agentic-workflow-manager 8.1.3 → 8.1.5

package/dist/src/release/index.js

@@ -40,6 +40,7 @@ function parseArgs(argv) {
 }
 function realIO(repoRoot, cliDir) {
     const pkgPath = path_1.default.join(cliDir, 'package.json');
+    const lockPath = path_1.default.join(cliDir, 'package-lock.json');
     const changelogPath = path_1.default.join(repoRoot, 'CHANGELOG.md');
     const npmrcPath = path_1.default.join(cliDir, '.npmrc');
     return {
@@ -52,6 +53,18 @@ function realIO(repoRoot, cliDir) {
             pkg.version = v;
             fs_1.default.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
         },
+        // El round-trip JSON.parse/stringify preserva el orden de claves y el formato que
+        // npm escribe (2 espacios + newline final), asi que el diff de un bump son las dos
+        // lineas de version y nada mas — verificado sobre el lockfile real de este repo.
+        writeLockVersion: (v) => {
+            if (!fs_1.default.existsSync(lockPath))
+                return;
+            const lock = JSON.parse(fs_1.default.readFileSync(lockPath, 'utf8'));
+            lock.version = v;
+            if (lock.packages?.[''])
+                lock.packages[''].version = v;
+            fs_1.default.writeFileSync(lockPath, JSON.stringify(lock, null, 2) + '\n');
+        },
         readChangelog: () => (fs_1.default.existsSync(changelogPath) ? fs_1.default.readFileSync(changelogPath, 'utf8') : ''),
         writeChangelog: (c) => fs_1.default.writeFileSync(changelogPath, c),
         writeNpmrc: (token) => fs_1.default.writeFileSync(npmrcPath, `//registry.npmjs.org/:_authToken=${token}\n`),

package/dist/src/release/orchestrator.js

@@ -65,9 +65,10 @@ function release(opts, io) {
     }
     // aplicar
     io.writePackageVersion(version);
+    io.writeLockVersion(version);
     const section = (0, core_1.renderChangelog)(version, io.today(), commits);
     io.writeChangelog(section + '\n' + io.readChangelog());
-    io.run('git', ['add', 'cli/package.json', 'CHANGELOG.md']);
+    io.run('git', ['add', 'cli/package.json', 'cli/package-lock.json', 'CHANGELOG.md']);
     io.run('git', ['commit', '-m', `chore(release): v${version} [skip ci]`]);
     io.run('git', ['tag', '-a', `v${version}`, '-m', `v${version}`]);
     // OIDC mode: GitHub inyecta ACTIONS_ID_TOKEN_REQUEST_URL con id-token:write

