agentic-workflow-manager 3.9.1 → 3.11.0

package/dist/src/commands/preflight/checks.js

@@ -4,10 +4,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.preflight = preflight;
+const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const status_1 = require("../sensors/status");
 const init_1 = require("../sensors/init");
+const paths_1 = require("../../core/paths");
 const MANIFEST = path_1.default.join('.awm', 'sensors.json');
 /**
  * The agent needs project context delivered every session. A repo with neither file
@@ -62,6 +64,19 @@ function checkManifest(cwd, manifest) {
     }
     const total = Object.keys(manifest.sensors ?? {}).length;
     const enabled = Object.values(manifest.sensors ?? {}).filter(s => s.enabled !== false).length;
+    // total === 0 is NOT an opt-out: a deliberate opt-out lists every known sensor NAME
+    // explicitly with `enabled: false` (total > 0, enabled === 0). Zero entries means
+    // nothing was ever configured — most commonly because the registry had no pack.json
+    // for the detected stack, so `awm sensors init` built an honest, empty manifest
+    // rather than inventing defaults. That must not read as "all sensors disabled".
+    if (total === 0) {
+        return {
+            id: 'manifest',
+            ok: false,
+            detail: `pack '${manifest.pack}' has no sensors — the registry has no pack.json for it`,
+            remedy: `registry has no pack for '${manifest.pack}': run \`awm update\` or add a registry that has it`,
+        };
+    }
     return {
         id: 'manifest',
         ok: true,
@@ -75,6 +90,20 @@ function checkTools(cwd) {
     if (status.overall === 'NOT_CONFIGURED') {
         return { id: 'tools', ok: false, detail: 'no manifest to check', remedy: 'run `awm sensors init`' };
     }
+    // A manifest with zero sensor entries (honest-degraded — no pack.json reachable in
+    // the registry for this stack) makes `Object.entries({}).filter(...)` vacuously
+    // empty, which used to read as "0 broken out of 0" — a clean pass for a manifest
+    // that checks nothing at all. Mirrors the same zero-sensors signal `checkManifest`
+    // already guards against; this defends the invariant independently rather than
+    // relying solely on `checkManifest`'s gate to catch this exact manifest shape.
+    if (Object.keys(status.checks).length === 0) {
+        return {
+            id: 'tools',
+            ok: false,
+            detail: 'no sensors configured to check (0 sensor entries in the manifest)',
+            remedy: `registry has no pack for '${status.pack}': run \`awm update\` or add a registry that has it`,
+        };
+    }
     const broken = Object.entries(status.checks).filter(([, c]) => !c.ok);
     if (broken.length > 0) {
         return {
@@ -106,6 +135,89 @@ function checkPack(cwd, manifest) {
     }
     return { id: 'pack', ok: true, detail: `${manifest.pack} matches the detected stack` };
 }
+/**
+ * Extract just the hostname portion of a git remote URL — never match against the
+ * full URL string. A bare substring check against the whole remote (`remote.includes
+ * ('gitlab')`) false-positives on an org/repo name that happens to contain the word,
+ * e.g. `git@github.enterprise.internal:kodria/gitlab-migration-tool.git` is a GitHub
+ * Enterprise remote, not GitLab — "gitlab" only appears in the repo name.
+ *
+ * Covers the two common remote URL shapes:
+ *   HTTPS: `https://github.com/org/repo.git`      -> `github.com`
+ *   SSH:   `git@github.com:org/repo.git`          -> `github.com`
+ *
+ * Scheme-prefixed remotes (`https://`, `ssh://`, ...) are parsed with the built-in
+ * `URL` class rather than a hand-rolled regex — `.hostname` is spec-defined to exclude
+ * both userinfo (`user:pass@`/`user@`) and `:port`, so a userinfo or password/token
+ * that happens to contain "github"/"gitlab" (e.g. an SSH username `ssh://gitlab@host/`
+ * or a CI credential-injection URL `https://x-access-token:$TOKEN@host/...`) can never
+ * leak into the matched host, and IPv6 literals in brackets are also handled correctly.
+ *
+ * The SCP-style shorthand (`user@host:path`, no scheme — not a real URI, so `URL`
+ * rejects it) falls back to a regex whose host-capture group excludes `@`, so a second
+ * `@` in the remote (`user@host@evil:path`) can't smuggle a bogus "host" past the colon
+ * check either — it simply fails to match and returns `undefined`.
+ *
+ * Returns `undefined` when neither shape matches, so callers fall through to the same
+ * "unrecognized host" handling as any other unmatched URL.
+ */
+function extractHost(remote) {
+    try {
+        return new URL(remote).hostname;
+    }
+    catch {
+        // Not a valid URL — likely git's SCP-like shorthand (user@host:path, no scheme).
+        // Node's URL class does not parse this form (it's not a real URI).
+    }
+    const scpMatch = remote.match(/^[^@\s]+@([^:\s@]+):/);
+    return scpMatch?.[1];
+}
+/**
+ * Advisory only — `ok` is ALWAYS `true` here, no matter what it finds. The
+ * `finishing-a-development-branch`/`receiving-code-review` skills detect the git host
+ * (GitHub vs GitLab) and shell out to `gh`/`glab` to open a PR/MR, degrading honestly
+ * when neither is on PATH. This check tells the operator, in advance, whether that
+ * downstream step will actually work — but plenty of legitimate workflows never create
+ * a PR/MR at all (merge locally, keep the branch as-is), so gating the whole harness on
+ * missing tooling here would be wrong. It is FYI, never a blocker.
+ */
+function checkHost(cwd) {
+    let remote;
+    try {
+        remote = (0, child_process_1.execFileSync)('git', ['remote', 'get-url', 'origin'], {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'], // no origin / not a repo prints to stderr — keep it off the operator's screen
+        }).trim();
+    }
+    catch {
+        // No `origin`, or not a git repo at all — nothing to advise on.
+        return { id: 'host', ok: true, detail: 'no git remote detected — PR/MR automation not applicable' };
+    }
+    const host = extractHost(remote);
+    if (host?.includes('github.com')) {
+        return (0, paths_1.resolveOnPath)('gh')
+            ? { id: 'host', ok: true, detail: 'github detected, gh available' }
+            : {
+                id: 'host',
+                ok: true,
+                detail: 'github detected, gh not on PATH — PR creation will require manual steps',
+                remedy: 'install the GitHub CLI (gh), or PR creation will need to be done manually',
+            };
+    }
+    if (host?.includes('gitlab')) {
+        return (0, paths_1.resolveOnPath)('glab')
+            ? { id: 'host', ok: true, detail: 'gitlab detected, glab available' }
+            : {
+                id: 'host',
+                ok: true,
+                detail: 'gitlab detected, glab not on PATH — MR creation will require manual steps',
+                remedy: 'install the GitLab CLI (glab), or MR creation will need to be done manually',
+            };
+    }
+    // Bitbucket, Azure DevOps, an internal git server, etc. — don't overclaim support.
+    return { id: 'host', ok: true, detail: 'git host not recognized (github/gitlab) — PR/MR automation not applicable' };
+}
 function preflight(cwd = process.cwd()) {
     const manifest = readManifest(cwd);
     const manifestExists = fs_1.default.existsSync(path_1.default.join(cwd, MANIFEST));
@@ -115,6 +227,9 @@ function preflight(cwd = process.cwd()) {
         // Skipped when there is no manifest: reporting "tools broken" on a repo that was
         // never set up buries the one thing the operator needs to read.
         ...(manifestExists ? [checkTools(cwd), checkPack(cwd, manifest)] : []),
+        // Runs unconditionally — orthogonal to sensor configuration entirely, this is
+        // about PR/MR tooling, not sensors.
+        checkHost(cwd),
     ];
     const status = !manifestExists ? 'not_configured'
         : checks.every(c => c.ok) ? 'ready'

