agentic-workflow-manager 3.5.0 → 3.7.0

package/dist/tests/commands/sensors/run-partial.test.js

@@ -0,0 +1,225 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const mockRunCommand = jest.fn();
+jest.mock('../../../src/commands/sensors/exec', () => ({
+    runCommand: (...args) => mockRunCommand(...args),
+}));
+const { ok, timedOut, overflowed } = require('./exec-fixtures');
+const TS_FINDING = 'src/a.ts(1,1): error TS0001: Bad type.';
+function project(sensors) {
+    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-partial-'));
+    fs_1.default.mkdirSync(path_1.default.join(dir, '.awm'), { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), JSON.stringify({ pack: 'js-ts', sensors }));
+    return dir;
+}
+describe('runSensors — a cut-short run keeps the findings it did produce', () => {
+    let dir;
+    let prevAwmHome;
+    let fakeAwmHome;
+    beforeEach(() => {
+        jest.resetModules();
+        mockRunCommand.mockReset();
+        // CLAUDE.md: no test may reach the real ~/.awm.
+        fakeAwmHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-home-'));
+        prevAwmHome = process.env.AWM_HOME;
+        process.env.AWM_HOME = fakeAwmHome;
+    });
+    afterEach(() => {
+        process.env.AWM_HOME = prevAwmHome;
+        if (dir)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        fs_1.default.rmSync(fakeAwmHome, { recursive: true, force: true });
+    });
+    const load = () => require('../../../src/commands/sensors/run');
+    it('reports findings from partial output as fail instead of discarding them', async () => {
+        // The regression this guards: the old runner threw away everything a
+        // timed-out sensor had printed, so a 60s lint run that had already found
+        // real errors reported zero — and the caller re-ran it by hand to learn
+        // what it had just paid for.
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true } });
+        mockRunCommand.mockResolvedValueOnce(timedOut(TS_FINDING));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.status).toBe('fail');
+        expect(tc.errors).toHaveLength(1);
+        expect(tc.errors[0].message).toMatch(/Bad type/);
+        expect(out.overall).toBe('fail');
+    });
+    it('marks the partial fail as incomplete so absence of findings is not read as coverage', async () => {
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true, timeout: 30000 } });
+        mockRunCommand.mockResolvedValueOnce(timedOut(TS_FINDING));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.incomplete).toMatch(/timeout after 30000ms/);
+        expect(tc.incomplete).toMatch(/did not finish/);
+    });
+    it('still refuses to certify when the partial output is clean', async () => {
+        // A clean partial proves nothing — the findings could all be in the part
+        // that never ran. This must stay inconclusive, never pass.
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true } });
+        mockRunCommand.mockResolvedValueOnce(timedOut('Checking 400 files...\n'));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.status).toBe('inconclusive');
+        expect(tc.skipReason).toMatch(/timeout/);
+        expect(tc.incomplete).toBeUndefined();
+        expect(out.overall).toBe('not_certified');
+    });
+    it('applies the same rule to output-cap overflow', async () => {
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true } });
+        mockRunCommand.mockResolvedValueOnce(overflowed(TS_FINDING));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.status).toBe('fail');
+        expect(tc.incomplete).toMatch(/exceeded/);
+    });
+    it('fails the sensor when the shell could not be started', async () => {
+        const { spawnFailed } = require('./exec-fixtures');
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true } });
+        mockRunCommand.mockResolvedValueOnce(spawnFailed('spawn /bin/sh ENOENT'));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.status).toBe('fail');
+        expect(tc.errors[0].message).toMatch(/could not be started/);
