agentic-workflow-manager 6.4.1 → 6.5.0

package/dist/tests/commands/sensors/coverage/evidence.test.js

@@ -0,0 +1,251 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const tmp_1 = require("../../../support/tmp");
+const evidence_1 = require("../../../../src/commands/sensors/coverage/evidence");
+const contract_1 = require("../../../../src/commands/sensors/coverage/contract");
+let root;
+let externalRoot;
+beforeEach(() => {
+    root = (0, tmp_1.mkCanonicalTmpDir)('awm-coverage-evidence-');
+    externalRoot = undefined;
+});
+afterEach(() => {
+    fs_1.default.rmSync(root, { recursive: true, force: true });
+    if (externalRoot)
+        fs_1.default.rmSync(externalRoot, { recursive: true, force: true });
+});
+const detector = {
+    sensor: 'lint',
+    evidence: {
+        commandIncludes: ['eslint', '--config'],
+        files: [{ path: 'eslint.config.js', containsAll: ['no-unreachable'] }],
+    },
+};
+const noFollowUnavailableOnNativeWindows = process.platform === 'win32'
+    && typeof fs_1.default.constants.O_NOFOLLOW !== 'number';
+const regularFileStatus = (posixStatus) => noFollowUnavailableOnNativeWindows ? 'unverifiable' : posixStatus;
+test('active matching sensor with all AND evidence is covered (R2.2)', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), "rules: { 'no-unreachable': 'error' }");
+    const observed = (0, evidence_1.observeDetector)(root, 'style', 0, detector, {
+        cmd: 'npx eslint . --config eslint.config.js', enabled: true,
+    });
+    if (noFollowUnavailableOnNativeWindows) {
+        expect(observed).toMatchObject({
+            status: 'unverifiable',
+            evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
+        });
+        return;
+    }
+    expect(observed).toEqual({
+        classId: 'style',
+        detectorIndex: 0,
+        sensor: 'lint',
+        status: 'covered',
+        evidence: [
+            { kind: 'command', status: 'matched' },
+            { kind: 'file', path: 'eslint.config.js', status: 'matched' },
+            { kind: 'marker', path: 'eslint.config.js', ordinal: 1, status: 'matched' },
+        ],
+    });
+});
+test.each([
+    [undefined, 'missing'],
+    [{ cmd: 'npx eslint .', enabled: false }, 'disabled'],
+    [{ cmd: 'custom-linter .' }, 'unverifiable'],
+    [{ enabled: true }, 'unverifiable'],
+])('maps sensor availability/config %# to %s (R2.3, R2.5)', (sensor, expected) => {
+    expect((0, evidence_1.observeDetector)(root, 'style', 0, detector, sensor)).toMatchObject({ status: expected });
+});
+test('records absent and custom required commands without exposing their text (R2.5)', () => {
+    const absent = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { enabled: true });
+    const custom = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'private-linter --private-flag' });
+    expect(absent).toMatchObject({
+        status: 'unverifiable',
+        evidence: [{ kind: 'command', status: 'missing' }],
+    });
+    expect(custom).toMatchObject({
+        status: 'unverifiable',
+        evidence: [{ kind: 'command', status: 'custom' }],
+    });
+    expect(JSON.stringify({ absent, custom })).not.toContain('private-linter');
+    expect(JSON.stringify({ absent, custom })).not.toContain('private-flag');
+});
+test('recognized command plus missing file is ineffective (R2.4)', () => {
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' });
+    expect(out.status).toBe('ineffective');
+    expect(out.evidence).toContainEqual({ kind: 'file', path: 'eslint.config.js', status: 'missing' });
+});
+test('recognized command plus missing literal marker is ineffective (R2.4)', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'export default []');
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' });
+    expect(out.status).toBe(regularFileStatus('ineffective'));
+    if (noFollowUnavailableOnNativeWindows) {
+        expect(out.evidence).toContainEqual({ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' });
+    }
+    else {
+        expect(out.evidence).toContainEqual({ kind: 'marker', path: 'eslint.config.js', ordinal: 1, status: 'missing' });
+    }
+});
+test('native Windows without no-follow support never certifies regular evidence from its contents', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'no-unreachable');
+    const observed = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' });
+    if (noFollowUnavailableOnNativeWindows) {