package/dist/src/commands/sensors/formatters/mypy.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseMypyOutput = parseMypyOutput;
+// mypy's plain-text output (no --output json flag in this pack's defaultCmd), one
+// finding per line: `file:line: error: message  [code]`. The `[code]` suffix is
+// separated from the message by two spaces and is OPTIONAL — some mypy error kinds
+// omit it. No column: this pack's defaultCmd has no --show-column-numbers.
+//
+// Deliberately excluded, not matched by this pattern:
+//   - `note:` lines (e.g. `reveal_type` output, supplementary context) — not failures.
+//   - the trailing summary line (`Found N errors in M files…` / `Success: …`).
+const MYPY_LINE = /^(.+):(\d+): error: (.*?)(?:  \[(\S+)\])?$/;
+function parseMypyOutput(raw) {
+    const errors = [];
+    for (const line of raw.split('\n')) {
+        if (!line)
+            continue;
+        const m = MYPY_LINE.exec(line);
+        if (!m)
+            continue;
+        const [, file, lineStr, msg, code] = m;
+        errors.push({
+            file,
+            line: parseInt(lineStr, 10),
+            rule: code,
+            message: `SENSOR[typecheck] ${file}:${lineStr} — ${msg} Fix: review the type annotation. Error code: ${code ?? 'n/a'}.`,
+        });
+    }
+    return errors;
+}

