agentic-workflow-manager 6.5.2 → 8.1.0

package/dist/tests/commands/sensors/compatibility/contract.test.js

@@ -0,0 +1,193 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const contract_1 = require("../../../../src/commands/sensors/compatibility/contract");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const coverage = {
+    schemaVersion: 1,
+    classes: {
+        formatting: {
+            description: 'Formatting is checked.',
+            detectors: [{ sensor: 'lint' }],
+            remedy: { summary: 'Add a formatter.', command: 'npm install prettier' },
+        },
+    },
+};
+function validPack() {
+    return {
+        schemaVersion: 2,
+        name: 'js-ts', description: 'fixture', detects: ['package.json'],
+        sensors: {
+            lint: {
+                applicability: { allFiles: ['package.json'] },
+                variants: [{
+                        id: 'eslint-9',
+                        priority: 10,
+                        requirements: { tool: 'eslint', toolRange: '>=9.0.0 <10.0.0', runtime: 'node', runtimeRange: '>=20.0.0' },
+                        certifiedRange: '>=9.0.0 <10.0.0',
+                        assets: ['eslint.config.awm.mjs'], formatter: 'eslint-llm', probe: { kind: 'eslint-print-config' },
+                        command: {
+                            executable: 'eslint',
+                            resolution: 'node-modules-bin',
+                            args: ['--format', 'json', '{files}'],
+                            fileInput: { placeholder: '{files}', extensions: ['.ts', '.tsx'] },
+                        },
+                    }],
+            },
+        },
+        coverage,
+    };
+}
+describe('sensor pack v2 contract', () => {
+    it('derives Semgrep compatibility from a contained shared policy reference', () => {
+        const sensorPacks = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-semgrep-policy-'));
+        const packDir = path_1.default.join(sensorPacks, 'python');
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(sensorPacks, 'shared'), { recursive: true });
+            fs_1.default.mkdirSync(packDir);
+            fs_1.default.writeFileSync(path_1.default.join(sensorPacks, 'shared', 'semgrep-policy.json'), JSON.stringify({
+                tool: 'semgrep', toolRange: '>=1.0.0', runtime: 'python', runtimeRange: '>=3.9.0', probe: 'semgrep-validate',
+            }));
+            const pack = validPack();
+            pack.sensors.lint.variants[0] = {
+                id: 'semgrep-python', priority: 10, certifiedRange: '>=1.0.0', policyRef: 'shared/semgrep-policy.json',
+                command: { executable: 'semgrep', resolution: 'path', args: ['--config', '.semgrep.awm.yml', '--json', '.'] },
+                assets: ['.semgrep.awm.yml'], formatter: 'semgrep',
+            };
+            const parsed = (0, contract_1.parseSensorPack)(pack, path_1.default.join(packDir, 'pack.json'));
+            expect(parsed).toMatchObject({ kind: 'v2', pack: { sensors: { lint: { variants: [{
+                                    policyRef: 'shared/semgrep-policy.json', requirements: { tool: 'semgrep', runtime: 'python' }, probe: { kind: 'semgrep-validate' },
+                                }] } } } });
+        }
+        finally {
+            fs_1.default.rmSync(sensorPacks, { recursive: true, force: true });
+        }
+    });
+    it('fails closed when a policy reference is not the AWM-owned shared Semgrep policy', () => {
+        const pack = validPack();
+        pack.sensors.lint.variants[0] = {
+            id: 'semgrep-python', priority: 10, certifiedRange: '>=1.0.0', policyRef: '../secret.json',
+            command: { executable: 'semgrep', resolution: 'path', args: ['--config', '.semgrep.awm.yml', '--json', '.'] },
+            assets: ['.semgrep.awm.yml'], formatter: 'semgrep',
+        };
+        expect(() => (0, contract_1.parseSensorPack)(pack, '/tmp/sensor-packs/python/pack.json')).toThrow('policyRef');
+    });
+    it('parses a valid versioned pack', () => {
+        expect((0, contract_1.parseSensorPack)(validPack(), 'pack.json')).toMatchObject({ kind: 'v2', pack: validPack() });
+    });
+    it('accepts an opt-in hardening asset while variants may require no assets', () => {
+        const pack = {
+            ...validPack(),
+            hardening: { 'typescript-strict': { assets: ['tsconfig.awm.json'] } },
+            sensors: {
+                lint: {
+                    ...validPack().sensors.lint,
+                    variants: [{ ...validPack().sensors.lint.variants[0], assets: [] }],