+        expect(observed.status).toBe('unverifiable');
+        expect(observed.status).not.toBe('covered');
+        expect(observed.status).not.toBe('ineffective');
+    }
+    else {
+        expect(observed.status).toBe('covered');
+    }
+});
+test('unverifiable file evidence dominates missing evidence in the detector result (R2.5a)', () => {
+    const mixed = {
+        sensor: 'lint',
+        evidence: {
+            files: [
+                { path: 'missing.js', containsAll: [] },
+                { path: 'linked.js', containsAll: ['no-unreachable'] },
+            ],
+        },
+    };
+    const target = path_1.default.join(root, 'target.js');
+    fs_1.default.writeFileSync(target, 'no-unreachable');
+    fs_1.default.symlinkSync(target, path_1.default.join(root, 'linked.js'));
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, mixed, { cmd: 'eslint' });
+    expect(out.status).toBe('unverifiable');
+    expect(out.evidence).toEqual(expect.arrayContaining([
+        { kind: 'file', path: 'missing.js', status: 'missing' },
+        { kind: 'file', path: 'linked.js', status: 'unverifiable' },
+    ]));
+});
+test.each(['symlink', 'oversize'])('%s evidence is unverifiable, never green or missing (R2.5a, R2.11)', (kind) => {
+    const target = path_1.default.join(root, 'target.js');
+    fs_1.default.writeFileSync(target, 'no-unreachable');
+    const file = path_1.default.join(root, 'eslint.config.js');
+    if (kind === 'symlink')
+        fs_1.default.symlinkSync(target, file);
+    if (kind === 'oversize')
+        fs_1.default.writeFileSync(file, Buffer.alloc(contract_1.MAX_COVERAGE_FILE_BYTES + 1));
+    expect((0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' })).toMatchObject({
+        status: 'unverifiable',
+        evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
+    });
+});
+test('does not trust injected lstat semantics to make symlink evidence regular (R2.11)', () => {
+    const target = path_1.default.join(root, 'target.js');
+    const file = path_1.default.join(root, 'eslint.config.js');
+    fs_1.default.writeFileSync(target, 'no-unreachable');
+    fs_1.default.symlinkSync(target, file);
+    const command = { cmd: 'eslint --config eslint.config.js' };
+    const observedWithLstat = (0, evidence_1.observeDetector)(root, 'style', 0, detector, command, {
+        lstatSync: fs_1.default.lstatSync,
+    });
+    const simulatedStatRegression = (0, evidence_1.observeDetector)(root, 'style', 0, detector, command, {
+        lstatSync: fs_1.default.statSync,
+    });
+    expect(observedWithLstat.status).toBe('unverifiable');
+    expect(simulatedStatRegression.status).toBe('unverifiable');
+});
+test('rejects a file swapped to a symlink after lstat without reading its target (R2.11)', () => {
+    const file = path_1.default.join(root, 'eslint.config.js');
+    externalRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-coverage-external-'));
+    const outsideTarget = path_1.default.join(externalRoot, 'outside-target.js');
+    fs_1.default.writeFileSync(file, 'no-unreachable');
+    fs_1.default.writeFileSync(outsideTarget, 'no-unreachable private-target-content');
+    const reads = [];
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' }, {
+        lstatSync: (input) => {
+            const stat = fs_1.default.lstatSync(input);
+            fs_1.default.rmSync(input);
+            fs_1.default.symlinkSync(outsideTarget, input);
+            return stat;
+        },
+        readSync: (fd, buffer, offset, length, position) => {
+            reads.push(fd);
+            return fs_1.default.readSync(fd, buffer, offset, length, position);
+        },
+    });
+    expect(out).toMatchObject({
+        status: 'unverifiable',
+        evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
+    });
+    expect(reads).toEqual([]);
+});
+test('rejects a non-regular descriptor before reading it (R2.11)', () => {
+    const file = path_1.default.join(root, 'eslint.config.js');
+    fs_1.default.writeFileSync(file, 'no-unreachable');
+    const reads = [];
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' }, {
+        lstatSync: fs_1.default.lstatSync,
+        openSync: fs_1.default.openSync,
+        fstatSync: () => fs_1.default.statSync(root),
+        readSync: (fd, buffer, offset, length, position) => {
+            reads.push(fd);
+            return fs_1.default.readSync(fd, buffer, offset, length, position);
+        },
