agentic-workflow-manager 3.9.1 → 3.11.0

package/dist/tests/commands/preflight/preflight.test.js

@@ -6,8 +6,23 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 const checks_1 = require("../../../src/commands/preflight/checks");
 const preflight_1 = require("../../../src/commands/preflight");
+// Only `execSync` (used by `resolveOnPath` to check for `gh`/`glab`) is mocked — `git
+// remote get-url origin` runs for real via `execFileSync` against real tmpdir git repos,
+// same as every other check in this file exercises the real filesystem.
+jest.mock('child_process', () => ({
+    ...jest.requireActual('child_process'),
+    execSync: jest.fn(),
+}));
+const mockExecSync = child_process_1.execSync;
+/** Turn a tmpdir into a real git repo with (optionally) an `origin` remote. */
+function gitRepo(dir, remoteUrl) {
+    (0, child_process_1.execFileSync)('git', ['init'], { cwd: dir, stdio: 'pipe' });
+    if (remoteUrl)
+        (0, child_process_1.execFileSync)('git', ['remote', 'add', 'origin', remoteUrl], { cwd: dir, stdio: 'pipe' });
+}
 /** CLAUDE.md: no test may reach the real ~/.awm. Everything here is a tmpdir. */
 function project(opts = {}) {
     const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-'));
@@ -81,6 +96,36 @@ describe('preflight', () => {
         expect(report.status).toBe('ready');
         expect(check(report, 'manifest').detail).toContain('opt-out');
     });
+    it('flags a manifest with zero sensor entries as degraded, distinct from a deliberate opt-out', () => {
+        // Genuinely different manifest shape from the opt-out test above: no sensor
+        // NAMES at all, vs. an opt-out which lists every known sensor explicitly with
+        // `enabled: false`. This is the honest-floor case from init.ts — the registry
+        // had no pack.json for the detected stack — and must never read as "opted out".
+        const noPack = make({
+            manifest: { pack: 'python', sensors: {} },
+        });
+        const report = (0, checks_1.preflight)(noPack);
+        expect(report.status).toBe('degraded');
+        expect(check(report, 'manifest').ok).toBe(false);
+        expect(check(report, 'manifest').detail).not.toContain('opt-out');
+        expect(check(report, 'manifest').detail).toContain('python');
+        expect(check(report, 'manifest').remedy).toContain('python');
+    });
+    it('flags the tools check as failing (not "0/0 runnable") for a manifest with zero sensor entries', () => {
+        // Regression for Finding 6: `checkTools` independently inspects
+        // `status.checks`, which is also `{}` for a zero-sensor manifest —
+        // `Object.entries({}).filter(...)` is vacuously `[]`, so before the fix this
+        // read as "0 broken out of 0 sensors" -> ok: true, a clean pass for a manifest
+        // that checks nothing at all. `checkManifest`'s own `total === 0` gate happens
+        // to also catch this exact manifest shape and keeps overall status degraded —
+        // but `checkTools` must defend the same invariant on its own.
+        const noPack = make({
+            manifest: { pack: 'python', sensors: {} },
+        });
+        const report = (0, checks_1.preflight)(noPack);
+        expect(check(report, 'tools').ok).toBe(false);
+        expect(report.status).toBe('degraded');
+    });
     it('flags a manifest stuck on generic while the tree has a real stack', () => {
         // The gate would run, report green, and have checked almost nothing.
         const dir = make({
@@ -112,6 +157,161 @@ describe('preflight', () => {
         expect((0, preflight_1.exitCodeFor)({ status: 'degraded', checks: [] })).toBe(1);
         expect((0, preflight_1.exitCodeFor)({ status: 'ready', checks: [] })).toBe(0);
     });
+    describe('host check (advisory — never changes the exit code)', () => {
+        // Fixtures below use a non-empty, deliberately-opted-out manifest (one sensor
+        // entry, `enabled: false`), not `sensors: {}` — the host check is orthogonal to
+        // sensor configuration, and an empty sensors object now fails `checkManifest`
+        // (see the `total === 0` branch), which would drag `report.status` off 'ready'
+        // for reasons unrelated to what these tests exercise.