package/dist/src/commands/sensors/formatters/ruff.js

@@ -0,0 +1,45 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRuffOutput = parseRuffOutput;
+const path_1 = __importDefault(require("path"));
+function parseRuffOutput(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    // Valid JSON syntax does not guarantee the expected shape — `{}`, `null`, `42` all
+    // parse successfully but are not arrays, and an array element can itself be `null`
+    // or missing the fields this parser reads. Guard both, or a well-formed-but-wrong
+    // shape from `ruff --output-format=json` throws instead of degrading to [].
+    if (!Array.isArray(parsed))
+        return [];
+    const cwd = process.cwd();
+    const errors = [];
+    for (const item of parsed) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const msg = item;
+        if (typeof msg.filename !== 'string')
+            continue;
+        if (!msg.location || typeof msg.location !== 'object'
+            || typeof msg.location.row !== 'number' || typeof msg.location.column !== 'number')
+            continue;
+        const rel = msg.filename.startsWith(cwd + path_1.default.sep)
+            ? path_1.default.relative(cwd, msg.filename)
+            : msg.filename;
+        errors.push({
+            file: rel,
+            line: msg.location.row,
+            column: msg.location.column,
+            rule: msg.code ?? 'unknown',
+            message: `SENSOR[lint] ${rel}:${msg.location.row} — ${msg.message ?? ''} Fix: check rule ${msg.code ?? 'unknown'}.`,
+        });
+    }
+    return errors;
+}

package/dist/src/commands/sensors/formatters/shellcheck.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseShellcheckOutput = parseShellcheckOutput;
+// shellcheck's own levels, from most to least severe: error, warning, info, style.
+// `info`/`style` are advisory — quoting preferences, portability nits — not genuine
+// problems (mirrors eslint.ts's `severity < 2` filter, which drops eslint's "warn" the
+// same way: findings should be real breakage, not 100% of the tool's advisory noise).
+// Only `error`/`warning` are reported as SensorErrors.
+const FAILING_LEVELS = new Set(['error', 'warning']);
+function parseShellcheckOutput(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    // Valid JSON syntax does not guarantee the expected shape — `{}`, `null`, `42` all
+    // parse successfully but are not arrays, and an array element can itself be `null`
+    // or missing the fields this parser reads. Guard both, or a well-formed-but-wrong
+    // shape from `shellcheck -f json` throws instead of degrading to [].
+    if (!Array.isArray(parsed))
+        return [];
+    const errors = [];
+    for (const item of parsed) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const msg = item;
+        if (typeof msg.file !== 'string' || typeof msg.line !== 'number'
+            || typeof msg.column !== 'number' || typeof msg.code !== 'number'
+            || !msg.level)
+            continue;
+        if (!FAILING_LEVELS.has(msg.level))
+            continue;
+        const rule = `SC${msg.code}`;
+        errors.push({
+            file: msg.file,
+            line: msg.line,
+            column: msg.column,
+            rule,
+            message: `SENSOR[lint] ${msg.file}:${msg.line} — ${msg.message ?? ''} Fix: see https://www.shellcheck.net/wiki/${rule}.`,
+        });
+    }
+    return errors;
+}