+        expect(out.overall).toBe('fail');
+    });
+    it('lets the baseline suppress a finding that came from partial output', async () => {
+        dir = project({ typecheck: { cmd: 'npx tsc --noEmit', fast: true } });
+        const { buildBaseline, writeBaseline } = require('../../../src/commands/sensors/baseline');
+        const { parseTscOutput } = require('../../../src/commands/sensors/formatters/tsc');
+        writeBaseline(dir, buildBaseline([{ name: 'typecheck', errors: parseTscOutput(TS_FINDING) }]));
+        mockRunCommand.mockResolvedValueOnce(timedOut(TS_FINDING));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        const tc = out.sensors.find((s) => s.name === 'typecheck');
+        expect(tc.status).toBe('pass');
+        expect(tc.baselineCount).toBe(1);
+    });
+});
+describe('runSensors — sensors run concurrently', () => {
+    let dir;
+    let prevAwmHome;
+    let prevConcurrency;
+    let fakeAwmHome;
+    beforeEach(() => {
+        jest.resetModules();
+        mockRunCommand.mockReset();
+        fakeAwmHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-home-'));
+        prevAwmHome = process.env.AWM_HOME;
+        prevConcurrency = process.env.AWM_SENSORS_CONCURRENCY;
+        process.env.AWM_HOME = fakeAwmHome;
+    });
+    afterEach(() => {
+        process.env.AWM_HOME = prevAwmHome;
+        if (prevConcurrency === undefined)
+            delete process.env.AWM_SENSORS_CONCURRENCY;
+        else
+            process.env.AWM_SENSORS_CONCURRENCY = prevConcurrency;
+        if (dir)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        fs_1.default.rmSync(fakeAwmHome, { recursive: true, force: true });
+    });
+    const load = () => require('../../../src/commands/sensors/run');
+    /** Resolves after `ms`, recording when it started and finished. */
+    const timed = (log, label, ms) => () => new Promise((resolve) => {
+        log.push([`${label}:start`, Date.now()]);
+        setTimeout(() => { log.push([`${label}:end`, Date.now()]); resolve(ok()); }, ms);
+    });
+    const THREE = {
+        typecheck: { cmd: 'a', fast: true },
+        lint: { cmd: 'b', fast: true },
+        security: { cmd: 'c', fast: true },
+    };
+    it('starts every sensor before the first one finishes', async () => {
+        process.env.AWM_SENSORS_CONCURRENCY = '3';
+        dir = project(THREE);
+        const log = [];
+        mockRunCommand
+            .mockImplementationOnce(timed(log, 'typecheck', 120))
+            .mockImplementationOnce(timed(log, 'lint', 120))
+            .mockImplementationOnce(timed(log, 'security', 120));
+        const { runSensors } = load();
+        await runSensors({ cwd: dir });
+        const order = log.map(([label]) => label);
+        // All three starts precede the first end — that is what serial execution
+        // could not do, and the reason wall clock stops being the sum.
+        expect(order.slice(0, 3)).toEqual(['typecheck:start', 'lint:start', 'security:start']);
+        expect(order[3]).toMatch(/:end$/);
+    });
+    it('honours a concurrency of 1 by running them strictly one at a time', async () => {
+        process.env.AWM_SENSORS_CONCURRENCY = '1';
+        dir = project(THREE);
+        const log = [];
+        mockRunCommand
+            .mockImplementationOnce(timed(log, 'typecheck', 30))
+            .mockImplementationOnce(timed(log, 'lint', 30))
+            .mockImplementationOnce(timed(log, 'security', 30));
+        const { runSensors } = load();
+        await runSensors({ cwd: dir });
+        expect(log.map(([label]) => label)).toEqual([
+            'typecheck:start', 'typecheck:end',
+            'lint:start', 'lint:end',
+            'security:start', 'security:end',
+        ]);
+    });
+    it('reports results in manifest order regardless of which sensor finishes first', async () => {
+        process.env.AWM_SENSORS_CONCURRENCY = '3';
+        dir = project(THREE);
+        const log = [];
+        // Deliberately inverted durations: security finishes first, typecheck last.
