agentic-workflow-manager 6.5.2 → 8.1.0

package/dist/tests/core/same-existing-path.test.js

@@ -14,6 +14,7 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../../src/core/paths");
+const itPosix = process.platform !== 'win32' ? it : it.skip;
 describe('sameExistingPath', () => {
     let root;
     beforeEach(() => { root = fs_1.default.realpathSync(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-samepath-'))); });
@@ -34,12 +35,46 @@ describe('sameExistingPath', () => {
         fs_1.default.mkdirSync(b);
         expect((0, paths_1.sameExistingPath)(a, b)).toBe(false);
     });
+    it('does not treat colliding inode metadata as identity when native realpaths differ', () => {
+        const a = path_1.default.join(root, 'inode-collision-a');
+        const b = path_1.default.join(root, 'inode-collision-b');
+        fs_1.default.mkdirSync(a);
+        fs_1.default.mkdirSync(b);
+        const stat = jest.spyOn(fs_1.default, 'statSync').mockImplementation((() => ({ dev: 1, ino: 1 })));
+        const platform = Object.getOwnPropertyDescriptor(process, 'platform');
+        Object.defineProperty(process, 'platform', { ...platform, value: 'win32' });
+        try {
+            expect((0, paths_1.sameExistingPath)(a, b)).toBe(false);
+        }
+        finally {
+            Object.defineProperty(process, 'platform', platform);
+            stat.mockRestore();
+        }
+    });
+    itPosix('conserva la identidad de un archivo con hard links POSIX', () => {
+        const original = path_1.default.join(root, 'original');
+        const alias = path_1.default.join(root, 'alias');
+        fs_1.default.writeFileSync(original, 'contenido');
+        fs_1.default.linkSync(original, alias);
+        expect((0, paths_1.sameExistingPath)(alias, original)).toBe(true);
+    });
     it('una ruta inexistente nunca "coincide" — la identidad no se afirma sin prueba', () => {
         const a = path_1.default.join(root, 'a');
         fs_1.default.mkdirSync(a);
         expect((0, paths_1.sameExistingPath)(a, path_1.default.join(root, 'fantasma'))).toBe(false);
         expect((0, paths_1.sameExistingPath)(path_1.default.join(root, 'fantasma'), path_1.default.join(root, 'fantasma'))).toBe(false);
     });
+    it('falla cerrado si la canonicalización nativa no está disponible', () => {
+        const a = path_1.default.join(root, 'a');
+        fs_1.default.mkdirSync(a);
+        const realpath = jest.spyOn(fs_1.default.realpathSync, 'native').mockImplementation(() => { throw new Error('canonicalización no disponible'); });
+        try {
+            expect((0, paths_1.sameExistingPath)(a, a)).toBe(false);
+        }
+        finally {
+            realpath.mockRestore();
+        }
+    });
     it('sobrevive a separadores y segmentos redundantes', () => {
         const a = path_1.default.join(root, 'a');
         fs_1.default.mkdirSync(a);

package/dist/tests/core/sync-gates.test.js

@@ -41,7 +41,8 @@ async function rmSyncRetryingBusy(target, attempts = 10, delayMs = 100) {
 }
 function makeRegistryWithManifest(base, name, manifest) {
     const dir = path_1.default.join(base, name);
-    fs_1.default.mkdirSync(dir, { recursive: true });
+    fs_1.default.mkdirSync(path_1.default.join(dir, 'skills'), { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'skills', '.keep'), 'fixture');
     GIT(dir, 'init -q -b main');
     fs_1.default.writeFileSync(path_1.default.join(dir, 'awm-registry.json'), JSON.stringify(manifest));
     GIT(dir, 'add -A');