+        beforeEach(() => { mockExecSync.mockReset(); });
+        it('reports github + gh available, and does not affect status', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'git@github.com:kodria/agentic-workflow.git');
+            mockExecSync.mockImplementation(((cmd) => {
+                if (cmd === 'command -v gh')
+                    return Buffer.from('/usr/bin/gh');
+                throw new Error(`not found: ${cmd}`);
+            }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toBe('github detected, gh available');
+            expect(report.status).toBe('ready');
+        });
+        it('is still ok:true (advisory only) when gitlab is detected but glab is not on PATH, and status stays ready', () => {
+            // The only thing "wrong" in this fixture is the missing `glab` — proving the
+            // advisory contract: it must not drag an otherwise-clean repo to `degraded`.
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'https://gitlab.com/kodria/agentic-workflow.git');
+            mockExecSync.mockImplementation((() => {
+                throw new Error('not found');
+            }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('glab not on PATH');
+            expect(check(report, 'host').remedy).toContain('glab');
+            expect(report.status).toBe('ready');
+        });
+        it('handles no origin remote gracefully — no throw, ok:true, minimal detail', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            // Not a git repo at all — the common case for `execFileSync` failing here.
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toBe('no git remote detected — PR/MR automation not applicable');
+            expect(check(report, 'host').remedy).toBeUndefined();
+            expect(report.status).toBe('ready');
+        });
+        it('handles a git repo with no origin remote configured gracefully', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir); // git init, no remote
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('no git remote detected');
+        });
+        it('does not overclaim support for an unrecognized host', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'git@bitbucket.org:kodria/agentic-workflow.git');
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('not recognized');
+            expect(report.status).toBe('ready');
+        });
+        it('does not misclassify a GitHub Enterprise host whose repo NAME contains "gitlab"', () => {
+            // The bug: a bare `remote.includes('gitlab')` matches the full remote URL
+            // string, so an org/repo name containing "gitlab" false-positives even though
+            // the actual host is unrelated. Hostname must be extracted first and matched
+            // in isolation.
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'git@github.enterprise.internal:kodria/gitlab-migration-tool.git');
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('not recognized');
+            expect(report.status).toBe('ready');
+        });
+        it('does not misclassify a non-GitHub host whose repo NAME contains "github"', () => {
+            // Same class of bug on the github side: "something-github-tool" is a repo
+            // name, not the host.
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'https://example.com/kodria/something-github-tool.git');
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('not recognized');
+            expect(report.status).toBe('ready');
+        });
+        it('does not misclassify a GitHub Enterprise host whose SSH USERNAME is "gitlab"', () => {
+            // The related bug: the scheme-based regex captured everything between
+            // `scheme://` and the first `/`, including `userinfo@` — so an SSH username
+            // of "gitlab" leaked into the matched "host" string and false-positived the
+            // `.includes('gitlab')` check even though the real host is GitHub
+            // Enterprise. `new URL(...).hostname` must exclude userinfo entirely.
+            //
+            // Note: `github.company-internal.com` legitimately contains the substring
+            // "github.com" (from "company"), so — with the userinfo bug fixed — this
+            // correctly classifies as github (checkHost's own substring matching is a
+            // separate, pre-existing design, not part of this fix). The regression this
+            // test guards is that it must never again read as gitlab.
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'ssh://gitlab@github.company-internal.com:22/team/repo.git');
+            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('github detected');
+            expect(check(report, 'host').detail).not.toContain('gitlab');
+            expect(report.status).toBe('ready');
+        });
+        it('does not misclassify a host whose injected credential/token contains "gitlab"', () => {
+            // A realistic CI credential-injection remote:
+            // `git remote set-url origin https://x-access-token:$TOKEN@host/...`. If the
+            // token or password happens to contain "gitlab", it must not leak into the
+            // matched host either.
