agentic-workflow-manager 6.5.2 → 8.0.0

package/dist/tests/commands/sensors/coverage/index.test.js

@@ -1,20 +1,45 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const coverage_1 = require("../../../../src/commands/sensors/coverage");
-test('not configured is explicit, actionable and exit-0 data', () => {
-    expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'not_configured' }) })).toEqual({
-        schemaVersion: 1, pack: null, registry: null, overall: 'inconclusive',
+test('not configured is explicit, actionable and exit-0 data', async () => {
+    await expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'not_configured' }), scan: () => ({
+            entries: [], sources: { activeFiles: 0, archivedFiles: 0, validEntries: 0, validFindings: 0, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0,
+        }) })).resolves.toEqual({
+        schemaVersion: 2, pack: null, registry: null, overall: 'inconclusive',
         static: { status: 'inconclusive', reason: 'not_configured', classes: [] },
+        empirical: expect.objectContaining({ status: 'no-evidence' }),
     });
 });
-test('old pack is no_reference and preserves pack and registry', () => {
-    const manifest = { pack: 'legacy', sensors: {} };
-    expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'no_reference', projectRoot: '/fixture', pack: 'legacy', registry: 'baseline', manifest }) }))
-        .toEqual({ schemaVersion: 1, pack: 'legacy', registry: 'baseline', overall: 'inconclusive',
-        static: { status: 'inconclusive', reason: 'no_reference', classes: [] } });
+test('unavailable static contracts make empirical findings coverage-unverifiable', async () => {
+    const scan = {
+        entries: [{ entry: { ts: 'x', branch: 'main', phase: 'qa', source_skill: 'test', polarity: 'finding',
+                    class: 'structural', signature: 'private', severity: 'minor', desc: 'secret', defectClass: 'lint-errors' }, source: '.awm/ledger/main.jsonl:1', evidenceRef: '.awm/ledger/main.jsonl:1' }],
+        sources: { activeFiles: 1, archivedFiles: 0, validEntries: 1, validFindings: 1, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0,
+    };
+    const notConfigured = await (0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'not_configured' }), scan: () => scan });
+    expect(notConfigured.empirical?.classes[0].outcome).toBe('coverage-unverifiable');
+    const manifest = { kind: 'legacy', pack: { pack: 'legacy', sensors: {}, compatibility: {
+                state: 'compatible-unverified', reason: 'legacy', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [],
+            } } };
+    const noReference = await (0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'no_reference', projectRoot: '/fixture', pack: 'legacy', registry: 'baseline', manifest }), scan: () => scan });
+    expect(noReference.empirical?.classes[0].outcome).toBe('coverage-unverifiable');
 });
-test('ready input observes every declared detector and evaluates once', () => {
-    const manifest = { pack: 'js-ts', sensors: { lint: { cmd: 'eslint .' }, format: { cmd: 'prettier --check .' } } };
+test('old pack is no_reference and preserves pack and registry', async () => {
+    const manifest = { kind: 'legacy', pack: { pack: 'legacy', sensors: {}, compatibility: {
+                state: 'compatible-unverified', reason: 'legacy', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [],
+            } } };
+    await expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'no_reference', projectRoot: '/fixture', pack: 'legacy', registry: 'baseline', manifest }), scan: () => ({
+            entries: [{ entry: { ts: 'x', branch: 'main', phase: 'qa', source_skill: 'test', polarity: 'finding', class: 'structural', signature: 'private', severity: 'minor', desc: 'secret', defectClass: 'lint-errors' }, source: '.awm/ledger/main.jsonl:1', evidenceRef: '.awm/ledger/main.jsonl:1' }],
+            sources: { activeFiles: 1, archivedFiles: 0, validEntries: 1, validFindings: 1, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0,
+        }) }))
+        .resolves.toEqual({ schemaVersion: 2, pack: 'legacy', registry: 'baseline', overall: 'inconclusive',
+        static: { status: 'inconclusive', reason: 'no_reference', classes: [] },
+        empirical: expect.objectContaining({ status: 'evidence', classes: [expect.objectContaining({ outcome: 'coverage-unverifiable' })] }) });
+});
+test('ready input observes every declared detector and evaluates once', async () => {
+    const manifest = { kind: 'legacy', pack: { pack: 'js-ts', sensors: { lint: { cmd: 'eslint .' }, format: { cmd: 'prettier --check .' } }, compatibility: {
+                state: 'compatible-unverified', reason: 'legacy', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [],
+            } } };
     const contract = { schemaVersion: 1, classes: {
