agentic-workflow-manager 6.4.2 → 6.5.1

package/dist/src/commands/sensors/coverage/resolve.js

@@ -0,0 +1,126 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBoundedJson = readBoundedJson;
+exports.resolveCoverageInputs = resolveCoverageInputs;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const registries_1 = require("../../../core/registries");
+const contract_1 = require("./contract");
+function readFailure(file, error) {
+    return new Error(`Cannot read ${file}: ${error instanceof Error ? error.message : String(error)}`);
+}
+/** Read JSON from a regular, bounded file without ever following a symlink. */
+function readBoundedJson(file) {
+    if (typeof file !== 'string' || file.trim().length === 0)
+        throw new Error('readBoundedJson: file must be a non-empty string');
+    let listed;
+    try {
+        listed = fs_1.default.lstatSync(file);
+    }
+    catch (error) {
+        throw readFailure(file, error);
+    }
+    if (!listed.isFile() || listed.isSymbolicLink())
+        throw new Error(`Cannot read ${file}: expected a regular file`);
+    if (listed.size > contract_1.MAX_COVERAGE_FILE_BYTES)
+        throw new Error(`Cannot read ${file}: exceeds 1 MiB limit`);
+    const noFollow = fs_1.default.constants.O_NOFOLLOW;
+    if (typeof noFollow !== 'number')
+        throw new Error(`Cannot read ${file}: platform cannot guarantee no symlink dereference`);
+    let descriptor;
+    let content;
+    try {
+        descriptor = fs_1.default.openSync(file, fs_1.default.constants.O_RDONLY | noFollow);
+        const opened = fs_1.default.fstatSync(descriptor);
+        if (!opened.isFile() || opened.size > contract_1.MAX_COVERAGE_FILE_BYTES) {
+            throw new Error('expected a regular file within the 1 MiB limit');
+        }
+        const buffer = Buffer.allocUnsafe(contract_1.MAX_COVERAGE_FILE_BYTES + 1);
+        const count = fs_1.default.readSync(descriptor, buffer, 0, buffer.length, null);
+        if (!Number.isSafeInteger(count) || count < 0 || count > contract_1.MAX_COVERAGE_FILE_BYTES) {
+            throw new Error('exceeds 1 MiB limit');
+        }
+        content = buffer.subarray(0, count).toString('utf8');
+    }
+    catch (error) {
+        throw readFailure(file, error);
+    }
+    finally {
+        if (descriptor !== undefined)
+            fs_1.default.closeSync(descriptor);
+    }
+    try {
+        return JSON.parse(content);
+    }
+    catch (error) {
+        throw new Error(`Invalid JSON at ${file}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function readPackEnvelope(input, file, expectedName) {
+    if (typeof input !== 'object' || input === null || Array.isArray(input))
+        throw new Error(`Invalid pack at ${file}: expected object`);
+    const pack = input;
+    if (typeof pack.name !== 'string' || pack.name !== expectedName) {
+        throw new Error(`Invalid pack at ${file}: name must equal '${expectedName}'`);
+    }
+    if (typeof pack.sensors !== 'object' || pack.sensors === null || Array.isArray(pack.sensors)) {
+        throw new Error(`Invalid pack at ${file}: sensors must be an object`);
+    }
+    return 'coverage' in pack ? { coverage: pack.coverage } : {};
+}
+function safeRegistryName(name) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name) || name.includes('..')) {
+        throw new Error(`Invalid registry name '${name}': expected a safe path component`);
+    }
+}
+/** Finds the nearest manifest without following a symlink during discovery. */
+function findManifestDirNoFollow(startCwd) {
+    let dir = path_1.default.resolve(startCwd);
+    while (true) {
+        const manifestPath = path_1.default.join(dir, '.awm', 'sensors.json');
+        try {
+            fs_1.default.lstatSync(manifestPath);
+            return dir;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw readFailure(manifestPath, error);
+        }
+        const parent = path_1.default.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+function resolveCoverageInputs(cwd) {
+    if (typeof cwd !== 'string' || cwd.trim().length === 0)
+        throw new Error('resolveCoverageInputs: cwd must be a non-empty string');
+    const projectRoot = findManifestDirNoFollow(cwd);
+    if (!projectRoot)
+        return { kind: 'not_configured' };
+    const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