+        mockRunCommand
+            .mockImplementationOnce(timed(log, 'typecheck', 90))
+            .mockImplementationOnce(timed(log, 'lint', 50))
+            .mockImplementationOnce(timed(log, 'security', 10));
+        const { runSensors } = load();
+        const out = await runSensors({ cwd: dir });
+        expect(out.sensors.map((s) => s.name)).toEqual(['typecheck', 'lint', 'security']);
+    });
+});
+describe('resolveConcurrency', () => {
+    const load = () => require('../../../src/commands/sensors/run');
+    let prev;
+    beforeEach(() => { jest.resetModules(); prev = process.env.AWM_SENSORS_CONCURRENCY; });
+    afterEach(() => {
+        if (prev === undefined)
+            delete process.env.AWM_SENSORS_CONCURRENCY;
+        else
+            process.env.AWM_SENSORS_CONCURRENCY = prev;
+    });
+    it('never exceeds the number of sensors to run', () => {
+        delete process.env.AWM_SENSORS_CONCURRENCY;
+        const { resolveConcurrency } = load();
+        expect(resolveConcurrency({ pack: 'js-ts', sensors: {} }, 1)).toBe(1);
+    });
+    it('caps at 4 even on a large box', () => {
+        delete process.env.AWM_SENSORS_CONCURRENCY;
+        const { resolveConcurrency } = load();
+        expect(resolveConcurrency({ pack: 'js-ts', sensors: {} }, 32)).toBeLessThanOrEqual(4);
+    });
+    it('lets the manifest pin it', () => {
+        delete process.env.AWM_SENSORS_CONCURRENCY;
+        const { resolveConcurrency } = load();
+        expect(resolveConcurrency({ pack: 'js-ts', sensors: {}, concurrency: 2 }, 8)).toBe(2);
+    });
+    it('lets the environment override the manifest', () => {
+        process.env.AWM_SENSORS_CONCURRENCY = '1';
+        const { resolveConcurrency } = load();
+        expect(resolveConcurrency({ pack: 'js-ts', sensors: {}, concurrency: 4 }, 8)).toBe(1);
+    });
+    it('ignores nonsense and falls back to the derived cap', () => {
+        process.env.AWM_SENSORS_CONCURRENCY = 'banana';
+        const { resolveConcurrency } = load();
+        expect(resolveConcurrency({ pack: 'js-ts', sensors: {} }, 8)).toBeGreaterThanOrEqual(1);
+    });
+});

package/dist/tests/commands/sensors/run-tool-missing.test.js

@@ -36,23 +36,23 @@ describe('runSensors — an absent tool never reads as green (real /bin/sh)', ()
         roots.push(root);
         return root;
     };
-    it('marks a sensor whose binary is absent as fail, not skipped', () => {
+    it('marks a sensor whose binary is absent as fail, not skipped', async () => {
         const root = project({ security: { cmd: `${MISSING_BIN} .`, fast: true } });
-        const out = (0, run_1.runSensors)({ cwd: root });
+        const out = await (0, run_1.runSensors)({ cwd: root });
         const security = out.sensors.find(s => s.name === 'security');
         expect(security.status).toBe('fail');
         expect(security.errors[0].message).toMatch(/not available/i);
     });
-    it('does not let a healthy sensor carry the run to pass while another tool is absent', () => {
+    it('does not let a healthy sensor carry the run to pass while another tool is absent', async () => {
         const root = project({
             typecheck: { cmd: 'node -e ""', fast: true },
             security: { cmd: `${MISSING_BIN} .`, fast: true },
         });
-        const out = (0, run_1.runSensors)({ cwd: root });
+        const out = await (0, run_1.runSensors)({ cwd: root });
         expect(out.sensors.find(s => s.name === 'typecheck').status).toBe('pass');
         expect(out.overall).toBe('fail');
     });
-    it('does not misread a tool that ran and merely printed "not found" as an absent tool', () => {
+    it('does not misread a tool that ran and merely printed "not found" as an absent tool', async () => {
         // Exits 1, not 127: the binary existed and reported something of its own.