+                },
+            },
+        };
+        expect((0, contract_1.parseSensorPack)(pack, 'pack.json')).toMatchObject({
+            kind: 'v2',
+            pack: { hardening: { 'typescript-strict': { assets: ['tsconfig.awm.json'] } }, sensors: { lint: { variants: [{ assets: [] }] } } },
+        });
+    });
+    it.each(['true', 'false'])('accepts the exact ESLINT_USE_FLAT_CONFIG=%s environment mapping', flatConfig => {
+        const command = {
+            executable: 'npm',
+            resolution: 'path',
+            args: ['run', 'lint'],
+            packageManager: 'npm',
+            environment: { ESLINT_USE_FLAT_CONFIG: flatConfig },
+        };
+        expect((0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...validPack().sensors.lint.variants[0], command }] } } }, 'pack.json'))
+            .toMatchObject({ kind: 'v2', pack: { sensors: { lint: { variants: [{ command }] } } } });
+    });
+    it.each([
+        { ESLINT_USE_FLAT_CONFIG: 'yes' },
+        { ESLINT_USE_FLAT_CONFIG: 'true', OTHER: 'value' },
+    ])('rejects an unknown or expanded ESLint environment mapping', environment => {
+        const command = { executable: 'npm', resolution: 'path', args: ['run', 'lint'], packageManager: 'npm', environment };
+        expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...validPack().sensors.lint.variants[0], command }] } } }, 'pack.json'))
+            .toThrow('command.environment');
+    });
+    it('normalizes package-manager executable spelling before enforcing its explicit selection', () => {
+        const variant = validPack().sensors.lint.variants[0];
+        const withExecutable = (executable, packageManager) => ({
+            ...validPack(),
+            sensors: { lint: { ...validPack().sensors.lint, variants: [{
+                            ...variant,
+                            command: { executable, resolution: 'path', args: ['run', 'lint'], ...(packageManager === undefined ? {} : { packageManager }) },
+                        }] } },
+        });
+        expect(() => (0, contract_1.parseSensorPack)(withExecutable('NPM'), 'pack.json')).toThrow('packageManager');
+        expect((0, contract_1.parseSensorPack)(withExecutable('npm.exe', 'NPM'), 'pack.json')).toMatchObject({
+            kind: 'v2', pack: { sensors: { lint: { variants: [{ command: { executable: 'npm.exe', packageManager: 'npm' } }] } } },
+        });
+        expect(() => (0, contract_1.parseSensorPack)(withExecutable('NPM', 'pnpm'), 'pack.json')).toThrow('match executable');
+    });
+    it('keeps an unversioned pack on the legacy compatibility path', () => {
+        const legacy = { name: 'legacy', sensors: {} };
+        expect((0, contract_1.parseSensorPack)(legacy, 'pack.json')).toMatchObject({ kind: 'legacy', pack: { ...legacy, compatibility: { state: 'compatible-unverified' } } });
+    });
+    test.each([
+        [{ name: 'legacy', detects: [null], sensors: {} }, 'detects[0]'],
+        [{ name: 'legacy', detects: ['package.json'], sensors: { lint: { unknown: true } } }, 'unknown field'],
+        [{ name: 'legacy', detects: ['package.json'], sensors: { lint: { defaultCmd: 'eslint\u0000 .' } } }, 'defaultCmd'],
+        [{ name: 'legacy', detects: ['package.json'], sensors: { lint: { changedExtensions: ['.ts', 3] } } }, 'changedExtensions[1]'],
+        [{ name: 'legacy', detects: ['package.json'], sensors: { 'bad/name': {} } }, 'sensor id'],
+    ])('rejects recursively malformed legacy content %j', (input, message) => {
+        expect(() => (0, contract_1.parseSensorPack)(input, 'legacy-pack.json')).toThrow(message);
+    });
+    it('preserves legacy config file fallbacks', () => {
+        expect((0, contract_1.parseSensorPack)({ name: 'legacy', sensors: { lint: { configFile: 'eslint.config.js', configFileFallback: '.eslintrc.json' } } }, 'legacy')).toMatchObject({ kind: 'legacy', pack: { sensors: { lint: { configFile: 'eslint.config.js', configFileFallback: '.eslintrc.json' } } } });
+    });
+    it('rejects malformed applicability and probe extensions', () => {
+        const variant = validPack().sensors.lint.variants[0];
+        expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { applicability: { allFiles: [3] }, variants: [variant] } } }, 'pack')).toThrow('allFiles[0]');
+        expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...variant, probe: { kind: 'version', extra: true } }] } } }, 'pack')).toThrow('unknown field');
+    });
+    it('preserves configFiles and rejects incomplete public overlap input', () => {
