agentic-workflow-manager 9.16.1 → 9.17.0

package/dist/src/commands/preflight/checks.js

@@ -100,13 +100,18 @@ function checkContextKernel(cwd) {
         remedy: inspection.remedy,
     };
 }
+function isDisabledCheckDetail(detail) {
+    return detail === 'disabled' || detail.startsWith('disabled ');
+}
 function manifestView(status) {
-    if (!status.pack)
+    // Only-project READY has pack null but non-empty checks — still a valid view (RF-2.8).
+    // Do not invent a fake pack id; keep pack null and surface sensors from status.checks.
+    if (status.mode !== 'project-sensors' && status.mode !== 'legacy-v1')
         return null;
     const sensors = Object.fromEntries(Object.entries(status.checks).map(([name, check]) => [name, {
-            enabled: check.detail !== 'disabled',
+            enabled: !isDisabledCheckDetail(check.detail),
         }]));
-    return { pack: status.pack, sensors };
+    return { pack: status.pack ?? null, sensors };
 }
 /**
  * Total sensor entries and how many are enabled (`enabled !== false`, so a missing
@@ -139,12 +144,32 @@ function checkManifest(status) {
         };
     }
     if (status.mode === 'invalid') {
+        if (status.reason === 'schema-unsupported') {
+            return {
+                id: 'manifest',
+                ok: false,
+                detail: '.awm/sensors.json uses an unsupported schema',
+                remedy: 'fix or regenerate it with `awm sensors init`',
+            };
+        }
+        // JSON.parse succeeded but schema/entry validation failed (RF-4.1/4.2).
+        // Never claim "not valid JSON"; name the sensor/field from status.reason.
+        if (typeof status.reason === 'string' && (status.reason.startsWith('schema-invalid') || status.reason.includes('Invalid sensor manifest'))) {
+            const detail = status.reason.startsWith('schema-invalid:')
+                ? status.reason.slice('schema-invalid:'.length).trim()
+                : status.reason;
+            // RF-3.3: project schema invalidity must not lead with `awm sensors init`.
+            return {
+                id: 'manifest',
+                ok: false,
+                detail,
+                remedy: 'repair the invalid sensor entry in .awm/sensors.json',
+            };
+        }
         return {
             id: 'manifest',
             ok: false,
-            detail: status.reason === 'schema-unsupported'
-                ? '.awm/sensors.json uses an unsupported schema'
-                : '.awm/sensors.json is not valid JSON',
+            detail: '.awm/sensors.json is not valid JSON',
             remedy: 'fix or regenerate it with `awm sensors init`',
         };
     }
@@ -165,6 +190,14 @@ function checkManifest(status) {
     // for the detected stack, so `awm sensors init` built an honest, empty manifest
     // rather than inventing defaults. That must not read as "all sensors disabled".
     if (total === 0) {
+        if (manifest.pack === null) {
+            return {
+                id: 'manifest',
+                ok: false,
+                detail: 'only-project manifest has no sensors',
+                remedy: 'add source:"project" sensor entries to .awm/sensors.json, or declare a pack',
+            };
+        }
         return {
             id: 'manifest',
             ok: false,
@@ -179,12 +212,14 @@ function checkManifest(status) {
     // gap is one missing tool could then configure sensors and still never pass.
     const uninitialized = Object.keys(status.uninitialized ?? {});
     const gap = uninitialized.length === 0 ? '' : `; ${uninitialized.length} applicable sensor(s) not initialized: ${uninitialized.join(', ')}`;
-    return {
-        id: 'manifest',
-        ok: true,
-        detail: (enabled === 0 ? `pack ${manifest.pack}, all ${total} sensors disabled (deliberate opt-out)`
-            : `pack ${manifest.pack}, ${enabled}/${total} sensors enabled`) + gap,
-    };
+    const summary = manifest.pack === null
+        ? (enabled === 0
+            ? `only-project, all ${total} sensors disabled (deliberate opt-out)`
+            : `only-project, ${enabled}/${total} project-declared sensors enabled`)
+        : (enabled === 0
+            ? `pack ${manifest.pack}, all ${total} sensors disabled (deliberate opt-out)`
+            : `pack ${manifest.pack}, ${enabled}/${total} sensors enabled`);
+    return { id: 'manifest', ok: true, detail: summary + gap };
 }
 /** Every enabled sensor's command must resolve. This is the check nothing was calling. */
 async function checkTools(cwd, status) {
@@ -198,11 +233,14 @@ async function checkTools(cwd, status) {
     // already guards against; this defends the invariant independently rather than
     // relying solely on `checkManifest`'s gate to catch this exact manifest shape.