             formatting: { description: 'Formatting', detectors: [{ sensor: 'format' }], remedy: { summary: 'Add format', command: 'npm i -D prettier' } },
             linting: { description: 'Linting', detectors: [{ sensor: 'lint' }], remedy: { summary: 'Add lint', command: 'npm i -D eslint' } },
@@ -22,9 +47,11 @@ test('ready input observes every declared detector and evaluates once', () => {
     const observe = jest.fn((_root, classId, detectorIndex, detector) => ({
         classId, detectorIndex, sensor: detector.sensor, status: 'covered', evidence: [],
     }));
-    const out = (0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'ready', projectRoot: '/fixture', pack: 'js-ts', registry: 'baseline', manifest, contract }), observe });
+    const out = await (0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'ready', projectRoot: '/fixture', pack: 'js-ts', registry: 'baseline', manifest, contract }), observe, scan: () => ({
+            entries: [], sources: { activeFiles: 0, archivedFiles: 0, validEntries: 0, validFindings: 0, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0,
+        }) });
     expect(observe.mock.calls.map((call) => [call[1], call[2]])).toEqual([['formatting', 0], ['linting', 0]]);
     expect(out.static.classes.map((item) => item.id)).toEqual(['formatting', 'linting']);
-    expect(out.overall).toBe('covered');
-    expect(out).not.toHaveProperty('empirical');
+    expect(out.overall).toBe('inconclusive');
+    expect(out.empirical).toMatchObject({ status: 'no-evidence' });
 });

package/dist/tests/commands/sensors/coverage/render.test.js

@@ -1,40 +1,206 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const render_1 = require("../../../../src/commands/sensors/coverage/render");
+const empirical_1 = require("../../../../src/commands/sensors/coverage/empirical");
 const report = {
-    schemaVersion: 1, pack: 'js-ts', registry: 'baseline', overall: 'gaps',
+    schemaVersion: 2, pack: 'js-ts', registry: 'baseline', overall: 'gaps',
     static: { status: 'gaps', reason: null, classes: [
-            { id: 'formatting', description: 'Formatting', status: 'missing',
-                detectors: [{ sensor: 'format', status: 'missing', evidence: [] }],
+            { id: 'lint-errors', description: 'Formatting', status: 'missing',
+                detectors: [{ sensor: 'format', status: 'missing', evidence: [], compatibility: { state: 'missing-tool', reason: 'fixture', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [] } }],
                 remedy: { summary: 'Add formatter', command: 'npm i -D prettier' } },
             { id: 'style', description: 'Style', status: 'unverifiable',
-                detectors: [{ sensor: 'lint', status: 'unverifiable', evidence: [{ kind: 'command', status: 'custom' }] }],
+                detectors: [{ sensor: 'lint', status: 'unverifiable', evidence: [{ kind: 'command', status: 'custom' }], compatibility: { state: 'unverifiable', reason: 'fixture', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [] } }],
                 remedy: { summary: 'Declare evidence', command: 'awm sensors init' } },
         ] },
 };
+const redactedCluster = {
+    occurrences: 1,
+    recurrent: false,
+    severity: 'important',
+    kind: 'exact',
+    signatures: [],
+    omittedSignatures: 1,
+    evidenceRefs: ['src/a.ts:1'],
+    omittedEvidenceRefs: 0,
+};
+const empiricalEvidence = {
+    recurrenceThreshold: 2, status: 'evidence',
+    classes: [{ defectClass: 'lint-errors', occurrences: 1, recurrent: false, severity: 'important', outcome: 'gap', evidenceRefs: ['src/a.ts:1'], omittedEvidenceRefs: 0, clusters: [redactedCluster] }],
+    unclassified: { occurrences: 0, evidenceRefs: [], omittedEvidenceRefs: 0 },
+    sources: { activeFiles: 1, archivedFiles: 0, validEntries: 1, validFindings: 1, skippedFindings: 0, skippedByReason: {} },
+    omittedEvidenceRefs: 0,
+};
 test('human output shows every non-green class, remedy and totals without raw evidence (R2.8)', () => {
     const human = (0, render_1.renderCoverageHuman)(report);
     expect(human).toBe([
         'Sensor coverage', 'Pack: js-ts', 'Registry: baseline', 'Overall: gaps', '',
-        'missing formatting — Formatting', '  detector: format (missing)', '  remedy: Add formatter', '  command: npm i -D prettier',
-        'unverifiable style — Style', '  detector: lint (unverifiable)', '  remedy: Declare evidence', '  command: awm sensors init', '',
-        'Summary: 0 covered, 1 missing, 1 unverifiable', '',
+        'missing lint-errors — Formatting', '  detector: format (missing)', '  compatibility: missing-tool — fixture', '  remedy: Add formatter', '  command: npm i -D prettier',
+        'unverifiable style — Style', '  detector: lint (unverifiable)', '  compatibility: unverifiable — fixture', '  remedy: Declare evidence', '  command: awm sensors init', '',
+        'Summary: 0 covered, 1 missing, 1 unverifiable, 0 not applicable', '',
     ].join('\n'));