+    const manifest = (0, contract_1.parseCoverageManifest)(readBoundedJson(manifestPath), manifestPath);
+    for (const registry of (0, registries_1.listRegistries)()) {
+        safeRegistryName(registry.name);
+        const packPath = path_1.default.join(registry.contentRoot, 'sensor-packs', manifest.pack, 'pack.json');
+        try {
+            fs_1.default.lstatSync(packPath);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            throw readFailure(packPath, error);
+        }
+        const { coverage } = readPackEnvelope(readBoundedJson(packPath), packPath, manifest.pack);
+        if (coverage === undefined)
+            return { kind: 'no_reference', projectRoot, pack: manifest.pack, registry: registry.name, manifest };
+        return {
+            kind: 'ready', projectRoot, pack: manifest.pack, registry: registry.name,
+            manifest, contract: (0, contract_1.parseCoverageContract)(coverage, packPath),
+        };
+    }
+    throw new Error(`Pack '${manifest.pack}' was not found in configured registries`);
+}

package/dist/src/commands/sensors/index.js

@@ -12,6 +12,8 @@ const init_1 = require("./init");
 const status_1 = require("./status");
 const install_1 = require("./install");
 const baseline_1 = require("./baseline");
+const coverage_1 = require("./coverage");
+const render_1 = require("./coverage/render");
 const registries_1 = require("../../core/registries");
 /** Map a sensor run verdict to a process exit code. fail → 1; everything else → 0.
  *  not_certified intentionally exits 0: its signal lives in `overall`, because
@@ -21,6 +23,20 @@ function exitCodeFor(output) {
 }
 function registerSensorsCommand(program) {
     const sensors = program.command('sensors').description('manage computational sensors for the current project');
+    sensors
+        .command('coverage')
+        .description('report static gaps between configured sensors and the pack reference')
+        .option('--json', 'emit the versioned machine-readable envelope')
+        .action((opts) => {
+        try {
+            const report = (0, coverage_1.runCoverage)(process.cwd());
+            process.stdout.write(opts.json ? (0, render_1.renderCoverageJson)(report) : (0, render_1.renderCoverageHuman)(report));
+        }
+        catch (error) {
+            prompts_1.log.error(error instanceof Error ? error.message : String(error));
+            process.exit(1);
+        }
+    });
     sensors
         .command('run')
         .description('run sensors from .awm/sensors.json')

package/dist/tests/commands/sensors/coverage/contract.test.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const contract_1 = require("../../../../src/commands/sensors/coverage/contract");
+describe('coverage contract v1', () => {
+    it('returns a complete valid contract unchanged', () => {
+        const input = {
+            schemaVersion: 1,
+            classes: {
+                'runtime-validation': {
+                    description: 'All durable coverage artifacts validate their inputs.',
+                    detectors: [{
+                            sensor: 'contract-test',
+                            evidence: {
+                                commandIncludes: ['coverage'],
+                                files: [{ path: 'contract.ts', containsAll: ['parseCoverageContract'] }],
+                            },
+                        }],
+                    remedy: { summary: 'Add a parser.', command: 'npm test -- contract.test.ts' },
+                },
+            },
+        };
+        expect((0, contract_1.parseCoverageContract)(input, 'coverage.json')).toEqual(input);
+    });
+    test.each([
+        [{ schemaVersion: 2, classes: {} }, 'schemaVersion'],
+        [{ schemaVersion: 1, classes: {}, extra: true }, 'unknown field'],
+        [{ schemaVersion: 1, classes: {} }, 'classes'],
+        [{ schemaVersion: 1, classes: { Bad: { description: 'x', detectors: [{ sensor: 'test' }], remedy: { summary: 'x', command: 'x' } } } }, 'class'],
+        [{ schemaVersion: 1, classes: { valid: { description: '', detectors: [{ sensor: 'test' }], remedy: { summary: 'x', command: 'x' } } } }, 'description'],
+        [{ schemaVersion: 1, classes: { valid: { description: '  \t', detectors: [{ sensor: 'test' }], remedy: { summary: 'x', command: 'x' } } } }, 'description'],
+        [{ schemaVersion: 1, classes: { valid: { description: 'x', detectors: [], remedy: { summary: 'x', command: 'x' } } } }, 'detectors'],