     if (Object.keys(status.checks).length === 0) {
+        const packId = typeof status.pack === 'string' && status.pack.length > 0 ? status.pack : null;
         return {
             id: 'tools',
             ok: false,
             detail: 'no sensors configured to check (0 sensor entries in the manifest)',
-            remedy: `registry has no pack for '${status.pack}': run \`awm update\` or add a registry that has it`,
+            remedy: packId === null
+                ? 'add source:"project" sensor entries to .awm/sensors.json, or declare a pack'
+                : `registry has no pack for '${packId}': run \`awm update\` or add a registry that has it`,
         };
     }
     const broken = Object.entries(status.checks).filter(([, c]) => !c.ok);
@@ -227,6 +265,9 @@ function checkPack(cwd, status) {
     const manifest = manifestView(status);
     if (!manifest)
         return { id: 'pack', ok: true, detail: 'skipped (no manifest)' };
+    if (manifest.pack === null) {
+        return { id: 'pack', ok: true, detail: 'no pack (project-declared sensors only)' };
+    }
     const detection = (0, detection_1.detectStack)(cwd);
     if (manifest.pack === 'generic' && detection.pack !== 'generic') {
         return {
@@ -327,6 +368,15 @@ async function checkSensorExecution(cwd) {
     try {
         const output = await (0, run_1.runSensors)({ cwd, all: true });
         if (output.overall === 'pass') {
+            const invalid = output.invalidEntries ?? [];
+            if (invalid.length > 0) {
+                return {
+                    id: 'sensors-execution',
+                    ok: false,
+                    detail: `sensors passed but ${invalid.length} invalidEntries remain: ${invalid.map(entry => `${entry.name} (${entry.reason})`).join('; ')}`,
+                    remedy: 'repair the invalid sensor entries in .awm/sensors.json, then rerun `awm preflight --verify-sensors`',
+                };
+            }
             return { id: 'sensors-execution', ok: true, detail: 'all selected sensors completed with pass' };
         }
         return {

package/dist/src/commands/sensors/bootstrap.js

@@ -209,7 +209,8 @@ function applySensorBootstrap(plan) {
     if (plan.manifest.mode === 'project-sensors') {
         if (!plan.source)
             throw new Error('project-sensors bootstrap plan requires its resolved source');
-        (0, materialize_1.materializePortableSensors)({ projectRoot: plan.projectRoot, pack: plan.manifest.pack, source: plan.source, ...(plan.manifest.packageRoot ? { packageRoot: plan.manifest.packageRoot } : {}), sensors: plan.manifest.sensors, configure: plan.configure !== false });
+        const packBound = (0, manifest_1.asPackBoundProjectSensors)(plan.manifest);
+        (0, materialize_1.materializePortableSensors)({ projectRoot: plan.projectRoot, pack: packBound.pack, source: plan.source, ...(packBound.packageRoot ? { packageRoot: packBound.packageRoot } : {}), sensors: packBound.sensors, configure: plan.configure !== false });
         return 'created';
     }
     const parsed = (0, manifest_1.parseSensorManifest)(plan.manifest, 'bootstrap declaration');

package/dist/src/commands/sensors/compatibility/contract.js

@@ -137,61 +137,65 @@ function resolveSemgrepPolicy(policyRef, source, location = 'policy') {
     }
     return parseSemgrepPolicy(parsed, candidate);
 }
-function parseStructuredCommand(input, source) {
-    const value = record(input, source, 'command');
-    fields(value, ['executable', 'resolution', 'args', 'packageManager', 'environment', 'fileInput', 'pythonEnvironmentRoot'], source, 'command');
-    const executable = text(value.executable, source, 'command.executable');
+function parseStructuredCommand(input, source, location = 'command') {
+    const value = record(input, source, location);
+    fields(value, ['executable', 'resolution', 'args', 'packageManager', 'environment', 'fileInput', 'pythonEnvironmentRoot'], source, location);
+    const executable = text(value.executable, source, `${location}.executable`);
     if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(executable) || SHELL_EXECUTABLES.has(executable.toLowerCase().replace(/\.exe$/, ''))) {
-        invalid(source, 'command.executable must not be a shell or path');
+        invalid(source, `${location}.executable must not be a shell or path`);
     }