+        closeSync: fs_1.default.closeSync,
+    });
+    expect(out).toMatchObject({
+        status: 'unverifiable',
+        evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
+    });
+    expect(reads).toEqual([]);
+});
+test('rejects evidence that grows beyond the byte cap after descriptor validation (R2.11)', () => {
+    const file = path_1.default.join(root, 'eslint.config.js');
+    fs_1.default.writeFileSync(file, 'no-unreachable');
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' }, {
+        lstatSync: fs_1.default.lstatSync,
+        openSync: fs_1.default.openSync,
+        fstatSync: (fd) => {
+            const stat = fs_1.default.fstatSync(fd);
+            fs_1.default.appendFileSync(file, Buffer.alloc(contract_1.MAX_COVERAGE_FILE_BYTES + 1));
+            return stat;
+        },
+        closeSync: fs_1.default.closeSync,
+    });
+    expect(out).toMatchObject({
+        status: 'unverifiable',
+        evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
+    });
+});
+test('read errors are unverifiable independently of host permissions (R2.5a)', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'no-unreachable');
+    const io = {
+        lstatSync: fs_1.default.lstatSync,
+        readSync: () => { throw Object.assign(new Error('permission denied'), { code: 'EACCES' }); },
+    };
+    expect((0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' }, io).status).toBe('unverifiable');
+});
+test('rejects an evidence path that escapes the project root (R2.11)', () => {
+    const escaped = {
+        sensor: 'lint',
+        evidence: { files: [{ path: '../outside.txt', containsAll: [] }] },
+    };
+    expect(() => (0, evidence_1.observeDetector)(root, 'style', 0, escaped, { cmd: 'eslint' }))
+        .toThrow('evidence path escaped project root: ../outside.txt');
+});
+test.each([
+    [{}, 'style', 0, 'root must be a non-empty string'],
+    ['   ', 'style', 0, 'root must be a non-empty string'],
+    ['/valid-root', '', 0, 'classId must be a non-empty string'],
+    ['/valid-root', '   ', 0, 'classId must be a non-empty string'],
+    ['/valid-root', 'style', -1, 'detectorIndex must be a non-negative integer'],
+    ['/valid-root', 'style', 0.5, 'detectorIndex must be a non-negative integer'],
+])('rejects malformed public arguments %#', (inputRoot, classId, detectorIndex, message) => {
+    expect(() => (0, evidence_1.observeDetector)(inputRoot, classId, detectorIndex, detector, { cmd: 'eslint --config eslint.config.js' }))
+        .toThrow(`observeDetector: ${message}`);
+});
+test('reports only ordinal/path/status and never leaks command or marker text (RF-1.4)', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'secret-marker');
+    const serialized = JSON.stringify((0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'private-command eslint --config' }));
+    expect(serialized).not.toContain('private-command');
+    expect(serialized).not.toContain('no-unreachable');
+    expect(serialized).not.toContain('secret-marker');
+});

package/dist/tests/commands/sensors/coverage/index.test.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const coverage_1 = require("../../../../src/commands/sensors/coverage");
+test('not configured is explicit, actionable and exit-0 data', () => {
+    expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'not_configured' }) })).toEqual({
+        schemaVersion: 1, pack: null, registry: null, overall: 'inconclusive',
+        static: { status: 'inconclusive', reason: 'not_configured', classes: [] },
+    });
+});
+test('old pack is no_reference and preserves pack and registry', () => {
+    const manifest = { pack: 'legacy', sensors: {} };
+    expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'no_reference', projectRoot: '/fixture', pack: 'legacy', registry: 'baseline', manifest }) }))
+        .toEqual({ schemaVersion: 1, pack: 'legacy', registry: 'baseline', overall: 'inconclusive',
+        static: { status: 'inconclusive', reason: 'no_reference', classes: [] } });
+});
+test('ready input observes every declared detector and evaluates once', () => {
+    const manifest = { pack: 'js-ts', sensors: { lint: { cmd: 'eslint .' }, format: { cmd: 'prettier --check .' } } };
+    const contract = { schemaVersion: 1, classes: {
+            formatting: { description: 'Formatting', detectors: [{ sensor: 'format' }], remedy: { summary: 'Add format', command: 'npm i -D prettier' } },