     expect(human).not.toContain('commandIncludes');
     expect(human).not.toContain('custom');
 });
+test('human output explains an incompatible detector even when its structural evidence is covered (R3.3)', () => {
+    const compatibility = {
+        state: 'incompatible',
+        reason: 'installed eslint version is outside the certified range',
+        variantId: 'eslint-v9',
+        toolVersion: '10.0.0',
+        runtimeVersion: null,
+        certifiedRange: '^9.0.0',
+        evidence: [],
+    };
+    const incompatible = {
+        ...report,
+        static: {
+            ...report.static,
+            classes: [{
+                    ...report.static.classes[0],
+                    detectors: [{
+                            ...report.static.classes[0].detectors[0],
+                            status: 'covered',
+                            compatibility,
+                        }],
+                }],
+        },
+    };
+    const human = (0, render_1.renderCoverageHuman)(incompatible);
+    expect(human).toContain('  detector: format (covered)');
+    expect(human).toContain('  compatibility: incompatible — installed eslint version is outside the certified range');
+});
 test('json is the exact versioned envelope and ends in newline (R2.8, R2.14)', () => {
     expect((0, render_1.renderCoverageJson)(report)).toBe(`${JSON.stringify(report, null, 2)}\n`);
 });
 test('keeps the R2 static shape when an optional empirical section is added (R2.14)', () => {
-    const extended = { ...report, empirical: { status: 'no_evidence' } };
+    const extended = { ...report, empirical: {
+            recurrenceThreshold: 2, status: 'partial', classes: [{ defectClass: 'lint-errors', occurrences: 1, recurrent: false, severity: 'important', outcome: 'gap', evidenceRefs: ['src/a.ts:1'], omittedEvidenceRefs: 0, clusters: [redactedCluster] }],
+            unclassified: { occurrences: 1, evidenceRefs: [], omittedEvidenceRefs: 1 },
+            sources: { activeFiles: 1, archivedFiles: 0, validEntries: 2, validFindings: 2, skippedFindings: 1, skippedByReason: { 'invalid-json': 1 } }, omittedEvidenceRefs: 1,
+        } };
     const parsed = JSON.parse((0, render_1.renderCoverageJson)(extended));
     expect(parsed.static).toEqual(report.static);
-    expect(parsed.empirical).toEqual({ status: 'no_evidence' });
-    expect(parsed.schemaVersion).toBe(1);
+    expect(parsed.empirical).toEqual(extended.empirical);
+    expect(parsed.schemaVersion).toBe(2);
+});
+test('renders sanitized empirical outcomes without ledger descriptions or unsafe signatures', () => {
+    const empirical = {
+        recurrenceThreshold: 2, status: 'partial', classes: [{ defectClass: 'lint-errors', occurrences: 1, recurrent: false, severity: 'important', outcome: 'gap', evidenceRefs: ['PR #2'], omittedEvidenceRefs: 0, clusters: [redactedCluster] }],
+        unclassified: { occurrences: 1, evidenceRefs: [], omittedEvidenceRefs: 1 },
+        sources: { activeFiles: 1, archivedFiles: 0, validEntries: 2, validFindings: 2, skippedFindings: 1, skippedByReason: { 'invalid-json': 1 } }, omittedEvidenceRefs: 1,
+    };
+    const human = (0, render_1.renderCoverageHuman)({ ...report, empirical });
+    expect(human).toContain('Empirical coverage: partial');
+    expect(human).toContain('gap lint-errors — 1 occurrence');
+    expect(human).toContain('below recurrence threshold (2)');
+    expect(human).toContain('PR #2');
+    expect(human).toContain('omitted cluster signatures: 1');
+    expect(human).not.toContain('desc');
+});
+test('renders a report generated with both invalid and scanner-omitted evidence refs', () => {
+    const empirical = (0, empirical_1.evaluateEmpiricalCoverage)({
+        entries: [{ entry: { ts: '2026-08-14', branch: 'main', phase: 'qa', source_skill: 'test', polarity: 'finding', class: 'structural', signature: 'private', severity: 'important', desc: 'secret', defectClass: 'lint-errors' }, source: '.awm/ledger/main.jsonl:1', evidenceRef: 'not an allowed ref' }],
+        sources: { activeFiles: 1, archivedFiles: 0, validEntries: 1, validFindings: 1, skippedFindings: 3, skippedByReason: { 'evidence-ref-limit': 3 } }, omittedEvidenceRefs: 3,
+    }, { 'lint-errors': 'missing' }, 2);
+    expect(() => (0, render_1.renderCoverageJson)({ ...report, empirical })).not.toThrow();
+    expect((0, render_1.renderCoverageHuman)({ ...report, empirical })).toContain('omitted evidence refs: 4');
+});
+test('renders recurrence emphasis and rejects the retired complete empirical state', () => {
+    const empirical = {
+        recurrenceThreshold: 2, status: 'evidence', classes: [{ defectClass: 'lint-errors', occurrences: 2, recurrent: true, severity: 'important', outcome: 'gap', evidenceRefs: [], omittedEvidenceRefs: 0, clusters: [{ ...redactedCluster, occurrences: 2, recurrent: true, evidenceRefs: [] }] }],
+        unclassified: { occurrences: 0, evidenceRefs: [], omittedEvidenceRefs: 0 },