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'https://user:gitlab@example-host.com/org/repo.git');
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('not recognized');
+            expect(report.status).toBe('ready');
+        });
+        it('does not misclassify an SCP-style remote with a second "@" in it', () => {
+            // `user@host:path` shorthand has no scheme for `URL` to parse, so it falls
+            // back to a regex. A second "@" (e.g. a malformed/adversarial remote) must
+            // not let a bogus "host@evil"-shaped capture slip past the colon check —
+            // the host-capture group excludes "@", so this fails to match at all and
+            // falls through to "unrecognized" rather than misclassifying as gitlab.
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'user@github.com@gitlab.evil:org/repo.git');
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('not recognized');
+            expect(report.status).toBe('ready');
+        });
+        it('still detects github.com over HTTPS', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'https://github.com/org/repo.git');
+            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').detail).toContain('github detected');
+        });
+        it('still detects github.com over SSH shorthand', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'git@github.com:org/repo.git');
+            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').detail).toContain('github detected');
+        });
+        it('still detects gitlab over HTTPS', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'https://gitlab.example.com/org/repo.git');
+            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').detail).toContain('gitlab detected');
+        });
+        it('still detects gitlab over SSH shorthand', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+            gitRepo(dir, 'git@gitlab.example.com:org/repo.git');
+            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').detail).toContain('gitlab detected');
+        });
+    });
     it('tells the operator not to hand a broken harness to an unattended run', () => {
         const out = (0, preflight_1.formatReport)({
             status: 'not_configured',

package/dist/tests/commands/sensors/formatters/mypy.test.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const mypy_1 = require("../../../../src/commands/sensors/formatters/mypy");
+describe('parseMypyOutput', () => {
+    it('parses a single mypy error line (real captured output)', () => {
+        const raw = 'bad.py:6: error: Incompatible return value type (got "int", expected "str")  [return-value]\n'
+            + 'Found 1 error in 1 file (checked 1 source file)';
+        const errors = (0, mypy_1.parseMypyOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].file).toBe('bad.py');
+        expect(errors[0].line).toBe(6);
+        expect(errors[0].rule).toBe('return-value');
+        expect(errors[0].message).toMatch('SENSOR[typecheck]');
+        expect(errors[0].message).toMatch('Fix:');
+        expect(errors[0].column).toBeUndefined(); // plain mypy output has no column
+    });
+    it('parses multiple error lines and ignores the trailing summary', () => {
+        const raw = 'multi.py:2: error: Incompatible return value type (got "int", expected "str")  [return-value]\n'
+            + 'multi.py:5: error: Incompatible return value type (got "str", expected "int")  [return-value]\n'
+            + 'multi.py:7: error: Incompatible types in assignment (expression has type "str", variable has type "int")  [assignment]\n'
+            + 'Found 3 errors in 1 file (checked 1 source file)';
+        const errors = (0, mypy_1.parseMypyOutput)(raw);
+        expect(errors).toHaveLength(3);
+        expect(errors.map(e => e.line)).toEqual([2, 5, 7]);
+        expect(errors[2].rule).toBe('assignment');
+    });
+    it('excludes `note:` lines — only `error:` lines are findings', () => {
+        // Real captured output: `reveal_type()` prints a note line ahead of the actual
+        // error, and an incompatible override reports without a trailing summary change.