package/dist/tests/integration/copilot-init-isolated.test.js

@@ -94,6 +94,24 @@ describe('copilot provider — isolated home E2E (devCore global-scope guard reg
     function readPrefs() {
         return JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpHome, '.awm/preferences.json'), 'utf8'));
     }
+    it('machine-only enables Copilot without writing project artifacts (R7, R15)', async () => {
+        seedPublicRegistryFixture(path_1.default.join(tmpHome, '.awm/registries/baseline'));
+        fs_1.default.rmSync(path_1.default.join(tmpWork, 'package.json'));
+        const before = fs_1.default.readdirSync(tmpWork).sort();
+        const { runInit } = require('../../src/commands/init');
+        const code = await runInit({
+            cwd: tmpWork,
+            yes: true,
+            agent: 'copilot',
+            machineOnly: true,
+        });
+        expect(code).toBe(0);
+        expect(readPrefs().enabledAgents).toEqual(['copilot']);
+        expect(fs_1.default.readdirSync(tmpWork).sort()).toEqual(before);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpWork, 'AGENTS.md'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpWork, '.github'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpWork, '.awm'))).toBe(false);
+    });
     it('completes without crashing/rolling back (real bug repro) and delivers content via AGENTS.md, not a doomed global-scope install', async () => {
         seedPublicRegistryFixture(path_1.default.join(tmpHome, '.awm/registries/baseline'));
         const { runInit } = require('../../src/commands/init');