+        sources: { activeFiles: 1, archivedFiles: 0, validEntries: 2, validFindings: 2, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0,
+    };
+    expect((0, render_1.renderCoverageHuman)({ ...report, empirical })).toContain('recurrent at threshold 2');
+    expect(() => (0, render_1.renderCoverageJson)({ ...report, empirical: { ...empirical, status: 'complete' } })).toThrow('invalid report');
+});
+test.each([
+    ['a recurrence flag that disagrees with its threshold', {
+            ...empiricalEvidence,
+            classes: [{ ...empiricalEvidence.classes[0], recurrent: true }],
+        }],
+    ['a skipped finding total that disagrees with its reason totals', {
+            ...empiricalEvidence,
+            status: 'partial',
+            sources: { ...empiricalEvidence.sources, skippedFindings: 2, skippedByReason: { 'invalid-json': 1 } },
+        }],
+    ['an omitted evidence total that disagrees with its component omissions', {
+            ...empiricalEvidence,
+            status: 'partial',
+            sources: { ...empiricalEvidence.sources, skippedFindings: 1, skippedByReason: { 'evidence-ref-limit': 1 } },
+        }],
+    ['evidence status when findings were skipped', {
+            ...empiricalEvidence,
+            sources: { ...empiricalEvidence.sources, skippedFindings: 1, skippedByReason: { 'invalid-json': 1 } },
+        }],
+    ['partial status without any incomplete evidence', {
+            ...empiricalEvidence,
+            status: 'partial',
+        }],
+    ['no-evidence status with a valid finding', {
+            ...empiricalEvidence,
+            status: 'no-evidence',
+        }],
+    ['inconclusive status with a valid finding', {
+            ...empiricalEvidence,
+            status: 'inconclusive',
+        }],
+])('renderers reject an empirical envelope with %s', (_case, empirical) => {
+    for (const render of [render_1.renderCoverageJson, render_1.renderCoverageHuman]) {
+        expect(() => render({ ...report, empirical })).toThrow(/^renderCoverage(?:Json|Human): invalid report/);
+    }
+});
+test.each([
+    ['a covered class reported as a gap', {
+            static: { ...report.static, status: 'covered', classes: [{
+                        ...report.static.classes[0], status: 'covered',
+                        detectors: [{ ...report.static.classes[0].detectors[0], status: 'covered',
+                                compatibility: { ...report.static.classes[0].detectors[0].compatibility, state: 'certified' } }],
+                    }] },
+            empirical: { ...empiricalEvidence, classes: [{ ...empiricalEvidence.classes[0], outcome: 'gap' }] },
+        }],
+    ['a missing-tool class reported as covered', {
+            static: report.static,
+            empirical: { ...empiricalEvidence, classes: [{ ...empiricalEvidence.classes[0], outcome: 'covered-by-sensor' }] },
+        }],
+    ['an unverifiable class reported as a gap', {
+            static: { ...report.static, status: 'inconclusive', classes: [{ ...report.static.classes[1], id: 'lint-errors' }] },
+            empirical: { ...empiricalEvidence, classes: [{ ...empiricalEvidence.classes[0], outcome: 'gap' }] },
+        }],
+    ['a not-applicable class with evidence reported without a contradiction', {
+            static: { ...report.static, status: 'inconclusive', classes: [{
+                        ...report.static.classes[0], status: 'not-applicable',
+                        detectors: [{ ...report.static.classes[0].detectors[0], status: 'covered',
+                                compatibility: { ...report.static.classes[0].detectors[0].compatibility, state: 'not-applicable' } }],
+                    }] },
+            empirical: { ...empiricalEvidence, classes: [{ ...empiricalEvidence.classes[0], outcome: 'coverage-unverifiable' }] },
+        }],
+    ['an unmapped class reported as a gap while the catalog is available', {
+            static: report.static,
+            empirical: { ...empiricalEvidence, classes: [{ ...empiricalEvidence.classes[0], defectClass: 'unknown-class', outcome: 'gap' }] },
+        }],
+    ['a mapped class reported as unmapped', {
+            static: report.static,
+            empirical: { ...empiricalEvidence, classes: [{ ...empiricalEvidence.classes[0], outcome: 'unmapped-class' }] },
+        }],
+])('renderers reject an empirical outcome incompatible with static coverage: %s', (_case, invalid) => {
+    const envelope = { ...report, overall: invalid.static.status, static: invalid.static, empirical: invalid.empirical };
+    for (const render of [render_1.renderCoverageJson, render_1.renderCoverageHuman]) {
+        expect(() => render(envelope)).toThrow(/^renderCoverage(?:Json|Human): invalid report/);
+    }
+});
+test('renderers reject non-unverifiable empirical outcomes when the catalog is unavailable', () => {
+    const unavailable = {
