agentic-workflow-manager 8.1.4 → 8.1.6

package/dist/src/commands/preflight/checks.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSensorExecution = checkSensorExecution;
 exports.preflight = preflight;
 const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
@@ -10,6 +11,7 @@ const path_1 = __importDefault(require("path"));
 const status_1 = require("../sensors/status");
 const init_1 = require("../sensors/init");
 const baseline_1 = require("../sensors/baseline");
+const run_1 = require("../sensors/run");
 const paths_1 = require("../../core/paths");
 const MANIFEST = path_1.default.join('.awm', 'sensors.json');
 /**
@@ -193,6 +195,67 @@ function checkSensorsBaseline(cwd, manifest) {
             + 'so the gate only chases new problems',
     };
 }
+/**
+ * Empirical diagnostics intentionally name only stable execution facts. Sensor output
+ * can include source, environment values, or tool-specific unbounded text; preflight
+ * is a phase gate, not a log transport, so none of that crosses this boundary.
+ */
+function executionReason(sensor) {
+    const reason = sensor.skipReason ?? sensor.incomplete ?? '';
+    if (/^timeout after \d+ms/.test(reason))
+        return 'timeout';
+    if (/^output exceeded \d+ bytes/.test(reason))
+        return 'output limit exceeded';
+    const exit = /^exit (\d+):/.exec(reason);
+    if (exit)
+        return `exit ${exit[1]} without parseable findings`;
+    if (sensor.status === 'fail')
+        return 'reported findings or an actionable execution failure';
+    if (sensor.status === 'skipped')
+        return 'not applicable to this execution';
+    return 'execution did not establish a conclusive result';
+}
+function renderExecutionFailure(output) {
+    const failed = output.sensors.filter(sensor => sensor.status !== 'pass');
+    if (failed.length === 0)
+        return `sensor verdict was ${output.overall}; no sensor established an empirical pass`;
+    return failed.map(sensor => {
+        const evidence = sensor.execution;
+        if (!evidence)
+            return `${sensor.name} (${sensor.status}): no bounded execution evidence; ${executionReason(sensor)}`;
+        return `${sensor.name} (${sensor.status}): timeout ${evidence.timeoutMs}ms (${evidence.timeoutSource}), `
+            + `elapsed ${evidence.elapsedMs}ms; ${executionReason(sensor)}`;
+    }).join('; ');
+}
+function executionRemedy(output) {
+    if (output.sensors.every(sensor => sensor.status === 'pass')) {
+        return 'configure at least one runnable sensor with `awm sensors init`, then rerun `awm preflight --verify-sensors`';
+    }
+    return 'diagnose the named sensor; if a healthy progressing run needs longer, set a finite sensor timeout and rerun `awm preflight --verify-sensors`';
+}
+/** Run the full read-only sensor gate and reject every verdict except `pass`. */
+async function checkSensorExecution(cwd) {
+    try {
+        const output = await (0, run_1.runSensors)({ cwd, all: true });
+        if (output.overall === 'pass') {
+            return { id: 'sensors-execution', ok: true, detail: 'all selected sensors completed with pass' };
+        }
+        return {
+            id: 'sensors-execution',
+            ok: false,
+            detail: renderExecutionFailure(output),
+            remedy: executionRemedy(output),
+        };
+    }
+    catch {
+        // Fail closed without relaying an arbitrary tool/configuration error to JSON.
+        return {
+            id: 'sensors-execution', ok: false,
+            detail: 'sensor execution could not establish an empirical verdict',
+            remedy: 'repair the sensor configuration, then rerun `awm preflight --verify-sensors`',
+        };
+    }
+}
 /**
  * Extract just the hostname portion of a git remote URL — never match against the
  * full URL string. A bare substring check against the whole remote (`remote.includes
@@ -276,7 +339,10 @@ function checkHost(cwd) {
     // Bitbucket, Azure DevOps, an internal git server, etc. — don't overclaim support.
     return { id: 'host', ok: true, detail: 'git host not recognized (github/gitlab) — PR/MR automation not applicable' };
 }
-async function preflight(cwd = process.cwd()) {
+async function preflight(cwd = process.cwd(), opts = {}) {
+    if (!opts || typeof opts !== 'object' || Array.isArray(opts) || (opts.verifySensors !== undefined && typeof opts.verifySensors !== 'boolean')) {
+        throw new Error('preflight options must contain an optional boolean verifySensors');
+    }
     const manifest = readManifest(cwd);
     const manifestExists = fs_1.default.existsSync(path_1.default.join(cwd, MANIFEST));
     const checks = [
@@ -286,6 +352,9 @@ async function preflight(cwd = process.cwd()) {
         // a baseline that has nothing to snapshot) on a repo that was never set up
         // buries the one thing the operator needs to read.
         ...(manifestExists ? [await checkTools(cwd), checkPack(cwd, manifest), checkSensorsBaseline(cwd, manifest)] : []),
+        // The empirical mode is intentionally opt-in: ordinary preflight remains a
+        // quick static inspection and must not dispatch project software.
+        ...(opts.verifySensors === true ? [await checkSensorExecution(cwd)] : []),
         // Runs unconditionally — orthogonal to sensor configuration entirely, this is
         // about PR/MR tooling, not sensors.
         checkHost(cwd),