package/dist/tests/integration/sensor-compatibility.e2e.test.js

@@ -0,0 +1,141 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const contract_1 = require("../../src/commands/sensors/compatibility/contract");
+const discovery_1 = require("../../src/commands/sensors/compatibility/discovery");
+const probe_1 = require("../../src/commands/sensors/compatibility/probe");
+const resolve_1 = require("../../src/commands/sensors/compatibility/resolve");
+const cliDir = path_1.default.resolve(__dirname, '../..');
+const bin = path_1.default.join(cliDir, 'dist/src/index.js');
+const fixtureRoot = path_1.default.join(cliDir, 'tests/fixtures/sensor-compatibility');
+const projectFixture = path_1.default.join(fixtureRoot, 'project');
+const registryFixture = path_1.default.join(fixtureRoot, 'registry');
+const noFollowUnavailableOnNativeWindows = process.platform === 'win32'
+    && typeof fs_1.default.constants.O_NOFOLLOW !== 'number';
+// Other native platforms exercise coverage through testWithNoFollow; this
+// branch preserves the deliberate Windows fail-closed behavior instead.
+const testWithNoFollow = noFollowUnavailableOnNativeWindows ? test.skip : test;
+const testWithoutNoFollowOnNativeWindows = noFollowUnavailableOnNativeWindows ? test : test.skip;
+function hashTree(root) {
+    const hash = crypto_1.default.createHash('sha256');
+    const walk = (directory) => {
+        for (const entry of fs_1.default.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const file = path_1.default.join(directory, entry.name);
+            hash.update(path_1.default.relative(root, file));
+            if (entry.isDirectory())
+                walk(file);
+            else if (entry.isFile())
+                hash.update(fs_1.default.readFileSync(file));
+        }
+    };
+    walk(root);
+    return hash.digest('hex');
+}
+function createFixture() {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-r3-compatibility-'));
+    const project = path_1.default.join(root, 'project');
+    const awmHome = path_1.default.join(root, 'awm-home');
+    const registryRoot = path_1.default.join(awmHome, 'registries', 'baseline');
+    fs_1.default.cpSync(projectFixture, project, { recursive: true });
+    fs_1.default.mkdirSync(path_1.default.join(project, 'node_modules', 'eslint'), { recursive: true });
+    fs_1.default.copyFileSync(path_1.default.join(project, 'eslint-tool-package.json'), path_1.default.join(project, 'node_modules', 'eslint', 'package.json'));
+    fs_1.default.mkdirSync(path_1.default.dirname(registryRoot), { recursive: true });
+    fs_1.default.cpSync(registryFixture, registryRoot, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify([{ name: 'baseline', remote: 'fixture' }]));
+    return { root, project, awmHome, registryRoot };
+}
+function runCli(fixture, ...args) {
+    return (0, child_process_1.spawnSync)(process.execPath, [bin, 'sensors', ...args], {
+        cwd: fixture.project,
+        encoding: 'utf8',
+        env: { ...process.env, AWM_HOME: fixture.awmHome, AWM_NO_UPDATE_CHECK: '1' },
+    });
+}
+function json(result) {
+    expect(result.status).toBe(0);
+    if (!(result.stdout ?? '').trim())
+        throw new Error(`coverage emitted no JSON: stderr=${result.stderr ?? ''}`);
+    return JSON.parse(result.stdout ?? '');
+}
+beforeAll(() => {
+    if (!fs_1.default.existsSync(bin))
+        throw new Error(`Compatibility E2E requires the compiled CLI at ${bin}; run npm run build before this test.`);
+});
+// This is a portable resolver *semantic* matrix: `platform` is injected into
+// the resolver, so it proves the three path/selection branches but does not
+// claim that this Linux process is a native macOS or Windows execution. Native
+// binary coverage is exercised separately below and by the CI OS matrix.
+test.each(['linux', 'darwin', 'win32'])('keeps injected resolver semantics consistent on %s (R9.1)', async (platform) => {
+    const fixture = createFixture();
+    try {
+        const source = JSON.parse(fs_1.default.readFileSync(path_1.default.join(fixture.registryRoot, 'sensor-packs', 'js-ts', 'pack.json'), 'utf8'));
+        const parsed = (0, contract_1.parseSensorPack)(source, 'fixture/pack.json');