+            linting: { description: 'Linting', detectors: [{ sensor: 'lint' }], remedy: { summary: 'Add lint', command: 'npm i -D eslint' } },
+        } };
+    const observe = jest.fn((_root, classId, detectorIndex, detector) => ({
+        classId, detectorIndex, sensor: detector.sensor, status: 'covered', evidence: [],
+    }));
+    const out = (0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'ready', projectRoot: '/fixture', pack: 'js-ts', registry: 'baseline', manifest, contract }), observe });
+    expect(observe.mock.calls.map((call) => [call[1], call[2]])).toEqual([['formatting', 0], ['linting', 0]]);
+    expect(out.static.classes.map((item) => item.id)).toEqual(['formatting', 'linting']);
+    expect(out.overall).toBe('covered');
+    expect(out).not.toHaveProperty('empirical');
+});

package/dist/tests/commands/sensors/coverage/render.test.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const render_1 = require("../../../../src/commands/sensors/coverage/render");
+const report = {
+    schemaVersion: 1, pack: 'js-ts', registry: 'baseline', overall: 'gaps',
+    static: { status: 'gaps', reason: null, classes: [
+            { id: 'formatting', description: 'Formatting', status: 'missing',
+                detectors: [{ sensor: 'format', status: 'missing', evidence: [] }],
+                remedy: { summary: 'Add formatter', command: 'npm i -D prettier' } },
+            { id: 'style', description: 'Style', status: 'unverifiable',
+                detectors: [{ sensor: 'lint', status: 'unverifiable', evidence: [{ kind: 'command', status: 'custom' }] }],
+                remedy: { summary: 'Declare evidence', command: 'awm sensors init' } },
+        ] },
+};
+test('human output shows every non-green class, remedy and totals without raw evidence (R2.8)', () => {
+    const human = (0, render_1.renderCoverageHuman)(report);
+    expect(human).toBe([
+        'Sensor coverage', 'Pack: js-ts', 'Registry: baseline', 'Overall: gaps', '',
+        'missing formatting — Formatting', '  detector: format (missing)', '  remedy: Add formatter', '  command: npm i -D prettier',
+        'unverifiable style — Style', '  detector: lint (unverifiable)', '  remedy: Declare evidence', '  command: awm sensors init', '',
+        'Summary: 0 covered, 1 missing, 1 unverifiable', '',
+    ].join('\n'));
+    expect(human).not.toContain('commandIncludes');
+    expect(human).not.toContain('custom');
+});
+test('json is the exact versioned envelope and ends in newline (R2.8, R2.14)', () => {
+    expect((0, render_1.renderCoverageJson)(report)).toBe(`${JSON.stringify(report, null, 2)}\n`);
+});
+test('keeps the R2 static shape when an optional empirical section is added (R2.14)', () => {
+    const extended = { ...report, empirical: { status: 'no_evidence' } };
+    const parsed = JSON.parse((0, render_1.renderCoverageJson)(extended));
+    expect(parsed.static).toEqual(report.static);
+    expect(parsed.empirical).toEqual({ status: 'no_evidence' });
+    expect(parsed.schemaVersion).toBe(1);
+});
+test('not_configured names the remedy and no_reference stays distinct (R2.6)', () => {
+    const notConfigured = { schemaVersion: 1, pack: null, registry: null, overall: 'inconclusive',
+        static: { status: 'inconclusive', reason: 'not_configured', classes: [] } };
+    expect((0, render_1.renderCoverageHuman)(notConfigured)).toContain('Run: awm sensors init');
+    expect((0, render_1.renderCoverageHuman)({ ...notConfigured, pack: 'legacy', registry: 'baseline', static: { ...notConfigured.static, reason: 'no_reference' } }))
+        .toContain('No coverage reference');
+});
+test('human output never renders structured detector evidence', () => {
+    const evidenceReport = {
+        ...report,
+        static: {
+            ...report.static,
+            classes: [{ ...report.static.classes[0], detectors: [{
+                            sensor: 'format', status: 'missing',
+                            evidence: [
+                                { kind: 'command', status: 'matched' },
+                                { kind: 'file', path: '.prettierrc', status: 'matched' },
+                                { kind: 'marker', path: '.prettierrc', ordinal: 1, status: 'missing' },
+                            ],
+                        }] }],
+        },
+    };
+    const human = (0, render_1.renderCoverageHuman)(evidenceReport);
+    expect(human).not.toContain('.prettierrc');
+    expect(human).not.toContain('marker');