+        const variant = { ...validPack().sensors.lint.variants[0], requirements: { ...validPack().sensors.lint.variants[0].requirements, configFiles: ['eslint.config.js'] } };
+        expect((0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [variant] } } }, 'pack')).toMatchObject({ kind: 'v2', pack: { sensors: { lint: { variants: [{ requirements: { configFiles: ['eslint.config.js'] } }] } } } });
+        const complete = validPack().sensors.lint.variants[0];
+        expect(() => (0, contract_1.assertNoEqualPriorityOverlap)([{ ...complete, id: '../bad' }])).toThrow('stable lowercase id');
+        expect(() => (0, contract_1.assertNoEqualPriorityOverlap)([{ ...complete, command: undefined }])).toThrow('command');
+    });
+    it('rejects equal-priority variants with overlapping operational tool ranges', () => {
+        const first = validPack().sensors.lint.variants[0];
+        const second = { ...first, id: 'eslint-9-alt', certifiedRange: '>=10 <11', requirements: { ...first.requirements, toolRange: '>=9.5 <10.5' } };
+        expect(() => (0, contract_1.assertNoEqualPriorityOverlap)([first, second])).toThrow('overlap');
+    });
+    it('accepts overlapping tool ranges when runtime ranges are disjoint', () => {
+        const first = validPack().sensors.lint.variants[0];
+        const second = { ...first, id: 'eslint-9-node-old', requirements: { ...first.requirements, toolRange: '>=9.5 <10.5', runtimeRange: '>=18 <20' } };
+        expect(() => (0, contract_1.assertNoEqualPriorityOverlap)([first, second])).not.toThrow();
+    });
+    test.each([
+        [{ ...validPack(), schemaVersion: 3 }, 'supported: legacy, 2'],
+        [{ ...validPack(), sensors: { lint: { variants: [] } } }, 'variants'],
+        [{ ...validPack(), name: '../escape' }, 'name'],
+        [{ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...validPack().sensors.lint.variants[0], assets: ['../secret'] }] } } }, 'asset'],
+        [{ ...validPack(), sensors: { lint: { variants: [{ ...validPack().sensors.lint.variants[0], command: { executable: 'sh', resolution: 'path', args: ['-c', 'echo nope'] } }] } } }, 'executable'],
+        [{ ...validPack(), coverage: { ...coverage, schemaVersion: 2 } }, 'coverage.schemaVersion'],
+        [{ ...validPack(), sensors: { lint: { variants: [{ ...validPack().sensors.lint.variants[0], certifiedRange: 'not-a-range' }] } } }, 'certifiedRange'],
+        [{ ...validPack(), sensors: { lint: validPack().sensors.lint, lint2: validPack().sensors.lint } }, 'variant id'],
+        [{ ...validPack(), sensors: { lint: { variants: [validPack().sensors.lint.variants[0], { ...validPack().sensors.lint.variants[0], id: 'eslint-9-next', certifiedRange: '>=9.1.0 <10.0.0' }] } } }, 'overlap'],
+        [{ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...validPack().sensors.lint.variants[0], assets: ['C:/secret'] }] } } }, 'asset'],
+        [{ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...validPack().sensors.lint.variants[0], command: { executable: 'cmd.exe', resolution: 'path', args: ['x'] } }] } } }, 'executable'],
+        [{ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...validPack().sensors.lint.variants[0], command: { executable: 'npm', resolution: 'path', args: ['run', 'lint'] } }] } } }, 'packageManager'],
+        [{ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...validPack().sensors.lint.variants[0], command: { executable: 'npm', resolution: 'path', args: ['run', 'lint'], packageManager: 'pnpm' } }] } } }, 'match executable'],
+        [{ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...validPack().sensors.lint.variants[0], command: { ...validPack().sensors.lint.variants[0].command, environment: { NODE_OPTIONS: '--require unsafe' } } }] } } }, 'environment'],
+        [{ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...validPack().sensors.lint.variants[0], command: { ...validPack().sensors.lint.variants[0].command, args: ['prefix{files}'] } }] } } }, 'embed'],
+        [{ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...validPack().sensors.lint.variants[0], formatter: 'bad\nformat' }] } } }, 'formatter'],
+        [{ ...validPack(), hardening: { 'typescript-strict': { assets: ['../tsconfig.awm.json'] } } }, 'asset'],
+        [{ ...validPack(), hardening: { 'typescript-strict': { assets: [] } } }, 'hardening'],
+        [{ ...validPack(), hardening: { 'typescript-strict': { assets: ['tsconfig.awm.json'], command: {} } } }, 'unknown field'],
+    ])('rejects malformed pack %j', (input, message) => {
