agentic-workflow-manager 8.1.4 → 8.1.6

package/dist/src/commands/sensors/status.js

@@ -8,7 +8,10 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../../core/paths");
 const manifest_1 = require("./compatibility/manifest");
-const live_1 = require("./compatibility/live");
+const contract_1 = require("./compatibility/contract");
+const discovery_1 = require("./compatibility/discovery");
+const pack_source_1 = require("./compatibility/pack-source");
+const resolve_1 = require("./compatibility/resolve");
 /** First non-flag token after `npx` — the tool the command actually runs. */
 function npxTool(parts) {
     for (let i = 1; i < parts.length; i++) {
@@ -55,6 +58,83 @@ function checkCmd(cmd, cwd) {
     }
     return configCheck(parts, cwd) ?? { ok: true, detail: bin };
 }
+/** Check a v2 command's declared local prerequisite without invoking it. */
+function checkStructuredCommand(command, cwd, assets = []) {
+    const missingAsset = assets.find(asset => !fs_1.default.existsSync(path_1.default.join(cwd, asset)));
+    if (missingAsset)
+        return { ok: false, detail: `missing config: ${missingAsset}` };
+    if (command.resolution === 'node-modules-bin') {
+        const binary = path_1.default.join(cwd, 'node_modules', '.bin', command.executable);
+        const present = fs_1.default.existsSync(binary)
+            || fs_1.default.existsSync(`${binary}.cmd`)
+            || fs_1.default.existsSync(`${binary}.exe`);
+        return present
+            ? { ok: true, detail: `${command.executable} (node_modules/.bin)` }
+            : { ok: false, detail: `${command.executable} not installed locally` };
+    }
+    if (command.resolution === 'python-environment') {
+        if (!command.pythonEnvironmentRoot)
+            return { ok: false, detail: `${command.executable} has no selected Python environment` };
+        const root = path_1.default.join(cwd, command.pythonEnvironmentRoot);
+        const candidates = process.platform === 'win32'
+            ? [path_1.default.join(root, 'Scripts', `${command.executable}.exe`), path_1.default.join(root, 'Scripts', `${command.executable}.cmd`)]
+            : [path_1.default.join(root, 'bin', command.executable)];
+        return candidates.some(candidate => fs_1.default.existsSync(candidate))
+            ? { ok: true, detail: `${command.executable} (${command.pythonEnvironmentRoot})` }
+            : { ok: false, detail: `${command.executable} not found in ${command.pythonEnvironmentRoot}` };
+    }
+    return (0, paths_1.resolveOnPath)(command.executable)
+        ? { ok: true, detail: command.executable }
+        : { ok: false, detail: `${command.executable} not found in PATH` };
+}
+/**
+ * Re-evaluate only locally discoverable v2 compatibility evidence. Unlike the
+ * execution path, status never runs a compatibility probe: probes such as
+ * `eslint --print-config` are process execution and would turn this command
+ * into a health check. A selected variant still proves that its current tool
+ * and runtime ranges are compatible; its probe state remains unverifiable.
+ */
+function resolveStaticV2Compatibility(cwd, manifest) {
+    const source = manifest.registryRoot === undefined
+        ? (0, pack_source_1.resolvePackSource)(manifest.pack)
+        : (0, pack_source_1.resolvePackSource)(manifest.pack, { registries: [{ name: 'manifest-provenance', remote: 'local', contentRoot: manifest.registryRoot }] });
+    const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
+    if (parsed.kind !== 'v2')
+        throw new Error(`sensor pack "${manifest.pack}" does not provide a v2 compatibility contract`);
+    const evidence = (0, discovery_1.discoverProjectEvidence)(cwd, parsed.pack);
+    const resolutionEvidence = {
+        ...evidence,
+        ...(manifest.packSelection === 'explicit' ? { packSelection: 'explicit' } : {}),
+    };
+    const initial = (0, resolve_1.resolveProjectCompatibility)(parsed.pack, resolutionEvidence).sensors;
+    return Object.fromEntries(Object.entries(parsed.pack.sensors).map(([name, sensor]) => {
+        const variant = initial[name]?.variantId === null
+            ? null
+            : sensor.variants.find(candidate => candidate.id === initial[name]?.variantId) ?? null;
+        // These two probe kinds consume discovery output only. Keep their useful
+        // static validation in status while leaving every command-backed probe
+        // inconclusive rather than dispatching it.
+        const probeStatus = variant?.probe.kind === 'config-present'
+            ? (evidence.configFiles.length > 0 ? 'matched' : 'not-matched')
+            : variant?.probe.kind === 'package-script-present'
+                ? (evidence.scripts.length > 0 ? 'matched' : 'not-matched')
+                : undefined;