+        if (parsed.kind !== 'v2')
+            throw new Error('fixture must be a v2 pack');
+        const discovered = (0, discovery_1.discoverProjectEvidence)(fixture.project, parsed.pack, { platform: () => platform });
+        const probe = await (0, probe_1.runCompatibilityProbe)({ kind: 'version' }, { cwd: fixture.project, toolExecutable: 'eslint' }, async () => ({
+            code: 0, signal: null, timedOut: false, overflowed: false, stdout: 'eslint v10.4.1', stderr: '',
+        }));
+        const result = (0, resolve_1.resolveSensorCompatibility)(parsed.pack.sensors.lint, { ...discovered, probe }, { pack: 'js-ts', sensor: 'lint' });
+        expect(result).toMatchObject({ state: 'certified', variantId: 'eslint-10', toolVersion: '10.4.1' });
+    }
+    finally {
+        fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+    }
+});
+testWithNoFollow('compiled binary dispatches coverage and emits parseable JSON on the native CI platform', () => {
+    const fixture = createFixture();
+    try {
+        const report = json(runCli(fixture, 'coverage', '--json'));
+        expect(report).toMatchObject({ schemaVersion: 2, static: expect.any(Object), empirical: expect.any(Object) });
+    }
+    finally {
+        fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+    }
+});
+testWithNoFollow('legacy coverage stays unverified, init migrates explicitly, and version drift is visible (R7.2, R7.8)', () => {
+    const fixture = createFixture();
+    try {
+        const before = [hashTree(fixture.project), hashTree(fixture.awmHome)];
+        const legacy = json(runCli(fixture, 'coverage', '--json'));
+        expect(legacy).toMatchObject({ schemaVersion: 2, static: { status: 'inconclusive' } });
+        expect(legacy.static.classes).toEqual(expect.arrayContaining([expect.objectContaining({
+                id: 'lint-errors', status: 'unverifiable', detectors: expect.arrayContaining([expect.objectContaining({ compatibility: expect.objectContaining({ state: 'compatible-unverified' }) })]),
+            })]));
+        expect([hashTree(fixture.project), hashTree(fixture.awmHome)]).toEqual(before);
+        const migrated = runCli(fixture, 'init', '--registry-root', fixture.registryRoot, '--pack', 'js-ts', '--no-configure');
+        expect(migrated.status).toBe(0);
+        const manifest = JSON.parse(fs_1.default.readFileSync(path_1.default.join(fixture.project, '.awm', 'sensors.json'), 'utf8'));
+        expect(manifest).toMatchObject({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: { variantId: 'eslint-10' } } });
+        const certified = json(runCli(fixture, 'coverage', '--json'));
+        expect(certified.static.classes).toEqual(expect.arrayContaining([expect.objectContaining({
+                id: 'lint-errors', status: 'covered', detectors: expect.arrayContaining([expect.objectContaining({ compatibility: expect.objectContaining({ state: 'certified' }) })]),
+            })]));
+        fs_1.default.writeFileSync(path_1.default.join(fixture.project, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ name: 'eslint', version: '11.0.0' }));
+        const drift = json(runCli(fixture, 'coverage', '--json'));
+        expect(drift).toMatchObject({ overall: 'inconclusive', static: { classes: [expect.objectContaining({
+                        id: 'lint-errors', status: 'unverifiable', detectors: expect.arrayContaining([expect.objectContaining({ compatibility: expect.objectContaining({ state: 'compatible-unverified' }) })]),
+                    })] } });
+    }
+    finally {
+        fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+    }
+});
+testWithoutNoFollowOnNativeWindows('coverage fails closed when native Windows cannot prevent symlink dereference', () => {
+    const fixture = createFixture();
+    try {
+        const result = runCli(fixture, 'coverage', '--json');
+        expect(result.status).toBe(1);
+        expect(`${result.stdout ?? ''}${result.stderr ?? ''}`).toContain('platform cannot guarantee no symlink dereference');
+    }
+    finally {
+        fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+    }
+});