+        expect(() => (0, contract_1.parseSensorPack)(input, 'pack.json')).toThrow(message);
+    });
+});

package/dist/tests/commands/sensors/compatibility/discovery.test.js

@@ -0,0 +1,119 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const discovery_1 = require("../../../../src/commands/sensors/compatibility/discovery");
+describe('discoverProjectEvidence', () => {
+    it('returns only local, relative project evidence and detects conflicting lockfiles', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), JSON.stringify({ scripts: { lint: 'eslint .' }, devDependencies: { eslint: '10.0.0' } }));
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package-lock.json'), '{}');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pnpm-lock.yaml'), 'lockfileVersion: 9');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'export default []');
+            fs_1.default.mkdirSync(path_1.default.join(root, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ name: 'eslint', version: '10.4.1' }));
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, { schemaVersion: 2, name: 'js-ts', detects: ['package.json'], sensors: { lint: { applicability: { allFiles: ['package.json'] }, variants: [{ requirements: { tool: 'eslint', configFiles: [] } }] } } }, { platform: () => 'darwin' });
+            expect(evidence.packageManagerConflict).toBe(true);
+            expect(evidence.os).toBe('darwin');
+            expect(evidence.declaredToolRanges.eslint).toBe('10.0.0');
+            expect(evidence.toolVersions.eslint).toBe('10.4.1');
+            expect(evidence.scripts).toContain('lint');
+            expect(evidence.configFiles).toContain('eslint.config.js');
+            expect(evidence.paths.every((item) => !path_1.default.isAbsolute(item) && !item.includes('..'))).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('includes pack and applicability markers when deciding whether a sensor applies', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-markers-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pack-marker'), 'present');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'sensor-marker'), 'present');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'one-of-these'), 'present');
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, {
+                schemaVersion: 2,
+                name: 'custom',
+                detects: ['pack-marker'],
+                sensors: {
+                    lint: {
+                        applicability: { allFiles: ['sensor-marker'], anyFiles: ['one-of-these', 'missing-marker'] },
+                        variants: [{ requirements: { tool: 'eslint', configFiles: [] } }],
+                    },
+                },
+            });
+            expect(evidence.paths).toEqual(expect.arrayContaining(['pack-marker', 'sensor-marker', 'one-of-these']));
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('does not report package.json as evidence when the project has none', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-no-package-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pyproject.toml'), '[project]\nname = "sample"');
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, {
+                schemaVersion: 2,
+                name: 'python',
+                detects: ['pyproject.toml'],
+                sensors: {
+                    lint: { applicability: { allFiles: ['package.json'] }, variants: [{ requirements: { tool: 'ruff', configFiles: [] } }] },
+                },
+            });
+            expect(evidence.paths).not.toContain('package.json');
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    test.each([
+        ['linux', ['.venv', 'lib', 'python3.12', 'site-packages']],
+        ['win32', ['.venv', 'Lib', 'site-packages']],
+    ])('discovers exact local Python runtime and tool metadata on %s', (targetPlatform, sitePackages) => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-discovery-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(root, ...sitePackages), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, '.venv', 'pyvenv.cfg'), 'version = 3.12.4\n');
+            for (const [tool, version] of Object.entries({ mypy: '1.11.2', ruff: '0.6.9', pytest: '8.3.3', semgrep: '1.91.0' })) {
+                const info = path_1.default.join(root, ...sitePackages, `${tool}-${version}.dist-info`);
+                fs_1.default.mkdirSync(info);
+                fs_1.default.writeFileSync(path_1.default.join(info, 'METADATA'), `Metadata-Version: 2.3\nName: ${tool}\nVersion: ${version}\n`);
+            }
+            const pack = { schemaVersion: 2, name: 'python', detects: ['pyproject.toml'], sensors: {