     if (value.resolution !== 'node-modules-bin' && value.resolution !== 'python-environment' && value.resolution !== 'path') {
-        invalid(source, 'command.resolution must be a supported resolution');
+        invalid(source, `${location}.resolution must be a supported resolution`);
     }
-    const args = stringArray(value.args, source, 'command.args');
+    const args = stringArray(value.args, source, `${location}.args`);
     for (const [index, arg] of args.entries()) {
         if (arg.includes('{files}') && arg !== '{files}')
-            invalid(source, `command.args[${index}] must not embed {files}`);
+            invalid(source, `${location}.args[${index}] must not embed {files}`);
     }
     const command = { executable, resolution: value.resolution, args };
     if ('pythonEnvironmentRoot' in value) {
-        if (value.resolution !== 'python-environment' || (value.pythonEnvironmentRoot !== '.venv' && value.pythonEnvironmentRoot !== 'venv'))
-            invalid(source, 'command.pythonEnvironmentRoot must name the selected .venv or venv Python environment');
+        if (value.resolution !== 'python-environment' || (value.pythonEnvironmentRoot !== '.venv' && value.pythonEnvironmentRoot !== 'venv')) {
+            invalid(source, `${location}.pythonEnvironmentRoot must name the selected .venv or venv Python environment`);
+        }
         command.pythonEnvironmentRoot = value.pythonEnvironmentRoot;
     }
     const executablePackageManager = normalizedPackageManager(executable);
-    if (PACKAGE_MANAGERS.has(executablePackageManager) && !('packageManager' in value))
-        invalid(source, 'command.packageManager is required for a package-manager executable');
+    if (PACKAGE_MANAGERS.has(executablePackageManager) && !('packageManager' in value)) {
+        invalid(source, `${location}.packageManager is required for a package-manager executable`);
+    }
     if ('packageManager' in value) {
-        if (typeof value.packageManager !== 'string' || !PACKAGE_MANAGERS.has(normalizedPackageManager(value.packageManager)))
-            invalid(source, 'command.packageManager must be npm, pnpm, yarn, or bun');
+        if (typeof value.packageManager !== 'string' || !PACKAGE_MANAGERS.has(normalizedPackageManager(value.packageManager))) {
+            invalid(source, `${location}.packageManager must be npm, pnpm, yarn, or bun`);
+        }
         const packageManager = normalizedPackageManager(value.packageManager);
         if (packageManager !== executablePackageManager)
-            invalid(source, 'command.packageManager must match executable');
+            invalid(source, `${location}.packageManager must match executable`);
         command.packageManager = packageManager;
     }
     if ('environment' in value) {
-        const environment = record(value.environment, source, 'command.environment');
-        fields(environment, ['ESLINT_USE_FLAT_CONFIG'], source, 'command.environment');
-        if ((environment.ESLINT_USE_FLAT_CONFIG !== 'true' && environment.ESLINT_USE_FLAT_CONFIG !== 'false') || Object.keys(environment).length !== 1)
-            invalid(source, 'command.environment must be the exact allowlisted ESLINT_USE_FLAT_CONFIG=true or false mapping');
+        const environment = record(value.environment, source, `${location}.environment`);
+        fields(environment, ['ESLINT_USE_FLAT_CONFIG'], source, `${location}.environment`);
+        if ((environment.ESLINT_USE_FLAT_CONFIG !== 'true' && environment.ESLINT_USE_FLAT_CONFIG !== 'false') || Object.keys(environment).length !== 1) {
+            invalid(source, `${location}.environment must be the exact allowlisted ESLINT_USE_FLAT_CONFIG=true or false mapping`);
+        }
         command.environment = { ESLINT_USE_FLAT_CONFIG: environment.ESLINT_USE_FLAT_CONFIG };
     }
     if ('fileInput' in value) {
-        const fileInput = record(value.fileInput, source, 'command.fileInput');
-        fields(fileInput, ['placeholder', 'extensions'], source, 'command.fileInput');
+        const fileInput = record(value.fileInput, source, `${location}.fileInput`);
+        fields(fileInput, ['placeholder', 'extensions'], source, `${location}.fileInput`);
         if (fileInput.placeholder !== '{files}')
-            invalid(source, 'command.fileInput.placeholder must be {files}');
-        const extensions = stringArray(fileInput.extensions, source, 'command.fileInput.extensions');