package/dist/tests/integration/sensor-coverage.e2e.test.js

@@ -14,6 +14,7 @@ const fixture = path_1.default.join(cliDir, 'tests/fixtures/sensor-coverage/js-t
 const registryFixture = path_1.default.join(cliDir, 'tests/fixtures/sensor-coverage/registry');
 const noFollowUnavailableOnNativeWindows = process.platform === 'win32'
     && typeof fs_1.default.constants.O_NOFOLLOW !== 'number';
+const testWithNoFollow = noFollowUnavailableOnNativeWindows ? test.skip : test;
 const hashTree = (root) => {
     const hash = crypto_1.default.createHash('sha256');
     const walk = (directory) => {
@@ -63,7 +64,7 @@ function runWithFixture(mutatePack) {
     }
     return { tmp, project, awmHome };
 }
-test('compiled CLI reports gaps or fails closed when no-follow safety is unavailable (RF-1.1, RF-1.4)', () => {
+test('compiled CLI reports static and read-only empirical coverage without leaking ledger text (R5.6, R5.10)', () => {
     const { tmp, project, awmHome } = runWithFixture();
     try {
         const before = [hashTree(project), hashTree(awmHome)];
@@ -78,9 +79,16 @@ test('compiled CLI reports gaps or fails closed when no-follow safety is unavail
             expect(result.status).toBe(0);
             const report = JSON.parse(result.stdout ?? '');
             expect(report.static.classes).toEqual(expect.arrayContaining([
-                expect.objectContaining({ id: 'formatting', status: 'missing' }),
-                expect.objectContaining({ id: 'project-style-conventions', status: 'missing' }),
+                expect.objectContaining({ id: 'formatting', status: 'unverifiable' }),
+                expect.objectContaining({ id: 'project-style-conventions', status: 'unverifiable' }),
             ]));
+            expect(report).toMatchObject({ schemaVersion: 2, empirical: {
+                    status: 'partial', classes: [expect.objectContaining({ defectClass: 'lint-errors', occurrences: 2, recurrent: true })],
+                    unclassified: { occurrences: 1 },
+                } });
+            expect(result.stdout).not.toContain('fixture-secret-description');
+            expect(result.stdout).not.toContain('private-lint-signature');
+            expect(result.stdout).not.toContain('windows secret');
         }
         expect([hashTree(project), hashTree(awmHome)]).toEqual(before);
     }
@@ -88,7 +96,25 @@ test('compiled CLI reports gaps or fails closed when no-follow safety is unavail
         fs_1.default.rmSync(tmp, { recursive: true, force: true });
     }
 });
-const testWithNoFollow = noFollowUnavailableOnNativeWindows ? test.skip : test;
+testWithNoFollow('compiled coverage keeps static verdict stable while --min changes only recurrence emphasis', () => {
+    const { tmp, project, awmHome } = runWithFixture();
+    try {
+        const before = [hashTree(project), hashTree(awmHome)];
+        const run = (min) => (0, child_process_1.spawnSync)(process.execPath, [bin, 'sensors', 'coverage', '--json', '--min', min], {
+            cwd: project, encoding: 'utf8', env: { ...process.env, AWM_HOME: awmHome, AWM_NO_UPDATE_CHECK: '1' },
+        });
+        const defaultReport = JSON.parse(run('2').stdout ?? '');
+        const minThree = JSON.parse(run('3').stdout ?? '');
+        expect(defaultReport.static).toEqual(minThree.static);
+        expect(defaultReport.overall).toBe(minThree.overall);
+        expect(defaultReport.empirical.classes[0]).toMatchObject({ occurrences: 2, recurrent: true });
+        expect(minThree.empirical.classes[0]).toMatchObject({ occurrences: 2, recurrent: false });
+        expect([hashTree(project), hashTree(awmHome)]).toEqual(before);
+    }
+    finally {
+        fs_1.default.rmSync(tmp, { recursive: true, force: true });
+    }
+});
 testWithNoFollow('informative states exit zero; malformed contract exits non-zero (R2.7, R2.9)', () => {
     const run = (mutatePack) => {
         const { tmp, project, awmHome } = runWithFixture(mutatePack);
@@ -105,9 +131,12 @@ testWithNoFollow('informative states exit zero; malformed contract exits non-zer
     const noReference = run((pack) => { delete pack.coverage; });
     const malformed = run((pack) => { pack.coverage.schemaVersion = 2; });
     expect(gaps.status).toBe(0);
-    expect(JSON.parse(gaps.stdout ?? '')).toMatchObject({ overall: 'gaps' });
+    expect(JSON.parse(gaps.stdout ?? '')).toMatchObject({ overall: 'inconclusive' });
     expect(noReference.status).toBe(0);
-    expect(JSON.parse(noReference.stdout ?? '')).toMatchObject({ static: { reason: 'no_reference' } });
+    expect(JSON.parse(noReference.stdout ?? '')).toMatchObject({
+        static: { reason: 'no_reference' },
+        empirical: { classes: [expect.objectContaining({ outcome: 'coverage-unverifiable' })] },
+    });
     expect(malformed.status).toBe(1);
     expect(`${malformed.stdout ?? ''}${malformed.stderr ?? ''}`).toContain('schemaVersion must be 1');
 });