+        return [name, probeStatus === undefined
+                ? initial[name]
+                : (0, resolve_1.resolveSensorCompatibility)(sensor, { ...resolutionEvidence, probe: { status: probeStatus } }, { pack: parsed.pack.name, sensor: name })];
+    }));
+}
+function staticCompatibilityCheck(sensor, live) {
+    if (!live)
+        return { ok: false, detail: 'live compatibility unavailable' };
+    if (live.variantId !== sensor.variantId) {
+        return { ok: false, detail: `compatibility drift: initialized ${sensor.variantId}, resolved ${live.variantId ?? live.state}` };
+    }
+    if (live.state === 'incompatible' || live.state === 'missing-tool' || live.state === 'not-applicable' || live.reason === 'probe-not-matched') {
+        return { ok: false, detail: `live compatibility ${live.state}: ${live.reason}` };
+    }
+    return null;
+}
 async function computeSensorStatus(cwd = process.cwd()) {
     const manifestPath = path_1.default.join(cwd, '.awm', 'sensors.json');
     if (!fs_1.default.existsSync(manifestPath)) {
@@ -66,32 +146,26 @@ async function computeSensorStatus(cwd = process.cwd()) {
         const parsed = (0, manifest_1.parseSensorManifest)(raw, manifestPath);
         if (parsed.kind === 'v2') {
             const checks = {};
-            let live;
+            let compatibility;
             try {
-                live = await (0, live_1.resolveLiveCompatibility)(cwd, parsed.pack.pack, parsed.pack.registryRoot, { packSelection: parsed.pack.packSelection });
+                compatibility = resolveStaticV2Compatibility(cwd, parsed.pack);
             }
             catch (error) {
-                const detail = `compatibility revalidation failed: ${error instanceof Error ? error.message : String(error)}`;
+                const detail = error instanceof Error ? error.message : 'live compatibility unavailable';
                 for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
                     checks[name] = sensor.enabled === false ? { ok: true, detail: 'disabled' } : { ok: false, detail };
                 }
                 return { overall: 'DEGRADED', pack: parsed.pack.pack, checks };
             }
             for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
-                const state = live.sensors[name];
-                checks[name] = sensor.enabled === false
-                    ? { ok: true, detail: 'disabled' }
-                    : !state
-                        ? { ok: false, detail: 'variant-drift: sensor no longer exists in the live pack; run `awm sensors init`' }
-                        : state.variantId !== sensor.variantId
-                            ? { ok: false, detail: `variant-drift: manifest ${sensor.variantId}, live ${state.variantId ?? 'none'}; run \`awm sensors init\`` }
-                            : state.state === 'certified'
-                                ? { ok: true, detail: `certified (${state.variantId})` }
-                                : state.state === 'not-applicable'
-                                    ? { ok: true, detail: 'not applicable' }
-                                    : { ok: false, detail: `${state.state}: ${state.reason}` };
+                if (sensor.enabled === false) {
+                    checks[name] = { ok: true, detail: 'disabled' };
+                    continue;
+                }
+                checks[name] = staticCompatibilityCheck(sensor, compatibility[name])
+                    ?? checkStructuredCommand(sensor.command, cwd, sensor.assets);
             }
-            return { overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'HEALTHY' : 'DEGRADED', pack: parsed.pack.pack, checks };
+            return { overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED', pack: parsed.pack.pack, checks };
         }
         manifest = parsed.pack;
     }
@@ -122,12 +196,10 @@ async function computeSensorStatus(cwd = process.cwd()) {
     }
     // `Object.values({}).every(...)` is vacuously true — a manifest with zero sensor
     // entries (the registry had no pack.json for this stack; see init.ts) must not read
-    // as HEALTHY just because there was nothing to fail. Same false-green `checkManifest`
+    // as READY just because there was nothing to fail. Same false-green `checkManifest`
     // guards against in preflight.
     if (Object.keys(manifest.sensors ?? {}).length === 0) {
         return { overall: 'DEGRADED', pack: manifest.pack, checks };
     }
-    // A legacy manifest may be operational (the checks are still useful), but it
-    // has no versioned/structured contract and must never present as certified.
-    return { overall: 'DEGRADED', pack: manifest.pack, checks };
+    return { overall: Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED', pack: manifest.pack, checks };
 }