package/dist/src/commands/sensors/index.js

@@ -46,12 +46,19 @@ function registerSensorsCommand(program) {
         .description('detect stack and write .awm/sensors.json (+ copy pack config files)')
         .option('--no-configure', 'skip copying sensor pack config files into the project')
         .option('--registry-root <path>', 'path to AWM registry root')
+        .option('--pack <name>', 'skip auto-detection, use this pack explicitly')
         .action((opts) => {
         const registryRoot = opts.registryRoot ?? (0, registries_1.capabilityRoot)('sensor-packs') ?? undefined;
-        const result = (0, init_1.initSensors)({ configure: opts.configure, registryRoot });
-        prompts_1.log.success(`Detected: ${result.detection.pack} (${result.detection.indicators.join(', ') || 'fallback'})`);
-        prompts_1.log.success('Wrote .awm/sensors.json');
-        result.configured.forEach((f) => prompts_1.log.info(`  Installed ${f}`));
+        try {
+            const result = (0, init_1.initSensors)({ configure: opts.configure, registryRoot, pack: opts.pack });
+            prompts_1.log.success(`Detected: ${result.detection.pack} (${result.detection.indicators.join(', ') || 'fallback'})`);
+            prompts_1.log.success('Wrote .awm/sensors.json');
+            result.configured.forEach((f) => prompts_1.log.info(`  Installed ${f}`));
+        }
+        catch (e) {
+            prompts_1.log.error(e instanceof Error ? e.message : String(e));
+            process.exit(1);
+        }
     });
     sensors
         .command('baseline')