+                    quality: { applicability: { allFiles: ['pyproject.toml'] }, variants: Object.keys({ mypy: 0, ruff: 0, pytest: 0, semgrep: 0 }).map(tool => ({ requirements: { tool, runtime: 'python', configFiles: [] } })) },
+                } };
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pyproject.toml'), '[project]\nname = "sample"');
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, pack, { platform: () => targetPlatform });
+            expect(evidence.runtimeVersions.python).toBe('3.12.4');
+            expect(evidence.toolVersions).toMatchObject({ mypy: '1.11.2', ruff: '0.6.9', pytest: '8.3.3', semgrep: '1.91.0' });
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('does not trust missing or escaping Python environment metadata', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-discovery-untrusted-'));
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-discovery-outside-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(root, '.venv', 'lib', 'python3.12', 'site-packages'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, '.venv', 'pyvenv.cfg'), 'version = not-a-version\n');
+            const escaped = path_1.default.join(root, '.venv', 'lib', 'python3.12', 'site-packages', 'ruff-0.6.9.dist-info');
+            fs_1.default.mkdirSync(path_1.default.join(outside, 'ruff-0.6.9.dist-info'));
+            fs_1.default.writeFileSync(path_1.default.join(outside, 'ruff-0.6.9.dist-info', 'METADATA'), 'Name: ruff\nVersion: 0.6.9\n');
+            fs_1.default.symlinkSync(path_1.default.join(outside, 'ruff-0.6.9.dist-info'), escaped, 'dir');
+            const pack = { schemaVersion: 2, name: 'python', detects: [], sensors: { lint: { applicability: {}, variants: [{ requirements: { tool: 'ruff', runtime: 'python', configFiles: [] } }] } } };
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, pack, { platform: () => 'linux' });
+            expect(evidence.runtimeVersions.python).toBeNull();
+            expect(evidence.toolVersions.ruff).toBeNull();
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/commands/sensors/compatibility/live.test.js

@@ -0,0 +1,124 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const live_1 = require("../../../../src/commands/sensors/compatibility/live");
+const exec_1 = require("../../../../src/commands/sensors/exec");
+const python_venv_fixture_1 = require("./python-venv-fixture");
+const itPosix = process.platform !== 'win32' ? it : it.skip;
+describe('resolveParsedPackCompatibility — contained Python commands', () => {
+    test.each([
+        ['linux', ['.venv', 'bin', 'semgrep']],
+        ['win32', ['.venv', 'Scripts', 'semgrep.exe']],
+    ])('creates a local Semgrep executable in the %s virtual-environment layout', (targetPlatform, executableParts) => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-semgrep-venv-layout-'));
+        try {
+            (0, python_venv_fixture_1.createSemgrepVenvFixture)(root, targetPlatform);
+            expect(fs_1.default.lstatSync(path_1.default.join(root, ...executableParts)).isFile()).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('resolves the Windows virtual-environment executable from Scripts instead of PATH', async () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-semgrep-windows-resolution-'));
+        const global = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-semgrep-windows-global-'));
+        const originalPlatform = process.platform;
+        const savedPath = process.env.PATH;
+        const savedPathExt = process.env.PATHEXT;
+        try {
+            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+            process.env.PATH = global;
+            process.env.PATHEXT = '.EXE';
+            (0, python_venv_fixture_1.createSemgrepVenvFixture)(root, 'win32');
+            fs_1.default.writeFileSync(path_1.default.join(global, 'semgrep.exe'), 'must-not-run');
+            await expect((0, exec_1.runStructuredCommand)({
+                executable: 'semgrep', resolution: 'python-environment', pythonEnvironmentRoot: '.venv', args: ['--version'],
+            }, { cwd: root, timeout: 5_000 })).resolves.toMatchObject({
+                code: 0,
+                stdout: expect.stringContaining(process.version),
+            });
+        }
+        finally {
+            Object.defineProperty(process, 'platform', { value: originalPlatform, configurable: true });
+            if (savedPath === undefined)
+                delete process.env.PATH;
+            else
+                process.env.PATH = savedPath;
