockRunCommand(...args),
+}));
+const mockChangedFiles = jest.fn();
+jest.mock('../../../src/commands/sensors/changed', () => {
+    const actual = jest.requireActual('../../../src/commands/sensors/changed');
+    return { ...actual, changedFiles: (...args) => mockChangedFiles(...args) };
+});
+const { ok } = require('./exec-fixtures');
+function project(sensors) {
+    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-changed-run-'));
+    fs_1.default.mkdirSync(path_1.default.join(dir, '.awm'), { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), JSON.stringify({ pack: 'js-ts', sensors }));
+    return dir;
+}
+/** The two sensors that matter: one that opted into scoping, one that cannot. */
+const LINT = { fast: true, cmd: 'eslint --format json .', changedCmd: 'eslint --format json {files}' };
+const TYPECHECK = { fast: true, cmd: 'tsc --noEmit' };
+describe('runSensors --changed', () => {
+    let dir;
+    let prevAwmHome;
+    let fakeAwmHome;
+    beforeEach(() => {
+        jest.resetModules();
+        mockRunCommand.mockReset();
+        mockChangedFiles.mockReset();
+        mockRunCommand.mockResolvedValue(ok(''));
+        // CLAUDE.md: no test may reach the real ~/.awm.
+        fakeAwmHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-home-'));
+        prevAwmHome = process.env.AWM_HOME;
+        process.env.AWM_HOME = fakeAwmHome;
+    });
+    afterEach(() => {
+        process.env.AWM_HOME = prevAwmHome;
+        if (dir)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        fs_1.default.rmSync(fakeAwmHome, { recursive: true, force: true });
+    });
+    const load = () => require('../../../src/commands/sensors/run');
+    const cmds = () => mockRunCommand.mock.calls.map(c => c[0]);
+    it('scopes a sensor that opted in and leaves one that did not at full scope', async () => {
+        // The core contract. tsc is whole-program: handed a subset it reports clean
+        // while the change breaks a caller it was never shown. Scoping is opt-in
+        // precisely so that sensor keeps measuring everything.
+        dir = project({ lint: LINT, typecheck: TYPECHECK });
+        mockChangedFiles.mockReturnValue({ files: ['src/a.ts'] });
+        await load().runSensors({ cwd: dir, changed: true });
+        expect(cmds()).toContain(`eslint --format json 'src/a.ts'`);
+        expect(cmds()).toContain('tsc --noEmit');
+    });
+    it('marks the scoped result so a scoped pass is not read as a full one', async () => {
+        dir = project({ lint: LINT, typecheck: TYPECHECK });
+        mockChangedFiles.mockReturnValue({ files: ['src/a.ts'] });
+        const out = await load().runSensors({ cwd: dir, changed: true });
+        expect(out.sensors.find((s) => s.name === 'lint').scope).toBe('changed');
+        expect(out.sensors.find((s) => s.name === 'typecheck').scope).toBeUndefined();
+        expect(out.changedScope).toEqual({ files: 1 });
+    });
+    it('falls back to the full command when the scope cannot be resolved', async () => {
+        // Not a git repo, git absent, bad ref. Running everything is slow; guessing at
+        // a narrower set would certify files nobody proved were the only ones touched.
+        dir = project({ lint: LINT });
+        mockChangedFiles.mockReturnValue({ files: [], error: 'not a git repository' });
+        const out = await load().runSensors({ cwd: dir, changed: true });
+        expect(cmds()).toContain('eslint --format json .');
+        expect(out.sensors[0].scope).toBeUndefined();
+        expect(out.changedScope).toEqual({ files: 0, error: 'not a git repository' });
+    });
+    it('skips an opted-in sensor when nothing changed, without touching the others', async () => {
+        dir = project({ lint: LINT, typecheck: TYPECHECK });
+        mockChangedFiles.mockReturnValue({ files: [] });
+        const out = await load().runSensors({ cwd: dir, changed: true });
+        const lint = out.sensors.find((s) => s.name === 'lint');
+        expect(lint.status).toBe('skipped');
+        expect(lint.skipReason).toBe('no changed files in scope');
+        expect(cmds()).toEqual(['tsc --noEmit']);
+    });
+    it('hands the sensor only the extensions it declared it can take', async () => {
+        // Without this, editing a README turns the lint gate red: eslint given a .md
+        // fails rather than skipping it.