package/dist/src/commands/preflight/index.js

@@ -11,10 +11,10 @@ const checks_1 = require("./checks");
 /**
  * Exit code. Anything but `ready` exits 1.
  *
- * Unlike `awm sensors run` — which exits 0 on `not_certified` because exit 2 is a
- * blocking error in Claude Code hooks — preflight is never a hook. It is invoked
- * explicitly by a phase gate, so the exit code can carry the verdict and the caller
- * does not have to remember to read a field out of JSON.
+ * `awm sensors run` exits zero only for an empirical `pass`; preflight mirrors that
+ * binary-gate rule for its own `ready` status. It is invoked explicitly by a phase
+ * gate, so the exit code carries the verdict and the caller need not infer it from
+ * a field in JSON.
  */
 function exitCodeFor(report) {
     return report.status === 'ready' ? 0 : 1;
@@ -44,9 +44,10 @@ function registerPreflightCommand(program) {
         .command('preflight')
         .description('verify the project harness can actually gate before development starts')
         .option('--json', 'emit the report as JSON')
+        .option('--verify-sensors', 'run the complete sensor gate before unattended execution')
         .option('--cwd <path>', 'project directory to check (default: current)')
         .action(async (opts) => {
-        const report = await (0, checks_1.preflight)(opts.cwd ?? process.cwd());
+        const report = await (0, checks_1.preflight)(opts.cwd ?? process.cwd(), { verifySensors: opts.verifySensors === true });
         process.stdout.write(opts.json ? JSON.stringify(report, null, 2) + '\n' : formatReport(report));
         const code = exitCodeFor(report);
         // `process.exit()` may truncate the JSON written immediately above when

package/dist/src/commands/sensors/changed.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.changedFiles = changedFiles;
 exports.hasUnsafeWin32Chars = hasUnsafeWin32Chars;
+exports.changedScopeError = changedScopeError;
 exports.applyChangedCmd = applyChangedCmd;
 exports.filterByExtension = filterByExtension;
 const child_process_1 = require("child_process");
@@ -80,6 +81,20 @@ const WIN32_UNSAFE_CHARS = /[&|<>^%\r\n]/;
 function hasUnsafeWin32Chars(file) {
     return WIN32_UNSAFE_CHARS.test(file);
 }
+/**
+ * Explain why a resolved diff cannot safely be interpolated into a legacy shell
+ * command. Structured v2 commands never need this check: their file names remain
+ * literal argv entries and never meet a shell.
+ */
+function changedScopeError(changed) {
+    if (changed.error)
+        return changed.error;
+    if ((0, paths_1.isWindowsNative)() && changed.files.some(hasUnsafeWin32Chars)) {
+        return 'a changed filename contains a cmd.exe metacharacter (& | < > ^ % or newline/CR) '
+            + 'that quoting cannot reliably neutralize on native Windows — refusing to interpolate it';
+    }
+    return undefined;
+}
 /**
  * CommandLineToArgvW-safe quoting (the algorithm behind Python's
  * `subprocess.list2cmdline`, Rust's `std::process::Command` on Windows, and .NET's

