agentic-workflow-manager 8.0.0 → 8.1.1

package/dist/tests/commands/sensors/compatibility/resolve.test.js

@@ -12,6 +12,14 @@ const sensor = { applicability: { allFiles: ['package.json'] }, variants: [varia
 const evidence = (input = {}) => ({ paths: ['package.json'], applicable: true, packageManagerConflict: false, toolVersion: '10.4.1', runtimeVersion: '22.0.0', probe: { status: 'matched' }, ...input });
 const context = { pack: 'js-ts', sensor: 'lint' };
 describe('resolveSensorCompatibility', () => {
+    it('keeps an automatically selected generic pack not-applicable despite language markers', () => {
+        const resolved = (0, resolve_1.resolveSensorCompatibility)({ applicability: { kind: 'explicit-or-supported-language' }, variants: [variant('semgrep')] }, evidence({ applicable: undefined, paths: ['pyproject.toml'], toolVersion: '1.0.0', runtimeVersion: '3.12.0', probe: { status: 'matched' } }), { pack: 'generic', sensor: 'security' });
+        expect(resolved).toMatchObject({ state: 'not-applicable', reason: 'applicability-not-met' });
+    });
+    it('treats the persisted explicit generic pack selection as positive capability in project resolution', () => {
+        const resolved = (0, resolve_1.resolveProjectCompatibility)({ schemaVersion: 2, name: 'generic', sensors: { security: { applicability: { kind: 'explicit-or-supported-language' }, variants: [variant('semgrep')] } } }, evidence({ applicable: undefined, paths: [], packSelection: 'explicit' }));
+        expect(resolved.sensors.security.state).not.toBe('not-applicable');
+    });
     test.each([
         ['certified', evidence(), 'eslint-main'],
         ['compatible-unverified', evidence({ toolVersion: '11.0.0' }), 'eslint-main'],