+        dir = project({ lint: { ...LINT, changedExtensions: ['.ts', '.tsx'] } });
+        mockChangedFiles.mockReturnValue({ files: ['README.md', 'logo.png', 'src/a.ts'] });
+        await load().runSensors({ cwd: dir, changed: true });
+        expect(cmds()).toEqual([`eslint --format json 'src/a.ts'`]);
+    });
+    it('skips the sensor when the filter empties the scope, rather than running repo-wide', async () => {
+        // A docs-only commit means the lint sensor has nothing to say. Falling back to
+        // the full command here would reintroduce exactly the cost --changed removes.
+        dir = project({ lint: { ...LINT, changedExtensions: ['.ts'] }, typecheck: TYPECHECK });
+        mockChangedFiles.mockReturnValue({ files: ['README.md'] });
+        const out = await load().runSensors({ cwd: dir, changed: true });
+        expect(out.sensors.find((s) => s.name === 'lint').status).toBe('skipped');
+        expect(cmds()).toEqual(['tsc --noEmit']);
+    });
+    it('refuses a changedCmd without a {files} placeholder instead of running it repo-wide', async () => {
+        // Running the template as-is would cover the whole repo while the result
+        // claimed to be scoped. That is a mislabelled verdict, not a slow path.
+        dir = project({ lint: { ...LINT, changedCmd: 'eslint --format json .' } });
+        mockChangedFiles.mockReturnValue({ files: ['src/a.ts'] });
+        const out = await load().runSensors({ cwd: dir, changed: true });
+        expect(out.sensors[0].status).toBe('inconclusive');
+        expect(out.overall).toBe('not_certified');
+        expect(mockRunCommand).not.toHaveBeenCalled();
+    });
+    it('refuses to combine --changed with a baseline capture', async () => {
+        // buildBaseline snapshots the run it is given, so baselining a scoped run
+        // would write a baseline covering only the diff and silently drop every
+        // accepted finding elsewhere — which then reports as NEW on the next full run.
+        dir = project({ lint: LINT });
+        mockChangedFiles.mockReturnValue({ files: ['src/a.ts'] });
+        await expect(load().runSensors({ cwd: dir, changed: true, ignoreBaseline: true }))
+            .rejects.toThrow(/cannot define the accepted set/);
+    });
+    it('runs everything at full scope when --changed is absent', async () => {
+        dir = project({ lint: LINT, typecheck: TYPECHECK });
+        const out = await load().runSensors({ cwd: dir });
+        expect(cmds()).toEqual(['eslint --format json .', 'tsc --noEmit']);
+        expect(mockChangedFiles).not.toHaveBeenCalled();
+        expect(out.changedScope).toBeUndefined();
+    });
+    it('passes the requested base through to the scope resolver', async () => {
+        dir = project({ lint: LINT });
+        mockChangedFiles.mockReturnValue({ files: ['src/a.ts'] });
+        await load().runSensors({ cwd: dir, changed: true, base: 'main' });
+        expect(mockChangedFiles).toHaveBeenCalledWith(dir, 'main');
+    });
+});

package/dist/tests/commands/sensors/run-inconclusive.test.js

@@ -6,10 +6,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
-const mockExecSyncFn = jest.fn();
-jest.mock('child_process', () => ({
-    execSync: (...args) => mockExecSyncFn(...args),
+const mockRunCommand = jest.fn();
+jest.mock('../../../src/commands/sensors/exec', () => ({
+    runCommand: (...args) => mockRunCommand(...args),
 }));
+const { ok, exited, timedOut, overflowed } = require('./exec-fixtures');
 /** Sensors run in manifest insertion order, so mocks are queued in that order. */
 const MANIFEST = {
     pack: 'js-ts',
@@ -18,14 +19,14 @@ const MANIFEST = {
         security: { cmd: 'semgrep .', fast: false },
     },
 };
-const timeoutError = () => { throw Object.assign(new Error('killed'), { code: 'ETIMEDOUT' }); };
+const timeoutError = () => timedOut();
 describe('runSensors — inconclusive: a sensor that could not certify is never green', () => {
     let root;
     let fakeAwmHome;
     let prevAwmHome;
     beforeEach(() => {
         jest.resetModules();
-        mockExecSyncFn.mockReset();
+        mockRunCommand.mockReset();
         root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-inconclusive-'));
         fs_1.default.mkdirSync(path_1.default.join(root, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify(MANIFEST));
@@ -40,55 +41,51 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
         fs_1.default.rmSync(fakeAwmHome, { recursive: true, force: true });
     });
     const load = () => require('../../../src/commands/sensors/run');
-    it('reports a timed-out sensor as inconclusive, keeping its reason', () => {
-        mockExecSyncFn
-            .mockReturnValueOnce('') // typecheck: clean
-            .mockImplementationOnce(timeoutError); // security: times out
+    it('reports a timed-out sensor as inconclusive, keeping its reason', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(ok()) // typecheck: clean