package/dist/src/commands/sensors/verdict.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exitCodeForVerdict = exitCodeForVerdict;
+exports.reduceVerdict = reduceVerdict;
+/** Map the semantic sensor verdict to the CLI process status. Only a global pass succeeds. */
+function exitCodeForVerdict(overall) {
+    return overall === 'pass' ? 0 : 1;
+}
+/** Reduce all selected sensor outcomes through one format-agnostic verdict rule. */
+function reduceVerdict(results) {
+    if (!Array.isArray(results))
+        throw new Error('sensor results must be an array');
+    for (const result of results) {
+        if (!result || typeof result !== 'object')
+            throw new Error('sensor result must be an object');
+        if (!['pass', 'fail', 'inconclusive', 'skipped'].includes(result.status)) {
+            throw new Error('sensor result status is invalid');
+        }
+    }
+    if (results.some(result => result.status === 'fail'))
+        return 'fail';
+    if (results.some(result => result.status === 'inconclusive'))
+        return 'not_certified';
+    if (results.some(result => result.status === 'pass'))
+        return 'pass';
+    return 'skipped';
+}

package/dist/tests/commands/preflight/preflight.test.js

@@ -9,6 +9,7 @@ const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const checks_1 = require("../../../src/commands/preflight/checks");
 const preflight_1 = require("../../../src/commands/preflight");
+const run_1 = require("../../../src/commands/sensors/run");
 // Only `execSync` (used by `resolveOnPath` to check for `gh`/`glab`) is mocked — `git
 // remote get-url origin` runs for real via `execFileSync` against real tmpdir git repos,
 // same as every other check in this file exercises the real filesystem.
@@ -16,7 +17,12 @@ jest.mock('child_process', () => ({
     ...jest.requireActual('child_process'),
     execSync: jest.fn(),
 }));
+jest.mock('../../../src/commands/sensors/run', () => ({
+    ...jest.requireActual('../../../src/commands/sensors/run'),
+    runSensors: jest.fn(),
+}));
 const mockExecSync = child_process_1.execSync;
+const mockRunSensors = run_1.runSensors;
 /** Turn a tmpdir into a real git repo with (optionally) an `origin` remote. */
 function gitRepo(dir, remoteUrl) {
     (0, child_process_1.execFileSync)('git', ['init'], { cwd: dir, stdio: 'pipe' });
@@ -47,6 +53,50 @@ const make = (o) => { const d = project(o); dirs.push(d); return d; };
 afterAll(() => dirs.forEach(d => fs_1.default.rmSync(d, { recursive: true, force: true })));
 const check = (r, id) => r.checks.find(c => c.id === id);
 describe('preflight', () => {
+    afterEach(() => mockRunSensors.mockReset());
+    it('keeps default preflight static and does not dispatch sensors', async () => {
+        const dir = make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        });
+        await (0, checks_1.preflight)(dir);
+        expect(mockRunSensors).not.toHaveBeenCalled();
+    });
+    it('rejects an array passed as public preflight options before filesystem work', async () => {
+        await expect((0, checks_1.preflight)(process.cwd(), []))
+            .rejects.toThrow('preflight options must contain an optional boolean verifySensors');
+    });
+    it('requires an empirical sensor pass when verification is requested', async () => {
+        const dir = make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        });
+        mockRunSensors.mockResolvedValue({
+            overall: 'not_certified',
+            sensors: [{
+                    name: 'lint', status: 'inconclusive', errors: [], skipReason: 'timeout after 30000ms',
+                    execution: { timeoutMs: 30000, timeoutSource: 'project', elapsedMs: 30012, requestedScope: 'full', effectiveScope: 'full' },
+                }],
+        });
+        const report = await (0, checks_1.preflight)(dir, { verifySensors: true });
+        expect(mockRunSensors).toHaveBeenCalledWith({ cwd: dir, all: true });
+        expect(report.status).toBe('degraded');
+        expect(check(report, 'sensors-execution')).toMatchObject({
+            ok: false,
+            detail: expect.stringMatching(/lint.*30000ms.*elapsed.*timeout/i),
+        });
+    });
+    it('does not invent a sensor or timeout when empirical verification has no executed sensors', async () => {
+        const dir = make();
+        mockRunSensors.mockResolvedValue({ overall: 'not_certified', sensors: [] });
+        const report = await (0, checks_1.preflight)(dir, { verifySensors: true });
+        const execution = check(report, 'sensors-execution');
+        expect(execution).toMatchObject({
+            ok: false,
+            detail: 'sensor verdict was not_certified; no sensor established an empirical pass',
+        });
+        expect(execution.detail).not.toMatch(/timeout|elapsed|named sensor/i);
+        expect(execution.remedy).toContain('awm sensors init');
+        expect(execution.remedy).not.toContain('named sensor');
+    });
     it('reports not_configured when no sensor manifest exists', async () => {
         // The team-rollout case: a developer clones the repo and never runs
         // `awm sensors init`. Today nothing notices until an unattended run is already