package/dist/tests/commands/preflight/preflight.test.js

@@ -9,6 +9,7 @@ const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const checks_1 = require("../../../src/commands/preflight/checks");
 const preflight_1 = require("../../../src/commands/preflight");
+const run_1 = require("../../../src/commands/sensors/run");
 // Only `execSync` (used by `resolveOnPath` to check for `gh`/`glab`) is mocked — `git
 // remote get-url origin` runs for real via `execFileSync` against real tmpdir git repos,
 // same as every other check in this file exercises the real filesystem.
@@ -16,7 +17,12 @@ jest.mock('child_process', () => ({
     ...jest.requireActual('child_process'),
     execSync: jest.fn(),
 }));
+jest.mock('../../../src/commands/sensors/run', () => ({
+    ...jest.requireActual('../../../src/commands/sensors/run'),
+    runSensors: jest.fn(),
+}));
 const mockExecSync = child_process_1.execSync;
+const mockRunSensors = run_1.runSensors;
 /** Turn a tmpdir into a real git repo with (optionally) an `origin` remote. */
 function gitRepo(dir, remoteUrl) {
     (0, child_process_1.execFileSync)('git', ['init'], { cwd: dir, stdio: 'pipe' });
@@ -47,6 +53,50 @@ const make = (o) => { const d = project(o); dirs.push(d); return d; };
 afterAll(() => dirs.forEach(d => fs_1.default.rmSync(d, { recursive: true, force: true })));
 const check = (r, id) => r.checks.find(c => c.id === id);
 describe('preflight', () => {
+    afterEach(() => mockRunSensors.mockReset());
+    it('keeps default preflight static and does not dispatch sensors', async () => {
+        const dir = make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        });
+        await (0, checks_1.preflight)(dir);
+        expect(mockRunSensors).not.toHaveBeenCalled();
+    });
+    it('rejects an array passed as public preflight options before filesystem work', async () => {
+        await expect((0, checks_1.preflight)(process.cwd(), []))
+            .rejects.toThrow('preflight options must contain an optional boolean verifySensors');
+    });
+    it('requires an empirical sensor pass when verification is requested', async () => {
+        const dir = make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        });
+        mockRunSensors.mockResolvedValue({
+            overall: 'not_certified',
+            sensors: [{
+                    name: 'lint', status: 'inconclusive', errors: [], skipReason: 'timeout after 30000ms',
+                    execution: { timeoutMs: 30000, timeoutSource: 'project', elapsedMs: 30012, requestedScope: 'full', effectiveScope: 'full' },
+                }],
+        });
+        const report = await (0, checks_1.preflight)(dir, { verifySensors: true });
+        expect(mockRunSensors).toHaveBeenCalledWith({ cwd: dir, all: true });
+        expect(report.status).toBe('degraded');
+        expect(check(report, 'sensors-execution')).toMatchObject({
+            ok: false,
+            detail: expect.stringMatching(/lint.*30000ms.*elapsed.*timeout/i),
+        });
+    });
+    it('does not invent a sensor or timeout when empirical verification has no executed sensors', async () => {
+        const dir = make();
+        mockRunSensors.mockResolvedValue({ overall: 'not_certified', sensors: [] });
+        const report = await (0, checks_1.preflight)(dir, { verifySensors: true });
+        const execution = check(report, 'sensors-execution');
+        expect(execution).toMatchObject({
+            ok: false,
+            detail: 'sensor verdict was not_certified; no sensor established an empirical pass',
+        });
+        expect(execution.detail).not.toMatch(/timeout|elapsed|named sensor/i);
+        expect(execution.remedy).toContain('awm sensors init');
+        expect(execution.remedy).not.toContain('named sensor');
+    });
     it('reports not_configured when no sensor manifest exists', async () => {
         // The team-rollout case: a developer clones the repo and never runs
         // `awm sensors init`. Today nothing notices until an unattended run is already

package/dist/tests/commands/sensors/baseline.test.js

@@ -7,6 +7,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const baseline_1 = require("../../../src/commands/sensors/baseline");
+const result_1 = require("../../../src/commands/sensors/result");
 const err = (over = {}) => ({
     file: 'lib/a.ts', rule: 'TS2345', message: 'Argument of type X', ...over,
 });
@@ -76,6 +77,19 @@ describe('partition', () => {
         expect(newErrors).toHaveLength(0);
     });
 });
+describe('applyBaseline', () => {
+    it('applies the same baseline to structured findings (R2)', () => {
+        const finding = { file: 'src/a.ts', line: 1, message: 'x' };
+        const accepted = [(0, baseline_1.fingerprint)('lint', finding)];
+        expect((0, result_1.applyBaseline)({ name: 'lint', status: 'fail', errors: [finding] }, accepted))
+            .toMatchObject({ status: 'pass', baselineCount: 1, newCount: 0 });
+    });
+    test.each(['inconclusive', 'skipped'])('baseline never changes %s to pass (R2.1)', status => {
+        const finding = { file: 'src/a.ts', line: 1, message: 'fixture finding' };
+        const accepted = [(0, baseline_1.fingerprint)('lint', finding)];
+        expect((0, result_1.applyBaseline)({ name: 'lint', status, errors: [finding], skipReason: 'fixture' }, accepted).status).toBe(status);
+    });
+});
 describe('readBaseline / writeBaseline', () => {
     let cwd;
     beforeEach(() => { cwd = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-bl-')); });

package/dist/tests/commands/sensors/changed-windows.test.js

@@ -41,4 +41,7 @@ describe('applyChangedCmd — Windows quoting', () => {
         expect((0, changed_1.applyChangedCmd)('eslint {files}', ['report\\']))
             .toBe(`eslint "report\\\\"`);
     });
+    it('refuses unsafe filenames for legacy shell interpolation', () => {
+        expect((0, changed_1.changedScopeError)({ files: ['src/a&b.ts'] })).toMatch(/cmd\.exe metacharacter/);
+    });
 });