         // Classifying this as a missing tool would be a false accusation. It also
         // must not read as a benign 'skipped': the formatter parsed no findings
@@ -61,7 +61,7 @@ describe('runSensors — an absent tool never reads as green (real /bin/sh)', ()
         const root = project({
             security: { cmd: `node -e "console.error('rule pack not found'); process.exit(1)"`, fast: true },
         });
-        const out = (0, run_1.runSensors)({ cwd: root });
+        const out = await (0, run_1.runSensors)({ cwd: root });
         const security = out.sensors.find(s => s.name === 'security');
         expect(security.status).toBe('inconclusive');
         expect(security.errors).toEqual([]);

package/dist/tests/commands/sensors/run.test.js

@@ -11,10 +11,11 @@ function mkTmp() {
     return fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-sensors-'));
 }
 // Define stable mock before jest.mock hoisting
-const mockExecSyncFn = jest.fn();
-jest.mock('child_process', () => ({
-    execSync: (...args) => mockExecSyncFn(...args),
+const mockRunCommand = jest.fn();
+jest.mock('../../../src/commands/sensors/exec', () => ({
+    runCommand: (...args) => mockRunCommand(...args),
 }));
+const { ok, exited, timedOut } = require('./exec-fixtures');
 const MANIFEST = {
     pack: 'js-ts',
     sensors: {
@@ -33,15 +34,15 @@ describe('runSensors', () => {
         tmpDir = fs_1.default.mkdtempSync(path.join(os.tmpdir(), 'awm-run-test-'));
         fs_1.default.mkdirSync(path.join(tmpDir, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify(MANIFEST));
-        mockExecSyncFn.mockReset();
+        mockRunCommand.mockReset();
     });
     afterEach(() => { fs_1.default.rmSync(tmpDir, { recursive: true }); });
     const load = () => require('../../../src/commands/sensors/run');
-    it('returns not_certified output when manifest does not exist', () => {
+    it('returns not_certified output when manifest does not exist', async () => {
         const emptyDir = fs_1.default.mkdtempSync(path.join(os.tmpdir(), 'awm-empty-'));
         try {
             const { runSensors } = load();
-            const result = runSensors({ fast: true, cwd: emptyDir });
+            const result = await runSensors({ fast: true, cwd: emptyDir });
             expect(result.overall).toBe('not_certified');
             expect(result.sensors).toHaveLength(0);
         }
@@ -49,80 +50,80 @@ describe('runSensors', () => {
             fs_1.default.rmSync(emptyDir, { recursive: true });
         }
     });
-    it('runs only fast sensors with --fast flag', () => {
-        mockExecSyncFn.mockReturnValue('');
+    it('runs only fast sensors with --fast flag', async () => {
+        mockRunCommand.mockResolvedValue(ok());
         const { runSensors } = load();
-        const result = runSensors({ fast: true, cwd: tmpDir });
-        expect(mockExecSyncFn).toHaveBeenCalledTimes(2); // typecheck + lint (security disabled, mutation disabled)
+        const result = await runSensors({ fast: true, cwd: tmpDir });
+        expect(mockRunCommand).toHaveBeenCalledTimes(2); // typecheck + lint (security disabled, mutation disabled)
         expect(result.sensors.some((s) => s.name === 'security')).toBe(false);
         expect(result.overall).toBe('pass');
     });
-    it('returns fail when a fast sensor has errors', () => {
-        mockExecSyncFn
-            .mockImplementationOnce(() => { throw Object.assign(new Error(), { stdout: "src/a.ts(1,1): error TS0001: Bad type.", stderr: '', status: 1 }); })
-            .mockReturnValueOnce('');
+    it('returns fail when a fast sensor has errors', async () => {
+        mockRunCommand
+            .mockResolvedValueOnce(exited(1, 'src/a.ts(1,1): error TS0001: Bad type.'))