+    ])('rejects malformed contract %j', (input, message) => {
+        expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow(message);
+    });
+    test.each(['', '.', '..', 'a..b', '../secret', 'a/../../secret', '/etc/passwd', 'C:\\secret', 'a\\..\\secret', ' report.txt', 'report!.txt', 'ñ.txt', '.env', '.gitignore'])('rejects hostile evidence path %p', (path) => {
+        const input = {
+            schemaVersion: 1,
+            classes: {
+                valid: {
+                    description: 'x',
+                    detectors: [{ sensor: 'test', evidence: { files: [{ path, containsAll: [] }] } }],
+                    remedy: { summary: 'x', command: 'x' },
+                },
+            },
+        };
+        expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow('path');
+    });
+    test.each(['.semgrep.awm.yml', '.dep-cruiser.awm.js'])('accepts safe dotfile evidence path %p', (path) => {
+        const input = {
+            schemaVersion: 1,
+            classes: {
+                valid: {
+                    description: 'x',
+                    detectors: [{ sensor: 'test', evidence: { files: [{ path, containsAll: [] }] } }],
+                    remedy: { summary: 'x', command: 'x' },
+                },
+            },
+        };
+        expect((0, contract_1.parseCoverageContract)(input, 'coverage.json')).toEqual(input);
+    });
+    it('rejects whitespace-only evidence text', () => {
+        const input = {
+            schemaVersion: 1,
+            classes: {
+                valid: {
+                    description: 'x',
+                    detectors: [{ sensor: 'test', evidence: { files: [{ path: 'report.txt', containsAll: [' \n'] }] } }],
+                    remedy: { summary: 'x', command: 'x' },
+                },
+            },
+        };
+        expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow('containsAll');
+    });
+    it('rejects unknown nested evidence fields', () => {
+        const input = {
+            schemaVersion: 1,
+            classes: {
+                valid: {
+                    description: 'x',
+                    detectors: [{ sensor: 'test', evidence: { commandInclude: ['coverage'] } }],
+                    remedy: { summary: 'x', command: 'x' },
+                },
+            },
+        };
+        expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow('unknown field');
+    });
+});
+describe('coverage manifest boundary', () => {
+    it('accepts all legacy sensor fields', () => {
+        const input = {
+            pack: 'js-ts',
+            concurrency: 2,
+            sensors: {
+                lint: {
+                    cmd: 'npm run lint', fast: true, enabled: true, timeout: 120, changedCmd: 'npm run lint -- {files}', changedExtensions: ['.ts'], formatter: 'eslint-llm',
+                },
+            },
+        };
+        expect((0, contract_1.parseCoverageManifest)(input, 'sensors.json')).toEqual(input);
+    });
+    test.each([
+        [null, 'object'],
+        [{}, 'pack'],
+        [{ pack: '', sensors: {} }, 'pack'],
+        [{ pack: ' js-ts', sensors: {} }, 'pack'],
+        [{ pack: 'js ts', sensors: {} }, 'pack'],
+        [{ pack: 'js@ts', sensors: {} }, 'pack'],
+        [{ pack: 'js-ts', sensors: null }, 'sensors'],
+        [{ pack: 'js-ts', sensors: { lint: { cmd: 3 } } }, 'cmd'],
+        [{ pack: 'js-ts', sensors: { 'lint!': {} } }, 'sensor name'],
+    ])('rejects malformed manifest %j', (input, message) => {
+        expect(() => (0, contract_1.parseCoverageManifest)(input, 'sensors.json')).toThrow(message);
+    });
+});

package/dist/tests/commands/sensors/coverage/evaluate.test.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const evaluate_1 = require("../../../../src/commands/sensors/coverage/evaluate");
+const contract = {
+    schemaVersion: 1,
+    classes: {
+        alpha: {
+            description: 'Alpha',
+            detectors: [{ sensor: 'one' }, { sensor: 'two' }],
+            remedy: { summary: 'Fix alpha', command: 'fix alpha' },
+        },
+        zeta: {
+            description: 'Zeta',
+            detectors: [{ sensor: 'three' }],
+            remedy: { summary: 'Fix zeta', command: 'fix zeta' },
+        },
+    },
+};
+const observation = (classId, detectorIndex, sensor, status) => ({ classId, detectorIndex, sensor, status, evidence: [] });