package/dist/src/commands/sensors/compatibility/contract.js

@@ -12,6 +12,7 @@ const semver_1 = __importDefault(require("semver"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const contract_1 = require("../coverage/contract");
+const timeout_1 = require("./timeout");
 const PACK_SCHEMA_VERSION = 2;
 const SHELL_EXECUTABLES = new Set(['sh', 'bash', 'cmd', 'powershell']);
 const PACKAGE_MANAGERS = new Set(['npm', 'pnpm', 'yarn', 'bun']);
@@ -193,7 +194,7 @@ function parseStructuredCommand(input, source) {
 }
 function parseVariant(input, source, location) {
     const value = record(input, source, location);
-    fields(value, ['id', 'priority', 'requirements', 'certifiedRange', 'command', 'assets', 'formatter', 'probe', 'policyRef'], source, location);
+    fields(value, ['id', 'priority', 'requirements', 'certifiedRange', 'command', 'changedCommand', 'assets', 'formatter', 'probe', 'policyRef'], source, location);
     const certifiedRange = text(value.certifiedRange, source, `${location}.certifiedRange`);
     if (semver_1.default.validRange(certifiedRange) === null)
         invalid(source, `${location}.certifiedRange must be a valid semver range`);
@@ -217,6 +218,9 @@ function parseVariant(input, source, location) {
         if (typeof probe.kind !== 'string' || !ALLOWED_PROBES.has(probe.kind))
             invalid(source, `${location}.probe.kind must be an allowed probe`);
     }
+    const changedCommand = 'changedCommand' in value ? parseStructuredCommand(value.changedCommand, source) : undefined;
+    if (changedCommand && !changedCommand.fileInput)
+        invalid(source, `${location}.changedCommand must declare fileInput`);
     return {
         id: id(value.id, source, `${location}.id`),
         priority: value.priority,
@@ -230,6 +234,7 @@ function parseVariant(input, source, location) {
         probe: { kind: policy?.probe ?? probe.kind },
         ...(policy ? { policyRef: SEMGREP_POLICY_REF } : {}),
         command: parseStructuredCommand(value.command, source),
+        ...(changedCommand ? { changedCommand } : {}),
     };
 }
 function parseHardening(input, source) {
@@ -265,7 +270,7 @@ function assertNoEqualPriorityOverlap(variants) {
 }
 function parseSensor(input, source, location, variantIds) {
     const value = record(input, source, location);
-    fields(value, ['applicability', 'variants', 'fast'], source, location);
+    fields(value, ['applicability', 'variants', 'fast', 'timeout'], source, location);
     if (!Array.isArray(value.variants) || value.variants.length === 0)
         invalid(source, `${location}.variants must be a nonempty array`);
     const variants = value.variants.map((variant, index) => parseVariant(variant, source, `${location}.variants[${index}]`));
@@ -293,7 +298,16 @@ function parseSensor(input, source, location, variantIds) {
         invalid(source, `${location}.applicability must declare a condition`);
     if ('fast' in value && typeof value.fast !== 'boolean')
         invalid(source, `${location}.fast must be a boolean`);
-    return { applicability, variants, ...('fast' in value ? { fast: value.fast } : {}) };
+    let timeout;
+    if ('timeout' in value) {
+        try {
+            timeout = (0, timeout_1.positiveTimeout)(value.timeout, `${location}.timeout`);
+        }
+        catch (error) {
+            invalid(source, error instanceof Error ? error.message : `${location}.timeout must be a positive safe integer`);
+        }
+    }
+    return { applicability, variants, ...('fast' in value ? { fast: value.fast } : {}), ...(timeout !== undefined ? { timeout } : {}) };
 }
 function legacyCompatibility() {
     return {