package/dist/tests/commands/sensors/exec-windows.test.js

@@ -24,6 +24,12 @@ function fakeChild(pid = 4242) {
     child.unref = jest.fn();
     return child;
 }
+function restoreEnvironment(name, value) {
+    if (value === undefined)
+        delete process.env[name];
+    else
+        process.env[name] = value;
+}
 describe('runCommand — win32', () => {
     const originalPlatform = process.platform;
     beforeEach(() => {
@@ -58,11 +64,35 @@ describe('runCommand — win32', () => {
             expect(mockSpawn).toHaveBeenCalledWith(path_1.default.join(dir, 'tool.exe'), ['literal;&'], expect.objectContaining({ shell: false, detached: false }));
             child.emit('close', 0, null);
             await expect(pending).resolves.toMatchObject({ code: 0 });
-            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool.cmd', resolution: 'path', args: [] }, { timeout: 5000, cwd: dir })).toThrow(/wrappers/);
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool.cmd', resolution: 'path', args: ['--version'] }, { timeout: 5000, cwd: dir })).toThrow(/wrappers/);
+        }
+        finally {
+            restoreEnvironment('PATH', savedPath);
+            restoreEnvironment('PATHEXT', savedPathExt);
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    it('spawns the allowlisted flat-config environment for ESLint 8', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-structured-win-env-'));
+        const savedPath = process.env.PATH;
+        const savedPathExt = process.env.PATHEXT;
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(dir, 'tool.exe'), 'fixture');
+            process.env.PATH = dir;
+            process.env.PATHEXT = '.EXE';
+            const child = fakeChild();
+            mockSpawn.mockReturnValue(child);
+            const pending = (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'path', args: ['--version'], environment: { ESLINT_USE_FLAT_CONFIG: 'true' } }, { timeout: 5000, cwd: dir });
+            expect(mockSpawn).toHaveBeenCalledWith(path_1.default.join(dir, 'tool.exe'), ['--version'], expect.objectContaining({
+                shell: false,
+                env: expect.objectContaining({ ESLINT_USE_FLAT_CONFIG: 'true' }),
+            }));
+            child.emit('close', 0, null);
+            await expect(pending).resolves.toMatchObject({ code: 0 });
         }
         finally {
-            process.env.PATH = savedPath;
-            process.env.PATHEXT = savedPathExt;
+            restoreEnvironment('PATH', savedPath);
+            restoreEnvironment('PATHEXT', savedPathExt);
             fs_1.default.rmSync(dir, { recursive: true, force: true });
         }
     });
@@ -80,14 +110,14 @@ describe('runCommand — win32', () => {
             process.env.PATHEXT = '.EXE';
             const child = fakeChild();
             mockSpawn.mockReturnValue(child);
-            const pending = (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir });
-            expect(mockSpawn).toHaveBeenCalledWith(path_1.default.join(localBin, 'tool.exe'), [], expect.objectContaining({ shell: false }));
+            const pending = (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: ['--version'] }, { timeout: 5000, cwd: dir });
+            expect(mockSpawn).toHaveBeenCalledWith(path_1.default.join(localBin, 'tool.exe'), ['--version'], expect.objectContaining({ shell: false }));
             child.emit('close', 0, null);
             await expect(pending).resolves.toMatchObject({ code: 0 });
         }
         finally {
-            process.env.PATH = savedPath;
-            process.env.PATHEXT = savedPathExt;
+            restoreEnvironment('PATH', savedPath);
+            restoreEnvironment('PATHEXT', savedPathExt);
             fs_1.default.rmSync(dir, { recursive: true, force: true });
             fs_1.default.rmSync(global, { recursive: true, force: true });
         }
@@ -100,16 +130,34 @@ describe('runCommand — win32', () => {
             fs_1.default.writeFileSync(path_1.default.join(global, 'tool.exe'), 'global');
             process.env.PATH = global;
             mockSpawn.mockReturnValue(fakeChild());
-            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir }))
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: ['--version'] }, { timeout: 5000, cwd: dir }))
                 .toThrow(/node_modules.*not found locally/i);
             expect(mockSpawn).not.toHaveBeenCalled();
         }
         finally {
-            process.env.PATH = savedPath;
+            restoreEnvironment('PATH', savedPath);
             fs_1.default.rmSync(dir, { recursive: true, force: true });
             fs_1.default.rmSync(global, { recursive: true, force: true });
         }
     });
+    it('fails closed when PATHEXT contains no safe executable extension', () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-structured-win-pathext-'));
+        const savedPath = process.env.PATH;
+        const savedPathExt = process.env.PATHEXT;
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(dir, 'tool.cmd'), 'wrapper');
+            process.env.PATH = dir;
+            process.env.PATHEXT = '.CMD';
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'path', args: ['--version'] }, { timeout: 5000, cwd: dir }))
+                .toThrow(/safe Windows executable|PATHEXT/i);
+            expect(mockSpawn).not.toHaveBeenCalled();
+        }
+        finally {
+            restoreEnvironment('PATH', savedPath);
+            restoreEnvironment('PATHEXT', savedPathExt);
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    });
     it('rejects a missing Python environment executable instead of falling back to a same-named global command', () => {
         const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-missing-win-'));
         const global = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-global-win-'));
@@ -123,7 +171,7 @@ describe('runCommand — win32', () => {
             expect(mockSpawn).not.toHaveBeenCalled();
         }
         finally {
-            process.env.PATH = savedPath;
+            restoreEnvironment('PATH', savedPath);
             fs_1.default.rmSync(dir, { recursive: true, force: true });
             fs_1.default.rmSync(global, { recursive: true, force: true });
         }