package/dist/tests/commands/sensors/compatibility/contract.test.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const contract_1 = require("../../../../src/commands/sensors/compatibility/contract");
+const timeout_1 = require("../../../../src/commands/sensors/compatibility/timeout");
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
@@ -43,6 +44,22 @@ function validPack() {
     };
 }
 describe('sensor pack v2 contract', () => {
+    it('exports bounded timeout validation and resolution (R3.1, R3.4)', () => {
+        expect((0, timeout_1.positiveTimeout)(1, 'sensor timeout')).toBe(1);
+        expect((0, timeout_1.resolveTimeout)({ project: 90_000, pack: 30_000, fast: true })).toEqual({ timeoutMs: 90_000, source: 'project' });
+        expect((0, timeout_1.resolveTimeout)({ pack: 30_000, fast: true })).toEqual({ timeoutMs: 30_000, source: 'pack' });
+        expect((0, timeout_1.resolveTimeout)({ fast: true })).toEqual({ timeoutMs: 10_000, source: 'fallback' });
+        expect((0, timeout_1.resolveTimeout)({ fast: false })).toEqual({ timeoutMs: 120_000, source: 'fallback' });
+    });
+    test.each([0, -1, 1.5, Number.MAX_SAFE_INTEGER + 1, '1000'])('rejects invalid resolved timeout %p (R3.3)', timeout => {
+        expect(() => (0, timeout_1.positiveTimeout)(timeout, 'sensor timeout')).toThrow(/sensor timeout.*positive safe integer/);
+        expect(() => (0, timeout_1.resolveTimeout)({ project: timeout, fast: true })).toThrow(/project timeout.*positive safe integer/);
+    });
+    it('rejects malformed timeout helper inputs loudly (R3.4)', () => {
+        expect(() => (0, timeout_1.positiveTimeout)(1000, '')).toThrow('timeout location must be a nonempty string');
+        expect(() => (0, timeout_1.resolveTimeout)(null)).toThrow('timeout resolution input is invalid');
+        expect(() => (0, timeout_1.resolveTimeout)({ fast: 'true' })).toThrow('timeout resolution input is invalid');
+    });
     it('derives Semgrep compatibility from a contained shared policy reference', () => {
         const sensorPacks = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-semgrep-policy-'));
         const packDir = path_1.default.join(sensorPacks, 'python');
@@ -79,6 +96,40 @@ describe('sensor pack v2 contract', () => {
     it('parses a valid versioned pack', () => {
         expect((0, contract_1.parseSensorPack)(validPack(), 'pack.json')).toMatchObject({ kind: 'v2', pack: validPack() });
     });
+    it('accepts one standalone files placeholder in changedCommand (R4)', () => {
+        const pack = validPack();
+        pack.sensors.lint.variants[0].changedCommand = {
+            executable: 'eslint', resolution: 'node-modules-bin',
+            args: ['--format', 'json', '{files}'],
+            fileInput: { placeholder: '{files}', extensions: ['.js', '.ts'] },
+        };
+        expect((0, contract_1.parseSensorPack)(pack, '/registry/sensor-packs/js-ts/pack.json')).toMatchObject({
+            kind: 'v2', pack: { sensors: { lint: { variants: [{ changedCommand: { args: ['--format', 'json', '{files}'] } }] } } },
+        });
+    });
+    test.each([
+        { args: ['{files}', '{files}'], fileInput: { placeholder: '{files}', extensions: ['.ts'] } },
+        { args: ['prefix-{files}'], fileInput: { placeholder: '{files}', extensions: ['.ts'] } },
+        { args: ['{files}'], fileInput: { placeholder: '{files}', extensions: [] } },
+    ])('rejects unsafe changedCommand %# (R4)', changedCommand => {
+        const pack = validPack();
+        pack.sensors.lint.variants[0].changedCommand = {
+            executable: 'eslint', resolution: 'node-modules-bin', ...changedCommand,
+        };
+        expect(() => (0, contract_1.parseSensorPack)(pack, '/registry/sensor-packs/js-ts/pack.json')).toThrow(/changedCommand|fileInput|\{files\}/);
+    });
+    test.each([0, -1, 1.5, Number.MAX_SAFE_INTEGER + 1, '1000'])('rejects pack sensor timeout %p (R3.3)', timeout => {
+        const pack = validPack();
+        pack.sensors.lint.timeout = timeout;
+        expect(() => (0, contract_1.parseSensorPack)(pack, '/registry/sensor-packs/js-ts/pack.json')).toThrow(/timeout.*positive safe integer/);
+    });
+    it('accepts an optional positive pack sensor timeout (R3.1)', () => {
+        const pack = validPack();
+        pack.sensors.lint.timeout = 30_000;
+        expect((0, contract_1.parseSensorPack)(pack, '/registry/sensor-packs/js-ts/pack.json')).toMatchObject({
+            kind: 'v2', pack: { sensors: { lint: { timeout: 30_000 } } },
+        });
+    });
     it('accepts an opt-in hardening asset while variants may require no assets', () => {
         const pack = {
             ...validPack(),