package/dist/src/commands/sensors/compatibility/manifest.js

@@ -7,6 +7,7 @@ exports.legacyCompatibility = legacyCompatibility;
 exports.parseSensorManifest = parseSensorManifest;
 exports.serializeManifestV2 = serializeManifestV2;
 const contract_1 = require("./contract");
+const timeout_1 = require("./timeout");
 const semver_1 = __importDefault(require("semver"));
 const path_1 = __importDefault(require("path"));
 function isRecord(value) {
@@ -106,9 +107,12 @@ function parseLegacySensor(input, source, location) {
         sensor.enabled = value.enabled;
     }
     if ('timeout' in value) {
-        if (typeof value.timeout !== 'number' || !Number.isSafeInteger(value.timeout) || value.timeout <= 0)
-            invalid(source, `${location}.timeout must be a positive safe integer`);
-        sensor.timeout = value.timeout;
+        try {
+            sensor.timeout = (0, timeout_1.positiveTimeout)(value.timeout, `${location}.timeout`);
+        }
+        catch (error) {
+            invalid(source, error instanceof Error ? error.message : `${location}.timeout must be a positive safe integer`);
+        }
     }
     if ('changedCmd' in value)
         sensor.changedCmd = text(value.changedCmd, source, `${location}.changedCmd`);
@@ -135,7 +139,7 @@ function parseLegacyManifest(value, source) {
 }
 function parseV2Sensor(input, source, location) {
     const value = record(input, source, location);
-    fields(value, ['enabled', 'fast', 'variantId', 'command', 'assets', 'policyRef', 'initializedCompatibility'], source, location);
+    fields(value, ['enabled', 'fast', 'timeout', 'variantId', 'command', 'assets', 'policyRef', 'initializedCompatibility'], source, location);
     if (typeof value.enabled !== 'boolean')
         invalid(source, `${location}.enabled must be a boolean`);
     const sensor = {
@@ -163,6 +167,14 @@ function parseV2Sensor(input, source, location) {
             invalid(source, `${location}.fast must be a boolean`);
         sensor.fast = value.fast;
     }
+    if ('timeout' in value) {
+        try {
+            sensor.timeout = (0, timeout_1.positiveTimeout)(value.timeout, `${location}.timeout`);
+        }
+        catch (error) {
+            invalid(source, error instanceof Error ? error.message : `${location}.timeout must be a positive safe integer`);
+        }
+    }
     return sensor;
 }
 function provenanceRoot(value, source) {

package/dist/src/commands/sensors/compatibility/timeout.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.positiveTimeout = positiveTimeout;
+exports.resolveTimeout = resolveTimeout;
+function positiveTimeout(value, location) {
+    if (typeof location !== 'string' || location.trim() === '')
+        throw new Error('timeout location must be a nonempty string');
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`${location} must be a positive safe integer`);
+    }
+    return value;
+}
+function resolveTimeout(input) {
+    if (!input || typeof input !== 'object' || typeof input.fast !== 'boolean')
+        throw new Error('timeout resolution input is invalid');
+    if (input.project !== undefined)
+        return { timeoutMs: positiveTimeout(input.project, 'project timeout'), source: 'project' };
+    if (input.pack !== undefined)
+        return { timeoutMs: positiveTimeout(input.pack, 'pack timeout'), source: 'pack' };
+    return { timeoutMs: input.fast ? 10_000 : 120_000, source: 'fallback' };
+}

package/dist/src/commands/sensors/exec.js

@@ -73,6 +73,7 @@ function collectSpawn(input, opts) {
     const maxBuffer = opts.maxBuffer ?? DEFAULT_MAX_BUFFER;
     const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
     return new Promise((resolve) => {
+        const startedAt = process.hrtime.bigint();
         let stdout = '';
         let stderr = '';
         let timedOut = false;
@@ -106,7 +107,8 @@ function collectSpawn(input, opts) {
                 return;
             settled = true;
             timers.forEach(clearTimeout);
-            resolve({ stdout, stderr, code: null, signal: null, timedOut, overflowed, ...extra });
+            const elapsedMs = Number((process.hrtime.bigint() - startedAt) / 1000000n);
+            resolve({ stdout, stderr, code: null, signal: null, timedOut, overflowed, elapsedMs, ...extra });
         };
         /** Cut the run short: kill the tree, escalate, and never hang waiting for it. */
         const cutShort = () => {