+            .mockResolvedValueOnce(timeoutError()); // security: times out
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         const security = out.sensors.find((s) => s.name === 'security');
         expect(security.status).toBe('inconclusive');
         expect(security.skipReason).toMatch(/timeout/);
     });
-    it('does not let a healthy sensor carry the run to pass while another could not certify', () => {
-        mockExecSyncFn
-            .mockReturnValueOnce('')
-            .mockImplementationOnce(timeoutError);
+    it('does not let a healthy sensor carry the run to pass while another could not certify', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(ok())
+            .mockResolvedValueOnce(timeoutError());
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         expect(out.sensors.find((s) => s.name === 'typecheck').status).toBe('pass');
         expect(out.overall).toBe('not_certified');
     });
-    it('reports a sensor whose output was truncated as inconclusive', () => {
-        mockExecSyncFn
-            .mockReturnValueOnce('')
-            .mockImplementationOnce(() => { throw Object.assign(new Error('too big'), { code: 'ENOBUFS' }); });
+    it('reports a sensor whose output was truncated as inconclusive', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(ok())
+            .mockResolvedValueOnce(overflowed());
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         const security = out.sensors.find((s) => s.name === 'security');
         expect(security.status).toBe('inconclusive');
         expect(security.skipReason).toMatch(/exceeded/);
         expect(out.overall).toBe('not_certified');
     });
-    it('reports an uninterpretable non-zero exit as inconclusive', () => {
-        mockExecSyncFn
-            .mockReturnValueOnce('')
-            .mockImplementationOnce(() => {
+    it('reports an uninterpretable non-zero exit as inconclusive', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(ok())
             // semgrep formatter yields no findings for non-JSON output, the
             // tool is present (exit 2, not 127), and `security` is not an
             // exit-code sensor — the residual "I don't know" case.
-            throw Object.assign(new Error('failed'), {
-                stdout: '', stderr: 'internal error: rule engine crashed\n', status: 2,
-            });
-        });
+            .mockResolvedValueOnce(exited(2, '', 'internal error: rule engine crashed\n'));
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         const security = out.sensors.find((s) => s.name === 'security');
         expect(security.status).toBe('inconclusive');
         expect(security.skipReason).toMatch(/exit 2/);
         expect(out.overall).toBe('not_certified');
     });
-    it('reports an enabled sensor with no cmd as inconclusive', () => {
+    it('reports an enabled sensor with no cmd as inconclusive', async () => {
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: {
@@ -96,29 +93,25 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
                 depcheck: { fast: false }, // enabled, but nothing to run
             },
         }));
-        mockExecSyncFn.mockReturnValueOnce(''); // typecheck: clean
+        mockRunCommand.mockResolvedValueOnce(ok()); // typecheck: clean
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         const depcheck = out.sensors.find((s) => s.name === 'depcheck');
         expect(depcheck.status).toBe('inconclusive');
         expect(depcheck.skipReason).toBe('no cmd configured');
         expect(out.overall).toBe('not_certified');
     });
-    it('reports fail, not not_certified, when something is broken and something could not run', () => {
-        mockExecSyncFn
-            .mockImplementationOnce(() => {
-            throw Object.assign(new Error(), {
-                stdout: 'src/a.ts(1,1): error TS0001: Bad type.', stderr: '', status: 1,
-            });
-        })
-            .mockImplementationOnce(timeoutError); // security: times out
+    it('reports fail, not not_certified, when something is broken and something could not run', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(exited(1, 'src/a.ts(1,1): error TS0001: Bad type.')) // typecheck: real findings
+            .mockResolvedValueOnce(timeoutError()); // security: times out
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         expect(out.sensors.find((s) => s.name === 'typecheck').status).toBe('fail');
         expect(out.sensors.find((s) => s.name === 'security').status).toBe('inconclusive');
         expect(out.overall).toBe('fail');
     });
-    it('never emits an overall value outside the published domain', () => {
+    it('never emits an overall value outside the published domain', async () => {
         // `inconclusive` is a per-sensor status only. External consumers (the
         // registry skills) read `overall`, whose domain must not grow — this