+            .mockResolvedValueOnce(ok());
         const { runSensors } = load();
-        const result = runSensors({ fast: true, cwd: tmpDir });
+        const result = await runSensors({ fast: true, cwd: tmpDir });
         expect(result.overall).toBe('fail');
         const tc = result.sensors.find((s) => s.name === 'typecheck');
         expect(tc.status).toBe('fail');
         expect(tc.errors[0].message).toMatch('SENSOR[typecheck]');
     });
-    it('marks sensor as inconclusive on timeout', () => {
-        mockExecSyncFn.mockImplementationOnce(() => { throw Object.assign(new Error('killed'), { code: 'ETIMEDOUT' }); });
-        mockExecSyncFn.mockReturnValueOnce('');
+    it('marks sensor as inconclusive on timeout', async () => {
+        mockRunCommand.mockResolvedValueOnce(timedOut());
+        mockRunCommand.mockResolvedValueOnce(ok());
         const { runSensors } = load();
-        const result = runSensors({ fast: true, cwd: tmpDir });
+        const result = await runSensors({ fast: true, cwd: tmpDir });
         const tc = result.sensors.find((s) => s.name === 'typecheck');
         expect(tc.status).toBe('inconclusive');
         expect(tc.skipReason).toMatch('timeout');
     });
-    it('skips disabled sensors', () => {
-        mockExecSyncFn.mockReturnValue('');
+    it('skips disabled sensors', async () => {
+        mockRunCommand.mockResolvedValue(ok());
         const { runSensors } = load();
-        const result = runSensors({ all: true, cwd: tmpDir });
+        const result = await runSensors({ all: true, cwd: tmpDir });
         const sec = result.sensors.find((s) => s.name === 'security');
         expect(sec.status).toBe('skipped');
         expect(sec.skipReason).toBe('disabled');
     });
-    const tcError = () => { throw Object.assign(new Error(), { stdout: 'src/a.ts(1,1): error TS0001: Bad type.', stderr: '', status: 1 }); };
-    it('baseline suppresses accepted findings — sensor passes on no NEW findings', () => {
+    const tcError = () => exited(1, 'src/a.ts(1,1): error TS0001: Bad type.');
+    it('baseline suppresses accepted findings — sensor passes on no NEW findings', async () => {
         const { runSensors } = load();
         const { buildBaseline, writeBaseline } = require('../../../src/commands/sensors/baseline');
         // Run 1 (no baseline): typecheck reports a TS error → fail.
-        mockExecSyncFn.mockImplementationOnce(tcError).mockReturnValueOnce('');
-        const first = runSensors({ fast: true, cwd: tmpDir });
+        mockRunCommand.mockResolvedValueOnce(tcError()).mockResolvedValueOnce(ok());
+        const first = await runSensors({ fast: true, cwd: tmpDir });
         expect(first.overall).toBe('fail');
         // Accept the current findings as baseline.
         writeBaseline(tmpDir, buildBaseline(first.sensors.map((s) => ({ name: s.name, errors: s.errors }))));
         // Run 2 (same finding): baseline-suppressed → pass.