+        schemaVersion: 2, pack: null, registry: null, overall: 'inconclusive',
+        static: { status: 'inconclusive', reason: 'not_configured', classes: [] },
+        empirical: { ...empiricalEvidence, classes: [{ ...empiricalEvidence.classes[0], outcome: 'gap' }] },
+    };
+    for (const render of [render_1.renderCoverageJson, render_1.renderCoverageHuman]) {
+        expect(() => render(unavailable)).toThrow(/^renderCoverage(?:Json|Human): invalid report/);
+    }
 });
 test('not_configured names the remedy and no_reference stays distinct (R2.6)', () => {
-    const notConfigured = { schemaVersion: 1, pack: null, registry: null, overall: 'inconclusive',
+    const notConfigured = { schemaVersion: 2, pack: null, registry: null, overall: 'inconclusive',
         static: { status: 'inconclusive', reason: 'not_configured', classes: [] } };
     expect((0, render_1.renderCoverageHuman)(notConfigured)).toContain('Run: awm sensors init');
     expect((0, render_1.renderCoverageHuman)({ ...notConfigured, pack: 'legacy', registry: 'baseline', static: { ...notConfigured.static, reason: 'no_reference' } }))
@@ -52,6 +218,7 @@ test('human output never renders structured detector evidence', () => {
                                 { kind: 'file', path: '.prettierrc', status: 'matched' },
                                 { kind: 'marker', path: '.prettierrc', ordinal: 1, status: 'missing' },
                             ],
+                            compatibility: report.static.classes[0].detectors[0].compatibility,
                         }] }],
         },
     };
@@ -71,12 +238,20 @@ test('human output removes OSC controls from pack-provided text while retaining
                     ...report.static.classes[0],
                     description: `${osc8Open}Formatting${osc8Close}`,
                     remedy: { summary: `Add ${osc8Open}formatter${osc8Close}`, command: 'npm i -D prettier' },
+                    detectors: [{
+                            ...report.static.classes[0].detectors[0],
+                            compatibility: {
+                                ...report.static.classes[0].detectors[0].compatibility,
+                                reason: `tool ${osc8Open}version${osc8Close} is unsupported`,
+                            },
+                        }],
                 }],
         },
     };
     const human = (0, render_1.renderCoverageHuman)(hostile);
-    expect(human).toContain('missing formatting — Formatting');
+    expect(human).toContain('missing lint-errors — Formatting');
     expect(human).toContain('  remedy: Add formatter');
+    expect(human).toContain('  compatibility: missing-tool — tool version is unsupported');
     expect(human.replace(/\n/g, '')).not.toMatch(/[\u0000-\u001F\u007F-\u009F]/);
 });
 test.each([

package/dist/tests/commands/sensors/coverage/resolve.test.js

@@ -41,7 +41,19 @@ test('no manifest returns not_configured without reading registries', () => {
     fs_1.default.rmSync(path_1.default.join(project, '.awm', 'sensors.json'), { force: true });
     fs_1.default.mkdirSync(awmHome, { recursive: true });
     fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), '{malformed');
-    expect((0, resolve_1.resolveCoverageInputs)(project)).toEqual({ kind: 'not_configured' });
+    const originalLstat = fs_1.default.lstatSync;
+    const lstat = jest.spyOn(fs_1.default, 'lstatSync').mockImplementation(((file, ...args) => {
+        if (typeof file === 'string' && file.endsWith(path_1.default.join('.awm', 'sensors.json'))) {
+            throw Object.assign(new Error('missing manifest'), { code: 'ENOENT' });
+        }
+        return originalLstat(file, ...args);
+    }));
+    try {
+        expect((0, resolve_1.resolveCoverageInputs)(project)).toEqual({ kind: 'not_configured' });
+    }
+    finally {
+        lstat.mockRestore();
+    }
 });
 test('selects the first configured registry containing the exact pack', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
@@ -98,7 +110,7 @@ test.each([
 });
 test.each([
     ['pack-malformed', '{broken', /Invalid JSON.*pack\.json/],
-    ['pack-oversize', Buffer.alloc(1024 * 1024 + 1), /pack\.json.*exceeds 1 MiB/],
+    ['pack-oversize', Buffer.alloc(1024 * 1024 + 1), /pack.*pack\.json.*exceeds the 1 MiB limit/],
 ])('rejects %s', (_name, body, expected) => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
@@ -121,10 +133,19 @@ test('rejects a JSON object that is not a valid pack', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', { coverage });
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : /Invalid pack.*name/);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : /Invalid sensor pack.*name/);
 });
 test('rejects registry names that are not safe path components', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['']);
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : /Invalid registry name/);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : /malformed entry name|Invalid registry name/);