package/dist/tests/commands/sensors/compatibility/manifest.test.js

@@ -6,6 +6,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const manifest_1 = require("../../../../src/commands/sensors/compatibility/manifest");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+function validV2Manifest() {
+    return {
+        schemaVersion: 2,
+        pack: 'js-ts',
+        sensors: {
+            lint: {
+                enabled: true, variantId: 'eslint-9',
+                command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.', '--format', 'json'] },
+                initializedCompatibility: { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] },
+            },
+        },
+    };
+}
 describe('sensor manifest contract', () => {
     it('keeps compatibility contracts on an acyclic import boundary', () => {
         const source = (relative) => fs_1.default.readFileSync(path_1.default.join(__dirname, '../../../../src/commands/sensors', relative), 'utf8');
@@ -21,20 +34,23 @@ describe('sensor manifest contract', () => {
             } });
     });
     it('accepts a v2 selected variant and structured command', () => {
-        const manifest = {
-            schemaVersion: 2,
-            pack: 'js-ts',
-            sensors: {
-                lint: {
-                    enabled: true, variantId: 'eslint-9',
-                    command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.', '--format', 'json'] },
-                    initializedCompatibility: { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] },
-                },
-            },
-        };
+        const manifest = validV2Manifest();
         expect((0, manifest_1.parseSensorManifest)(manifest, 'sensors.json')).toMatchObject({ kind: 'v2', pack: manifest });
         expect(JSON.parse((0, manifest_1.serializeManifestV2)(manifest))).toEqual(manifest);
     });
+    it('accepts and serializes a positive v2 project timeout (R3)', () => {
+        const manifest = validV2Manifest();
+        manifest.sensors.lint.timeout = 45_000;
+        expect((0, manifest_1.parseSensorManifest)(manifest, '/project/.awm/sensors.json')).toMatchObject({
+            kind: 'v2', pack: { sensors: { lint: { timeout: 45_000 } } },
+        });
+        expect(JSON.parse((0, manifest_1.serializeManifestV2)(manifest))).toEqual(manifest);
+    });
+    test.each([0, -1, 1.5, Number.MAX_SAFE_INTEGER + 1, '1000'])('rejects v2 timeout %p before execution (R3.3)', timeout => {
+        const manifest = validV2Manifest();
+        manifest.sensors.lint.timeout = timeout;
+        expect(() => (0, manifest_1.parseSensorManifest)(manifest, '/project/.awm/sensors.json')).toThrow(/timeout.*positive safe integer/);
+    });
     it('persists only an explicit v2 pack selection as applicability provenance', () => {
         const manifest = {
             schemaVersion: 2, pack: 'generic', packSelection: 'explicit',

package/dist/tests/commands/sensors/compatibility/probe.test.js

@@ -1,7 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const probe_1 = require("../../../../src/commands/sensors/compatibility/probe");
-const fakeExecutor = jest.fn(async () => ({ code: 0, signal: null, timedOut: false, overflowed: false, stdout: 'SECRET_VALUE\nmatched', stderr: '' }));
+const execResult = (overrides = {}) => ({
+    code: 0,
+    signal: null,
+    timedOut: false,
+    overflowed: false,
+    elapsedMs: 0,
+    stdout: 'SECRET_VALUE\nmatched',
+    stderr: '',
+    ...overrides,
+});
+const fakeExecutor = jest.fn(async () => execResult());
 const evidence = { cwd: process.cwd(), configFiles: ['eslint.config.js'], scripts: ['lint'] };
 describe('runCompatibilityProbe', () => {
     beforeEach(() => fakeExecutor.mockClear());
@@ -11,9 +21,9 @@ describe('runCompatibilityProbe', () => {
         expect(JSON.stringify(result)).not.toContain('SECRET_VALUE');
     });
     it('never treats a timeout or overflow as a match', async () => {
-        fakeExecutor.mockResolvedValueOnce({ code: null, signal: 'SIGKILL', timedOut: true, overflowed: false, stdout: '', stderr: '' });
+        fakeExecutor.mockResolvedValueOnce(execResult({ code: null, signal: 'SIGKILL', timedOut: true, stdout: '' }));
         await expect((0, probe_1.runCompatibilityProbe)({ kind: 'version' }, evidence, fakeExecutor)).resolves.toMatchObject({ status: 'unverifiable' });
-        fakeExecutor.mockResolvedValueOnce({ code: 0, signal: null, timedOut: false, overflowed: true, stdout: 'ok', stderr: '' });
+        fakeExecutor.mockResolvedValueOnce(execResult({ overflowed: true, stdout: 'ok' }));
         await expect((0, probe_1.runCompatibilityProbe)({ kind: 'version' }, evidence, fakeExecutor)).resolves.toMatchObject({ status: 'unverifiable' });
     });
     it('binds tool probes to the project node_modules executable instead of PATH', async () => {