package/dist/tests/commands/sensors/baseline.test.js

@@ -7,6 +7,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const baseline_1 = require("../../../src/commands/sensors/baseline");
+const result_1 = require("../../../src/commands/sensors/result");
 const err = (over = {}) => ({
     file: 'lib/a.ts', rule: 'TS2345', message: 'Argument of type X', ...over,
 });
@@ -76,6 +77,19 @@ describe('partition', () => {
         expect(newErrors).toHaveLength(0);
     });
 });
+describe('applyBaseline', () => {
+    it('applies the same baseline to structured findings (R2)', () => {
+        const finding = { file: 'src/a.ts', line: 1, message: 'x' };
+        const accepted = [(0, baseline_1.fingerprint)('lint', finding)];
+        expect((0, result_1.applyBaseline)({ name: 'lint', status: 'fail', errors: [finding] }, accepted))
+            .toMatchObject({ status: 'pass', baselineCount: 1, newCount: 0 });
+    });
+    test.each(['inconclusive', 'skipped'])('baseline never changes %s to pass (R2.1)', status => {
+        const finding = { file: 'src/a.ts', line: 1, message: 'fixture finding' };
+        const accepted = [(0, baseline_1.fingerprint)('lint', finding)];
+        expect((0, result_1.applyBaseline)({ name: 'lint', status, errors: [finding], skipReason: 'fixture' }, accepted).status).toBe(status);
+    });
+});
 describe('readBaseline / writeBaseline', () => {
     let cwd;
     beforeEach(() => { cwd = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-bl-')); });

package/dist/tests/commands/sensors/changed-windows.test.js

@@ -41,4 +41,7 @@ describe('applyChangedCmd — Windows quoting', () => {
         expect((0, changed_1.applyChangedCmd)('eslint {files}', ['report\\']))
             .toBe(`eslint "report\\\\"`);
     });
+    it('refuses unsafe filenames for legacy shell interpolation', () => {
+        expect((0, changed_1.changedScopeError)({ files: ['src/a&b.ts'] })).toMatch(/cmd\.exe metacharacter/);
+    });
 });