package/dist/tests/commands/sensors/exec.test.js

@@ -27,7 +27,7 @@ describe('runCommand — exit codes and output', () => {
             const literal = `;touch ${marker}`;
             const received = path_1.default.join(dir, 'received');
             const result = await (0, exec_1.runStructuredCommand)({
-                executable: process.execPath,
+                executable: 'node',
                 resolution: 'path',
                 args: ['-e', "require('fs').writeFileSync(process.argv[1], process.argv[2])", received, literal],
             }, { timeout: 5000, cwd: dir });
@@ -130,6 +130,36 @@ describe('runCommand — spawn failure', () => {
         expect(r.code).not.toBe(0);
     });
 });
+describe('runStructuredCommand — public boundary validation', () => {
+    it.each(['sh', 'cmd.exe', '/usr/bin/node', 'nested/tool', 'nested\\tool'])('rejects unsafe executable %j before resolution', executable => {
+        expect(() => (0, exec_1.runStructuredCommand)({ executable, resolution: 'path', args: ['--version'] }, { timeout: 5000, cwd: process.cwd() }))
+            .toThrow(/safe executable name|shell/i);
+    });
+    it('normalizes package-manager spellings while requiring an equivalent explicit selection', () => {
+        expect(() => (0, exec_1.runStructuredCommand)({ executable: 'NPM.exe', resolution: 'path', args: ['--version'] }, { timeout: 5000, cwd: process.cwd() }))
+            .toThrow(/packageManager/);
+        expect(() => (0, exec_1.runStructuredCommand)({ executable: 'NPM.exe', resolution: 'path', args: ['--version'], packageManager: 'pnpm' }, { timeout: 5000, cwd: process.cwd() }))
+            .toThrow(/packageManager/);
+    });
+    it.each([
+        { ESLINT_USE_FLAT_CONFIG: 'invalid' },
+        { ESLINT_USE_FLAT_CONFIG: 'true', OTHER: 'value' },
+    ])('rejects an unknown or expanded environment mapping at the public boundary', environment => {
+        expect(() => (0, exec_1.runStructuredCommand)({ executable: 'node', resolution: 'path', args: ['--version'], environment }, { timeout: 5000, cwd: process.cwd() }))
+            .toThrow(/exact allowlisted/);
+    });
+    it.each([
+        [{ executable: 'node', resolution: 'path', args: [] }, /nonempty array/],
+        [{ executable: 'node', resolution: 'path', args: [''] }, /nonempty single-line/],
+        [{ executable: 'node', resolution: 'path', args: ['one\ntwo'] }, /single-line/],
+        [{ executable: 'node', resolution: 'path', args: ['{files}'] }, /requires fileInput/],
+        [{ executable: 'node', resolution: 'path', args: ['prefix{files}'], fileInput: { placeholder: '{files}', extensions: ['.ts'] } }, /must not embed/],
+        [{ executable: 'node', resolution: 'path', args: ['{files}', '{files}'], fileInput: { placeholder: '{files}', extensions: ['.ts'] } }, /exactly one/],
+        [{ executable: 'node', resolution: 'path', args: ['--check'], fileInput: { placeholder: '{files}', extensions: ['.ts'] } }, /exactly one/],
+    ])('rejects malformed args or file input at the public boundary', (command, message) => {
+        expect(() => (0, exec_1.runStructuredCommand)(command, { timeout: 5000, cwd: process.cwd() })).toThrow(message);
+    });
+});
 onPosix('runStructuredCommand — local node_modules binaries', () => {
     it('follows an npm-style contained shim but rejects one escaping node_modules', async () => {
         const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-local-bin-symlink-'));
@@ -143,11 +173,11 @@ onPosix('runStructuredCommand — local node_modules binaries', () => {
             fs_1.default.writeFileSync(outside, '#!/bin/sh\necho outside\n', { mode: 0o755 });
             fs_1.default.mkdirSync(bin, { recursive: true });
             fs_1.default.symlinkSync('../tool/bin/tool', path_1.default.join(bin, 'tool'));
-            await expect((0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir }))
+            await expect((0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: ['--version'] }, { timeout: 5000, cwd: dir }))
                 .resolves.toMatchObject({ code: 0, stdout: 'contained\n' });
             fs_1.default.unlinkSync(path_1.default.join(bin, 'tool'));
             fs_1.default.symlinkSync(outside, path_1.default.join(bin, 'tool'));
-            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir }))
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: ['--version'] }, { timeout: 5000, cwd: dir }))
                 .toThrow(/node_modules.*contain|local/i);
         }
         finally {
@@ -156,6 +186,24 @@ onPosix('runStructuredCommand — local node_modules binaries', () => {
     });
 });
 onPosix('runStructuredCommand — Python environments', () => {
+    it.each(['.venv', 'venv'])('rejects a symlinked %s ancestor instead of executing outside the project', environment => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-ancestor-'));
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-outside-'));
+        const marker = path_1.default.join(dir, 'must-not-exist');
+        try {
+            const executable = path_1.default.join(outside, 'bin', 'semgrep');
+            fs_1.default.mkdirSync(path_1.default.dirname(executable), { recursive: true });
+            fs_1.default.writeFileSync(executable, `#!/bin/sh\ntouch ${marker}\n`, { mode: 0o755 });
+            fs_1.default.symlinkSync(outside, path_1.default.join(dir, environment));
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'semgrep', resolution: 'python-environment', pythonEnvironmentRoot: environment, args: ['--validate'] }, { timeout: 5000, cwd: dir }))
+                .toThrow(/python.*environment.*local|contained/i);
+            expect(fs_1.default.existsSync(marker)).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
     it('rejects a missing project Python executable instead of falling back to PATH', () => {
         const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-missing-'));
         const global = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-global-'));