+});
+test.each([
+    [{ schemaVersion: 3, name: 'js-ts', sensors: {}, coverage: {} }, /supported: legacy, 2/],
+    [{ schemaVersion: 2, name: 'js-ts', sensors: {}, coverage: {} }, /sensors must be nonempty/],
+])('fails closed before reading coverage from invalid versioned packs', (pack, expected) => {
+    writeManifest({ pack: 'js-ts', sensors: {} });
+    configure(['baseline']);
+    writePack('baseline', 'js-ts', pack);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : expected);
 });

package/dist/tests/commands/sensors/exec-windows.test.js

@@ -1,6 +1,12 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const events_1 = require("events");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const exec_1 = require("../../../src/commands/sensors/exec");
 jest.mock('child_process', () => ({
@@ -21,12 +27,12 @@ function fakeChild(pid = 4242) {
 describe('runCommand — win32', () => {
     const originalPlatform = process.platform;
     beforeEach(() => {
-        Object.defineProperty(process, 'platform', { value: 'win32' });
+        Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
         mockSpawn.mockReset();
         mockExecFile.mockReset();
     });
     afterEach(() => {
-        Object.defineProperty(process, 'platform', { value: originalPlatform });
+        Object.defineProperty(process, 'platform', { value: originalPlatform, configurable: true });
         jest.useRealTimers();
     });
     it('spawns with detached: false — win32 has no POSIX process groups to detach into', async () => {
@@ -38,6 +44,90 @@ describe('runCommand — win32', () => {
         const r = await pending;
         expect(r.code).toBe(0);
     });
+    it('resolves a PATHEXT executable and keeps structured argv shell-free', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-structured-win-'));
+        const savedPath = process.env.PATH;
+        const savedPathExt = process.env.PATHEXT;
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(dir, 'tool.exe'), 'fixture');
+            process.env.PATH = dir;
+            process.env.PATHEXT = '.CMD;.EXE';
+            const child = fakeChild();
+            mockSpawn.mockReturnValue(child);
+            const pending = (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'path', args: ['literal;&'] }, { timeout: 5000, cwd: dir });
+            expect(mockSpawn).toHaveBeenCalledWith(path_1.default.join(dir, 'tool.exe'), ['literal;&'], expect.objectContaining({ shell: false, detached: false }));
+            child.emit('close', 0, null);
+            await expect(pending).resolves.toMatchObject({ code: 0 });
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool.cmd', resolution: 'path', args: [] }, { timeout: 5000, cwd: dir })).toThrow(/wrappers/);
+        }
+        finally {
+            process.env.PATH = savedPath;
+            process.env.PATHEXT = savedPathExt;
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    it('uses the project node_modules executable instead of a same-named global command', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-local-bin-win-'));
+        const global = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-global-bin-win-'));
+        const savedPath = process.env.PATH;
+        const savedPathExt = process.env.PATHEXT;
+        try {
+            const localBin = path_1.default.join(dir, 'node_modules', '.bin');
+            fs_1.default.mkdirSync(localBin, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(localBin, 'tool.exe'), 'local');
+            fs_1.default.writeFileSync(path_1.default.join(global, 'tool.exe'), 'global');
+            process.env.PATH = global;
+            process.env.PATHEXT = '.EXE';
+            const child = fakeChild();
+            mockSpawn.mockReturnValue(child);
+            const pending = (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir });
+            expect(mockSpawn).toHaveBeenCalledWith(path_1.default.join(localBin, 'tool.exe'), [], expect.objectContaining({ shell: false }));
+            child.emit('close', 0, null);
+            await expect(pending).resolves.toMatchObject({ code: 0 });
+        }
+        finally {
+            process.env.PATH = savedPath;
+            process.env.PATHEXT = savedPathExt;
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+            fs_1.default.rmSync(global, { recursive: true, force: true });
+        }
+    });
+    it('rejects a missing local executable instead of falling back to a same-named global command', () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-local-bin-missing-win-'));
+        const global = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-global-bin-missing-win-'));
+        const savedPath = process.env.PATH;
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(global, 'tool.exe'), 'global');
+            process.env.PATH = global;