package/dist/tests/commands/sensors/compatibility/contract.test.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const contract_1 = require("../../../../src/commands/sensors/compatibility/contract");
+const timeout_1 = require("../../../../src/commands/sensors/compatibility/timeout");
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
@@ -43,6 +44,22 @@ function validPack() {
     };
 }
 describe('sensor pack v2 contract', () => {
+    it('exports bounded timeout validation and resolution (R3.1, R3.4)', () => {
+        expect((0, timeout_1.positiveTimeout)(1, 'sensor timeout')).toBe(1);
+        expect((0, timeout_1.resolveTimeout)({ project: 90_000, pack: 30_000, fast: true })).toEqual({ timeoutMs: 90_000, source: 'project' });
+        expect((0, timeout_1.resolveTimeout)({ pack: 30_000, fast: true })).toEqual({ timeoutMs: 30_000, source: 'pack' });
+        expect((0, timeout_1.resolveTimeout)({ fast: true })).toEqual({ timeoutMs: 10_000, source: 'fallback' });
+        expect((0, timeout_1.resolveTimeout)({ fast: false })).toEqual({ timeoutMs: 120_000, source: 'fallback' });
+    });
+    test.each([0, -1, 1.5, Number.MAX_SAFE_INTEGER + 1, '1000'])('rejects invalid resolved timeout %p (R3.3)', timeout => {
+        expect(() => (0, timeout_1.positiveTimeout)(timeout, 'sensor timeout')).toThrow(/sensor timeout.*positive safe integer/);
+        expect(() => (0, timeout_1.resolveTimeout)({ project: timeout, fast: true })).toThrow(/project timeout.*positive safe integer/);
+    });
+    it('rejects malformed timeout helper inputs loudly (R3.4)', () => {
+        expect(() => (0, timeout_1.positiveTimeout)(1000, '')).toThrow('timeout location must be a nonempty string');
+        expect(() => (0, timeout_1.resolveTimeout)(null)).toThrow('timeout resolution input is invalid');
+        expect(() => (0, timeout_1.resolveTimeout)({ fast: 'true' })).toThrow('timeout resolution input is invalid');
+    });
     it('derives Semgrep compatibility from a contained shared policy reference', () => {
         const sensorPacks = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-semgrep-policy-'));
         const packDir = path_1.default.join(sensorPacks, 'python');
@@ -79,6 +96,40 @@ describe('sensor pack v2 contract', () => {
     it('parses a valid versioned pack', () => {
         expect((0, contract_1.parseSensorPack)(validPack(), 'pack.json')).toMatchObject({ kind: 'v2', pack: validPack() });
     });
+    it('accepts one standalone files placeholder in changedCommand (R4)', () => {
+        const pack = validPack();
+        pack.sensors.lint.variants[0].changedCommand = {
+            executable: 'eslint', resolution: 'node-modules-bin',
+            args: ['--format', 'json', '{files}'],
+            fileInput: { placeholder: '{files}', extensions: ['.js', '.ts'] },
+        };
+        expect((0, contract_1.parseSensorPack)(pack, '/registry/sensor-packs/js-ts/pack.json')).toMatchObject({
+            kind: 'v2', pack: { sensors: { lint: { variants: [{ changedCommand: { args: ['--format', 'json', '{files}'] } }] } } },
+        });
+    });
+    test.each([
+        { args: ['{files}', '{files}'], fileInput: { placeholder: '{files}', extensions: ['.ts'] } },
+        { args: ['prefix-{files}'], fileInput: { placeholder: '{files}', extensions: ['.ts'] } },
+        { args: ['{files}'], fileInput: { placeholder: '{files}', extensions: [] } },
+    ])('rejects unsafe changedCommand %# (R4)', changedCommand => {
+        const pack = validPack();
+        pack.sensors.lint.variants[0].changedCommand = {
+            executable: 'eslint', resolution: 'node-modules-bin', ...changedCommand,
+        };
+        expect(() => (0, contract_1.parseSensorPack)(pack, '/registry/sensor-packs/js-ts/pack.json')).toThrow(/changedCommand|fileInput|\{files\}/);
+    });
+    test.each([0, -1, 1.5, Number.MAX_SAFE_INTEGER + 1, '1000'])('rejects pack sensor timeout %p (R3.3)', timeout => {
+        const pack = validPack();
+        pack.sensors.lint.timeout = timeout;
+        expect(() => (0, contract_1.parseSensorPack)(pack, '/registry/sensor-packs/js-ts/pack.json')).toThrow(/timeout.*positive safe integer/);
+    });
+    it('accepts an optional positive pack sensor timeout (R3.1)', () => {
+        const pack = validPack();
+        pack.sensors.lint.timeout = 30_000;
+        expect((0, contract_1.parseSensorPack)(pack, '/registry/sensor-packs/js-ts/pack.json')).toMatchObject({
+            kind: 'v2', pack: { sensors: { lint: { timeout: 30_000 } } },
+        });
+    });
     it('accepts an opt-in hardening asset while variants may require no assets', () => {
         const pack = {
             ...validPack(),