package/dist/tests/commands/sensors/init.test.js

@@ -7,6 +7,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const init_1 = require("../../../src/commands/sensors/init");
+const status_1 = require("../../../src/commands/sensors/status");
 // Build a throwaway registry with a js-ts pack.json (the single source of truth
 // init now reads from). `defaultCmd` uses the {{SOURCE_DIRS}} placeholder for depcheck.
 function makeRegistry() {
@@ -45,9 +46,11 @@ function makeV2Registry() {
     const packDir = path_1.default.join(registryRoot, 'sensor-packs', 'js-ts');
     fs_1.default.mkdirSync(packDir, { recursive: true });
     fs_1.default.writeFileSync(path_1.default.join(packDir, 'eslint.config.awm.mjs'), 'export default []\n');
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'tsconfig.awm.json'), '{ "compilerOptions": { "strict": true } }\n');
     fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
         schemaVersion: 2, name: 'js-ts', description: 'fixture', detects: ['package.json'],
         coverage: { schemaVersion: 1, classes: { lint: { description: 'lint', detectors: [{ sensor: 'lint' }], remedy: { summary: 'fix lint', command: 'awm sensors init --pack js-ts' } } } },
+        hardening: { 'typescript-strict': { assets: ['tsconfig.awm.json'] } },
         sensors: { lint: { applicability: { allFiles: ['package.json'] }, variants: [{
                         id: 'eslint-10', priority: 10, certifiedRange: '>=10.0.0 <11.0.0',
                         requirements: { tool: 'eslint', toolRange: '>=10.0.0 <11.0.0', runtime: 'node', runtimeRange: '>=0.0.0' },
@@ -57,6 +60,23 @@ function makeV2Registry() {
     }));
     return registryRoot;
 }
+function makeGenericV2Registry() {
+    const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-reg-generic-v2-'));
+    const packDir = path_1.default.join(registryRoot, 'sensor-packs', 'generic');
+    fs_1.default.mkdirSync(packDir, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'generic.config'), 'fixture\n');
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
+        schemaVersion: 2, name: 'generic', description: 'fixture', detects: ['README.md'],
+        coverage: { schemaVersion: 1, classes: { security: { description: 'security', detectors: [{ sensor: 'security' }], remedy: { summary: 'run security', command: 'awm sensors init --pack generic' } } } },
+        sensors: { security: { applicability: { kind: 'explicit-or-supported-language' }, variants: [{
+                        id: 'eslint-10', priority: 10, certifiedRange: '>=10.0.0 <11.0.0',
+                        requirements: { tool: 'eslint', toolRange: '>=10.0.0 <11.0.0', runtime: 'node', runtimeRange: '>=0.0.0', configFiles: ['generic.config'] },
+                        assets: ['generic.config'], formatter: 'eslint-llm', probe: { kind: 'config-present' },
+                        command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                    }] } },
+    }));
+    return registryRoot;
+}
 describe('detectStack', () => {
     let tmpDir;
     beforeEach(() => { tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-')); });
@@ -277,6 +297,58 @@ describe('initSensors', () => {
             fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
         }
     });
+    it('persists an explicit generic selection for live revalidation without promoting automatic generic fallback', async () => {
+        const v2Registry = makeGenericV2Registry();
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            const automatic = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, configure: false });
+            expect(automatic.manifest).toMatchObject({ schemaVersion: 2, pack: 'generic', sensors: {} });
+            expect(automatic.manifest.packSelection).toBeUndefined();
+            const explicit = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, pack: 'generic' });
+            const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8'));
+            expect(explicit.manifest).toMatchObject({ schemaVersion: 2, pack: 'generic', packSelection: 'explicit', sensors: { security: { variantId: 'eslint-10' } } });
+            expect(written.packSelection).toBe('explicit');
+            await expect((0, status_1.computeSensorStatus)(tmpDir)).resolves.toMatchObject({ overall: 'HEALTHY', checks: { security: { ok: true } } });
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('never materializes an opt-in hardening asset during ordinary v2 init', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'))).toBe(true);
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'tsconfig.awm.json'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('initializes a selected v2 variant with an explicitly empty assets list', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            const packPath = path_1.default.join(v2Registry, 'sensor-packs', 'js-ts', 'pack.json');
+            const pack = JSON.parse(fs_1.default.readFileSync(packPath, 'utf8'));
+            pack.sensors.lint.variants[0].assets = [];
+            fs_1.default.writeFileSync(packPath, JSON.stringify(pack));
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await expect((0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry })).resolves.toMatchObject({
+                manifest: { schemaVersion: 2, sensors: { lint: { assets: [] } } },
+                configured: [],
+            });
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
     it('preserves enabled and fast choices when a valid v2 manifest is re-initialized', async () => {
         const v2Registry = makeV2Registry();
         try {

package/dist/tests/integration/preflight-json-pipe.e2e.test.js

@@ -0,0 +1,26 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const cliRoot = path_1.default.resolve(__dirname, '../..');
+const bin = path_1.default.join(cliRoot, 'dist', 'src', 'index.js');
+test('preserves degraded preflight JSON when stdout is piped', () => {
+    const project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-pipe-'));
+    try {
+        const result = (0, child_process_1.spawnSync)(process.execPath, [bin, 'preflight', '--json'], {
+            cwd: project,
+            encoding: 'utf8',
+            env: { ...process.env, AWM_HOME: path_1.default.join(project, 'awm-home'), AWM_NO_UPDATE_CHECK: '1' },
+        });
+        expect(result.status).toBe(1);
+        expect(JSON.parse(result.stdout)).toMatchObject({ status: 'not_configured' });
+    }
+    finally {
+        fs_1.default.rmSync(project, { recursive: true, force: true });
+    }
+});