+            invalid(source, `${location}.fileInput.placeholder must be {files}`);
+        const extensions = stringArray(fileInput.extensions, source, `${location}.fileInput.extensions`);
         for (const [index, extension] of extensions.entries()) {
             if (!/^\.[A-Za-z0-9]+$/.test(extension))
-                invalid(source, `command.fileInput.extensions[${index}] must be an extension`);
+                invalid(source, `${location}.fileInput.extensions[${index}] must be an extension`);
         }
         if (args.filter(arg => arg === '{files}').length !== 1)
-            invalid(source, 'command.fileInput requires exactly one {files} argument');
+            invalid(source, `${location}.fileInput requires exactly one {files} argument`);
         command.fileInput = { placeholder: '{files}', extensions };
     }
     else if (args.includes('{files}')) {
-        invalid(source, 'command {files} argument requires fileInput');
+        invalid(source, `${location} {files} argument requires fileInput`);
     }
     return command;
 }

package/dist/src/commands/sensors/compatibility/discovery.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.discoverPresentMarkers = discoverPresentMarkers;
 exports.discoverProjectEvidence = discoverProjectEvidence;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -21,6 +22,26 @@ function safeFile(root, relative) {
         return false;
     }
 }
+/**
+ * Present contained marker files under cwd — same `safeFile` rules pack discovery
+ * uses when evaluating applicability allFiles/anyFiles.
+ */
+function discoverPresentMarkers(cwd, markers) {
+    if (typeof cwd !== 'string' || cwd.trim() === '')
+        throw new Error('cwd must be a non-empty path');
+    if (!Array.isArray(markers))
+        throw new Error('markers must be an array');
+    let root;
+    try {
+        root = fs_1.default.realpathSync(cwd);
+        if (!fs_1.default.statSync(root).isDirectory())
+            throw new Error();
+    }
+    catch {
+        throw new Error(`cwd is not a readable project directory: ${cwd}`);
+    }
+    return [...new Set(markers.filter((marker) => typeof marker === 'string' && safeFile(root, marker)))].sort();
+}
 function safeParts(parts) {
     return parts.length > 0 && parts.every(part => Boolean(part) && part !== '.' && part !== '..' && !part.includes('/') && !part.includes('\\'));
 }

package/dist/src/commands/sensors/compatibility/manifest.js

@@ -3,7 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isProjectDeclaredSensor = isProjectDeclaredSensor;
+exports.isPackBoundManifestSensor = isPackBoundManifestSensor;
+exports.asPackBoundProjectSensors = asPackBoundProjectSensors;
 exports.legacyCompatibility = legacyCompatibility;
+exports.parseSensorManifestWithIssues = parseSensorManifestWithIssues;
 exports.parseSensorManifest = parseSensorManifest;
 exports.serializeManifestV2 = serializeManifestV2;
 exports.serializeManifestV3 = serializeManifestV3;
@@ -11,6 +15,28 @@ const contract_1 = require("./contract");
 const timeout_1 = require("./timeout");
 const semver_1 = __importDefault(require("semver"));
 const path_1 = __importDefault(require("path"));
+/** Registered CLI formatter ids plus exit-code (default for project-declared sensors). */
+const PROJECT_FORMATTERS = new Set([
+    'tsc', 'eslint-llm', 'semgrep', 'test', 'mypy', 'ruff', 'shellcheck', 'generic', 'exit-code',
+]);
+function isProjectDeclaredSensor(sensor) {
+    return 'source' in sensor && sensor.source === 'project';
+}
+function isPackBoundManifestSensor(sensor) {
+    return !isProjectDeclaredSensor(sensor);
+}
+/** Narrow a parsed v3 manifest to the pack-bound shape expected by migrate/materialize. */
+function asPackBoundProjectSensors(manifest) {
+    if (typeof manifest.pack !== 'string' || manifest.pack.length === 0 || !manifest.source) {
+        throw new Error('project-sensors manifest requires a nonempty pack and source.registry');
+    }
+    for (const [name, sensor] of Object.entries(manifest.sensors)) {
+        if (isProjectDeclaredSensor(sensor)) {
+            throw new Error(`sensors.${name} is project-declared; pack-bound operation required`);
+        }
+    }
+    return manifest;
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -93,6 +119,9 @@ function parseLegacySensor(input, source, location) {
     if (typeof input === 'string')