+describe('coverage evaluation', () => {
+    test.each([
+        [[observation('alpha', 0, 'one', 'covered'), observation('alpha', 1, 'two', 'missing')], 'covered'],
+        [[observation('alpha', 0, 'one', 'missing'), observation('alpha', 1, 'two', 'disabled')], 'missing'],
+        [[observation('alpha', 0, 'one', 'ineffective'), observation('alpha', 1, 'two', 'missing')], 'missing'],
+        [[observation('alpha', 0, 'one', 'unverifiable'), observation('alpha', 1, 'two', 'missing')], 'unverifiable'],
+    ])('reduces detector alternatives %j to %s', (alpha, expected) => {
+        const result = (0, evaluate_1.evaluateCoverage)(contract, [...alpha, observation('zeta', 0, 'three', 'covered')]);
+        expect(result.classes.find((item) => item.id === 'alpha')?.status).toBe(expected);
+    });
+    it('makes global gaps outrank unverifiable while preserving both classes', () => {
+        const result = (0, evaluate_1.evaluateCoverage)(contract, [
+            observation('alpha', 0, 'one', 'unverifiable'),
+            observation('alpha', 1, 'two', 'missing'),
+            observation('zeta', 0, 'three', 'missing'),
+        ]);
+        expect(result.overall).toBe('gaps');
+        expect(result.classes.map((item) => [item.id, item.status])).toEqual([
+            ['alpha', 'unverifiable'],
+            ['zeta', 'missing'],
+        ]);
+    });
+    it('sorts classes by stable ID and is deterministic under reordered observations', () => {
+        const result = (0, evaluate_1.evaluateCoverage)(contract, [
+            observation('zeta', 0, 'three', 'covered'),
+            observation('alpha', 1, 'two', 'missing'),
+            observation('alpha', 0, 'one', 'covered'),
+        ]);
+        expect(result.classes.map((item) => item.id)).toEqual(['alpha', 'zeta']);
+        expect((0, evaluate_1.evaluateCoverage)(contract, [
+            observation('alpha', 0, 'one', 'covered'),
+            observation('zeta', 0, 'three', 'covered'),
+            observation('alpha', 1, 'two', 'missing'),
+        ])).toEqual(result);
+    });
+    it('fails loudly when an observation is missing or duplicated', () => {
+        expect(() => (0, evaluate_1.evaluateCoverage)(contract, [])).toThrow(/missing observation.*one/);
+        expect(() => (0, evaluate_1.evaluateCoverage)(contract, [
+            observation('alpha', 0, 'one', 'covered'),
+            observation('alpha', 0, 'one', 'covered'),
+            observation('alpha', 1, 'two', 'covered'),
+            observation('zeta', 0, 'three', 'covered'),
+        ])).toThrow(/duplicate observation.*alpha:0/);
+    });
+    it('keeps alternatives with the same sensor independent by detector index', () => {
+        const sameSensor = {
+            schemaVersion: 1,
+            classes: {
+                config: {
+                    description: 'Project configuration',
+                    detectors: [{ sensor: 'lint' }, { sensor: 'lint' }],
+                    remedy: { summary: 'Add config', command: 'touch eslint.config.js' },
+                },
+            },
+        };
+        const result = (0, evaluate_1.evaluateCoverage)(sameSensor, [
+            observation('config', 0, 'lint', 'ineffective'),
+            observation('config', 1, 'lint', 'covered'),
+        ]);
+        expect(result.classes[0].status).toBe('covered');
+        expect(result.classes[0].detectors).toHaveLength(2);
+    });
+});

package/dist/tests/commands/sensors/coverage/evidence.test.js

@@ -0,0 +1,251 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const tmp_1 = require("../../../support/tmp");
+const evidence_1 = require("../../../../src/commands/sensors/coverage/evidence");
+const contract_1 = require("../../../../src/commands/sensors/coverage/contract");
+let root;
+let externalRoot;
+beforeEach(() => {
+    root = (0, tmp_1.mkCanonicalTmpDir)('awm-coverage-evidence-');
+    externalRoot = undefined;
+});
+afterEach(() => {
+    fs_1.default.rmSync(root, { recursive: true, force: true });
+    if (externalRoot)
+        fs_1.default.rmSync(externalRoot, { recursive: true, force: true });
+});
+const detector = {
+    sensor: 'lint',
+    evidence: {
+        commandIncludes: ['eslint', '--config'],
+        files: [{ path: 'eslint.config.js', containsAll: ['no-unreachable'] }],
+    },
+};
+const noFollowUnavailableOnNativeWindows = process.platform === 'win32'