-        mockExecSyncFn.mockImplementationOnce(tcError).mockReturnValueOnce('');
-        const second = runSensors({ fast: true, cwd: tmpDir });
+        mockRunCommand.mockResolvedValueOnce(tcError()).mockResolvedValueOnce(ok());
+        const second = await runSensors({ fast: true, cwd: tmpDir });
         const tc = second.sensors.find((s) => s.name === 'typecheck');
         expect(tc.status).toBe('pass');
         expect(tc.baselineCount).toBe(1);
         expect(second.overall).toBe('pass');
     });
-    it('baseline lets NEW findings through (still fails)', () => {
+    it('baseline lets NEW findings through (still fails)', async () => {
         const { runSensors } = load();
         const { writeBaseline } = require('../../../src/commands/sensors/baseline');
         writeBaseline(tmpDir, { typecheck: ['some-unrelated-fingerprint'] });
-        mockExecSyncFn.mockImplementationOnce(tcError).mockReturnValueOnce('');
-        const result = runSensors({ fast: true, cwd: tmpDir });
+        mockRunCommand.mockResolvedValueOnce(tcError()).mockResolvedValueOnce(ok());
+        const result = await runSensors({ fast: true, cwd: tmpDir });
         const tc = result.sensors.find((s) => s.name === 'typecheck');
         expect(tc.status).toBe('fail');
         expect(result.overall).toBe('fail');
     });
-    it('--ignore-baseline reports all findings even when a baseline exists', () => {
+    it('--ignore-baseline reports all findings even when a baseline exists', async () => {
         const { runSensors } = load();
         const { buildBaseline, writeBaseline } = require('../../../src/commands/sensors/baseline');
         // First capture + accept the finding.
-        mockExecSyncFn.mockImplementationOnce(tcError).mockReturnValueOnce('');
-        const first = runSensors({ fast: true, cwd: tmpDir });
+        mockRunCommand.mockResolvedValueOnce(tcError()).mockResolvedValueOnce(ok());
+        const first = await runSensors({ fast: true, cwd: tmpDir });
         writeBaseline(tmpDir, buildBaseline(first.sensors.map((s) => ({ name: s.name, errors: s.errors }))));
         // With ignoreBaseline, the accepted finding still counts → fail.
-        mockExecSyncFn.mockImplementationOnce(tcError).mockReturnValueOnce('');
-        const result = runSensors({ fast: true, cwd: tmpDir, ignoreBaseline: true });
+        mockRunCommand.mockResolvedValueOnce(tcError()).mockResolvedValueOnce(ok());
+        const result = await runSensors({ fast: true, cwd: tmpDir, ignoreBaseline: true });
         expect(result.overall).toBe('fail');
     });
 });
@@ -133,32 +134,26 @@ describe('runSensors — missing tool is a fail, not a skip', () => {
             fs_1.default.rmSync(root, { recursive: true, force: true });
     });
     beforeEach(() => {
-        mockExecSyncFn.mockReset();
+        mockRunCommand.mockReset();
         // What Node's execSync actually throws when the binary is absent and `/bin/sh`
         // is dash (Debian/Ubuntu, hence most CI runners): status 127, `not found`
         // rather than bash's `command not found`, and no `code` — ENOENT is set only
         // when spawning the shell itself fails, not the command inside it.
-        mockExecSyncFn.mockImplementation(() => {
-            throw Object.assign(new Error('Command failed: awm-nonexistent-binary-xyz .'), {
-                stdout: '',
-                stderr: '/bin/sh: 1: awm-nonexistent-binary-xyz: not found\n',
-                status: 127,
-            });
-        });
+        mockRunCommand.mockResolvedValue(exited(127, '', '/bin/sh: 1: awm-nonexistent-binary-xyz: not found\n'));
     });
     // The sensor is named `security` so it uses the semgrep formatter, which returns
     // zero findings for unparseable shell noise and lets execution reach the
     // tool-missing branch. Under the generic formatter any stderr becomes a finding,
     // so a sensor named `ghost` would report `fail` without that branch ever running —
     // green for a reason unrelated to what this test claims to cover.