+    expect(human).not.toContain('matched');
+});
+test('human output removes OSC controls from pack-provided text while retaining printable text', () => {
+    const osc8Open = '\x1B]8;;https://attacker.invalid\x07';
+    const osc8Close = '\x1B]8;;\x07';
+    const hostile = {
+        ...report,
+        static: {
+            ...report.static,
+            classes: [{
+                    ...report.static.classes[0],
+                    description: `${osc8Open}Formatting${osc8Close}`,
+                    remedy: { summary: `Add ${osc8Open}formatter${osc8Close}`, command: 'npm i -D prettier' },
+                }],
+        },
+    };
+    const human = (0, render_1.renderCoverageHuman)(hostile);
+    expect(human).toContain('missing formatting — Formatting');
+    expect(human).toContain('  remedy: Add formatter');
+    expect(human.replace(/\n/g, '')).not.toMatch(/[\u0000-\u001F\u007F-\u009F]/);
+});
+test.each([
+    ['non-string pack', { ...report, pack: 42 }],
+    ['malformed class detectors', { ...report, static: { ...report.static, classes: [{ ...report.static.classes[0], detectors: null }] } }],
+    ['unknown static reason', { ...report, static: { ...report.static, reason: 'other' } }],
+    ['unknown top-level field', { ...report, extra: true }],
+    ['unknown class field', { ...report, static: { ...report.static, classes: [{ ...report.static.classes[0], extra: true }] } }],
+    ['unknown evidence field', { ...report, static: { ...report.static, classes: [{ ...report.static.classes[0], detectors: [{
+                                ...report.static.classes[0].detectors[0], evidence: [{ kind: 'command', status: 'matched', command: 'secret' }],
+                            }] }] } }],
+    ['malformed marker evidence', { ...report, static: { ...report.static, classes: [{ ...report.static.classes[0], detectors: [{
+                                ...report.static.classes[0].detectors[0], evidence: [{ kind: 'marker', path: '.prettierrc', ordinal: 0, status: 'matched' }],
+                            }] }] } }],
+    ['mismatched static and overall status', { ...report, static: { ...report.static, status: 'covered' } }],
+    ['covered class whose detectors are all missing', {
+            ...report,
+            static: { ...report.static, classes: [{ ...report.static.classes[0], status: 'covered' }] },
+        }],
+    ['missing class with an unverifiable detector and no covered detector', {
+            ...report,
+            static: { ...report.static, classes: [{
+                        ...report.static.classes[0],
+                        detectors: [{ ...report.static.classes[0].detectors[0], status: 'unverifiable' }],
+                    }] },
+        }],
+    ['gaps overall when every class is covered', {
+            ...report,
+            static: {
+                ...report.static,
+                classes: report.static.classes.map((coverageClass) => ({
+                    ...coverageClass,
+                    status: 'covered',
+                    detectors: coverageClass.detectors.map((detector) => ({ ...detector, status: 'covered' })),
+                })),
+            },
+        }],
+    ['not_configured with resolved pack and registry', {
+            schemaVersion: 1, pack: 'js-ts', registry: 'baseline', overall: 'inconclusive',
+            static: { status: 'inconclusive', reason: 'not_configured', classes: [] },
+        }],
+    ['not_configured with classes', {
+            schemaVersion: 1, pack: null, registry: null, overall: 'inconclusive',
+            static: { status: 'inconclusive', reason: 'not_configured', classes: [report.static.classes[0]] },
+        }],
+    ['no_reference without resolved registry', {
+            schemaVersion: 1, pack: 'js-ts', registry: null, overall: 'inconclusive',
+            static: { status: 'inconclusive', reason: 'no_reference', classes: [] },
+        }],
+    ['no_reference with classes', {
+            schemaVersion: 1, pack: 'js-ts', registry: 'baseline', overall: 'inconclusive',
+            static: { status: 'inconclusive', reason: 'no_reference', classes: [report.static.classes[0]] },
+        }],
+    ['normal coverage without a pack', { ...report, pack: null }],
+    ['normal coverage without classes', { ...report, static: { ...report.static, classes: [] } }],
+    ['blank pack', { ...report, pack: '  ' }],
+    ['blank registry', { ...report, registry: '' }],