package/dist/tests/commands/sensors/compatibility/manifest.test.js

@@ -6,6 +6,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const manifest_1 = require("../../../../src/commands/sensors/compatibility/manifest");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+function validV2Manifest() {
+    return {
+        schemaVersion: 2,
+        pack: 'js-ts',
+        sensors: {
+            lint: {
+                enabled: true, variantId: 'eslint-9',
+                command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.', '--format', 'json'] },
+                initializedCompatibility: { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] },
+            },
+        },
+    };
+}
 describe('sensor manifest contract', () => {
     it('keeps compatibility contracts on an acyclic import boundary', () => {
         const source = (relative) => fs_1.default.readFileSync(path_1.default.join(__dirname, '../../../../src/commands/sensors', relative), 'utf8');
@@ -21,20 +34,23 @@ describe('sensor manifest contract', () => {
             } });
     });
     it('accepts a v2 selected variant and structured command', () => {
-        const manifest = {
-            schemaVersion: 2,
-            pack: 'js-ts',
-            sensors: {
-                lint: {
-                    enabled: true, variantId: 'eslint-9',
-                    command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.', '--format', 'json'] },
-                    initializedCompatibility: { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] },
-                },
-            },
-        };
+        const manifest = validV2Manifest();
         expect((0, manifest_1.parseSensorManifest)(manifest, 'sensors.json')).toMatchObject({ kind: 'v2', pack: manifest });
         expect(JSON.parse((0, manifest_1.serializeManifestV2)(manifest))).toEqual(manifest);
     });
+    it('accepts and serializes a positive v2 project timeout (R3)', () => {
+        const manifest = validV2Manifest();
+        manifest.sensors.lint.timeout = 45_000;
+        expect((0, manifest_1.parseSensorManifest)(manifest, '/project/.awm/sensors.json')).toMatchObject({
+            kind: 'v2', pack: { sensors: { lint: { timeout: 45_000 } } },
+        });
+        expect(JSON.parse((0, manifest_1.serializeManifestV2)(manifest))).toEqual(manifest);
+    });
+    test.each([0, -1, 1.5, Number.MAX_SAFE_INTEGER + 1, '1000'])('rejects v2 timeout %p before execution (R3.3)', timeout => {
+        const manifest = validV2Manifest();
+        manifest.sensors.lint.timeout = timeout;
+        expect(() => (0, manifest_1.parseSensorManifest)(manifest, '/project/.awm/sensors.json')).toThrow(/timeout.*positive safe integer/);
+    });
     it('persists only an explicit v2 pack selection as applicability provenance', () => {
         const manifest = {
             schemaVersion: 2, pack: 'generic', packSelection: 'explicit',

package/dist/tests/commands/sensors/compatibility/probe.test.js

@@ -1,7 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const probe_1 = require("../../../../src/commands/sensors/compatibility/probe");
-const fakeExecutor = jest.fn(async () => ({ code: 0, signal: null, timedOut: false, overflowed: false, stdout: 'SECRET_VALUE\nmatched', stderr: '' }));
+const execResult = (overrides = {}) => ({
+    code: 0,
+    signal: null,
+    timedOut: false,
+    overflowed: false,
+    elapsedMs: 0,
+    stdout: 'SECRET_VALUE\nmatched',
+    stderr: '',
+    ...overrides,
+});
+const fakeExecutor = jest.fn(async () => execResult());
 const evidence = { cwd: process.cwd(), configFiles: ['eslint.config.js'], scripts: ['lint'] };
 describe('runCompatibilityProbe', () => {
     beforeEach(() => fakeExecutor.mockClear());
@@ -11,9 +21,9 @@ describe('runCompatibilityProbe', () => {
         expect(JSON.stringify(result)).not.toContain('SECRET_VALUE');
     });
     it('never treats a timeout or overflow as a match', async () => {
-        fakeExecutor.mockResolvedValueOnce({ code: null, signal: 'SIGKILL', timedOut: true, overflowed: false, stdout: '', stderr: '' });
+        fakeExecutor.mockResolvedValueOnce(execResult({ code: null, signal: 'SIGKILL', timedOut: true, stdout: '' }));
         await expect((0, probe_1.runCompatibilityProbe)({ kind: 'version' }, evidence, fakeExecutor)).resolves.toMatchObject({ status: 'unverifiable' });
-        fakeExecutor.mockResolvedValueOnce({ code: 0, signal: null, timedOut: false, overflowed: true, stdout: 'ok', stderr: '' });
+        fakeExecutor.mockResolvedValueOnce(execResult({ overflowed: true, stdout: 'ok' }));
         await expect((0, probe_1.runCompatibilityProbe)({ kind: 'version' }, evidence, fakeExecutor)).resolves.toMatchObject({ status: 'unverifiable' });
     });
     it('binds tool probes to the project node_modules executable instead of PATH', async () => {