package/dist/src/commands/sensors/init.js

@@ -11,14 +11,37 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const STACK_DETECTORS = [
     { pack: 'js-ts', files: ['package.json'] },
-    { pack: 'python', files: ['pyproject.toml', 'setup.py', 'setup.cfg'] },
+    { pack: 'python', files: ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt', 'Pipfile'] },
 ];
+// Shell detection is a glob (`*.sh` in the repo root or in `scripts/`), unlike the
+// exact-filename matches above — so it needs its own scan rather than fitting the
+// STACK_DETECTORS table. Tried last, after js-ts and python both fail: a Python
+// project that also ships a root `deploy.sh` must still detect as `python`, never
+// `shell`. Order of specificity: js-ts > python > shell > generic.
+const SHELL_SCAN_DIRS = ['.', 'scripts'];
+function findShellIndicators(cwd) {
+    const found = [];
+    for (const dir of SHELL_SCAN_DIRS) {
+        const full = path_1.default.join(cwd, dir);
+        if (!fs_1.default.existsSync(full) || !fs_1.default.statSync(full).isDirectory())
+            continue;
+        for (const entry of fs_1.default.readdirSync(full, { withFileTypes: true })) {
+            if (entry.isFile() && entry.name.endsWith('.sh')) {
+                found.push(dir === '.' ? entry.name : path_1.default.join(dir, entry.name));
+            }
+        }
+    }
+    return found;
+}
 function detectStack(cwd) {
     for (const { pack, files } of STACK_DETECTORS) {
         const found = files.filter(f => fs_1.default.existsSync(path_1.default.join(cwd, f)));
         if (found.length > 0)
             return { pack, indicators: found };
     }
+    const shellIndicators = findShellIndicators(cwd);
+    if (shellIndicators.length > 0)
+        return { pack: 'shell', indicators: shellIndicators };
     return { pack: 'generic', indicators: [] };
 }
 // Candidate source dirs in priority order. `depcheck` analyzes the ones that
@@ -31,17 +54,6 @@ function detectSourceDirs(cwd) {
     });
     return found.length > 0 ? found : ['src'];
 }
-// Fallback defaults for packs that don't yet ship a pack.json in the registry
-// (today: python). js-ts/generic are sourced from
-// registry/sensor-packs/<pack>/pack.json — single source of truth.
-const FALLBACK_DEFAULTS = {
-    python: {
-        typecheck: { cmd: 'mypy .', fast: true },
-        lint: { cmd: 'ruff check . --output-format json', fast: true },
-        security: { cmd: 'semgrep --config .semgrep.awm.yml --json .', fast: false },
-        mutation: { enabled: false },
-    },
-};
 /**
  * Read sensor defaults from the pack's pack.json (the single source of truth).
  * Maps `defaultCmd` → `cmd` and substitutes the `{{SOURCE_DIRS}}` placeholder
@@ -76,21 +88,74 @@ function readPackDefaults(pack, registryRoot, cwd) {
             entry.changedCmd = def.changedCmd;
         if (def.changedExtensions)
             entry.changedExtensions = def.changedExtensions;
+        // Carries the real tool name (`mypy`, `ruff`, `shellcheck`…) so the runner can
+        // dispatch to the right output parser instead of guessing from the sensor name —
+        // see `SensorConfig.formatter`.
+        if (def.formatter)
+            entry.formatter = def.formatter;
         sensors[name] = entry;
     }
     return sensors;
 }
 function buildManifest(pack, existing, registryRoot, cwd = process.cwd()) {
     const fromPack = registryRoot ? readPackDefaults(pack, registryRoot, cwd) : null;
-    const defaults = fromPack ?? FALLBACK_DEFAULTS[pack] ?? {};
+    // No registry root, or the pack has no pack.json there → `{}` is the honest floor,
+    // not a bug to paper over with CLI-hardcoded defaults. `checkManifest` (preflight)
+    // and `computeSensorStatus` both surface a zero-sensor manifest as degraded, with a
+    // remedy pointing at the registry — never silently inventing sensors here instead.
+    const defaults = fromPack ?? {};
     const existingSensors = existing?.sensors ?? {};
-    return { pack, sensors: { ...defaults, ...existingSensors } };
+    // Per-FIELD merge, not whole-sensor-object replacement: if `existingSensors.foo`
+    // exists at all, a naive `{ ...defaults, ...existingSensors }` would replace
+    // `defaults.foo` wholesale, permanently dropping any field that only lives in the
+    // (newer) pack default — e.g. a pre-`formatter`-era manifest re-merged against a
+    // pack.json that now declares `formatter` would silently lose it forever. Merging
+    // field-by-field within each sensor entry lets a user's hand-edited field (e.g. a
+    // custom `cmd`) win, while still inheriting any field the existing manifest doesn't
+    // specify.
+    const sensorNames = new Set([...Object.keys(defaults), ...Object.keys(existingSensors)]);
+    const sensors = {};
+    for (const name of sensorNames) {
+        sensors[name] = { ...defaults[name], ...existingSensors[name] };
+    }
+    return { pack, sensors };
+}
+/**
+ * Validate that `pack` exists as a directory under `<registryRoot>/sensor-packs/`.
+ * Throws (not a swallow-and-return) so `awm sensors init --pack bogus` actually stops
+ * instead of silently writing a manifest for a pack that doesn't exist. Lists every
+ * pack directory actually present, sorted, so the user immediately sees valid options.
+ */
+function assertPackExists(pack, registryRoot) {
+    const packsDir = path_1.default.join(registryRoot, 'sensor-packs');
+    if (!fs_1.default.existsSync(packsDir) || !fs_1.default.statSync(packsDir).isDirectory()) {
+        throw new Error('registry has no sensor-packs directory');
+    }
+    const available = fs_1.default.readdirSync(packsDir, { withFileTypes: true })
+        .filter(e => e.isDirectory())
+        .map(e => e.name)
+        .sort();
+    if (!available.includes(pack)) {
+        throw new Error(`pack '${pack}' not found in registry (available: ${available.join(', ')})`);
+    }
 }
 function initSensors(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const configure = opts.configure ?? true; // configure (copy pack config files) by default
     const manifestPath = path_1.default.join(cwd, '.awm', 'sensors.json');
-    const detection = detectStack(cwd);
+    // --pack skips the heuristic entirely. Only validate against the registry when a
+    // registryRoot was actually given — same tolerance pattern as readPackDefaults /
+    // buildManifest elsewhere in this file for a missing registry: nothing to validate
+    // against, so nothing is validated.
+    let detection;
+    if (opts.pack) {
+        if (opts.registryRoot)
+            assertPackExists(opts.pack, opts.registryRoot);
+        detection = { pack: opts.pack, indicators: ['--pack override'] };
+    }
+    else {
+        detection = detectStack(cwd);
+    }
     let existing;
     if (fs_1.default.existsSync(manifestPath)) {
         try {