package/dist/tests/integration/sensor-structured-run.e2e.test.js

@@ -0,0 +1,127 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const cliDir = path_1.default.resolve(__dirname, '../..');
+const bin = path_1.default.join(cliDir, 'dist/src/index.js');
+function writeJson(file, value) {
+    fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+    fs_1.default.writeFileSync(file, JSON.stringify(value, null, 2));
+}
+/**
+ * This is deliberately an argument which changes meaning under a shell on both
+ * POSIX and cmd.exe. The controlled Node tool records argv before the possible
+ * injected command can run, while the injected command would create the marker.
+ * A shell:true regression must therefore either alter argv or create the marker.
+ */
+const shellSensitiveLiteral = '--literal=preserve-this&node -e "require(\'fs\').writeFileSync(\'structured-shell-injection\', \'unexpected\')"';
+function createFixture() {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-structured-run-'));
+    const project = path_1.default.join(root, 'project');
+    const awmHome = path_1.default.join(root, 'awm-home');
+    const registryRoot = path_1.default.join(awmHome, 'registries', 'baseline');
+    const literal = shellSensitiveLiteral;
+    writeJson(path_1.default.join(project, 'package.json'), { name: 'structured-run-fixture', private: true });
+    // Local metadata is the compatibility evidence. It is not a tool found in a
+    // global installation, so init and run must keep resolving this fixture's pack.
+    writeJson(path_1.default.join(project, 'node_modules', 'fixture-sensor', 'package.json'), {
+        name: 'fixture-sensor', version: '1.0.0',
+    });
+    fs_1.default.writeFileSync(path_1.default.join(project, 'fixture-sensor.config.mjs'), 'export default {};\n');
+    fs_1.default.writeFileSync(path_1.default.join(project, 'fixture-sensor.mjs'), [
+        "import fs from 'fs';",
+        "fs.writeFileSync('structured-argv.json', JSON.stringify(process.argv.slice(2)));",
+    ].join('\n'));
+    writeJson(path_1.default.join(registryRoot, 'sensor-packs', 'fixture', 'pack.json'), {
+        schemaVersion: 2,
+        name: 'fixture',
+        description: 'compiled structured-run fixture',
+        detects: ['package.json'],
+        sensors: {
+            structured: {
+                applicability: { allFiles: ['package.json'] },
+                fast: true,
+                variants: [{
+                        id: 'fixture-v1', priority: 100,
+                        requirements: {
+                            tool: 'fixture-sensor', toolRange: '>=1 <2',
+                            runtime: 'node', runtimeRange: '>=20', configFiles: ['fixture-sensor.config.mjs'],
+                        },
+                        certifiedRange: '>=1 <2',
+                        // `node` is resolved from the process environment, but the actual
+                        // executable payload is the fixture-local script. Keeping the
+                        // literal as one argv element proves no shell parses it.
+                        command: { executable: 'node', resolution: 'path', args: ['fixture-sensor.mjs', literal] },
+                        assets: ['fixture-sensor.config.mjs'], formatter: 'generic', probe: { kind: 'config-present' },
+                    }],
+            },
+        },
+        coverage: {
+            schemaVersion: 1,
+            classes: {
+                'fixture-output': {
+                    description: 'fixture structured output', detectors: [{ sensor: 'structured' }],
+                    remedy: { summary: 'run the fixture sensor', command: 'awm sensors init --pack fixture' },
+                },
+            },
+        },
+    });
+    writeJson(path_1.default.join(awmHome, 'registries.json'), [{ name: 'baseline', remote: 'fixture' }]);
+    return { root, project, awmHome, registryRoot, literal };
+}
+function runCli(fixture, ...args) {
+    return (0, child_process_1.spawnSync)(process.execPath, [bin, 'sensors', ...args], {
+        cwd: fixture.project,
+        encoding: 'utf8',
+        env: { ...process.env, AWM_HOME: fixture.awmHome, AWM_NO_UPDATE_CHECK: '1' },
+    });
+}
+function assertSuccessfulCli(result, phase, requireStdout = false) {
+    const details = [
+        `status=${String(result.status)}`,
+        `signal=${String(result.signal)}`,
+        `error=${result.error ? `${result.error.name}: ${result.error.message}` : 'none'}`,
+        `stdout=${JSON.stringify(result.stdout ?? '')}`,
+        `stderr=${JSON.stringify(result.stderr ?? '')}`,
+    ].join('\n');
+    if (result.error || result.status !== 0 || result.signal !== null) {
+        throw new Error(`${phase} child process failed:\n${details}`);
+    }
+    if (requireStdout && !(result.stdout ?? '').trim()) {
+        throw new Error(`${phase} child process emitted no JSON:\n${details}`);
+    }
+}
+beforeAll(() => {
+    if (!fs_1.default.existsSync(bin))
+        throw new Error(`Structured sensor E2E requires the compiled CLI at ${bin}; run npm run build before this test.`);
+});
+test('compiled sensors run materializes a v2 registry command and passes its literal argv without a shell', () => {
+    const fixture = createFixture();
+    try {
+        const initialized = runCli(fixture, 'init', '--registry-root', fixture.registryRoot, '--pack', 'fixture', '--no-configure');
+        assertSuccessfulCli(initialized, 'init');
+        const manifest = JSON.parse(fs_1.default.readFileSync(path_1.default.join(fixture.project, '.awm', 'sensors.json'), 'utf8'));
+        expect(manifest).toMatchObject({
+            schemaVersion: 2,
+            pack: 'fixture',
+            sensors: { structured: { variantId: 'fixture-v1', command: { executable: 'node', resolution: 'path', args: ['fixture-sensor.mjs', fixture.literal] } } },
+        });
+        const result = runCli(fixture, 'run', '--fast');
+        assertSuccessfulCli(result, 'run --fast', true);
+        expect(JSON.parse(result.stdout)).toMatchObject({
+            overall: 'pass', sensors: [expect.objectContaining({ name: 'structured', status: 'pass' })],
+        });
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(fixture.project, 'structured-argv.json'), 'utf8'))).toEqual([fixture.literal]);
+        // A shell:true mutation executes the trailing `& node -e ...` (or fails to
+        // preserve argv); this sentinel is the side-effect half of the regression.
+        expect(fs_1.default.existsSync(path_1.default.join(fixture.project, 'structured-shell-injection'))).toBe(false);
+    }
+    finally {
+        fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+    }
+});