package/dist/tests/structural/r3-cli-major-version.test.js

@@ -8,7 +8,7 @@ const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const CLI_ROOT = path_1.default.resolve(__dirname, '../..');
 const DIST_ENTRYPOINT = path_1.default.join(CLI_ROOT, 'dist', 'src', 'index.js');
-const TARGET_VERSION = '7.0.0';
+const R3_MAJOR_VERSION = 8;
 function readJson(file) {
     return JSON.parse(fs_1.default.readFileSync(path_1.default.join(CLI_ROOT, file), 'utf8'));
 }
@@ -22,16 +22,18 @@ function runCompiledCli(...args) {
     return `${result.stdout}${result.stderr}`;
 }
 describe('R3 public major CLI release contract', () => {
-    it('declares 7.0.0 consistently in package metadata and the lockfile root', () => {
+    it('retains the R3 major version consistently in package metadata and the lockfile root', () => {
         const pkg = readJson('package.json');
         const lock = readJson('package-lock.json');
         const root = lock.packages[''];
-        expect(pkg.version).toBe(TARGET_VERSION);
-        expect(lock.version).toBe(TARGET_VERSION);
-        expect(root.version).toBe(TARGET_VERSION);
+        const version = pkg.version;
+        expect(typeof version).toBe('string');
+        expect(version).toMatch(new RegExp(`^${R3_MAJOR_VERSION}\\.`));
+        expect(lock.version).toBe(version);
+        expect(root.version).toBe(version);
     });
-    it('exposes 7.0.0 from the compiled CLI while retaining its help banner', () => {
-        expect(runCompiledCli('--version').trim()).toBe(TARGET_VERSION);
+    it('exposes the package version from the compiled CLI while retaining its help banner', () => {
+        expect(runCompiledCli('--version').trim()).toBe(readJson('package.json').version);
         expect(runCompiledCli('--help')).toContain('Usage: awm');
     });
 });