         return { cmd: text(input, source, `${location}.cmd`) };
     const value = record(input, source, location);
+    if (value.source === 'project') {
+        invalid(source, `${location}.source "project" requires schemaVersion 3; migrate-to-v3`);
+    }
     fields(value, ['cmd', 'fast', 'enabled', 'timeout', 'changedCmd', 'changedExtensions', 'formatter'], source, location);
     const sensor = {};
     if ('cmd' in value)
@@ -138,14 +167,96 @@ function parseLegacyManifest(value, source) {
     }
     return manifest;
 }
+function parseApplicability(input, source, location) {
+    const applicabilityInput = record(input, source, location);
+    fields(applicabilityInput, ['allFiles', 'anyFiles', 'kind'], source, location);
+    const applicability = {};
+    if ('allFiles' in applicabilityInput) {
+        applicability.allFiles = stringArray(applicabilityInput.allFiles, source, `${location}.allFiles`, false)
+            .map((file, index) => asset(file, source, `${location}.allFiles[${index}]`));
+    }
+    if ('anyFiles' in applicabilityInput) {
+        applicability.anyFiles = stringArray(applicabilityInput.anyFiles, source, `${location}.anyFiles`, false)
+            .map((file, index) => asset(file, source, `${location}.anyFiles[${index}]`));
+    }
+    if ('kind' in applicabilityInput) {
+        const kind = text(applicabilityInput.kind, source, `${location}.kind`);
+        if (kind !== 'explicit-or-supported-language' && kind !== 'explicit-opt-in') {
+            invalid(source, `${location}.kind must be a supported applicability kind`);
+        }
+        applicability.kind = kind;
+    }
+    if (Object.keys(applicability).length === 0)
+        invalid(source, `${location} must declare a condition`);
+    return applicability;
+}
+function parseProjectSensor(input, source, location) {
+    const value = record(input, source, location);
+    if ('variantId' in value)
+        invalid(source, `${location}.variantId is forbidden on source:"project" entries`);
+    if ('initializedCompatibility' in value)
+        invalid(source, `${location}.initializedCompatibility is forbidden on source:"project" entries`);
+    fields(value, ['source', 'enabled', 'command', 'formatter', 'fast', 'timeout', 'assets', 'applicability', 'description'], source, location);
+    if (value.source !== 'project')
+        invalid(source, `${location}.source must be "project"`);
+    if (typeof value.enabled !== 'boolean')
+        invalid(source, `${location}.enabled must be a boolean`);
+    const sensor = {
+        source: 'project',
+        enabled: value.enabled,
+        command: (0, contract_1.parseStructuredCommand)(value.command, source, `${location}.command`),
+        formatter: 'exit-code',
+    };
+    if ('formatter' in value) {
+        const formatter = text(value.formatter, source, `${location}.formatter`);
+        if (!PROJECT_FORMATTERS.has(formatter))
+            invalid(source, `${location}.formatter is not a registered formatter id`);
+        sensor.formatter = formatter;
+    }
+    if ('assets' in value) {
+        sensor.assets = stringArray(value.assets, source, `${location}.assets`, true)
+            .map((entry, index) => asset(entry, source, `${location}.assets[${index}]`));
+    }
+    if ('applicability' in value)
+        sensor.applicability = parseApplicability(value.applicability, source, `${location}.applicability`);
+    if ('description' in value)
+        sensor.description = text(value.description, source, `${location}.description`);
+    if ('fast' in value) {
+        if (typeof value.fast !== 'boolean')
+            invalid(source, `${location}.fast must be a boolean`);
+        sensor.fast = value.fast;
+    }
+    if ('timeout' in value) {
+        try {
+            sensor.timeout = (0, timeout_1.positiveTimeout)(value.timeout, `${location}.timeout`);
+        }
+        catch (error) {
+            invalid(source, error instanceof Error ? error.message : `${location}.timeout must be a positive safe integer`);
+        }
+    }
+    return sensor;
+}
+function parseV3SensorEntry(input, source, location) {
+    const value = record(input, source, location);
+    if (value.source === 'project')
+        return parseProjectSensor(value, source, location);
+    const unmarkedCustom = !('variantId' in value) && !('initializedCompatibility' in value) && 'command' in value;