package/dist/tests/structural/active-documentation.test.js

@@ -0,0 +1,128 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const providers_1 = require("../../src/providers");
+const ROOT = path_1.default.resolve(__dirname, '../../..');
+const ACTIVE = [
+    'README.md',
+    'docs/README.md',
+    'docs/framework.md',
+    'docs/installation.md',
+    'docs/configuration.md',
+    'docs/project-setup.md',
+    'docs/agents-setup.md',
+    'docs/runbook.md',
+    'docs/cli-reference.md',
+    'docs/support-matrix.md',
+    'docs/architecture.md',
+    'docs/decisions.md',
+    'docs/guides/product-process.md',
+    'docs/guides/development-process.md',
+    'docs/guides/parallel-tracks.md',
+];
+const read = (file) => fs_1.default.readFileSync(path_1.default.join(ROOT, file), 'utf8');
+function slug(text) {
+    return text
+        .trim()
+        .toLowerCase()
+        .replace(/[`*_~]/g, '')
+        .replace(/[^\p{L}\p{N}\s-]/gu, '')
+        .replace(/\s+/g, '-')
+        .replace(/-+/g, '-');
+}
+function anchors(markdown) {
+    const seen = new Map();
+    const out = new Set();
+    for (const match of markdown.matchAll(/^#{1,6}\s+(.+)$/gm)) {
+        const base = slug(match[1]);
+        const count = seen.get(base) ?? 0;
+        seen.set(base, count + 1);
+        out.add(count === 0 ? base : `${base}-${count}`);
+    }
+    for (const match of markdown.matchAll(/<a\s+(?:name|id)="([^"]+)"/g))
+        out.add(match[1]);
+    return out;
+}
+function localLinks(markdown) {
+    return Array.from(markdown.matchAll(/(?<!!)\[[^\]]+\]\(([^)]+)\)/g), (m) => m[1])
+        .filter((target) => !/^(?:https?:|mailto:)/.test(target));
+}
+describe('active documentation contract', () => {
+    it('has one reachable active editorial set (R1, R11, R14.4)', () => {
+        const navigation = read('README.md') + read('docs/README.md');
+        for (const file of ACTIVE) {
+            expect(fs_1.default.existsSync(path_1.default.join(ROOT, file))).toBe(true);
+            if (file !== 'README.md' && file !== 'docs/README.md') {
+                expect(navigation).toContain(file.replace(/^docs\//, ''));
+            }
+        }
+    });
+    it('keeps every relative link and anchor valid (R14.1)', () => {
+        for (const source of ACTIVE) {
+            for (const raw of localLinks(read(source))) {
+                const [filePart, fragment] = raw.split('#');
+                const target = filePart
+                    ? path_1.default.resolve(path_1.default.dirname(path_1.default.join(ROOT, source)), decodeURI(filePart))
+                    : path_1.default.join(ROOT, source);
+                expect(fs_1.default.existsSync(target)).toBe(true);
+                if (fragment && target.endsWith('.md')) {
+                    expect(anchors(fs_1.default.readFileSync(target, 'utf8'))).toContain(decodeURI(fragment));
+                }
+            }
+        }
+    });
+    it('documents the two-stage boundary and official bundle scopes (R3, R8)', () => {
+        expect(read('docs/installation.md')).toContain('Prepare the machine');
+        expect(read('docs/project-setup.md')).toContain('Initialize a project');
+        expect(read('docs/configuration.md')).toContain('`dev` and `product`');
+        expect(read('docs/project-setup.md')).toContain('`frontend`');
+    });
+    it('documents every init provider and option (R5, R14.2)', () => {
+        const config = read('docs/configuration.md');
+        for (const agent of providers_1.AGENT_TARGETS) {
+            expect(config).toContain(`awm init --agent ${agent} --machine-only`);
+        }
+        for (const flag of ['--agent', '--machine-only', '--yes', '--json']) {
+            expect(config).toContain(`\`${flag}\``);
+        }
+    });
+    it('assigns canonical topics instead of copying provider paths (R12)', () => {
+        expect(read('docs/configuration.md')).toContain('[Support matrix](support-matrix.md)');
+        expect(read('docs/configuration.md')).not.toMatch(/~\/\.(?:claude|codex|cursor|gemini)/);
+    });
+    it('keeps generated provider support prose in the canonical language (R2)', () => {
+        const matrix = read('docs/support-matrix.md');
+        expect(matrix).toContain('### Where each artifact is installed');
+        expect(matrix).toContain('### Agent profiles, workflows, hooks, and context');
+        expect(matrix).not.toContain('Dónde aterriza cada artefacto');
+        expect(matrix).not.toContain('Perfiles de agente, workflows, hooks y contexto');
+    });
+    it('keeps R3 canonical documentation in English and reachable from the hub', () => {
+        const hub = read('docs/README.md');
+        expect(hub).toContain('decisions.md');
+        for (const file of [
+            'docs/framework.md', 'docs/configuration.md', 'docs/project-setup.md',
+            'docs/runbook.md', 'docs/cli-reference.md', 'docs/support-matrix.md',
+            'docs/architecture.md',
+        ]) {
+            expect(read(file)).not.toContain('### Metodología');
+        }
+    });
+    it('keeps provider tiers, registries, and hook targets technically precise (R2)', () => {
+        const matrix = read('docs/support-matrix.md');
+        const runbook = read('docs/runbook.md');
+        const cliReference = read('docs/cli-reference.md');
+        expect(matrix).toContain('Re-anchors process guidance');
+        expect(matrix).toContain('Only `awm sensors run` is an enforceable deterministic gate');
+        expect(runbook).toContain('A registry needs at least one content directory');
+        expect(runbook).toMatch(/`catalog\.json` is required only when the registry\s+publishes bundles/);
+        expect(cliReference).toContain('`claude-code` and `codex`');
+        expect(cliReference).toContain('`--agent` is an alias for `--target`');
+        expect(cliReference).toContain('`dev` and `product` baseline bundles');
+        expect(runbook).toContain('bundles/<bundle-name>/bundle.json');
+    });
+});