package/dist/src/commands/sensors/index.js

@@ -3,7 +3,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.exitCodeFor = exitCodeFor;
 exports.parsePositiveSafeInteger = parsePositiveSafeInteger;
 exports.registerSensorsCommand = registerSensorsCommand;
 const picocolors_1 = __importDefault(require("picocolors"));
@@ -16,12 +15,7 @@ const baseline_1 = require("./baseline");
 const coverage_1 = require("./coverage");
 const render_1 = require("./coverage/render");
 const registries_1 = require("../../core/registries");
-/** Map a sensor run verdict to a process exit code. fail → 1; everything else → 0.
- *  not_certified intentionally exits 0: its signal lives in `overall`, because
- *  exit code 2 is a blocking error in Claude Code hooks. */
-function exitCodeFor(output) {
-    return output.overall === 'fail' ? 1 : 0;
-}
+const verdict_1 = require("./verdict");
 /** Commander coercion for coverage recurrence emphasis. It deliberately runs
  * before the action, so an invalid value cannot trigger ledger I/O. */
 function parsePositiveSafeInteger(value) {
@@ -65,9 +59,7 @@ function registerSensorsCommand(program) {
         // Emit the verdict ALWAYS — an empty `sensors` with overall:'not_certified'
         // must be visible, never a silent exit-0 that reads as "clean".
         process.stdout.write(JSON.stringify(output, null, 2) + '\n');
-        const code = exitCodeFor(output);
-        if (code !== 0)
-            process.exit(code);
+        process.exitCode = (0, verdict_1.exitCodeForVerdict)(output.overall);
     });
     sensors
         .command('init')
@@ -110,10 +102,10 @@ function registerSensorsCommand(program) {
     });
     sensors
         .command('status')
-        .description('check sensor health for the current project')
+        .description('check static sensor readiness for the current project')
         .action(async () => {
         const status = await (0, status_1.computeSensorStatus)();
-        const icon = status.overall === 'HEALTHY' ? picocolors_1.default.green('✔') : picocolors_1.default.yellow('⚠');
+        const icon = status.overall === 'READY' ? picocolors_1.default.green('✔') : picocolors_1.default.yellow('⚠');
         console.log(`\nPack:    ${status.pack ?? 'none'}`);
         console.log(`Overall: ${icon} ${status.overall}\n`);
         for (const [name, check] of Object.entries(status.checks)) {
@@ -121,7 +113,7 @@ function registerSensorsCommand(program) {
             console.log(`  ${mark}  ${name.padEnd(12)} ${check.detail}`);
         }
         console.log('');
-        if (status.overall !== 'HEALTHY')
+        if (status.overall !== 'READY')
             process.exit(1);
     });
     sensors

package/dist/src/commands/sensors/init.js

@@ -272,6 +272,7 @@ async function initSensors(opts = {}) {
                     sensors[name] = {
                         enabled: prior?.enabled ?? true,
                         fast: prior?.fast ?? sensor.fast ?? false,
+                        ...(prior?.timeout !== undefined ? { timeout: prior.timeout } : {}),
                         variantId: variant.id,
                         command: variant.command,
                         assets: variant.assets,