+    if (unmarkedCustom) {
+        invalid(source, `${location}.source is required for project-declared sensors; add source:"project"`);
+    }
+    return parseV2Sensor(input, source, location);
+}
 function parseV2Sensor(input, source, location) {
     const value = record(input, source, location);
+    if (value.source === 'project') {
+        invalid(source, `${location}.source "project" requires schemaVersion 3; migrate-to-v3`);
+    }
     fields(value, ['enabled', 'fast', 'timeout', 'variantId', 'command', 'assets', 'policyRef', 'initializedCompatibility'], source, location);
     if (typeof value.enabled !== 'boolean')
         invalid(source, `${location}.enabled must be a boolean`);
     const sensor = {
         enabled: value.enabled, variantId: id(value.variantId, source, `${location}.variantId`),
-        command: (0, contract_1.parseStructuredCommand)(value.command, source),
+        command: (0, contract_1.parseStructuredCommand)(value.command, source, `${location}.command`),
         initializedCompatibility: parseCompatibilityEvidence(value.initializedCompatibility, source, `${location}.initializedCompatibility`),
     };
     if (sensor.initializedCompatibility.variantId !== null && sensor.initializedCompatibility.variantId !== sensor.variantId)
@@ -226,24 +337,28 @@ function parseV2Manifest(value, source) {
     }
     return manifest;
 }
-function parseV3ProjectManifest(value, source) {
+function parseV3ProjectManifestRoot(value, source) {
     fields(value, ['schemaVersion', 'mode', 'pack', 'packSelection', 'source', 'packageRoot', 'sensors', 'concurrency'], source, 'root');
-    const sourceValue = record(value.source, source, 'source');
-    fields(sourceValue, ['registry'], source, 'source');
-    const sensorsInput = record(value.sensors, source, 'sensors');
-    const sensors = {};
-    for (const name of Object.keys(sensorsInput))
-        sensors[id(name, source, 'sensor id')] = parseV2Sensor(sensorsInput[name], source, `sensors.${name}`);
+    const hasPackKey = 'pack' in value;
+    const pack = !hasPackKey ? undefined : value.pack === null ? null : id(value.pack, source, 'pack');
     const manifest = {
         schemaVersion: 3,
         mode: 'project-sensors',
-        pack: id(value.pack, source, 'pack'),
-        source: { registry: id(sourceValue.registry, source, 'source.registry') },
-        sensors,
+        ...(hasPackKey ? { pack } : {}),
     };
+    if (typeof pack === 'string' && pack.length > 0) {
+        const sourceValue = record(value.source, source, 'source');
+        fields(sourceValue, ['registry'], source, 'source');
+        manifest.source = { registry: id(sourceValue.registry, source, 'source.registry') };
+    }
+    else if ('source' in value) {
+        invalid(source, 'source requires a nonempty pack id');
+    }
     if ('packSelection' in value) {
         if (value.packSelection !== 'explicit')
             invalid(source, 'packSelection must be "explicit" when present');
+        if (typeof pack !== 'string' || pack.length === 0)
+            invalid(source, 'packSelection requires a nonempty pack id');
         manifest.packSelection = 'explicit';
     }
     if ('packageRoot' in value)
@@ -255,26 +370,63 @@ function parseV3ProjectManifest(value, source) {
     }
     return manifest;
 }
+function parseV3ProjectSensorsMap(sensorsInput, source, soft) {
+    const sensors = {};
+    const invalidEntries = [];
+    for (const name of Object.keys(sensorsInput)) {
+        const sensorName = id(name, source, 'sensor id');
+        try {
+            sensors[sensorName] = parseV3SensorEntry(sensorsInput[name], source, `sensors.${sensorName}`);
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            if (!soft)
+                throw error instanceof Error ? error : new Error(reason);
+            invalidEntries.push({ name: sensorName, reason });
+        }
+    }
+    return { sensors, invalidEntries };
+}
+function parseV3ProjectManifest(value, source, soft) {
+    const root = parseV3ProjectManifestRoot(value, source);
+    const sensorsInput = record(value.sensors, source, 'sensors');
+    const { sensors, invalidEntries } = parseV3ProjectSensorsMap(sensorsInput, source, soft);
+    return { pack: { ...root, sensors }, invalidEntries };
+}
 function parseV3Manifest(value, source) {
     if (value.schemaVersion !== 3)