package/dist/src/commands/sensors/run.js

@@ -17,6 +17,9 @@ const eslint_1 = require("./formatters/eslint");
 const semgrep_1 = require("./formatters/semgrep");
 const generic_1 = require("./formatters/generic");
 const test_1 = require("./formatters/test");
+const mypy_1 = require("./formatters/mypy");
+const ruff_1 = require("./formatters/ruff");
+const shellcheck_1 = require("./formatters/shellcheck");
 const baseline_1 = require("./baseline");
 const changed_1 = require("./changed");
 const init_1 = require("./init");
@@ -117,7 +120,35 @@ function shouldRun(isFast, opts) {
         return true;
     return false;
 }
-function getFormatter(name) {
+/**
+ * Dispatch by the pack's `formatter` field (the real tool behind the sensor slot —
+ * `lint` is eslint on js-ts but ruff on python, shellcheck on shell) when present.
+ * Manifests written before this field existed carry no `formatter`, so they fall back
+ * to the pre-existing name-based dispatch — nothing already installed breaks.
+ */
+function getFormatter(name, formatterField) {
+    // A `formatter` field that is PRESENT but unrecognized (a typo in a pack.json, or a
+    // future pack declaring a tool this CLI version doesn't know about yet) is a
+    // different situation from no field at all. Falling through to name-based dispatch
+    // in that case would silently misparse a foreign output shape via the wrong parser
+    // (e.g. a `bandit` formatter falling through to `parseSemgrepOutput`, reading
+    // bandit's differently-shaped JSON and producing garbage findings). Only the
+    // ABSENT case (old manifest, written before this field existed) gets name-based
+    // backward-compat dispatch; a present-but-unknown value degrades honestly to the
+    // generic raw-wrap formatter instead.
+    if (formatterField !== undefined) {
+        switch (formatterField) {
+            case 'tsc': return tsc_1.parseTscOutput;
+            case 'eslint-llm': return eslint_1.parseEslintOutput;
+            case 'semgrep': return semgrep_1.parseSemgrepOutput;
+            case 'test': return test_1.parseTestOutput;
+            case 'mypy': return mypy_1.parseMypyOutput;
+            case 'ruff': return ruff_1.parseRuffOutput;
+            case 'shellcheck': return shellcheck_1.parseShellcheckOutput;
+            case 'generic': return generic_1.parseGenericOutput;
+            default: return generic_1.parseGenericOutput;
+        }
+    }
     if (name === 'typecheck')
         return tsc_1.parseTscOutput;
     if (name === 'lint')
@@ -131,9 +162,9 @@ function getFormatter(name) {
 function isExitCodeSensor(name) {
     return name === 'test';
 }
-async function runSensor(name, cmd, timeout, cwd) {
+async function runSensor(name, cmd, timeout, cwd, formatterField) {
     const res = await (0, exec_1.runCommand)(cmd, { timeout, cwd, maxBuffer: MAX_BUFFER });
-    const format = getFormatter(name);
+    const format = getFormatter(name, formatterField);
     // The shell itself never started (bad cwd, no shell). Nothing ran.
     if (res.spawnError) {
         return {
@@ -290,7 +321,7 @@ async function runSensors(opts = {}) {
     // in manifest order, so the reported order stays stable.
     const tasks = [];
     const settled = (r) => () => Promise.resolve(r);
-    for (const [name, config] of Object.entries(activeManifest.sensors)) {
+    for (const [name, config] of Object.entries(activeManifest.sensors ?? {})) {
         const isFast = config.fast ?? false;
         if (!shouldRun(isFast, opts))
             continue;
@@ -336,7 +367,7 @@ async function runSensors(opts = {}) {
         }
         const timeout = config.timeout ?? (isFast ? DEFAULT_FAST_TIMEOUT : DEFAULT_SLOW_TIMEOUT);
         tasks.push(async () => {
-            const result = await runSensor(name, cmd, timeout, cwd);
+            const result = await runSensor(name, cmd, timeout, cwd, config.formatter);
             const scoped = scope ? { ...result, scope } : result;
             return baseline ? applyBaseline(scoped, baseline[name]) : scoped;
         });