+    && typeof fs_1.default.constants.O_NOFOLLOW !== 'number';
+const regularFileStatus = (posixStatus) => noFollowUnavailableOnNativeWindows ? 'unverifiable' : posixStatus;
+test('active matching sensor with all AND evidence is covered (R2.2)', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), "rules: { 'no-unreachable': 'error' }");
+    const observed = (0, evidence_1.observeDetector)(root, 'style', 0, detector, {
+        cmd: 'npx eslint . --config eslint.config.js', enabled: true,
+    });
+    if (noFollowUnavailableOnNativeWindows) {
+        expect(observed).toMatchObject({
+            status: 'unverifiable',
+            evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
+        });
+        return;
+    }
+    expect(observed).toEqual({
+        classId: 'style',
+        detectorIndex: 0,
+        sensor: 'lint',
+        status: 'covered',
+        evidence: [
+            { kind: 'command', status: 'matched' },
+            { kind: 'file', path: 'eslint.config.js', status: 'matched' },
+            { kind: 'marker', path: 'eslint.config.js', ordinal: 1, status: 'matched' },
+        ],
+    });
+});
+test.each([
+    [undefined, 'missing'],
+    [{ cmd: 'npx eslint .', enabled: false }, 'disabled'],
+    [{ cmd: 'custom-linter .' }, 'unverifiable'],
+    [{ enabled: true }, 'unverifiable'],
+])('maps sensor availability/config %# to %s (R2.3, R2.5)', (sensor, expected) => {
+    expect((0, evidence_1.observeDetector)(root, 'style', 0, detector, sensor)).toMatchObject({ status: expected });
+});
+test('records absent and custom required commands without exposing their text (R2.5)', () => {
+    const absent = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { enabled: true });
+    const custom = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'private-linter --private-flag' });
+    expect(absent).toMatchObject({
+        status: 'unverifiable',
+        evidence: [{ kind: 'command', status: 'missing' }],
+    });
+    expect(custom).toMatchObject({
+        status: 'unverifiable',
+        evidence: [{ kind: 'command', status: 'custom' }],
+    });
+    expect(JSON.stringify({ absent, custom })).not.toContain('private-linter');
+    expect(JSON.stringify({ absent, custom })).not.toContain('private-flag');
+});
+test('recognized command plus missing file is ineffective (R2.4)', () => {
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' });
+    expect(out.status).toBe('ineffective');
+    expect(out.evidence).toContainEqual({ kind: 'file', path: 'eslint.config.js', status: 'missing' });
+});
+test('recognized command plus missing literal marker is ineffective (R2.4)', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'export default []');
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' });
+    expect(out.status).toBe(regularFileStatus('ineffective'));
+    if (noFollowUnavailableOnNativeWindows) {
+        expect(out.evidence).toContainEqual({ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' });
+    }
+    else {
+        expect(out.evidence).toContainEqual({ kind: 'marker', path: 'eslint.config.js', ordinal: 1, status: 'missing' });
+    }
+});
+test('native Windows without no-follow support never certifies regular evidence from its contents', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'no-unreachable');
+    const observed = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' });
+    if (noFollowUnavailableOnNativeWindows) {
+        expect(observed.status).toBe('unverifiable');
+        expect(observed.status).not.toBe('covered');
+        expect(observed.status).not.toBe('ineffective');
+    }
+    else {
+        expect(observed.status).toBe('covered');
+    }
+});
+test('unverifiable file evidence dominates missing evidence in the detector result (R2.5a)', () => {
+    const mixed = {
+        sensor: 'lint',
+        evidence: {
+            files: [
+                { path: 'missing.js', containsAll: [] },
+                { path: 'linked.js', containsAll: ['no-unreachable'] },
+            ],
+        },
+    };
+    const target = path_1.default.join(root, 'target.js');
+    fs_1.default.writeFileSync(target, 'no-unreachable');
+    fs_1.default.symlinkSync(target, path_1.default.join(root, 'linked.js'));
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, mixed, { cmd: 'eslint' });
+    expect(out.status).toBe('unverifiable');