+        const raw = 'notetest.py:2: note: Revealed type is "builtins.int"\n'
+            + 'notetest.py:10: error: Return type "str" of "foo" incompatible with return type "int" in supertype "A"  [override]\n'
+            + 'Found 1 error in 1 file (checked 1 source file)';
+        const errors = (0, mypy_1.parseMypyOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].line).toBe(10);
+        expect(errors[0].rule).toBe('override');
+    });
+    it('handles an error line with no trailing [code] bracket', () => {
+        // Synthetic case: attempted to reproduce a real mypy output line missing the
+        // bracketed error code against mypy 1.19.1 (syntax errors, import errors,
+        // `--warn-unused-ignores`, `--warn-redundant-casts`, unterminated strings,
+        // deep generic instantiation) — every error line this environment's mypy
+        // 1.19.1 produced included the `[code]` suffix (error codes have been attached
+        // to essentially all builtin error messages since they were introduced in
+        // mypy 0.730, per the mypy changelog). No real bracket-less line was found, so
+        // this fixture stays synthetic. The regex's optional bracket is kept
+        // defensively regardless — a plugin-emitted error, a third-party mypy
+        // extension, or an older mypy version could plausibly still omit it, and the
+        // parser must not crash or misparse if so.
+        const raw = 'foo.py:3: error: some mypy error kinds omit the bracketed code';
+        const errors = (0, mypy_1.parseMypyOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].rule).toBeUndefined();
+        expect(errors[0].message).toContain('n/a');
+    });
+    it('returns empty array for a clean run (real captured success line)', () => {
+        expect((0, mypy_1.parseMypyOutput)('Success: no issues found in 1 source file')).toEqual([]);
+        expect((0, mypy_1.parseMypyOutput)('')).toEqual([]);
+    });
+});

package/dist/tests/commands/sensors/formatters/ruff.test.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ruff_1 = require("../../../../src/commands/sensors/formatters/ruff");
+// Real `ruff check . --output-format json` output, captured against a fabricated
+// fixture (unused import + unused local variable).
+const SAMPLE = JSON.stringify([
+    {
+        cell: null,
+        code: 'F401',
+        end_location: { column: 10, row: 1 },
+        filename: '/home/user/project/bad.py',
+        fix: {
+            applicability: 'safe',
+            edits: [{ content: '', end_location: { column: 1, row: 2 }, location: { column: 1, row: 1 } }],
+            message: 'Remove unused import: `os`',
+        },
+        location: { column: 8, row: 1 },
+        message: '`os` imported but unused',
+        noqa_row: 1,
+        severity: 'error',
+        url: 'https://docs.astral.sh/ruff/rules/unused-import',
+    },
+    {
+        cell: null,
+        code: 'F841',
+        end_location: { column: 6, row: 4 },
+        filename: '/home/user/project/bad.py',
+        fix: {
+            applicability: 'unsafe',
+            edits: [{ content: '', end_location: { column: 1, row: 5 }, location: { column: 1, row: 4 } }],
+            message: 'Remove assignment to unused variable `x`',
+        },
+        location: { column: 5, row: 4 },
+        message: 'Local variable `x` is assigned to but never used',
+        noqa_row: 4,
+        severity: 'error',
+        url: 'https://docs.astral.sh/ruff/rules/unused-variable',
+    },
+]);
+describe('parseRuffOutput', () => {
+    let cwdSpy;
+    beforeEach(() => { cwdSpy = jest.spyOn(process, 'cwd').mockReturnValue('/home/user/project'); });
+    afterEach(() => { cwdSpy.mockRestore(); });
+    it('parses ruff JSON output into SensorErrors', () => {
+        const errors = (0, ruff_1.parseRuffOutput)(SAMPLE);
+        expect(errors).toHaveLength(2);
+        expect(errors[0].file).toBe('bad.py'); // relativized against cwd
+        expect(errors[0].line).toBe(1);
+        expect(errors[0].column).toBe(8);
+        expect(errors[0].rule).toBe('F401');
+        expect(errors[0].message).toMatch('SENSOR[lint]');
+        expect(errors[0].message).toMatch('Fix:');
+        expect(errors[1].rule).toBe('F841');
+    });
+    it('returns empty array for a clean run ([])', () => {
+        expect((0, ruff_1.parseRuffOutput)('[]')).toEqual([]);
+    });
+    it('returns empty array for malformed JSON', () => {
+        expect((0, ruff_1.parseRuffOutput)('not json')).toEqual([]);
+    });
+    // Regression for Finding 2: valid JSON that isn't the expected shape (object, null,
+    // number) must not throw when iterated — `JSON.parse` succeeding is not the same as
+    // the result being an array.