package/dist/tests/commands/sensors/exec-fixtures.js

@@ -6,7 +6,7 @@ exports.spawnFailed = exports.overflowed = exports.timedOut = exports.exited = e
  * mock the exec boundary rather than `child_process` directly: `runCommand`
  * never throws, so a mocked run is a value, not an exception.
  */
-const base = { stdout: '', stderr: '', code: null, signal: null, timedOut: false, overflowed: false };
+const base = { stdout: '', stderr: '', code: null, signal: null, timedOut: false, overflowed: false, elapsedMs: 0 };
 /** Clean run: exit 0. */
 const ok = (stdout = '') => ({ ...base, stdout, code: 0 });
 exports.ok = ok;

package/dist/tests/commands/sensors/exec.test.js

@@ -7,6 +7,17 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const exec_1 = require("../../../src/commands/sensors/exec");
+const result_1 = require("../../../src/commands/sensors/result");
+const sensor = (overrides = {}) => ({
+    name: 'lint',
+    command: { kind: 'legacy', value: 'node -e "setTimeout(() => {}, 1000)"' },
+    formatter: 'generic',
+    timeoutMs: 5_000,
+    timeoutSource: 'fallback',
+    requestedScope: 'full',
+    effectiveScope: 'full',
+    ...overrides,
+});
 const onPosix = process.platform !== 'win32' ? describe : describe.skip;
 const itPosix = process.platform !== 'win32' ? it : it.skip;
 /** Poll until `fn()` is true or the budget runs out. Avoids fixed sleeps. */
@@ -20,6 +31,12 @@ async function until(fn, budgetMs = 4000) {
     return fn();
 }
 describe('runCommand — exit codes and output', () => {
+    it('records bounded execution evidence on timeout (R3.2,R3.4,R7.1)', async () => {
+        const result = await (0, result_1.executePrepared)(sensor({ timeoutMs: 25, timeoutSource: 'project' }));
+        expect(result.status).toBe('inconclusive');
+        expect(result.execution).toMatchObject({ timeoutMs: 25, timeoutSource: 'project', effectiveScope: 'full' });
+        expect(result.execution.elapsedMs).toBeGreaterThanOrEqual(0);
+    });
     it('passes structured metacharacters literally without a shell', async () => {
         const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-exec-argv-'));
         const marker = path_1.default.join(dir, 'must-not-exist');