+    expect(out.evidence).toEqual(expect.arrayContaining([
+        { kind: 'file', path: 'missing.js', status: 'missing' },
+        { kind: 'file', path: 'linked.js', status: 'unverifiable' },
+    ]));
+});
+test.each(['symlink', 'oversize'])('%s evidence is unverifiable, never green or missing (R2.5a, R2.11)', (kind) => {
+    const target = path_1.default.join(root, 'target.js');
+    fs_1.default.writeFileSync(target, 'no-unreachable');
+    const file = path_1.default.join(root, 'eslint.config.js');
+    if (kind === 'symlink')
+        fs_1.default.symlinkSync(target, file);
+    if (kind === 'oversize')
+        fs_1.default.writeFileSync(file, Buffer.alloc(contract_1.MAX_COVERAGE_FILE_BYTES + 1));
+    expect((0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' })).toMatchObject({
+        status: 'unverifiable',
+        evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
+    });
+});
+test('does not trust injected lstat semantics to make symlink evidence regular (R2.11)', () => {
+    const target = path_1.default.join(root, 'target.js');
+    const file = path_1.default.join(root, 'eslint.config.js');
+    fs_1.default.writeFileSync(target, 'no-unreachable');
+    fs_1.default.symlinkSync(target, file);
+    const command = { cmd: 'eslint --config eslint.config.js' };
+    const observedWithLstat = (0, evidence_1.observeDetector)(root, 'style', 0, detector, command, {
+        lstatSync: fs_1.default.lstatSync,
+    });
+    const simulatedStatRegression = (0, evidence_1.observeDetector)(root, 'style', 0, detector, command, {
+        lstatSync: fs_1.default.statSync,
+    });
+    expect(observedWithLstat.status).toBe('unverifiable');
+    expect(simulatedStatRegression.status).toBe('unverifiable');
+});
+test('rejects a file swapped to a symlink after lstat without reading its target (R2.11)', () => {
+    const file = path_1.default.join(root, 'eslint.config.js');
+    externalRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-coverage-external-'));
+    const outsideTarget = path_1.default.join(externalRoot, 'outside-target.js');
+    fs_1.default.writeFileSync(file, 'no-unreachable');
+    fs_1.default.writeFileSync(outsideTarget, 'no-unreachable private-target-content');
+    const reads = [];
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' }, {
+        lstatSync: (input) => {
+            const stat = fs_1.default.lstatSync(input);
+            fs_1.default.rmSync(input);
+            fs_1.default.symlinkSync(outsideTarget, input);
+            return stat;
+        },
+        readSync: (fd, buffer, offset, length, position) => {
+            reads.push(fd);
+            return fs_1.default.readSync(fd, buffer, offset, length, position);
+        },
+    });
+    expect(out).toMatchObject({
+        status: 'unverifiable',
+        evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
+    });
+    expect(reads).toEqual([]);
+});
+test('rejects a non-regular descriptor before reading it (R2.11)', () => {
+    const file = path_1.default.join(root, 'eslint.config.js');
+    fs_1.default.writeFileSync(file, 'no-unreachable');
+    const reads = [];
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' }, {
+        lstatSync: fs_1.default.lstatSync,
+        openSync: fs_1.default.openSync,
+        fstatSync: () => fs_1.default.statSync(root),
+        readSync: (fd, buffer, offset, length, position) => {
+            reads.push(fd);
+            return fs_1.default.readSync(fd, buffer, offset, length, position);
+        },
+        closeSync: fs_1.default.closeSync,
+    });
+    expect(out).toMatchObject({
+        status: 'unverifiable',
+        evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
+    });
+    expect(reads).toEqual([]);
+});
+test('rejects evidence that grows beyond the byte cap after descriptor validation (R2.11)', () => {
+    const file = path_1.default.join(root, 'eslint.config.js');
+    fs_1.default.writeFileSync(file, 'no-unreachable');
+    const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' }, {
+        lstatSync: fs_1.default.lstatSync,
+        openSync: fs_1.default.openSync,
+        fstatSync: (fd) => {
+            const stat = fs_1.default.fstatSync(fd);
+            fs_1.default.appendFileSync(file, Buffer.alloc(contract_1.MAX_COVERAGE_FILE_BYTES + 1));
+            return stat;
+        },
+        closeSync: fs_1.default.closeSync,