package/dist/tests/commands/sensors/exec-fixtures.js

@@ -6,7 +6,7 @@ exports.spawnFailed = exports.overflowed = exports.timedOut = exports.exited = e
  * mock the exec boundary rather than `child_process` directly: `runCommand`
  * never throws, so a mocked run is a value, not an exception.
  */
-const base = { stdout: '', stderr: '', code: null, signal: null, timedOut: false, overflowed: false };
+const base = { stdout: '', stderr: '', code: null, signal: null, timedOut: false, overflowed: false, elapsedMs: 0 };
 /** Clean run: exit 0. */
 const ok = (stdout = '') => ({ ...base, stdout, code: 0 });
 exports.ok = ok;

package/dist/tests/commands/sensors/exec.test.js

@@ -7,6 +7,18 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const exec_1 = require("../../../src/commands/sensors/exec");
+const result_1 = require("../../../src/commands/sensors/result");
+const prepare_1 = require("../../../src/commands/sensors/prepare");
+const sensor = (overrides = {}) => ({
+    name: 'lint',
+    command: { kind: 'legacy', value: 'node -e "setTimeout(() => {}, 1000)"' },
+    formatter: 'generic',
+    timeoutMs: 5_000,
+    timeoutSource: 'fallback',
+    requestedScope: 'full',
+    effectiveScope: 'full',
+    ...overrides,
+});
 const onPosix = process.platform !== 'win32' ? describe : describe.skip;
 const itPosix = process.platform !== 'win32' ? it : it.skip;
 /** Poll until `fn()` is true or the budget runs out. Avoids fixed sleeps. */
@@ -20,6 +32,12 @@ async function until(fn, budgetMs = 4000) {
     return fn();
 }
 describe('runCommand — exit codes and output', () => {
+    it('records bounded execution evidence on timeout (R3.2,R3.4,R7.1)', async () => {
+        const result = await (0, result_1.executePrepared)(sensor({ timeoutMs: 25, timeoutSource: 'project' }));
+        expect(result.status).toBe('inconclusive');
+        expect(result.execution).toMatchObject({ timeoutMs: 25, timeoutSource: 'project', effectiveScope: 'full' });
+        expect(result.execution.elapsedMs).toBeGreaterThanOrEqual(0);
+    });
     it('passes structured metacharacters literally without a shell', async () => {
         const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-exec-argv-'));
         const marker = path_1.default.join(dir, 'must-not-exist');
@@ -131,6 +149,24 @@ describe('runCommand — spawn failure', () => {
     });
 });
 describe('runStructuredCommand — public boundary validation', () => {
+    it('dispatches argv materialized from a validated changed-command template without requiring its placeholder again', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-exec-changed-argv-'));
+        const received = path_1.default.join(dir, 'received.json');
+        try {
+            const command = (0, prepare_1.expandFileInput)({
+                executable: 'node',
+                resolution: 'path',
+                args: ['-e', "require('fs').writeFileSync(process.argv[1], JSON.stringify(process.argv.slice(2)))", received, '{files}'],
+                fileInput: { placeholder: '{files}', extensions: ['.ts'] },
+            }, ['src/a.ts', 'src/with space.ts']);
+            const result = await (0, exec_1.runStructuredCommand)(command, { timeout: 5_000, cwd: dir });
+            expect(result.code).toBe(0);
+            expect(JSON.parse(fs_1.default.readFileSync(received, 'utf8'))).toEqual(['src/a.ts', 'src/with space.ts']);
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    });
     it.each(['sh', 'cmd.exe', '/usr/bin/node', 'nested/tool', 'nested\\tool'])('rejects unsafe executable %j before resolution', executable => {
         expect(() => (0, exec_1.runStructuredCommand)({ executable, resolution: 'path', args: ['--version'] }, { timeout: 5000, cwd: process.cwd() }))
             .toThrow(/safe executable name|shell/i);