package/dist/tests/commands/sensors/index.test.js

@@ -15,18 +15,56 @@ const prompts_1 = require("@clack/prompts");
 const coverage_1 = require("../../../src/commands/sensors/coverage");
 const render_1 = require("../../../src/commands/sensors/coverage/render");
 const index_1 = require("../../../src/commands/sensors/index");
-describe('exitCodeFor — sensor run verdict → exit code', () => {
-    const base = (overall) => ({ sensors: [], overall });
-    it('pass → 0', () => expect((0, index_1.exitCodeFor)(base('pass'))).toBe(0));
-    it('skipped → 0', () => expect((0, index_1.exitCodeFor)(base('skipped'))).toBe(0));
-    it('not_certified → 0 (signal is in overall, not exit code)', () => expect((0, index_1.exitCodeFor)(base('not_certified'))).toBe(0));
-    it('fail → 1', () => expect((0, index_1.exitCodeFor)(base('fail'))).toBe(1));
+const verdict_1 = require("../../../src/commands/sensors/verdict");
+const processExit = jest.spyOn(process, 'exit').mockImplementation((() => undefined));
+const stdoutWrite = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+describe('exitCodeForVerdict — sensor run verdict → exit code', () => {
+    it.each([
+        ['pass', 0],
+        ['fail', 1],
+        ['skipped', 1],
+        ['not_certified', 1],
+    ])('%s → %i', (overall, code) => {
+        expect((0, verdict_1.exitCodeForVerdict)(overall)).toBe(code);
+    });
+});
+describe('sensors run Commander wiring', () => {
+    const originalExitCode = process.exitCode;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        process.exitCode = undefined;
+    });
+    afterAll(() => {
+        process.exitCode = originalExitCode;
+    });
+    const programWithSensors = () => {
+        const program = new commander_1.Command();
+        program.exitOverride();
+        (0, index_1.registerSensorsCommand)(program);
+        return program;
+    };
+    it.each([
+        ['pass', 0],
+        ['fail', 1],
+        ['skipped', 1],
+        ['not_certified', 1],
+    ])('writes full %s JSON before assigning exit code %i without process.exit', async (overall, code) => {
+        require('../../../src/commands/sensors/run').runSensors.mockResolvedValue({ sensors: [], overall });
+        const calls = [];
+        stdoutWrite.mockImplementation(() => {
+            calls.push(`stdout:${process.exitCode ?? 0}`);
+            return true;
+        });
+        await programWithSensors().parseAsync(['node', 'awm', 'sensors', 'run']);
+        expect(JSON.parse(String(stdoutWrite.mock.calls[0][0]))).toEqual({ sensors: [], overall });
+        expect(calls).toEqual(['stdout:0']);
+        expect(process.exitCode).toBe(code);
+        expect(processExit).not.toHaveBeenCalled();
+    });
 });
 describe('sensors coverage Commander wiring', () => {
     const report = { schemaVersion: 1, pack: 'js-ts', registry: 'baseline', overall: 'gaps',
         static: { status: 'gaps', reason: null, classes: [] } };
-    const stdoutWrite = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
-    const processExit = jest.spyOn(process, 'exit').mockImplementation((() => undefined));
     beforeEach(() => {
         jest.clearAllMocks();
         coverage_1.runCoverage.mockReturnValue(report);

package/dist/tests/commands/sensors/init.test.js

@@ -310,7 +310,7 @@ describe('initSensors', () => {
             const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8'));
             expect(explicit.manifest).toMatchObject({ schemaVersion: 2, pack: 'generic', packSelection: 'explicit', sensors: { security: { variantId: 'eslint-10' } } });
             expect(written.packSelection).toBe('explicit');
-            await expect((0, status_1.computeSensorStatus)(tmpDir)).resolves.toMatchObject({ overall: 'HEALTHY', checks: { security: { ok: true } } });
+            await expect((0, status_1.computeSensorStatus)(tmpDir)).resolves.toMatchObject({ overall: 'DEGRADED', checks: { security: { ok: false } } });
         }
         finally {
             fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
@@ -370,6 +370,35 @@ describe('initSensors', () => {
             fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
         }
     });
+    it('preserves only the project timeout override, never prior executable authority (R3, R10)', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            const manifestPath = path_1.default.join(tmpDir, '.awm', 'sensors.json');
+            const selected = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf8'));
+            selected.sensors.lint.timeout = 45_000;
+            selected.sensors.lint.command = {
+                executable: 'otherlint', resolution: 'path', args: ['--custom'],
+                environment: { ESLINT_USE_FLAT_CONFIG: 'false' },
+            };
+            selected.sensors.lint.assets = ['prior-owned.config'];
+            fs_1.default.writeFileSync(manifestPath, JSON.stringify(selected));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            const written = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf8'));
+            expect(written.sensors.lint).toMatchObject({
+                timeout: 45_000,
+                command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                assets: ['eslint.config.awm.mjs'],
+            });
+            expect(written.sensors.lint.command.environment).toBeUndefined();
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
     it('rejects a symlinked v2 pack source instead of reading it through init', async () => {
         const v2Registry = makeV2Registry();
         try {