package/dist/tests/structural/async-entrypoint.test.js

@@ -0,0 +1,15 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const entrypoint = path_1.default.resolve(__dirname, '../../src/index.ts');
+describe('CLI async entrypoint contract', () => {
+    it('awaits Commander actions instead of starting them with parse()', () => {
+        const source = fs_1.default.readFileSync(entrypoint, 'utf8');
+        expect(source).toMatch(/program\.parseAsync\(\)\.catch\(/);
+        expect(source).not.toMatch(/\bprogram\.parse\(\);/);
+    });
+});

package/dist/tests/structural/jest-environment-is-isolated.test.js

@@ -4,6 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const os_1 = __importDefault(require("os"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
 describe('Jest environment isolation', () => {
     it('does not inherit the operator Codex home', () => {
         expect(process.env.CODEX_HOME).toBeUndefined();
@@ -11,4 +13,46 @@ describe('Jest environment isolation', () => {
     it('uses a suite-owned temporary directory', () => {
         expect(os_1.default.tmpdir()).toContain('awm-jest-');
     });
+    it('falls back to the system temp directory when the home cache is read-only', async () => {
+        const originalEnv = { ...process.env };
+        const fallback = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-jest-fallback-'));
+        try {
+            jest.resetModules();
+            jest.doMock('os', () => ({
+                ...jest.requireActual('os'),
+                homedir: () => '/readonly-home',
+                tmpdir: () => fallback,
+            }));
+            const actualFs = jest.requireActual('fs');
+            jest.doMock('fs', () => ({
+                ...actualFs,
+                mkdirSync: jest.fn((target, ...args) => {
+                    if (String(target).includes('readonly-home')) {
+                        return undefined;
+                    }
+                    return actualFs.mkdirSync(target, ...args);
+                }),
+                mkdtempSync: jest.fn((prefix, ...args) => {
+                    if (prefix.includes('readonly-home')) {
+                        const error = new Error('read-only');
+                        error.code = 'EROFS';
+                        throw error;
+                    }
+                    return actualFs.mkdtempSync(prefix, ...args);
+                }),
+            }));
+            const setup = require('../../jest.global-setup.js');
+            await expect(setup()).resolves.toBeUndefined();
+            expect(process.env.AWM_JEST_TMPDIR?.startsWith(path_1.default.join(fallback, 'awm-cache', 'awm-jest-'))).toBe(true);
+        }
+        finally {
+            jest.dontMock('fs');
+            jest.dontMock('os');
+            jest.resetModules();
+            for (const key of Object.keys(process.env))
+                delete process.env[key];
+            Object.assign(process.env, originalEnv);
+            fs_1.default.rmSync(fallback, { recursive: true, force: true });
+        }
+    });
 });