+    it.each([['{}'], ['null'], ['42'], ['"a string"']])('returns empty array for valid-but-non-array JSON: %s', (raw) => {
+        expect(() => (0, ruff_1.parseRuffOutput)(raw)).not.toThrow();
+        expect((0, ruff_1.parseRuffOutput)(raw)).toEqual([]);
+    });
+    it('skips a null array element instead of crashing', () => {
+        expect(() => (0, ruff_1.parseRuffOutput)('[null]')).not.toThrow();
+        expect((0, ruff_1.parseRuffOutput)('[null]')).toEqual([]);
+    });
+    it('skips an element with a null/missing location instead of crashing on .row/.column', () => {
+        const raw = JSON.stringify([
+            { code: 'F401', filename: '/home/user/project/a.py', location: null, message: 'x' },
+        ]);
+        expect(() => (0, ruff_1.parseRuffOutput)(raw)).not.toThrow();
+        expect((0, ruff_1.parseRuffOutput)(raw)).toEqual([]);
+    });
+    it('skips a malformed element but still returns valid elements from the same array', () => {
+        const raw = JSON.stringify([
+            null,
+            { code: 'F401', filename: '/home/user/project/a.py', location: null, message: 'bad' },
+            {
+                code: 'F841', filename: '/home/user/project/bad.py',
+                location: { column: 5, row: 4 }, message: 'Local variable `x` is assigned to but never used',
+            },
+        ]);
+        const errors = (0, ruff_1.parseRuffOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].rule).toBe('F841');
+    });
+});

package/dist/tests/commands/sensors/formatters/shellcheck.test.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const shellcheck_1 = require("../../../../src/commands/sensors/formatters/shellcheck");
+describe('parseShellcheckOutput', () => {
+    it('parses an error-level finding (real captured output: unbalanced if/then)', () => {
+        const raw = JSON.stringify([
+            { file: 'syntaxerr.sh', line: 2, endLine: 2, column: 1, endColumn: 1, level: 'error', code: 1049, message: "Did you forget the 'then' for this 'if'?", fix: null },
+        ]);
+        const errors = (0, shellcheck_1.parseShellcheckOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].file).toBe('syntaxerr.sh');
+        expect(errors[0].line).toBe(2);
+        expect(errors[0].column).toBe(1);
+        expect(errors[0].rule).toBe('SC1049'); // shellcheck's own stable SC-prefix convention
+        expect(errors[0].message).toMatch('SENSOR[lint]');
+        expect(errors[0].message).toMatch('https://www.shellcheck.net/wiki/SC1049');
+    });
+    it('parses a warning-level finding (real captured output: unused variable)', () => {
+        const raw = JSON.stringify([
+            { file: 'bad.sh', line: 7, endLine: 7, column: 1, endColumn: 4, level: 'warning', code: 2034, message: 'FOO appears unused. Verify use (or export if used externally).', fix: null },
+        ]);
+        const errors = (0, shellcheck_1.parseShellcheckOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].rule).toBe('SC2034');
+    });
+    // Deliberate choice, mirroring eslint.ts's `severity < 2` filter (which drops
+    // eslint's "warn"): shellcheck's `info`/`style` levels are advisory — quoting
+    // preferences, portability nits, not genuine breakage — and are excluded so
+    // findings stay real problems rather than 100% of shellcheck's advisory noise.
+    // Only `error`/`warning` are reported.