+            mockSpawn.mockReturnValue(fakeChild());
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir }))
+                .toThrow(/node_modules.*not found locally/i);
+            expect(mockSpawn).not.toHaveBeenCalled();
+        }
+        finally {
+            process.env.PATH = savedPath;
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+            fs_1.default.rmSync(global, { recursive: true, force: true });
+        }
+    });
+    it('rejects a missing Python environment executable instead of falling back to a same-named global command', () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-missing-win-'));
+        const global = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-global-win-'));
+        const savedPath = process.env.PATH;
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(global, 'semgrep.exe'), 'global');
+            process.env.PATH = global;
+            mockSpawn.mockReturnValue(fakeChild());
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'semgrep', resolution: 'python-environment', args: ['--validate'] }, { timeout: 5000, cwd: dir }))
+                .toThrow(/python.*environment.*local|contained/i);
+            expect(mockSpawn).not.toHaveBeenCalled();
+        }
+        finally {
+            process.env.PATH = savedPath;
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+            fs_1.default.rmSync(global, { recursive: true, force: true });
+        }
+    });
     it('propagates cmd.exe\'s own exit code for a command that does not exist (1, not the POSIX 127)', async () => {
         // Mirrors exec.test.ts's POSIX "reports 127" case. cmd.exe has no
         // equivalent 127 convention — it reports 1 (sometimes 9009) for

package/dist/tests/commands/sensors/exec.test.js

@@ -20,6 +20,25 @@ async function until(fn, budgetMs = 4000) {
     return fn();
 }
 describe('runCommand — exit codes and output', () => {
+    it('passes structured metacharacters literally without a shell', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-exec-argv-'));
+        const marker = path_1.default.join(dir, 'must-not-exist');
+        try {
+            const literal = `;touch ${marker}`;
+            const received = path_1.default.join(dir, 'received');
+            const result = await (0, exec_1.runStructuredCommand)({
+                executable: process.execPath,
+                resolution: 'path',
+                args: ['-e', "require('fs').writeFileSync(process.argv[1], process.argv[2])", received, literal],
+            }, { timeout: 5000, cwd: dir });
+            expect(result.code).toBe(0);
+            expect(fs_1.default.readFileSync(received, 'utf8')).toBe(literal);
+            expect(fs_1.default.existsSync(marker)).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    });
     it('returns stdout and code 0 for a clean command', async () => {
         const r = await (0, exec_1.runCommand)('echo hello', { timeout: 5000, cwd: process.cwd() });
         expect(r.code).toBe(0);
@@ -27,7 +46,7 @@ describe('runCommand — exit codes and output', () => {
         expect(r.timedOut).toBe(false);
         expect(r.overflowed).toBe(false);
     });
-    it('captures stderr and a non-zero exit code without throwing', async () => {
+    itPosix('captures stderr and a non-zero exit code without throwing', async () => {
         // Portable by construction: `node -e "..."` is invoked identically by
         // `spawn(cmd, {shell:true})` on both `/bin/sh -c` (POSIX) and
         // `cmd.exe /d /s /c` (win32) — the shell only tokenizes the outer
@@ -38,7 +57,7 @@ describe('runCommand — exit codes and output', () => {
         // separator there, so the whole string became literal arguments to
         // `echo` and `exit 3` never ran as its own command — the run
         // "succeeded" with code 0 instead of 3 on windows-latest CI.
-        const r = await (0, exec_1.runCommand)(`node -e "process.stderr.write('oops'); process.exit(3)"`, { timeout: 5000, cwd: process.cwd() });
+        const r = await (0, exec_1.runCommand)('printf oops >&2; exit 3', { timeout: 5000, cwd: process.cwd() });
         expect(r.code).toBe(3);
         expect(r.stderr).toMatch(/oops/);
         expect(r.timedOut).toBe(false);
@@ -53,7 +72,7 @@ describe('runCommand — exit codes and output', () => {
         expect(r.code).toBe(127);
     });
 });
-describe('runCommand — output cap', () => {
+onPosix('runCommand — output cap', () => {
     it('stops at maxBuffer, flags overflow, and keeps what it read', async () => {
         // 200 lines of ~50 bytes each, capped at 1KB. A `for i in $(seq ...); do
         // ... done` POSIX shell loop silently no-ops under cmd.exe (win32's
@@ -64,11 +83,11 @@ describe('runCommand — output cap', () => {
         // r.overflowed came back false). A `node -e` one-liner is invoked
         // identically by both shells (same portability reasoning as the
         // exit-code test above).