+    ['blank class id', { ...report, static: { ...report.static, classes: [{ ...report.static.classes[0], id: ' ' }] } }],
+    ['blank class description', { ...report, static: { ...report.static, classes: [{ ...report.static.classes[0], description: '' }] } }],
+    ['blank remedy summary', { ...report, static: { ...report.static, classes: [{ ...report.static.classes[0], remedy: { ...report.static.classes[0].remedy, summary: ' ' } }] } }],
+    ['blank remedy command', { ...report, static: { ...report.static, classes: [{ ...report.static.classes[0], remedy: { ...report.static.classes[0].remedy, command: '' } }] } }],
+    ['empty class detectors', { ...report, static: { ...report.static, classes: [{ ...report.static.classes[0], detectors: [] }] } }],
+    ['blank detector sensor', { ...report, static: { ...report.static, classes: [{ ...report.static.classes[0], detectors: [{ ...report.static.classes[0].detectors[0], sensor: ' ' }] }] } }],
+    ['duplicate class ids', { ...report, static: { ...report.static, classes: [report.static.classes[0], { ...report.static.classes[1], id: report.static.classes[0].id }] } }],
+    ['unsorted class ids', { ...report, static: { ...report.static, classes: [...report.static.classes].reverse() } }],
+])('renderers reject a malformed envelope with %s before emitting or dereferencing fields', (_case, malformed) => {
+    for (const render of [render_1.renderCoverageJson, render_1.renderCoverageHuman]) {
+        expect(() => render(malformed)).toThrow(/^renderCoverage(?:Json|Human): invalid report/);
+    }
+});

package/dist/tests/commands/sensors/coverage/resolve.test.js

@@ -0,0 +1,130 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const tmp_1 = require("../../../support/tmp");
+const resolve_1 = require("../../../../src/commands/sensors/coverage/resolve");
+let root;
+let awmHome;
+let project;
+beforeEach(() => {
+    root = (0, tmp_1.mkCanonicalTmpDir)('awm-coverage-resolve-');
+    awmHome = path_1.default.join(root, 'home');
+    project = path_1.default.join(root, 'project');
+    fs_1.default.mkdirSync(path_1.default.join(project, '.awm'), { recursive: true });
+    process.env.AWM_HOME = awmHome;
+});
+afterEach(() => {
+    delete process.env.AWM_HOME;
+    fs_1.default.rmSync(root, { recursive: true, force: true });
+});
+const configure = (names) => {
+    fs_1.default.mkdirSync(awmHome, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify(names.map((name) => ({ name, remote: 'fixture' }))));
+};
+const writeManifest = (body) => fs_1.default.writeFileSync(path_1.default.join(project, '.awm', 'sensors.json'), typeof body === 'string' || Buffer.isBuffer(body) ? body : JSON.stringify(body));
+const coverage = { schemaVersion: 1, classes: {
+        formatting: { description: 'Formatting', detectors: [{ sensor: 'format' }], remedy: { summary: 'Add formatter', command: 'npm i -D prettier' } },
+    } };
+const noFollowUnavailableOnNativeWindows = process.platform === 'win32'
+    && typeof fs_1.default.constants.O_NOFOLLOW !== 'number';
+const safetyError = /platform cannot guarantee no symlink dereference/;
+const writePack = (registry, pack, body) => {
+    const dir = path_1.default.join(awmHome, 'registries', registry, 'sensor-packs', pack);
+    fs_1.default.mkdirSync(dir, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'pack.json'), typeof body === 'string' || Buffer.isBuffer(body) ? body : JSON.stringify(body));
+};
+test('no manifest returns not_configured without reading registries', () => {
+    fs_1.default.rmSync(path_1.default.join(project, '.awm', 'sensors.json'), { force: true });
+    fs_1.default.mkdirSync(awmHome, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), '{malformed');
+    expect((0, resolve_1.resolveCoverageInputs)(project)).toEqual({ kind: 'not_configured' });
+});
+test('selects the first configured registry containing the exact pack', () => {
+    writeManifest({ pack: 'js-ts', sensors: {} });
+    configure(['first', 'second']);
+    writePack('first', 'generic', { name: 'generic', sensors: {} });
+    writePack('second', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
+    if (noFollowUnavailableOnNativeWindows) {
+        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
+    }
+    else {
+        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', pack: 'js-ts', registry: 'second' });
+    }
+});
+test('registry ordering chooses the earlier exact pack when both registries contain it', () => {