+            if (savedPathExt === undefined)
+                delete process.env.PATHEXT;
+            else
+                process.env.PATHEXT = savedPathExt;
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+            fs_1.default.rmSync(global, { recursive: true, force: true });
+        }
+    });
+    itPosix('binds Semgrep discovery, validation probe, and execution to the same local virtual-environment executable', async () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-semgrep-contained-'));
+        const global = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-semgrep-global-'));
+        const savedPath = process.env.PATH;
+        try {
+            (0, python_venv_fixture_1.createSemgrepVenvFixture)(root);
+            fs_1.default.writeFileSync(path_1.default.join(root, '.venv', 'bin', 'semgrep'), '#!/bin/sh\nif [ "$1" = "--validate" ]; then echo local-semgrep; exit 0; fi\nexit 1\n', { mode: 0o755 });
+            fs_1.default.writeFileSync(path_1.default.join(global, 'semgrep'), '#!/bin/sh\necho global-semgrep\n', { mode: 0o755 });
+            process.env.PATH = global;
+            const pack = {
+                schemaVersion: 2,
+                name: 'python',
+                description: 'test',
+                detects: ['pyproject.toml'],
+                coverage: {},
+                sensors: {
+                    security: {
+                        applicability: { allFiles: ['pyproject.toml'] },
+                        variants: [{
+                                id: 'semgrep-1', priority: 1, certifiedRange: '>=1 <2',
+                                requirements: { tool: 'semgrep', toolRange: '>=1 <2', runtime: 'python', runtimeRange: '>=3.12 <4' },
+                                assets: [], formatter: 'semgrep', probe: { kind: 'semgrep-validate' },
+                                command: { executable: 'semgrep', resolution: 'path', args: ['--validate'] },
+                            }],
+                    },
+                },
+            };
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pyproject.toml'), '[project]\nname = "sample"\n');
+            const live = await (0, live_1.resolveParsedPackCompatibility)(root, pack);
+            const command = live.pack.sensors.security.variants[0].command;
+            expect(live.sensors.security).toMatchObject({ state: 'certified', toolVersion: '1.91.0' });
+            expect(command).toMatchObject({ executable: 'semgrep', resolution: 'python-environment' });
+            await expect((0, exec_1.runStructuredCommand)(command, { cwd: root, timeout: 5_000 })).resolves.toMatchObject({ code: 0, stdout: 'local-semgrep\n' });
+        }
+        finally {
+            process.env.PATH = savedPath;
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+            fs_1.default.rmSync(global, { recursive: true, force: true });
+        }
+    });
+    it('never falls back from the discovered .venv to a sibling venv executable', async () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-semgrep-environment-identity-'));
+        try {
+            (0, python_venv_fixture_1.createSemgrepVenvFixture)(root, process.platform, '.venv', { executable: false });
+            (0, python_venv_fixture_1.createSemgrepVenvFixture)(root, process.platform, 'venv');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pyproject.toml'), '[project]\nname = "sample"\n');
+            const pack = {
+                schemaVersion: 2, name: 'python', description: 'test', detects: ['pyproject.toml'], coverage: {},
+                sensors: { security: { applicability: { allFiles: ['pyproject.toml'] }, variants: [{
+                                id: 'semgrep-1', priority: 1, certifiedRange: '>=1 <2',
+                                requirements: { tool: 'semgrep', toolRange: '>=1 <2', runtime: 'python', runtimeRange: '>=3.12 <4' },
+                                assets: [], formatter: 'semgrep', probe: { kind: 'semgrep-validate' },
+                                command: { executable: 'semgrep', resolution: 'path', args: ['--validate'] },
+                            }] } },
+            };
+            const live = await (0, live_1.resolveParsedPackCompatibility)(root, pack);
+            expect(live.sensors.security).toMatchObject({ state: 'unverifiable', reason: 'probe-inconclusive', toolVersion: '1.91.0' });
+            expect(() => (0, exec_1.runStructuredCommand)(live.pack.sensors.security.variants[0].command, { cwd: root, timeout: 5_000 }))
+                .toThrow('python environment executable is not a contained local regular file');