+    it('excludes info- and style-level findings (real captured output: SC2086, SC2268)', () => {
+        const raw = JSON.stringify([
+            { file: 'bad.sh', line: 4, endLine: 4, column: 6, endColumn: 9, level: 'style', code: 2268, message: 'Avoid x-prefix in comparisons as it no longer serves a purpose.', fix: null },
+            { file: 'bad.sh', line: 4, endLine: 4, column: 7, endColumn: 9, level: 'info', code: 2086, message: 'Double quote to prevent globbing and word splitting.', fix: null },
+        ]);
+        expect((0, shellcheck_1.parseShellcheckOutput)(raw)).toEqual([]);
+    });
+    it('returns empty array for a clean run (real captured output: [])', () => {
+        expect((0, shellcheck_1.parseShellcheckOutput)('[]')).toEqual([]);
+    });
+    it('returns empty array for malformed JSON', () => {
+        expect((0, shellcheck_1.parseShellcheckOutput)('not json')).toEqual([]);
+    });
+    // Regression for Finding 2: valid JSON that isn't the expected shape (object, null,
+    // number) must not throw when iterated — `JSON.parse` succeeding is not the same as
+    // the result being an array.
+    it.each([['{}'], ['null'], ['42'], ['"a string"']])('returns empty array for valid-but-non-array JSON: %s', (raw) => {
+        expect(() => (0, shellcheck_1.parseShellcheckOutput)(raw)).not.toThrow();
+        expect((0, shellcheck_1.parseShellcheckOutput)(raw)).toEqual([]);
+    });
+    it('skips a null array element instead of crashing', () => {
+        expect(() => (0, shellcheck_1.parseShellcheckOutput)('[null]')).not.toThrow();
+        expect((0, shellcheck_1.parseShellcheckOutput)('[null]')).toEqual([]);
+    });
+    it('skips a malformed element but still returns valid elements from the same array', () => {
+        const raw = JSON.stringify([
+            null,
+            { file: 'bad.sh', line: 7, column: 1, level: 'warning' }, // missing code/message
+            { file: 'bad.sh', line: 7, endLine: 7, column: 1, endColumn: 4, level: 'warning', code: 2034, message: 'FOO appears unused.', fix: null },
+        ]);
+        const errors = (0, shellcheck_1.parseShellcheckOutput)(raw);
+        expect(errors).toHaveLength(1);
+        expect(errors[0].rule).toBe('SC2034');
+    });
+});

package/dist/tests/commands/sensors/init.test.js

@@ -16,14 +16,30 @@ function makeRegistry() {
     fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
         name: 'js-ts',
         sensors: {
-            typecheck: { fast: true, defaultCmd: 'npx tsc --noEmit' },
-            lint: { fast: true, defaultCmd: 'npx eslint . --config eslint.config.awm.mjs --cache --format json' },
+            typecheck: { fast: true, defaultCmd: 'npx tsc --noEmit', formatter: 'tsc' },
+            lint: { fast: true, defaultCmd: 'npx eslint . --config eslint.config.awm.mjs --cache --format json', formatter: 'eslint-llm' },
             depcheck: { fast: false, defaultCmd: 'npx depcruise --config .dep-cruiser.awm.js {{SOURCE_DIRS}}' },
             mutation: { fast: false, enabled: false, defaultCmd: 'npx stryker run' },
         },
     }));
     return registryRoot;
 }
+// Mirrors makeRegistry()'s js-ts shape but for a python pack.json that declares
+// `formatter` on `typecheck` — needed for the buildManifest per-field-merge
+// regression test (a pre-`formatter`-era existing manifest must still inherit it).