package/dist/tests/commands/sensors/prepare.test.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const prepare_1 = require("../../../src/commands/sensors/prepare");
+const fullCommand = { executable: 'manifest-eslint', resolution: 'path', args: ['.'] };
+const changedCommand = {
+    executable: 'live-eslint',
+    resolution: 'path',
+    args: ['--format', 'json', '{files}'],
+    fileInput: { placeholder: '{files}', extensions: ['.ts'] },
+};
+function v2Input(overrides = {}) {
+    const liveVariant = {
+        id: 'eslint-live', priority: 1, certifiedRange: '>=1.0.0', requirements: { tool: 'eslint', toolRange: '>=1.0.0', runtime: 'node', runtimeRange: '>=1.0.0' }, assets: [],
+        probe: { kind: 'version' }, command: { executable: 'live-eslint', resolution: 'path', args: ['.'] }, changedCommand, formatter: 'eslint-llm',
+    };
+    return {
+        name: 'lint',
+        sensor: {
+            enabled: true, fast: false, variantId: 'eslint-live', command: fullCommand,
+            initializedCompatibility: { state: 'certified', reason: 'test', variantId: 'eslint-live', toolVersion: '1.0.0', runtimeVersion: '1.0.0', certifiedRange: '>=1.0.0', evidence: [] },
+        },
+        liveSensor: { applicability: {}, fast: false, timeout: 30_000, variants: [liveVariant] },
+        liveState: { state: 'certified', reason: 'test', variantId: 'eslint-live', toolVersion: '1.0.0', runtimeVersion: '1.0.0', certifiedRange: '>=1.0.0', evidence: [] },
+        changed: { files: ['src/a.ts'] },
+        requestedScope: 'changed',
+        projectTimeout: 90_000,
+        ...overrides,
+    };
+}
+describe('prepareV2Sensor', () => {
+    test('v2 uses the live command and project > pack > fallback timeout (R1.1, R3.1)', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input());
+        expect(prepared.command).toEqual({ kind: 'structured', value: { ...changedCommand, args: ['--format', 'json', 'src/a.ts'] } });
+        expect(prepared.timeoutMs).toBe(90_000);
+        expect(prepared.timeoutSource).toBe('project');
+        expect((0, prepare_1.prepareV2Sensor)(v2Input({ projectTimeout: undefined })).timeoutSource).toBe('pack');
+        const fallback = v2Input();
+        fallback.liveSensor.timeout = undefined;
+        fallback.liveSensor.fast = true;
+        fallback.sensor.fast = undefined;
+        expect((0, prepare_1.prepareV2Sensor)({ ...fallback, projectTimeout: undefined })).toMatchObject({ timeoutMs: 10_000, timeoutSource: 'fallback' });
+    });
+    test('expands changed paths as literal argv entries (R4.1, R10.2)', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input({ changed: { files: ['src/a b.ts', 'src/$x.ts'] } }));
+        expect(prepared.command).toEqual({ kind: 'structured', value: { ...changedCommand, args: ['--format', 'json', 'src/a b.ts', 'src/$x.ts'] } });
+        expect(prepared.effectiveScope).toBe('changed');
+    });
+    test('falls back full with an explicit reason without changedCommand (R4.2)', () => {
+        const input = v2Input();
+        input.liveSensor.variants[0].changedCommand = undefined;
+        const prepared = (0, prepare_1.prepareV2Sensor)(input);
+        expect(prepared.command).toEqual({ kind: 'structured', value: input.liveSensor.variants[0].command });
+        expect(prepared.effectiveScope).toBe('full');
+        expect(prepared.scopeReason).toMatch(/does not support changed scope/);
+    });
+    test('uses the full command with an explicit reason when the diff cannot resolve', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input({ changed: { files: [], error: 'git failed' } }));
+        expect(prepared.effectiveScope).toBe('full');
+        expect(prepared.scopeReason).toMatch(/could not be resolved: git failed/);
+    });
+    test('returns zero-file pass plan without a process (R4.4)', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input({ changed: { files: ['README.md'] } }));
+        expect(prepared).toMatchObject({ effectiveScope: 'changed', files: 0, syntheticStatus: 'pass' });
+        expect(prepared.command).toBeUndefined();
+    });
+    test('rejects an invalid requested scope before preparing a command', () => {
+        expect(() => (0, prepare_1.prepareV2Sensor)({ ...v2Input(), requestedScope: 'sideways' }))
+            .toThrow('requested scope must be "full" or "changed"');
+    });
+});
+describe('prepareLegacySensor', () => {
+    const originalPlatform = process.platform;
+    afterEach(() => Object.defineProperty(process, 'platform', { value: originalPlatform, configurable: true }));
+    test('falls back to the full command for an unsafe Windows filename', () => {
+        Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+        const prepared = (0, prepare_1.prepareLegacySensor)({
+            name: 'lint', config: { cmd: 'eslint .', changedCmd: 'eslint {files}' }, requestedScope: 'changed', changed: { files: ['src/a&b.ts'] },
+        });
+        expect(prepared).toMatchObject({ command: { kind: 'legacy', value: 'eslint .' }, effectiveScope: 'full' });
+        expect(prepared.scopeReason).toMatch(/cmd\.exe metacharacter/);
+    });
+});
+describe('validateRunOptions', () => {
+    test('rejects changed baseline capture before any scope preparation (R4.6)', () => {
+        expect(() => (0, prepare_1.validateRunOptions)({ changed: true, ignoreBaseline: true }))
+            .toThrow(/refusing to combine --changed with a baseline capture/);
+    });
+});