package/dist/src/commands/sensors/prepare.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateRunOptions = validateRunOptions;
+exports.expandFileInput = expandFileInput;
+exports.prepareLegacySensor = prepareLegacySensor;
+exports.prepareV2Sensor = prepareV2Sensor;
+const changed_1 = require("./changed");
+const timeout_1 = require("./compatibility/timeout");
+function resolveRequestedScope(value) {
+    if (value === undefined)
+        return 'full';
+    if (value === 'full' || value === 'changed')
+        return value;
+    throw new Error('requested scope must be "full" or "changed"');
+}
+function validateRunOptions(opts) {
+    if (!opts || typeof opts !== 'object' || Array.isArray(opts))
+        throw new Error('run options must be an object');
+    if (opts.fast !== undefined && typeof opts.fast !== 'boolean')
+        throw new Error('run option fast must be a boolean');
+    if (opts.slow !== undefined && typeof opts.slow !== 'boolean')
+        throw new Error('run option slow must be a boolean');
+    if (opts.all !== undefined && typeof opts.all !== 'boolean')
+        throw new Error('run option all must be a boolean');
+    if (opts.cwd !== undefined && (typeof opts.cwd !== 'string' || opts.cwd.trim() === ''))
+        throw new Error('run option cwd must be a nonempty string');
+    if (opts.changed !== undefined && typeof opts.changed !== 'boolean')
+        throw new Error('run option changed must be a boolean');
+    if (opts.ignoreBaseline !== undefined && typeof opts.ignoreBaseline !== 'boolean')
+        throw new Error('run option ignoreBaseline must be a boolean');
+    if (opts.base !== undefined && (typeof opts.base !== 'string' || opts.base.trim() === ''))
+        throw new Error('run option base must be a nonempty string');
+    if (opts.changed && opts.ignoreBaseline) {
+        throw new Error('refusing to combine --changed with a baseline capture: a partial run cannot define the accepted set');
+    }
+}
+/** Expand the one declared file placeholder into literal structured argv entries. */
+function expandFileInput(command, files) {
+    if (!command.fileInput)
+        throw new Error('changed command requires fileInput');
+    const index = command.args.indexOf(command.fileInput.placeholder);
+    if (index < 0 || command.args.lastIndexOf(command.fileInput.placeholder) !== index) {
+        throw new Error('changed command requires exactly one standalone {files} argument');
+    }
+    // `fileInput` describes the unexpanded registry template. Leaving it on the
+    // materialized command makes the execution boundary (correctly) demand a
+    // placeholder that has already been replaced with literal argv entries.
+    const { fileInput: _templateInput, ...materialized } = command;
+    return { ...materialized, args: [...command.args.slice(0, index), ...files, ...command.args.slice(index + 1)] };
+}
+function timeout(project, pack, fast) {
+    const resolved = (0, timeout_1.resolveTimeout)({ project, pack, fast });
+    return { timeoutMs: resolved.timeoutMs, timeoutSource: resolved.source };
+}
+function fullLegacy(input, scopeReason) {
+    const requestedScope = resolveRequestedScope(input.requestedScope);
+    return {
+        name: input.name,
+        ...(input.config.cmd ? { command: { kind: 'legacy', value: input.config.cmd } } : { syntheticStatus: 'inconclusive', syntheticReason: 'no cmd configured' }),
+        ...(input.config.formatter ? { formatter: input.config.formatter } : {}),
+        ...timeout(input.config.timeout, input.packTimeout, input.config.fast ?? false),
+        requestedScope,
+        effectiveScope: 'full',
+        ...(scopeReason ? { scopeReason } : {}),
+    };
+}
+/** Prepare one legacy command without dispatching it. */
+function prepareLegacySensor(input) {
+    if (!input || typeof input !== 'object' || !input.config || typeof input.name !== 'string' || input.name === '')
+        throw new Error('legacy preparation input is invalid');
+    const requestedScope = resolveRequestedScope(input.requestedScope);
+    if (requestedScope !== 'changed' || !input.changed)
+        return fullLegacy(input);
+    const scopeError = (0, changed_1.changedScopeError)(input.changed);
+    if (scopeError)