package/dist/src/commands/sensors/status.js

@@ -4,7 +4,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.computeSensorStatus = computeSensorStatus;
-const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../../core/paths");
@@ -16,17 +15,6 @@ function npxTool(parts) {
     }
     return undefined;
 }
-/** Resolve a binary on PATH portably: `where` on win32, POSIX `command -v` elsewhere. */
-function resolveOnPath(bin) {
-    const cmd = (0, paths_1.isWindowsNative)() ? `where ${bin}` : `command -v ${bin}`;
-    try {
-        (0, child_process_1.execSync)(cmd, { stdio: 'pipe' });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 /** If the command references `--config <file>`, that file must exist in the repo. */
 function configCheck(parts, cwd) {
     const i = parts.indexOf('--config');
@@ -60,7 +48,7 @@ function checkCmd(cmd, cwd) {
         }
         return configCheck(parts, cwd) ?? { ok: true, detail: `${tool} (node_modules/.bin)` };
     }
-    if (!resolveOnPath(bin)) {
+    if (!(0, paths_1.resolveOnPath)(bin)) {
         return { ok: false, detail: `${bin} not found in PATH` };
     }
     return configCheck(parts, cwd) ?? { ok: true, detail: bin };
@@ -78,7 +66,7 @@ function computeSensorStatus(cwd = process.cwd()) {
         return { overall: 'NOT_CONFIGURED', pack: null, checks: {} };
     }
     const checks = {};
-    for (const [name, config] of Object.entries(manifest.sensors)) {
+    for (const [name, config] of Object.entries(manifest.sensors ?? {})) {
         if (config.enabled === false) {
             checks[name] = { ok: true, detail: 'disabled' };
             continue;
@@ -89,6 +77,13 @@ function computeSensorStatus(cwd = process.cwd()) {
         }
         checks[name] = checkCmd(config.cmd, cwd);
     }
+    // `Object.values({}).every(...)` is vacuously true — a manifest with zero sensor
+    // entries (the registry had no pack.json for this stack; see init.ts) must not read
+    // as HEALTHY just because there was nothing to fail. Same false-green `checkManifest`
+    // guards against in preflight.
+    if (Object.keys(manifest.sensors ?? {}).length === 0) {
+        return { overall: 'DEGRADED', pack: manifest.pack, checks };
+    }
     const allOk = Object.values(checks).every(c => c.ok);
     return { overall: allOk ? 'HEALTHY' : 'DEGRADED', pack: manifest.pack, checks };
 }

package/dist/src/core/paths.js

@@ -10,6 +10,7 @@ exports.platform = platform;
 exports.isWindowsNative = isWindowsNative;
 exports.platformLabel = platformLabel;
 exports.warnIfUnsupportedPlatform = warnIfUnsupportedPlatform;
+exports.resolveOnPath = resolveOnPath;
 // cli/src/core/paths.ts
 //
 // Single source of truth for home / AWM_HOME resolution and platform detection.
@@ -17,6 +18,7 @@ exports.warnIfUnsupportedPlatform = warnIfUnsupportedPlatform;
 // always honored and tests need no jest.resetModules().
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 /** User home directory with a robust fallback. Never returns a raw, possibly-empty process.env.HOME. */
 function homeDir() {
     return process.env.HOME || os_1.default.homedir();
@@ -54,3 +56,14 @@ function warnIfUnsupportedPlatform(log) {
     if (isWindowsNative())
         log(exports.WINDOWS_NATIVE_WARNING);
 }
+/** Resolve a binary on PATH portably: `where` on win32, POSIX `command -v` elsewhere. */
+function resolveOnPath(bin) {
+    const cmd = isWindowsNative() ? `where ${bin}` : `command -v ${bin}`;
+    try {
+        (0, child_process_1.execSync)(cmd, { stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}