+    });
+    expect(out).toMatchObject({
+        status: 'unverifiable',
+        evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
+    });
+});
+test('read errors are unverifiable independently of host permissions (R2.5a)', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'no-unreachable');
+    const io = {
+        lstatSync: fs_1.default.lstatSync,
+        readSync: () => { throw Object.assign(new Error('permission denied'), { code: 'EACCES' }); },
+    };
+    expect((0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' }, io).status).toBe('unverifiable');
+});
+test('rejects an evidence path that escapes the project root (R2.11)', () => {
+    const escaped = {
+        sensor: 'lint',
+        evidence: { files: [{ path: '../outside.txt', containsAll: [] }] },
+    };
+    expect(() => (0, evidence_1.observeDetector)(root, 'style', 0, escaped, { cmd: 'eslint' }))
+        .toThrow('evidence path escaped project root: ../outside.txt');
+});
+test.each([
+    [{}, 'style', 0, 'root must be a non-empty string'],
+    ['   ', 'style', 0, 'root must be a non-empty string'],
+    ['/valid-root', '', 0, 'classId must be a non-empty string'],
+    ['/valid-root', '   ', 0, 'classId must be a non-empty string'],
+    ['/valid-root', 'style', -1, 'detectorIndex must be a non-negative integer'],
+    ['/valid-root', 'style', 0.5, 'detectorIndex must be a non-negative integer'],
+])('rejects malformed public arguments %#', (inputRoot, classId, detectorIndex, message) => {
+    expect(() => (0, evidence_1.observeDetector)(inputRoot, classId, detectorIndex, detector, { cmd: 'eslint --config eslint.config.js' }))
+        .toThrow(`observeDetector: ${message}`);
+});
+test('reports only ordinal/path/status and never leaks command or marker text (RF-1.4)', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'secret-marker');
+    const serialized = JSON.stringify((0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'private-command eslint --config' }));
+    expect(serialized).not.toContain('private-command');
+    expect(serialized).not.toContain('no-unreachable');
+    expect(serialized).not.toContain('secret-marker');
+});

package/dist/tests/commands/sensors/coverage/index.test.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const coverage_1 = require("../../../../src/commands/sensors/coverage");
+test('not configured is explicit, actionable and exit-0 data', () => {
+    expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'not_configured' }) })).toEqual({
+        schemaVersion: 1, pack: null, registry: null, overall: 'inconclusive',
+        static: { status: 'inconclusive', reason: 'not_configured', classes: [] },
+    });
+});
+test('old pack is no_reference and preserves pack and registry', () => {
+    const manifest = { pack: 'legacy', sensors: {} };
+    expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'no_reference', projectRoot: '/fixture', pack: 'legacy', registry: 'baseline', manifest }) }))
+        .toEqual({ schemaVersion: 1, pack: 'legacy', registry: 'baseline', overall: 'inconclusive',
+        static: { status: 'inconclusive', reason: 'no_reference', classes: [] } });
+});
+test('ready input observes every declared detector and evaluates once', () => {
+    const manifest = { pack: 'js-ts', sensors: { lint: { cmd: 'eslint .' }, format: { cmd: 'prettier --check .' } } };
+    const contract = { schemaVersion: 1, classes: {
+            formatting: { description: 'Formatting', detectors: [{ sensor: 'format' }], remedy: { summary: 'Add format', command: 'npm i -D prettier' } },
+            linting: { description: 'Linting', detectors: [{ sensor: 'lint' }], remedy: { summary: 'Add lint', command: 'npm i -D eslint' } },
+        } };
+    const observe = jest.fn((_root, classId, detectorIndex, detector) => ({
+        classId, detectorIndex, sensor: detector.sensor, status: 'covered', evidence: [],
+    }));
+    const out = (0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'ready', projectRoot: '/fixture', pack: 'js-ts', registry: 'baseline', manifest, contract }), observe });
+    expect(observe.mock.calls.map((call) => [call[1], call[2]])).toEqual([['formatting', 0], ['linting', 0]]);
+    expect(out.static.classes.map((item) => item.id)).toEqual(['formatting', 'linting']);
+    expect(out.overall).toBe('covered');
+    expect(out).not.toHaveProperty('empirical');
+});