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/commands/sensors/compatibility/manifest.test.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const manifest_1 = require("../../../../src/commands/sensors/compatibility/manifest");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+describe('sensor manifest contract', () => {
+    it('keeps compatibility contracts on an acyclic import boundary', () => {
+        const source = (relative) => fs_1.default.readFileSync(path_1.default.join(__dirname, '../../../../src/commands/sensors', relative), 'utf8');
+        expect(source('types.ts')).not.toContain('./compatibility/');
+        expect(source('compatibility/types.ts')).not.toContain('../coverage/');
+        expect(source('coverage/contract.ts')).not.toContain('../compatibility/manifest');
+    });
+    it('normalizes a legacy string command with compatible-unverified evidence', () => {
+        expect((0, manifest_1.parseSensorManifest)({ pack: 'js-ts', sensors: { lint: 'npm run lint' } }, 'sensors.json')).toMatchObject({ kind: 'legacy', pack: {
+                pack: 'js-ts',
+                sensors: { lint: { cmd: 'npm run lint' } },
+                compatibility: (0, manifest_1.legacyCompatibility)(),
+            } });
+    });
+    it('accepts a v2 selected variant and structured command', () => {
+        const manifest = {
+            schemaVersion: 2,
+            pack: 'js-ts',
+            sensors: {
+                lint: {
+                    enabled: true, variantId: 'eslint-9',
+                    command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.', '--format', 'json'] },
+                    initializedCompatibility: { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] },
+                },
+            },
+        };
+        expect((0, manifest_1.parseSensorManifest)(manifest, 'sensors.json')).toMatchObject({ kind: 'v2', pack: manifest });
+        expect(JSON.parse((0, manifest_1.serializeManifestV2)(manifest))).toEqual(manifest);
+    });
+    it('persists only an explicit v2 pack selection as applicability provenance', () => {
+        const manifest = {
+            schemaVersion: 2, pack: 'generic', packSelection: 'explicit',
+            sensors: {},
+        };
+        expect((0, manifest_1.parseSensorManifest)(manifest, 'sensors.json')).toMatchObject({ kind: 'v2', pack: { packSelection: 'explicit' } });
+        expect(JSON.parse((0, manifest_1.serializeManifestV2)(manifest))).toEqual(manifest);
+        expect(() => (0, manifest_1.parseSensorManifest)({ ...manifest, packSelection: 'detected' }, 'sensors.json')).toThrow('packSelection');
+    });
+    it('accepts optional contained assets and rejects traversal', () => {
+        const sensor = { enabled: true, variantId: 'eslint-9', assets: ['eslint.config.awm.mjs'], command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
+        expect((0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'sensors.json')).toMatchObject({ kind: 'v2' });
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: { ...sensor, assets: ['C:/secret'] } } }, 'sensors.json')).toThrow('asset');
+    });
+    it('rejects mismatched compatibility variant and hostile source labels', () => {
+        const sensor = { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'other', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, { path: 'bad' })).toThrow('<unknown source>');
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'source\nleak')).toThrow('<unknown source>');
+    });
+    it('rejects invalid semver evidence independently', () => {
+        const sensor = { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: 'bad', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'source')).toThrow('toolVersion');
+    });
+    it('rejects certified evidence without a selected variant', () => {
+        const sensor = { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: null, toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'source')).toThrow('variantId');
+    });
+    it('rejects a certified tool version outside its certified range', () => {
+        const sensor = { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '10.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'source')).toThrow('certifiedRange');
+    });
+    test.each([
+        [null, 'object'],
+        [{}, 'pack'],
+        [{ schemaVersion: 3, pack: 'js-ts', sensors: {} }, 'schemaVersion'],
+        [{ schemaVersion: 2, pack: 'js-ts', sensors: { lint: { variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'path', args: [] } } } }, 'enabled'],