package/dist/tests/structural/support-matrix-is-current.test.js

@@ -16,10 +16,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // Este test hace que ese desvio sea imposible de mergear. No verifica que la tabla sea
 // "linda": verifica que sea LA MISMA que produce el codigo hoy.
 const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 const support_matrix_1 = require("../../scripts/support-matrix");
 const sensor_support_matrix_1 = require("../../scripts/sensor-support-matrix");
 const SENSOR_FIXTURE_REGISTRY = path_1.default.join(__dirname, '..', 'fixtures', 'sensor-support-matrix', 'registry');
+const CI_WORKFLOW_PATH = path_1.default.resolve(__dirname, '../../..', '.github', 'workflows', 'ci.yml');
 describe('docs/support-matrix.md refleja el codigo', () => {
     it('el bloque generado esta al dia', () => {
         const doc = fs_1.default.readFileSync(support_matrix_1.DOC_PATH, 'utf-8');
@@ -33,17 +36,76 @@ describe('docs/support-matrix.md refleja el codigo', () => {
         expect(doc).toContain(support_matrix_1.BEGIN_MARKER);
         expect(doc).toContain(support_matrix_1.END_MARKER);
     });
-    it('the generated pre-publication v2 sensor-pack contract fixture is current', () => {
+    it('keeps the generated pre-publication v2 fixture separately renderable', () => {
         const doc = fs_1.default.readFileSync(support_matrix_1.DOC_PATH, 'utf-8');
+        const fixture = (0, sensor_support_matrix_1.renderSensorSupportMatrix)(SENSOR_FIXTURE_REGISTRY);
+        expect(fixture).toContain(sensor_support_matrix_1.R3_PREPUBLICATION_FIXTURE_PURPOSE);
+        expect(fixture).toContain('not the published `awm-baseline-registry` manifests');
+        expect(fixture).not.toContain('Published certification evidence');
         expect(doc).toContain(sensor_support_matrix_1.SENSOR_BEGIN_MARKER);
         expect(doc).toContain(sensor_support_matrix_1.SENSOR_END_MARKER);
-        expect(doc).toContain(sensor_support_matrix_1.R3_PREPUBLICATION_FIXTURE_PURPOSE);
-        expect(doc).toContain('not the published `awm-baseline-registry` manifests');
-        expect(doc).toBe((0, sensor_support_matrix_1.spliceSensorSupportMatrix)(doc, (0, sensor_support_matrix_1.renderSensorSupportMatrix)(SENSOR_FIXTURE_REGISTRY)));
+        expect(doc).toContain('published registry evidence');
+        expect(doc).toContain('Published certification evidence');
     });
-    it('pins the documentation generator to the declared R3 pre-publication fixture', () => {
+    it('uses a published registry root for documentation and retains a fixture-only command', () => {
         const packageJson = JSON.parse(fs_1.default.readFileSync(path_1.default.join(__dirname, '..', '..', 'package.json'), 'utf8'));
-        expect(packageJson.scripts?.['docs:matrix']).toContain(`--registry-root ${sensor_support_matrix_1.R3_PREPUBLICATION_FIXTURE_RELATIVE_PATH}`);
+        expect(packageJson.scripts?.['docs:matrix']).toContain('--registry-root ../../awm-baseline-registry');
+        expect(packageJson.scripts?.['docs:matrix:prepublication']).toContain(`--registry-root ${sensor_support_matrix_1.R3_PREPUBLICATION_FIXTURE_RELATIVE_PATH}`);
+    });