+    writeManifest({ pack: 'js-ts', sensors: {} });
+    configure(['first', 'second']);
+    writePack('first', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
+    writePack('second', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
+    if (noFollowUnavailableOnNativeWindows) {
+        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
+    }
+    else {
+        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', registry: 'first' });
+    }
+});
+test('old pack without coverage is no_reference, not covered', () => {
+    writeManifest({ pack: 'js-ts', sensors: {} });
+    configure(['baseline']);
+    writePack('baseline', 'js-ts', { name: 'js-ts', sensors: {} });
+    if (noFollowUnavailableOnNativeWindows) {
+        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
+    }
+    else {
+        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'no_reference', pack: 'js-ts', registry: 'baseline' });
+    }
+});
+test('native Windows without no-follow support fails closed before resolving normal coverage inputs', () => {
+    writeManifest({ pack: 'js-ts', sensors: {} });
+    configure(['baseline']);
+    writePack('baseline', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
+    if (noFollowUnavailableOnNativeWindows) {
+        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
+    }
+    else {
+        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready' });
+    }
+});
+test.each([
+    ['manifest-malformed', '{broken', /Invalid JSON.*sensors\.json/],
+    ['manifest-oversize', Buffer.alloc(1024 * 1024 + 1), /sensors\.json.*exceeds 1 MiB/],
+])('rejects %s', (_name, body, expected) => {
+    writeManifest(body);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows && _name !== 'manifest-oversize' ? safetyError : expected);
+});
+test.each([
+    ['pack-malformed', '{broken', /Invalid JSON.*pack\.json/],
+    ['pack-oversize', Buffer.alloc(1024 * 1024 + 1), /pack\.json.*exceeds 1 MiB/],
+])('rejects %s', (_name, body, expected) => {
+    writeManifest({ pack: 'js-ts', sensors: {} });
+    configure(['baseline']);
+    writePack('baseline', 'js-ts', body);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : expected);
+});
+test('rejects a symlinked manifest without dereferencing it', () => {
+    const manifest = path_1.default.join(project, '.awm', 'sensors.json');
+    const target = path_1.default.join(root, 'manifest.json');
+    fs_1.default.writeFileSync(target, JSON.stringify({ pack: 'js-ts', sensors: {} }));
+    fs_1.default.symlinkSync(target, manifest);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(/sensors\.json.*regular file/);
+});
+test('rejects a dangling symlinked manifest without reporting not_configured', () => {
+    const manifest = path_1.default.join(project, '.awm', 'sensors.json');
+    fs_1.default.symlinkSync(path_1.default.join(root, 'missing-manifest.json'), manifest);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(/sensors\.json.*regular file/);
+});
+test('rejects a JSON object that is not a valid pack', () => {
+    writeManifest({ pack: 'js-ts', sensors: {} });
+    configure(['baseline']);
+    writePack('baseline', 'js-ts', { coverage });
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : /Invalid pack.*name/);
+});
+test('rejects registry names that are not safe path components', () => {
+    writeManifest({ pack: 'js-ts', sensors: {} });
+    configure(['']);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : /Invalid registry name/);
+});

package/dist/tests/commands/sensors/index.test.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-jest.mock('@clack/prompts', () => ({ log: { success: jest.fn(), info: jest.fn() } }));
+jest.mock('@clack/prompts', () => ({ log: { success: jest.fn(), info: jest.fn(), error: jest.fn() } }));
 jest.mock('picocolors', () => ({ green: (s) => s, yellow: (s) => s, red: (s) => s }));
 jest.mock('../../../src/commands/sensors/run', () => ({ runSensors: jest.fn() }));
 jest.mock('../../../src/commands/sensors/init', () => ({ initSensors: jest.fn() }));
@@ -8,6 +8,12 @@ jest.mock('../../../src/commands/sensors/status', () => ({ computeSensorStatus:
 jest.mock('../../../src/commands/sensors/install', () => ({ installSensorHook: jest.fn() }));
 jest.mock('../../../src/commands/sensors/baseline', () => ({ buildBaseline: jest.fn(), writeBaseline: jest.fn() }));
 jest.mock('../../../src/core/registries', () => ({ capabilityRoot: jest.fn(() => '/mock/registry') }));