-        const r = await (0, exec_1.runCommand)(`node -e "for(let i=1;i<=200;i++){console.log('line-'+i+'-padding-padding-padding-padding')}"`, { timeout: 10_000, cwd: process.cwd(), maxBuffer: 1024 });
+        const r = await (0, exec_1.runCommand)("yes 'line-padding-padding-padding-padding'", { timeout: 10_000, cwd: process.cwd(), maxBuffer: 1024 });
         expect(r.overflowed).toBe(true);
         expect(r.stdout.length).toBeLessThanOrEqual(1024);
         // The point of the cap change: what was read is still usable, not discarded.
-        expect(r.stdout).toMatch(/line-1-/);
+        expect(r.stdout).toMatch(/line-padding/);
     });
 });
 onPosix('runCommand — timeout', () => {
@@ -111,3 +130,46 @@ describe('runCommand — spawn failure', () => {
         expect(r.code).not.toBe(0);
     });
 });
+onPosix('runStructuredCommand — local node_modules binaries', () => {
+    it('follows an npm-style contained shim but rejects one escaping node_modules', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-local-bin-symlink-'));
+        const modules = path_1.default.join(dir, 'node_modules');
+        const bin = path_1.default.join(modules, '.bin');
+        const contained = path_1.default.join(modules, 'tool', 'bin', 'tool');
+        const outside = path_1.default.join(dir, 'outside-tool');
+        try {
+            fs_1.default.mkdirSync(path_1.default.dirname(contained), { recursive: true });
+            fs_1.default.writeFileSync(contained, '#!/bin/sh\necho contained\n', { mode: 0o755 });
+            fs_1.default.writeFileSync(outside, '#!/bin/sh\necho outside\n', { mode: 0o755 });
+            fs_1.default.mkdirSync(bin, { recursive: true });
+            fs_1.default.symlinkSync('../tool/bin/tool', path_1.default.join(bin, 'tool'));
+            await expect((0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir }))
+                .resolves.toMatchObject({ code: 0, stdout: 'contained\n' });
+            fs_1.default.unlinkSync(path_1.default.join(bin, 'tool'));
+            fs_1.default.symlinkSync(outside, path_1.default.join(bin, 'tool'));
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir }))
+                .toThrow(/node_modules.*contain|local/i);
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
+onPosix('runStructuredCommand — Python environments', () => {
+    it('rejects a missing project Python executable instead of falling back to PATH', () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-missing-'));
+        const global = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-global-'));
+        const savedPath = process.env.PATH;
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(global, 'semgrep'), '#!/bin/sh\necho global\n', { mode: 0o755 });
+            process.env.PATH = global;
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'semgrep', resolution: 'python-environment', args: ['--validate'] }, { timeout: 5000, cwd: dir }))
+                .toThrow(/python.*environment.*local|contained/i);
+        }
+        finally {
+            process.env.PATH = savedPath;
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+            fs_1.default.rmSync(global, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/commands/sensors/index.test.js

@@ -52,6 +52,14 @@ describe('sensors coverage Commander wiring', () => {
         expect(render_1.renderCoverageHuman).toHaveBeenCalledWith(report);
         expect(stdoutWrite).toHaveBeenCalledWith('human\n');
     });
+    it.each(['0', '-1', '1.5', '2x', 'Infinity', 'NaN', '9007199254740992'])('Commander rejects unsafe --min %s before coverage I/O (R5.5)', async (value) => {
+        await expect(programWithSensors().parseAsync(['node', 'awm', 'sensors', 'coverage', '--min', value])).rejects.toThrow('--min must be a positive safe integer');
+        expect(coverage_1.runCoverage).not.toHaveBeenCalled();
+    });
+    it('passes --min as a positive integer to coverage', async () => {
+        await programWithSensors().parseAsync(['node', 'awm', 'sensors', 'coverage', '--min', '3']);
+        expect(coverage_1.runCoverage).toHaveBeenCalledWith(process.cwd(), {}, { min: 3 });
+    });
     it('emits JSON for --json and does not exit for gaps or inconclusive (R2.9)', async () => {
         for (const overall of ['gaps', 'inconclusive']) {
             coverage_1.runCoverage.mockReturnValue({ ...report, overall, static: { ...report.static, status: overall } });