-    it('marks a sensor whose binary is missing as fail', () => {
+    it('marks a sensor whose binary is missing as fail', async () => {
         root = mkTmp();
         fs_1.default.mkdirSync(path_1.default.join(root, '.awm'));
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: { security: { cmd: 'awm-nonexistent-binary-xyz .', fast: true } },
         }));
-        const out = (0, run_1.runSensors)({ cwd: root });
+        const out = await (0, run_1.runSensors)({ cwd: root });
         const security = out.sensors.find((s) => s.name === 'security');
         expect(security?.status).toBe('fail');
         expect(security?.errors[0].message).toMatch(/not available/i);
@@ -168,8 +163,8 @@ describe('runSensors — missing tool is a fail, not a skip', () => {
 describe('runSensors — not_certified + auto-discovery', () => {
     let tmpDir;
     beforeEach(() => {
-        mockExecSyncFn.mockReset();
-        mockExecSyncFn.mockReturnValue('');
+        mockRunCommand.mockReset();
+        mockRunCommand.mockResolvedValue(ok());
     });
     afterEach(() => {
         if (tmpDir) {
@@ -177,19 +172,19 @@ describe('runSensors — not_certified + auto-discovery', () => {
             tmpDir = undefined;
         }
     });
-    it('returns not_certified when no manifest exists anywhere up the tree', () => {
+    it('returns not_certified when no manifest exists anywhere up the tree', async () => {
         tmpDir = mkTmp();
-        const out = (0, run_1.runSensors)({ cwd: tmpDir });
+        const out = await (0, run_1.runSensors)({ cwd: tmpDir });
         expect(out.overall).toBe('not_certified');
         expect(out.sensors).toEqual([]);
     });
-    it('discovers .awm/sensors.json in a parent directory (walk-up)', () => {
+    it('discovers .awm/sensors.json in a parent directory (walk-up)', async () => {
         tmpDir = mkTmp();
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'));
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({ pack: 'test', sensors: { noop: { cmd: 'echo ok', fast: true } } }));
         const nested = path_1.default.join(tmpDir, 'a', 'b');
         fs_1.default.mkdirSync(nested, { recursive: true });
-        const out = (0, run_1.runSensors)({ cwd: nested });
+        const out = await (0, run_1.runSensors)({ cwd: nested });
         expect(out.overall).toBe('pass');
         expect(out.sensors.length).toBe(1);
     });
@@ -234,7 +229,7 @@ describe('reconcilePack', () => {
             fs_1.default.writeFileSync(path_1.default.join(dir, 'package.json'), '{}');
         return dir;
     }
-    it('upgrades generic→js-ts when package.json is present', () => {
+    it('upgrades generic→js-ts when package.json is present', async () => {
         const { reconcilePack } = require('../../../src/commands/sensors/run');
         const dir = tmpProject('generic', true);
         try {
@@ -253,7 +248,7 @@ describe('reconcilePack', () => {
             fs_1.default.rmSync(dir, { recursive: true });
         }
     });
-    it('is a no-op when pack is already real (idempotent)', () => {
+    it('is a no-op when pack is already real (idempotent)', async () => {
         const { reconcilePack } = require('../../../src/commands/sensors/run');
         const dir = tmpProject('js-ts', true);
         try {
@@ -266,7 +261,7 @@ describe('reconcilePack', () => {
             fs_1.default.rmSync(dir, { recursive: true });
         }
     });
-    it('does not upgrade a truly generic project (no indicators)', () => {
+    it('does not upgrade a truly generic project (no indicators)', async () => {
         const { reconcilePack } = require('../../../src/commands/sensors/run');
         const dir = tmpProject('generic', false);
         try {
@@ -288,44 +283,32 @@ describe('runSensors — test sensor (exit-code)', () => {
         jest.resetModules();
         tmpDir = fs_1.default.mkdtempSync(path.join(os.tmpdir(), 'awm-run-test-'));
         fs_1.default.mkdirSync(path.join(tmpDir, '.awm'), { recursive: true });
-        mockExecSyncFn.mockReset();
+        mockRunCommand.mockReset();
     });
     afterEach(() => { fs_1.default.rmSync(tmpDir, { recursive: true }); });
     const load = () => require('../../../src/commands/sensors/run');
-    it('test sensor: passing run (exit 0 with output) is pass, not fail', () => {
+    it('test sensor: passing run (exit 0 with output) is pass, not fail', async () => {