+    ])('rejects malformed manifest %j', (input, message) => {
+        expect(() => (0, manifest_1.parseSensorManifest)(input, 'sensors.json')).toThrow(message);
+    });
+});

package/dist/tests/commands/sensors/compatibility/materialize.test.js

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const materialize_1 = require("../../../../src/commands/sensors/compatibility/materialize");
+const evidence = { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-10', toolVersion: '10.0.0', runtimeVersion: '22.0.0', certifiedRange: '>=10 <11', evidence: [] };
+describe('materializeResolvedSensors', () => {
+    let projectRoot;
+    let packRoot;
+    beforeEach(() => {
+        projectRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-project-'));
+        packRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-pack-'));
+        fs_1.default.writeFileSync(path_1.default.join(packRoot, 'eslint.config.awm.mjs'), 'export default [];');
+        fs_1.default.writeFileSync(path_1.default.join(packRoot, 'tsconfig.awm.json'), '{}');
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(projectRoot, { recursive: true, force: true });
+        fs_1.default.rmSync(packRoot, { recursive: true, force: true });
+    });
+    it('copies only selected assets and writes a v2 manifest atomically', () => {
+        const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(result.configured).toEqual(['eslint.config.awm.mjs']);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'tsconfig.awm.json'))).toBe(false);
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'), 'utf8'))).toMatchObject({ schemaVersion: 2, sensors: { lint: { variantId: 'eslint-10' } } });
+        expect(fs_1.default.readdirSync(path_1.default.join(projectRoot, '.awm'))).not.toContain('sensors.json.tmp');
+    });
+    it('preserves a destination that already exists', () => {
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'), 'owner content');
+        const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(result.preserved).toEqual(['eslint.config.awm.mjs']);
+        expect(fs_1.default.readFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'), 'utf8')).toBe('owner content');
+    });
+    it('revalidates a shared Semgrep policy reference without materializing the policy itself', () => {
+        const sensorPacks = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-policy-'));
+        const semgrepPack = path_1.default.join(sensorPacks, 'python');
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(sensorPacks, 'shared'), { recursive: true });
+            fs_1.default.mkdirSync(semgrepPack);
+            fs_1.default.writeFileSync(path_1.default.join(semgrepPack, 'pack.json'), '{}');
+            fs_1.default.writeFileSync(path_1.default.join(semgrepPack, '.semgrep.awm.yml'), 'rules: []\n');
+            fs_1.default.writeFileSync(path_1.default.join(sensorPacks, 'shared', 'semgrep-policy.json'), JSON.stringify({ tool: 'semgrep', toolRange: '>=1.0.0', runtime: 'python', runtimeRange: '>=3.9.0', probe: 'semgrep-validate' }));
+            const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot: semgrepPack, pack: 'python', sensors: {
+                    security: { enabled: true, variantId: 'semgrep-python', command: { executable: 'semgrep', resolution: 'path', args: ['--config', '.semgrep.awm.yml', '--json', '.'] }, assets: ['.semgrep.awm.yml'], policyRef: 'shared/semgrep-policy.json', initializedCompatibility: { ...evidence, variantId: 'semgrep-python' } },
+                } });
+            expect(result.configured).toEqual(['.semgrep.awm.yml']);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'shared', 'semgrep-policy.json'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(sensorPacks, { recursive: true, force: true });
+        }
+    });
+    it('reports previous AWM assets as orphaned and never deletes them', () => {
+        fs_1.default.mkdirSync(path_1.default.join(projectRoot, '.awm'));
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'), JSON.stringify({ schemaVersion: 2, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'old', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.cjs'], initializedCompatibility: { ...evidence, variantId: 'old' } },
+            } }));
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.cjs'), 'old');
+        const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(result.orphaned).toEqual(['eslint.config.awm.cjs']);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.cjs'))).toBe(true);
+    });
+});