+    it('CI regenerates the published matrix from the immutable registry tag', () => {
+        const workflow = fs_1.default.readFileSync(CI_WORKFLOW_PATH, 'utf8');
+        expect(workflow).toContain('repository: Kodria/awm-baseline-registry');
+        expect(workflow).toContain('ref: v2.0.0');
+        expect(workflow).toContain('path: awm-baseline-registry');
+        expect(workflow).toContain('Verify published sensor support matrix');
+        expect(workflow).toContain('--registry-root ../awm-baseline-registry --registry-tag v2.0.0 --registry-commit c35c087a0801c0b4e69e0a4ac3eafef9ecdf37cd');
+        expect(workflow).toContain('git diff --exit-code -- docs/support-matrix.md');
+    });
+    it('retains the published registry certification rows verbatim instead of inventing fixture evidence', () => {
+        const publishedSupport = [
+            '# Sensor pack support',
+            '',
+            '<!-- BEGIN GENERATED: sensor-pack-support -->',
+            'Generated from pack manifests and certification pins resolved at `2026-08-14T22:14:34.365Z`.',
+            '',
+            'Status: `certified` has a matching frozen tool pin; `compatible-unverified` has no matching frozen pin; `not-applicable` is reserved for variants without a tool contract.',
+            '',
+            '| Pack | Sensor | Variant | Tool | Certified range | Supported OS | OS certification evidence | Status | Evidence |',
+            '| --- | --- | --- | --- | --- | --- | --- | --- | --- |',
+            '| `js-ts` | `lint` | `eslint-10-flat` | `eslint` | `=10.8.1` | Ubuntu, macOS, Windows | Ubuntu/macOS/Windows: contract | certified | pin: `eslint@10.8.1` |',
+            '| `js-ts` | `test` | `npm-script` | `npm` | `>=8.0.0` | Ubuntu, macOS, Windows | Ubuntu/macOS/Windows: contract | compatible-unverified | no matching pinned tool |',
+            '',
+            '| Certification status | Derived variant count | Meaning |',
+            '| --- | --- | --- |',
+            '| certified | 15 | Matching frozen tool pin |',
+            '| compatible-unverified | 6 | No matching frozen tool pin |',
+            '| not-applicable | 0 | Variant has no tool contract |',
+            '<!-- END GENERATED: sensor-pack-support -->',
+            '',
+        ].join('\n');
+        expect((0, sensor_support_matrix_1.extractPublishedSupportMetadata)(publishedSupport)).toContain('`eslint-10-flat`');
+        expect((0, sensor_support_matrix_1.extractPublishedSupportMetadata)(publishedSupport)).toContain('compatible-unverified');
+        expect((0, sensor_support_matrix_1.extractPublishedSupportMetadata)(publishedSupport)).not.toContain('Fixture-declared ranges only');
+    });
+    it('rejects a mutable checkout even when it contains the published v2.0.0 tag', () => {
+        const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-published-registry-'));
+        const git = (...args) => (0, child_process_1.execFileSync)('git', ['-C', registryRoot, ...args], { stdio: 'pipe' });
+        try {
+            git('init');
+            git('config', 'user.email', 'test@example.com');
+            git('config', 'user.name', 'AWM test');