package/dist/tests/commands/sensors/index.test.js

@@ -15,18 +15,56 @@ const prompts_1 = require("@clack/prompts");
 const coverage_1 = require("../../../src/commands/sensors/coverage");
 const render_1 = require("../../../src/commands/sensors/coverage/render");
 const index_1 = require("../../../src/commands/sensors/index");
-describe('exitCodeFor — sensor run verdict → exit code', () => {
-    const base = (overall) => ({ sensors: [], overall });
-    it('pass → 0', () => expect((0, index_1.exitCodeFor)(base('pass'))).toBe(0));
-    it('skipped → 0', () => expect((0, index_1.exitCodeFor)(base('skipped'))).toBe(0));
-    it('not_certified → 0 (signal is in overall, not exit code)', () => expect((0, index_1.exitCodeFor)(base('not_certified'))).toBe(0));
-    it('fail → 1', () => expect((0, index_1.exitCodeFor)(base('fail'))).toBe(1));
+const verdict_1 = require("../../../src/commands/sensors/verdict");
+const processExit = jest.spyOn(process, 'exit').mockImplementation((() => undefined));
+const stdoutWrite = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+describe('exitCodeForVerdict — sensor run verdict → exit code', () => {
+    it.each([
+        ['pass', 0],
+        ['fail', 1],
+        ['skipped', 1],
+        ['not_certified', 1],
+    ])('%s → %i', (overall, code) => {
+        expect((0, verdict_1.exitCodeForVerdict)(overall)).toBe(code);
+    });
+});
+describe('sensors run Commander wiring', () => {
+    const originalExitCode = process.exitCode;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        process.exitCode = undefined;
+    });
+    afterAll(() => {
+        process.exitCode = originalExitCode;
+    });
+    const programWithSensors = () => {
+        const program = new commander_1.Command();
+        program.exitOverride();
+        (0, index_1.registerSensorsCommand)(program);
+        return program;
+    };
+    it.each([
+        ['pass', 0],
+        ['fail', 1],
+        ['skipped', 1],
+        ['not_certified', 1],
+    ])('writes full %s JSON before assigning exit code %i without process.exit', async (overall, code) => {
+        require('../../../src/commands/sensors/run').runSensors.mockResolvedValue({ sensors: [], overall });
+        const calls = [];
+        stdoutWrite.mockImplementation(() => {
+            calls.push(`stdout:${process.exitCode ?? 0}`);
+            return true;
+        });
+        await programWithSensors().parseAsync(['node', 'awm', 'sensors', 'run']);
+        expect(JSON.parse(String(stdoutWrite.mock.calls[0][0]))).toEqual({ sensors: [], overall });
+        expect(calls).toEqual(['stdout:0']);
+        expect(process.exitCode).toBe(code);
+        expect(processExit).not.toHaveBeenCalled();
+    });
 });
 describe('sensors coverage Commander wiring', () => {
     const report = { schemaVersion: 1, pack: 'js-ts', registry: 'baseline', overall: 'gaps',
         static: { status: 'gaps', reason: null, classes: [] } };
-    const stdoutWrite = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
-    const processExit = jest.spyOn(process, 'exit').mockImplementation((() => undefined));
     beforeEach(() => {
         jest.clearAllMocks();
         coverage_1.runCoverage.mockReturnValue(report);

package/dist/tests/commands/sensors/init.test.js

@@ -310,7 +310,7 @@ describe('initSensors', () => {
             const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8'));
             expect(explicit.manifest).toMatchObject({ schemaVersion: 2, pack: 'generic', packSelection: 'explicit', sensors: { security: { variantId: 'eslint-10' } } });
             expect(written.packSelection).toBe('explicit');
-            await expect((0, status_1.computeSensorStatus)(tmpDir)).resolves.toMatchObject({ overall: 'HEALTHY', checks: { security: { ok: true } } });
+            await expect((0, status_1.computeSensorStatus)(tmpDir)).resolves.toMatchObject({ overall: 'DEGRADED', checks: { security: { ok: false } } });
         }
         finally {
             fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
@@ -370,6 +370,35 @@ describe('initSensors', () => {
             fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
         }
     });
+    it('preserves only the project timeout override, never prior executable authority (R3, R10)', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            const manifestPath = path_1.default.join(tmpDir, '.awm', 'sensors.json');
+            const selected = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf8'));
+            selected.sensors.lint.timeout = 45_000;
+            selected.sensors.lint.command = {
+                executable: 'otherlint', resolution: 'path', args: ['--custom'],
+                environment: { ESLINT_USE_FLAT_CONFIG: 'false' },
+            };
+            selected.sensors.lint.assets = ['prior-owned.config'];
+            fs_1.default.writeFileSync(manifestPath, JSON.stringify(selected));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            const written = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf8'));
+            expect(written.sensors.lint).toMatchObject({
+                timeout: 45_000,
+                command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                assets: ['eslint.config.awm.mjs'],
+            });
+            expect(written.sensors.lint.command.environment).toBeUndefined();
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
     it('rejects a symlinked v2 pack source instead of reading it through init', async () => {
         const v2Registry = makeV2Registry();
         try {