+        return fullLegacy(input, `changed scope could not be resolved safely: ${scopeError}`);
+    if (!input.config.changedCmd)
+        return fullLegacy(input, 'sensor does not support changed scope');
+    if (!input.config.changedCmd.includes('{files}')) {
+        const { command: _command, ...prepared } = fullLegacy(input);
+        return { ...prepared, effectiveScope: 'changed', syntheticStatus: 'inconclusive', syntheticReason: 'changedCmd has no {files} placeholder' };
+    }
+    const files = (0, changed_1.filterByExtension)(input.changed.files, input.config.changedExtensions);
+    if (files.length === 0) {
+        const { command: _command, ...prepared } = fullLegacy(input);
+        return { ...prepared, effectiveScope: 'changed', files: 0, syntheticStatus: 'pass', syntheticReason: 'no changed files in scope' };
+    }
+    return {
+        name: input.name,
+        command: { kind: 'legacy', value: (0, changed_1.applyChangedCmd)(input.config.changedCmd, files) },
+        ...(input.config.formatter ? { formatter: input.config.formatter } : {}),
+        ...timeout(input.config.timeout, input.packTimeout, input.config.fast ?? false),
+        requestedScope,
+        effectiveScope: 'changed',
+        files: files.length,
+    };
+}
+function v2Synthetic(input, reason) {
+    const requestedScope = resolveRequestedScope(input.requestedScope);
+    return {
+        name: input.name,
+        ...timeout(input.projectTimeout ?? input.sensor.timeout, input.packTimeout ?? input.liveSensor?.timeout, input.sensor.fast ?? input.liveSensor?.fast ?? false),
+        requestedScope,
+        effectiveScope: 'full',
+        syntheticStatus: 'inconclusive',
+        syntheticReason: reason,
+    };
+}
+/**
+ * Prepare a v2 command from the freshly resolved pack. The manifest command is
+ * deliberately never read: variantId is only a selector for live authority.
+ */
+function prepareV2Sensor(input) {
+    if (!input || typeof input !== 'object' || !input.sensor || typeof input.name !== 'string' || input.name === '')
+        throw new Error('v2 preparation input is invalid');
+    const requestedScope = resolveRequestedScope(input.requestedScope);
+    if (!input.liveState || input.liveState.state !== 'certified')
+        return v2Synthetic(input, input.liveState ? `${input.liveState.state}: ${input.liveState.reason}` : 'compatibility could not be revalidated');
+    if (input.liveState.variantId !== input.sensor.variantId)
+        return v2Synthetic(input, `variant-drift: manifest ${input.sensor.variantId}, live ${input.liveState.variantId ?? 'none'}; run \`awm sensors init\``);
+    const variant = input.liveSensor?.variants.find(candidate => candidate.id === input.sensor.variantId);
+    if (!variant)
+        return v2Synthetic(input, 'variant-drift: selected live variant has no command; run `awm sensors init`');
+    const common = {
+        name: input.name,
+        ...(variant.formatter ? { formatter: variant.formatter } : {}),
+        ...timeout(input.projectTimeout ?? input.sensor.timeout, input.packTimeout ?? input.liveSensor?.timeout, input.sensor.fast ?? input.liveSensor?.fast ?? false),
+        requestedScope,
+    };
+    if (requestedScope !== 'changed' || !input.changed)
+        return { ...common, command: { kind: 'structured', value: variant.command }, effectiveScope: 'full' };
+    if (input.changed.error)
+        return { ...common, command: { kind: 'structured', value: variant.command }, effectiveScope: 'full', scopeReason: `changed scope could not be resolved: ${input.changed.error}` };
+    if (!variant.changedCommand)
+        return { ...common, command: { kind: 'structured', value: variant.command }, effectiveScope: 'full', scopeReason: 'sensor does not support changed scope' };
+    const files = (0, changed_1.filterByExtension)(input.changed.files, variant.changedCommand.fileInput?.extensions);
+    if (files.length === 0)
+        return { ...common, effectiveScope: 'changed', files: 0, syntheticStatus: 'pass', syntheticReason: 'no changed files in scope' };
+    return { ...common, command: { kind: 'structured', value: expandFileInput(variant.changedCommand, files) }, effectiveScope: 'changed', files: files.length };
+}