         // pins that invariant at runtime on a three-sensor pass+fail+inconclusive
@@ -137,20 +130,16 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
             },
         }));
         const DOMAIN = ['pass', 'fail', 'skipped', 'not_certified'];
-        mockExecSyncFn
-            .mockImplementationOnce(() => {
-            throw Object.assign(new Error(), {
-                stdout: 'src/a.ts(1,1): error TS0001: Bad type.', stderr: '', status: 1,
-            });
-        })
-            .mockReturnValueOnce('') // lint: clean → pass
-            .mockImplementationOnce(timeoutError); // security: times out → inconclusive
+        mockRunCommand
+            .mockResolvedValueOnce(exited(1, 'src/a.ts(1,1): error TS0001: Bad type.')) // typecheck: real findings → fail
+            .mockResolvedValueOnce(ok()) // lint: clean → pass
+            .mockResolvedValueOnce(timeoutError()); // security: times out → inconclusive
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         expect(DOMAIN).toContain(out.overall);
         expect(out.overall).not.toBe('inconclusive');
     });
-    it('keeps a deliberately disabled sensor apart from one that could not certify', () => {
+    it('keeps a deliberately disabled sensor apart from one that could not certify', async () => {
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: {
@@ -158,17 +147,17 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
                 mutation: { cmd: 'npx stryker run', enabled: false },
             },
         }));
-        mockExecSyncFn.mockImplementationOnce(timeoutError); // security: times out
+        mockRunCommand.mockResolvedValueOnce(timeoutError()); // security: times out
         // mutation: never invoked
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         // Same run, two different meanings — the whole point of the split.
         expect(out.sensors.find((s) => s.name === 'mutation').status).toBe('skipped');
         expect(out.sensors.find((s) => s.name === 'mutation').skipReason).toBe('disabled');
         expect(out.sensors.find((s) => s.name === 'security').status).toBe('inconclusive');
         expect(out.overall).toBe('not_certified');
     });
-    it('does not degrade the verdict for a disabled sensor alongside healthy ones', () => {
+    it('does not degrade the verdict for a disabled sensor alongside healthy ones', async () => {
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: {
@@ -176,12 +165,12 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
                 mutation: { cmd: 'npx stryker run', enabled: false },
             },
         }));
-        mockExecSyncFn.mockReturnValueOnce('');
+        mockRunCommand.mockResolvedValueOnce(ok());
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         expect(out.overall).toBe('pass');
     });
-    it('still refuses to certify a tree whose sensors are all disabled', () => {
+    it('still refuses to certify a tree whose sensors are all disabled', async () => {
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: {
@@ -191,25 +180,25 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
         }));
         fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}'); // real stack indicator
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         expect(out.sensors.every((s) => s.status === 'skipped')).toBe(true);
         expect(out.overall).toBe('not_certified');
-        expect(mockExecSyncFn).not.toHaveBeenCalled();
+        expect(mockRunCommand).not.toHaveBeenCalled();
     });
-    it('leaves an inconclusive result untouched when a baseline is applied', () => {
+    it('leaves an inconclusive result untouched when a baseline is applied', async () => {
         const { writeBaseline } = require('../../../src/commands/sensors/baseline');
         writeBaseline(root, { security: ['some-accepted-fingerprint'] });
-        mockExecSyncFn
-            .mockReturnValueOnce('')
-            .mockImplementationOnce(timeoutError);
+        mockRunCommand
+            .mockResolvedValueOnce(ok())
+            .mockResolvedValueOnce(timeoutError());
         const { runSensors } = load();
-        const out = runSensors({ cwd: root });
+        const out = await runSensors({ cwd: root });
         const security = out.sensors.find((s) => s.name === 'security');
         expect(security.status).toBe('inconclusive');
         expect(security.baselineCount).toBeUndefined();
         expect(out.overall).toBe('not_certified');
     });
-    it('applyBaseline leaves an inconclusive result untouched even if it somehow carried findings', () => {
+    it('applyBaseline leaves an inconclusive result untouched even if it somehow carried findings', async () => {
         // Every current `inconclusive` producer sets `errors: []`, so a test built
         // on the public `runSensors()` API can't tell "the explicit guard fired"
         // apart from "fell through to partition() and incidentally suppressed 0