+            fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'published.txt'), 'published\n');
+            git('add', '.');
+            git('commit', '-m', 'published registry');
+            git('tag', 'v2.0.0');
+            fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'mutable.txt'), 'newer checkout\n');
+            git('add', '.');
+            git('commit', '-m', 'mutable checkout');
+            expect(() => (0, sensor_support_matrix_1.verifyPublishedRegistryIdentity)(registryRoot, 'v2.0.0', 'c35c087a0801c0b4e69e0a4ac3eafef9ecdf37cd')).toThrow(/HEAD .*expected commit/i);
+        }
+        finally {
+            fs_1.default.rmSync(registryRoot, { recursive: true, force: true });
+        }
     });
     it('la tabla nombra a los seis providers declarados', () => {
         // Que el bloque este "al dia" no sirve si el generador se olvidara de un provider:
@@ -156,6 +218,16 @@ describe('docs/support-matrix.md refleja el codigo', () => {
         expect(out).toContain('linea uno\r\nlinea dos');
         expect(out.split('\r\n').length - 1).toBe(out.split('\n').length - 1); // ni un LF suelto
     });
+    it('preserva el EOL del bloque de providers aunque otro bloque sea CRLF', () => {
+        const mixedDoc = `intro\r\n${support_matrix_1.BEGIN_MARKER}\nold\n${support_matrix_1.END_MARKER}\nfin\n`;
+        const out = (0, support_matrix_1.spliceGenerated)(mixedDoc, 'linea uno\nlinea dos');
+        expect(out).toContain(`${support_matrix_1.BEGIN_MARKER}\n\nlinea uno\nlinea dos\n\n${support_matrix_1.END_MARKER}`);
+    });
+    it('preserva el EOL del bloque de sensores aunque otro bloque sea CRLF', () => {
+        const mixedDoc = `intro\r\n${sensor_support_matrix_1.SENSOR_BEGIN_MARKER}\nold\n${sensor_support_matrix_1.SENSOR_END_MARKER}\nfin\n`;
+        const out = (0, sensor_support_matrix_1.spliceSensorSupportMatrix)(mixedDoc, 'linea uno\nlinea dos');
+        expect(out).toContain(`${sensor_support_matrix_1.SENSOR_BEGIN_MARKER}\n\nlinea uno\nlinea dos\n\n${sensor_support_matrix_1.SENSOR_END_MARKER}`);
+    });
     it('marks an unsupported scope rather than leaving it absent', () => {
         // La diferencia entre "no soportado" y una celda vacia es exactamente lo que el
         // documento existe para no dejar ambiguo: Copilot no tiene scope global por

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "8.0.0",
+  "version": "8.1.1",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -27,7 +27,8 @@
     "release": "node dist/src/release/index.js",
     "prepack": "npm run build",
     "prepublishOnly": "npm run build",
-    "docs:matrix": "ts-node scripts/support-matrix.ts && ts-node scripts/sensor-support-matrix.ts --registry-root tests/fixtures/sensor-support-matrix/registry"
+    "docs:matrix": "ts-node scripts/support-matrix.ts && ts-node scripts/sensor-support-matrix.ts --registry-root ../../awm-baseline-registry --registry-tag v2.0.0 --registry-commit c35c087a0801c0b4e69e0a4ac3eafef9ecdf37cd",
+    "docs:matrix:prepublication": "ts-node scripts/sensor-support-matrix.ts --registry-root tests/fixtures/sensor-support-matrix/registry --prepublication-fixture --stdout"
   },
   "keywords": [
     "agentic",