         fs_1.default.writeFileSync(path.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({ pack: 'js-ts', sensors: { test: { cmd: 'npm test', fast: false } } }));
-        mockExecSyncFn.mockReturnValue('Tests: 6 passed, 6 total\n'); // runner prints on success
+        mockRunCommand.mockResolvedValue(ok('Tests: 6 passed, 6 total\n')); // runner prints on success
         const { runSensors } = load();
-        const result = runSensors({ all: true, cwd: tmpDir });
+        const result = await runSensors({ all: true, cwd: tmpDir });
         const test = result.sensors.find((s) => s.name === 'test');
         expect(test.status).toBe('pass');
     });
-    it('test sensor: failing run (non-zero exit) is fail, not skipped', () => {
+    it('test sensor: failing run (non-zero exit) is fail, not skipped', async () => {
         fs_1.default.writeFileSync(path.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({ pack: 'js-ts', sensors: { test: { cmd: 'npm test', fast: false } } }));
-        mockExecSyncFn.mockImplementation(() => {
-            const err = new Error('jest failed');
-            err.status = 1;
-            err.stdout = 'Tests: 1 failed, 5 passed\n';
-            err.stderr = '';
-            throw err;
-        });
+        mockRunCommand.mockResolvedValue(exited(1, 'Tests: 1 failed, 5 passed\n'));
         const { runSensors } = load();
-        const result = runSensors({ all: true, cwd: tmpDir });
+        const result = await runSensors({ all: true, cwd: tmpDir });
         const test = result.sensors.find((s) => s.name === 'test');
         expect(test.status).toBe('fail');
         expect(result.overall).toBe('fail');
     });
-    it('test sensor: missing npm test script exits non-zero → fail, not skipped', () => {
+    it('test sensor: missing npm test script exits non-zero → fail, not skipped', async () => {
         fs_1.default.writeFileSync(path.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({ pack: 'js-ts', sensors: { test: { cmd: 'npm test', fast: false } } }));
-        mockExecSyncFn.mockImplementation(() => {
-            const err = new Error('npm test: missing script');
-            err.status = 1;
-            err.stdout = 'npm error Missing script: test\n';
-            err.stderr = '';
-            throw err;
-        });
+        mockRunCommand.mockResolvedValue(exited(1, 'npm error Missing script: test\n'));
         const { runSensors } = load();
-        const result = runSensors({ all: true, cwd: tmpDir });
+        const result = await runSensors({ all: true, cwd: tmpDir });
         const test = result.sensors.find((s) => s.name === 'test');
         expect(test.status).toBe('fail');
         expect(result.overall).toBe('fail');
@@ -335,10 +318,10 @@ describe('runSensors — honest floor (not_certified over real stack)', () => {
     const path = require('path');
     const os = require('os');
     beforeEach(() => {
-        mockExecSyncFn.mockReset();
-        mockExecSyncFn.mockReturnValue('');
+        mockRunCommand.mockReset();
+        mockRunCommand.mockResolvedValue(ok());
     });
-    it('returns not_certified (not skipped) for a generic manifest over a real stack', () => {
+    it('returns not_certified (not skipped) for a generic manifest over a real stack', async () => {
         const dir = fs_1.default.mkdtempSync(path.join(os.tmpdir(), 'awm-floor-'));
         fs_1.default.mkdirSync(path.join(dir, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path.join(dir, '.awm', 'sensors.json'), JSON.stringify({ pack: 'generic', sensors: { security: { cmd: 'semgrep .', fast: false } } }));
@@ -349,7 +332,7 @@ describe('runSensors — honest floor (not_certified over real stack)', () => {
         try {
             jest.resetModules();
             const { runSensors } = require('../../../src/commands/sensors/run');
-            const result = runSensors({ fast: true, cwd: dir }); // --fast filters the fast:false security sensor → empty
+            const result = await runSensors({ fast: true, cwd: dir }); // --fast filters the fast:false security sensor → empty
             expect(result.overall).toBe('not_certified');
         }
         finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.5.0",
+  "version": "3.7.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"