+jest.mock('../../../src/commands/sensors/coverage', () => ({ runCoverage: jest.fn() }));
+jest.mock('../../../src/commands/sensors/coverage/render', () => ({ renderCoverageHuman: jest.fn(), renderCoverageJson: jest.fn() }));
+const commander_1 = require("commander");
+const prompts_1 = require("@clack/prompts");
+const coverage_1 = require("../../../src/commands/sensors/coverage");
+const render_1 = require("../../../src/commands/sensors/coverage/render");
 const index_1 = require("../../../src/commands/sensors/index");
 describe('exitCodeFor — sensor run verdict → exit code', () => {
     const base = (overall) => ({ sensors: [], overall });
@@ -16,3 +22,48 @@ describe('exitCodeFor — sensor run verdict → exit code', () => {
     it('not_certified → 0 (signal is in overall, not exit code)', () => expect((0, index_1.exitCodeFor)(base('not_certified'))).toBe(0));
     it('fail → 1', () => expect((0, index_1.exitCodeFor)(base('fail'))).toBe(1));
 });
+describe('sensors coverage Commander wiring', () => {
+    const report = { schemaVersion: 1, pack: 'js-ts', registry: 'baseline', overall: 'gaps',
+        static: { status: 'gaps', reason: null, classes: [] } };
+    const stdoutWrite = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    const processExit = jest.spyOn(process, 'exit').mockImplementation((() => undefined));
+    beforeEach(() => {
+        jest.clearAllMocks();
+        coverage_1.runCoverage.mockReturnValue(report);
+        render_1.renderCoverageHuman.mockReturnValue('human\n');
+        render_1.renderCoverageJson.mockReturnValue('json\n');
+    });
+    afterAll(() => {
+        stdoutWrite.mockRestore();
+        processExit.mockRestore();
+    });
+    const programWithSensors = () => {
+        const program = new commander_1.Command();
+        program.exitOverride();
+        (0, index_1.registerSensorsCommand)(program);
+        return program;
+    };
+    it('registers sensors coverage with --json and emits human output by default (R2.8)', async () => {
+        const program = programWithSensors();
+        const sensors = program.commands.find((command) => command.name() === 'sensors');
+        const coverage = sensors.commands.find((command) => command.name() === 'coverage');
+        expect(coverage.options.some((option) => option.long === '--json')).toBe(true);
+        await program.parseAsync(['node', 'awm', 'sensors', 'coverage']);
+        expect(render_1.renderCoverageHuman).toHaveBeenCalledWith(report);
+        expect(stdoutWrite).toHaveBeenCalledWith('human\n');
+    });
+    it('emits JSON for --json and does not exit for gaps or inconclusive (R2.9)', async () => {
+        for (const overall of ['gaps', 'inconclusive']) {
+            coverage_1.runCoverage.mockReturnValue({ ...report, overall, static: { ...report.static, status: overall } });
+            await programWithSensors().parseAsync(['node', 'awm', 'sensors', 'coverage', '--json']);
+        }
+        expect(render_1.renderCoverageJson).toHaveBeenCalledTimes(2);
+        expect(processExit).not.toHaveBeenCalled();
+    });
+    it('prints an actionable contract error and exits 1 (R2.7)', async () => {
+        coverage_1.runCoverage.mockImplementation(() => { throw new Error('Invalid coverage contract at pack.json: schemaVersion expected 1'); });
+        await programWithSensors().parseAsync(['node', 'awm', 'sensors', 'coverage']);
+        expect(prompts_1.log.error).toHaveBeenCalledWith(expect.stringContaining('schemaVersion'));
+        expect(processExit).toHaveBeenCalledWith(1);
+    });
+});

package/dist/tests/commands/sensors/router.test.js

@@ -9,7 +9,7 @@ jest.mock('../../../src/commands/sensors/install', () => ({ installSensorHook: j
 const commander_1 = require("commander");
 const index_1 = require("../../../src/commands/sensors/index");
 describe('registerSensorsCommand', () => {
-    it('registers sensors command with 4 subcommands', () => {
+    it('keeps existing sensor subcommands and adds coverage', () => {
         const program = new commander_1.Command();
         (0, index_1.registerSensorsCommand)(program);
         const cmd = program.commands.find(c => c.name() === 'sensors');
@@ -19,5 +19,6 @@ describe('registerSensorsCommand', () => {
         expect(subNames).toContain('init');
         expect(subNames).toContain('status');
         expect(subNames).toContain('install');
+        expect(subNames).toContain('coverage');
     });
 });