package/dist/tests/commands/sensors/router.test.js

@@ -4,7 +4,7 @@ jest.mock('@clack/prompts', () => ({ log: { success: jest.fn(), info: jest.fn()
 jest.mock('picocolors', () => ({ green: (s) => s, yellow: (s) => s, red: (s) => s }));
 jest.mock('../../../src/commands/sensors/run', () => ({ runSensors: jest.fn().mockReturnValue({ sensors: [], overall: 'pass' }) }));
 jest.mock('../../../src/commands/sensors/init', () => ({ initSensors: jest.fn().mockReturnValue({ detection: { pack: 'js-ts', indicators: [] }, manifest: { sensors: {} }, configured: [] }) }));
-jest.mock('../../../src/commands/sensors/status', () => ({ computeSensorStatus: jest.fn().mockReturnValue({ overall: 'HEALTHY', pack: 'js-ts', checks: {} }) }));
+jest.mock('../../../src/commands/sensors/status', () => ({ computeSensorStatus: jest.fn().mockReturnValue({ overall: 'READY', pack: 'js-ts', checks: {} }) }));
 jest.mock('../../../src/commands/sensors/install', () => ({ installSensorHook: jest.fn().mockReturnValue({ status: 'installed' }) }));
 const commander_1 = require("commander");
 const index_1 = require("../../../src/commands/sensors/index");
@@ -21,4 +21,18 @@ describe('registerSensorsCommand', () => {
         expect(subNames).toContain('install');
         expect(subNames).toContain('coverage');
     });
+    it('renders READY without claiming sensor execution, HEALTHY, or project certification', async () => {
+        const program = new commander_1.Command();
+        const output = jest.spyOn(console, 'log').mockImplementation(() => undefined);
+        try {
+            (0, index_1.registerSensorsCommand)(program);
+            await program.parseAsync(['node', 'awm', 'sensors', 'status']);
+            const rendered = output.mock.calls.flat().join('\n');
+            expect(rendered).toContain('READY');
+            expect(rendered).not.toMatch(/HEALTHY|certif/i);
+        }
+        finally {
+            output.mockRestore();
+        }
+    });
 });

package/dist/tests/commands/sensors/run-changed.test.js

@@ -84,12 +84,12 @@ describe('runSensors --changed', () => {
         expect(out.sensors[0].scope).toBeUndefined();
         expect(out.changedScope).toEqual({ files: 0, error: 'not a git repository' });
     });
-    it('skips an opted-in sensor when nothing changed, without touching the others', async () => {
+    it('records a clean synthetic pass when an opted-in sensor has no changed files, without touching the others', async () => {
         dir = project({ lint: LINT, typecheck: TYPECHECK });
         mockChangedFiles.mockReturnValue({ files: [] });
         const out = await load().runSensors({ cwd: dir, changed: true });
         const lint = out.sensors.find((s) => s.name === 'lint');
-        expect(lint.status).toBe('skipped');
+        expect(lint.status).toBe('pass');
         expect(lint.skipReason).toBe('no changed files in scope');
         expect(cmds()).toEqual(['tsc --noEmit']);
     });
@@ -101,13 +101,13 @@ describe('runSensors --changed', () => {
         await load().runSensors({ cwd: dir, changed: true });
         expect(cmds()).toEqual([`eslint --format json 'src/a.ts'`]);
     });
-    it('skips the sensor when the filter empties the scope, rather than running repo-wide', async () => {
+    it('records a clean synthetic pass when the filter empties the scope, rather than running repo-wide', async () => {
         // A docs-only commit means the lint sensor has nothing to say. Falling back to
         // the full command here would reintroduce exactly the cost --changed removes.
         dir = project({ lint: { ...LINT, changedExtensions: ['.ts'] }, typecheck: TYPECHECK });
         mockChangedFiles.mockReturnValue({ files: ['README.md'] });
         const out = await load().runSensors({ cwd: dir, changed: true });
-        expect(out.sensors.find((s) => s.name === 'lint').status).toBe('skipped');
+        expect(out.sensors.find((s) => s.name === 'lint').status).toBe('pass');
         expect(cmds()).toEqual(['tsc --noEmit']);
     });
     it('refuses a changedCmd without a {files} placeholder instead of running it repo-wide', async () => {