+function makePythonRegistry() {
+    const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-reg-py-'));
+    const packDir = path_1.default.join(registryRoot, 'sensor-packs', 'python');
+    fs_1.default.mkdirSync(packDir, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
+        name: 'python',
+        sensors: {
+            typecheck: { fast: true, defaultCmd: 'mypy .', formatter: 'mypy' },
+            lint: { fast: true, defaultCmd: 'ruff check --output-format=json .', formatter: 'ruff' },
+        },
+    }));
+    return registryRoot;
+}
 describe('detectStack', () => {
     let tmpDir;
     beforeEach(() => { tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-')); });
@@ -39,6 +55,60 @@ describe('detectStack', () => {
     it('falls back to generic when no indicators found', () => {
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('generic');
     });
+    it('detects shell from a root-level *.sh file when no js-ts/python marker exists', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
+        const result = (0, init_1.detectStack)(tmpDir);
+        expect(result.pack).toBe('shell');
+        expect(result.indicators).toEqual(['deploy.sh']);
+    });
+    it('detects shell from a scripts/*.sh file when root has nothing', () => {
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'scripts'));
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'scripts', 'build.sh'), '#!/bin/sh\n');
+        const result = (0, init_1.detectStack)(tmpDir);
+        expect(result.pack).toBe('shell');
+        expect(result.indicators).toEqual([path_1.default.join('scripts', 'build.sh')]);
+    });
+    it('js-ts wins over shell when both package.json and a root .sh file exist', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('js-ts');
+    });
+    it('python wins over shell when both a python marker and a root .sh file exist', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'pyproject.toml'), '');
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
+    });
+    it('falls through to generic when scripts/ has only non-.sh files (glob must not over-match)', () => {
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'scripts'));
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'scripts', 'notes.txt'), 'not shell');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('generic');
+    });
+    it('detects python from requirements.txt alone', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'requirements.txt'), '');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
+    });
+    it('detects python from Pipfile alone', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'Pipfile'), '');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
+    });
+    it('python (via Pipfile) wins over shell when both a Pipfile and a root .sh file exist', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'Pipfile'), '');
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
+    });
+    it('does not report a directory named "*.sh" as a shell indicator', () => {
+        // Directory literally named `something.sh` (not a file) — findShellIndicators'
+        // `entry.isFile()` guard must exclude it. Nothing else present → generic.
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'something.sh'));
+        expect((0, init_1.detectStack)(tmpDir).pack).toBe('generic');
+    });
+    it('ignores a directory named "*.sh" but still finds a real .sh file alongside it', () => {
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'notreal.sh'));
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
+        const result = (0, init_1.detectStack)(tmpDir);
+        expect(result.pack).toBe('shell');
+        expect(result.indicators).toEqual(['deploy.sh']);
+    });
 });
 describe('detectSourceDirs', () => {
     let tmpDir;
@@ -87,9 +157,45 @@ describe('buildManifest', () => {
         expect(m.sensors.typecheck.cmd).toBe('custom-tsc');
         expect(m.sensors.lint).toBeDefined();
     });
-    it('uses the python fallback when the pack has no pack.json', () => {
+    it('carries the formatter field through from pack.json into the built manifest', () => {
+        // readPackDefaults must copy `formatter` the same way it already copies
+        // `changedCmd`/`changedExtensions` — this is what lets run.ts's getFormatter
+        // dispatch by real tool (ruff/mypy/shellcheck) instead of guessing from the
+        // sensor name. Without this carry-through the field is read from pack.json but
+        // silently dropped before it ever reaches the manifest run.ts consumes.
+        const m = (0, init_1.buildManifest)('js-ts', undefined, registryRoot, cwd);
+        expect(m.sensors.typecheck.formatter).toBe('tsc');
+        expect(m.sensors.lint.formatter).toBe('eslint-llm');
+    });
+    it('returns an empty sensors object when the pack has no pack.json in the registry', () => {
+        // No FALLBACK_DEFAULTS anymore: `python` has no pack dir in this fixture
+        // registry (only js-ts does — see makeRegistry) → the honest floor is `{}`,
+        // never CLI-hardcoded commands that can drift from what the registry ships.
         const m = (0, init_1.buildManifest)('python', undefined, registryRoot, cwd);
-        expect(m.sensors.typecheck.cmd).toBe('mypy .');
+        expect(m.sensors).toEqual({});
+    });
+    it('per-field merge: an existing sensor missing a newer pack field still inherits it', () => {
+        // Regression for Finding 1: a manifest written by the old FALLBACK_DEFAULTS-era
+        // CLI has `typecheck: { cmd: 'mypy .', fast: true }` — no `formatter`, because
+        // that field didn't exist yet. A naive `{ ...defaults, ...existingSensors }`
+        // whole-sensor-object merge would replace `defaults.typecheck` wholesale,
+        // permanently dropping `formatter` even though the (upgraded) pack now declares
+        // it. The fix merges per FIELD within each sensor, so `formatter` — a field the
+        // existing manifest never specified — is inherited from the pack default.
+        const pyRegistryRoot = makePythonRegistry();
+        try {
+            const existing = {
+                pack: 'python',
+                sensors: { typecheck: { cmd: 'mypy .', fast: true } },
+            };
+            const m = (0, init_1.buildManifest)('python', existing, pyRegistryRoot, cwd);
+            expect(m.sensors.typecheck.formatter).toBe('mypy');
+            expect(m.sensors.typecheck.cmd).toBe('mypy .');
+            expect(m.sensors.typecheck.fast).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(pyRegistryRoot, { recursive: true });
+        }
     });
 });
 describe('initSensors', () => {
@@ -135,3 +241,52 @@ describe('initSensors', () => {
         expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'tsconfig.awm.json'))).toBe(false);
     });
 });
+describe('initSensors — --pack override', () => {
+    let tmpDir;
+    let registryRoot;
+    beforeEach(() => {
+        tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-pack-'));
+        registryRoot = makeRegistry(); // only ships a js-ts pack dir — see makeRegistry
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tmpDir, { recursive: true });
+        fs_1.default.rmSync(registryRoot, { recursive: true });
+    });
+    it('skips detection and uses the override pack when it exists in the registry', () => {
+        // No package.json/pyproject.toml here — if detection ran, this would be 'generic'.
+        const result = (0, init_1.initSensors)({ pack: 'js-ts', registryRoot, cwd: tmpDir });
+        expect(result.detection.pack).toBe('js-ts');
+        // Indicators must reflect an override, not file-based detection.
+        expect(result.detection.indicators).not.toEqual(['package.json']);
+        expect(result.detection.indicators.join(' ')).toMatch(/pack override/i);
+    });
+    it('throws listing available packs when the override pack is not in the registry', () => {
+        expect(() => (0, init_1.initSensors)({ pack: 'bogus', registryRoot, cwd: tmpDir })).toThrow(/js-ts/);
+        try {
+            (0, init_1.initSensors)({ pack: 'bogus', registryRoot, cwd: tmpDir });
+            throw new Error('expected initSensors to throw');
+        }
+        catch (e) {
+            expect(e.message).toContain('bogus');
+            expect(e.message).toContain('js-ts');
+        }
+    });
+    it('does not throw when no registryRoot is given — nothing to validate against', () => {
+        expect(() => (0, init_1.initSensors)({ pack: 'anything', cwd: tmpDir })).not.toThrow();
+        const result = (0, init_1.initSensors)({ pack: 'anything', cwd: tmpDir });
+        expect(result.detection.pack).toBe('anything');
+    });
+    it('throws a distinct message when the registry root has no sensor-packs directory at all', () => {
+        // Different failure shape from "pack not in the list": the registry root
+        // itself is missing sensor-packs/, so there's no list to show — must say
+        // so plainly instead of reporting an empty `available: `.
+        const emptyRegistryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-empty-reg-'));
+        try {
+            expect(() => (0, init_1.initSensors)({ pack: 'js-ts', registryRoot: emptyRegistryRoot, cwd: tmpDir }))
+                .toThrow(/no sensor-packs directory/);
+        }
+        finally {
+            fs_1.default.rmSync(emptyRegistryRoot, { recursive: true });
+        }
+    });
+});