         invalid(source, `unsupported manifest schemaVersion ${String(value.schemaVersion)}; supported: legacy, 2, 3; upgrade or migrate the manifest`);
     if (value.mode === 'project-sensors')
-        return parseV3ProjectManifest(value, source);
+        return parseV3ProjectManifest(value, source, false).pack;
     if (value.mode !== 'native-gate' && value.mode !== 'opt-out')
         invalid(source, 'schemaVersion 3 mode must be "project-sensors", "native-gate", or "opt-out"');
     fields(value, ['schemaVersion', 'mode', 'reason'], source, 'root');
     return { schemaVersion: 3, mode: value.mode, reason: text(value.reason, source, 'reason') };
 }
-function parseSensorManifest(input, source) {
+/** Soft per-entry parse for v3 project-sensors; document-level errors still throw. */
+function parseSensorManifestWithIssues(input, source) {
     const value = record(input, source, 'root');
     if (!('schemaVersion' in value))
-        return { kind: 'legacy', pack: parseLegacyManifest(value, source) };
+        return { kind: 'legacy', pack: parseLegacyManifest(value, source), invalidEntries: [] };
     if (value.schemaVersion === 2)
-        return { kind: 'v2', pack: parseV2Manifest(value, source) };
-    if (value.schemaVersion === 3)
-        return { kind: 'v3', pack: parseV3Manifest(value, source) };
+        return { kind: 'v2', pack: parseV2Manifest(value, source), invalidEntries: [] };
+    if (value.schemaVersion === 3) {
+        if (value.mode === 'project-sensors') {
+            const parsed = parseV3ProjectManifest(value, source, true);
+            return { kind: 'v3', pack: parsed.pack, invalidEntries: parsed.invalidEntries };
+        }
+        return { kind: 'v3', pack: parseV3Manifest(value, source), invalidEntries: [] };
+    }
     invalid(source, `unsupported manifest schemaVersion ${String(value.schemaVersion)}; supported: legacy, 2, 3; upgrade or migrate the manifest`);
 }
+function parseSensorManifest(input, source) {
+    const withIssues = parseSensorManifestWithIssues(input, source);
+    if (withIssues.invalidEntries.length > 0) {
+        throw new Error(withIssues.invalidEntries[0].reason);
+    }
+    const { invalidEntries: _invalidEntries, ...parsed } = withIssues;
+    return parsed;
+}
 function serializeManifestV2(input) {
     const parsed = parseSensorManifest(input, 'manifest serialization');
     if (parsed.kind !== 'v2')

package/dist/src/commands/sensors/compatibility/materialize.js

@@ -217,6 +217,23 @@ function priorAssets(projectRoot) {
         return Object.values(parsedManifest.pack.sensors).flatMap(sensor => sensor.assets ?? []);
     return [];
 }
+/** Existing `"source": "project"` entries to keep when regenerating pack sensors (RF-3.1). */
+function priorProjectSensors(projectRoot) {
+    const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
+    try {
+        const stat = fs_1.default.lstatSync(manifestPath, { bigint: true });
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return {};
+        // Soft-parse so one invalid sibling does not drop every valid project entry.
+        const parsed = (0, manifest_1.parseSensorManifestWithIssues)(JSON.parse((0, safe_file_1.readInspectedBoundedFile)(manifestPath, stat, MAX_ASSET_BYTES, () => new Error('prior manifest unreadable')).toString('utf8')), manifestPath);
+        if (parsed.kind !== 'v3' || parsed.pack.mode !== 'project-sensors')
+            return {};
+        return Object.fromEntries(Object.entries(parsed.pack.sensors).filter(([, sensor]) => (0, manifest_1.isProjectDeclaredSensor)(sensor)));
+    }
+    catch {
+        return {};
+    }
+}
 /** Materialize a previously selected logical registry source into a portable v3 manifest. */
 function materializePortableSensors(input) {
     if (!input || typeof input !== 'object')
@@ -237,18 +254,25 @@ function materializePortableSensors(input) {
     const parsed = (0, manifest_1.parseSensorManifest)(candidate, 'portable materialized manifest');
     if (parsed.kind !== 'v3' || parsed.pack.mode !== 'project-sensors')
         throw new Error('portable materialized manifest must be v3 project-sensors');
-    const manifest = parsed.pack;
-    for (const [name, sensor] of Object.entries(manifest.sensors)) {
-        if (sensor.policyRef)
+    const packBound = (0, manifest_1.asPackBoundProjectSensors)(parsed.pack);
+    for (const [name, sensor] of Object.entries(packBound.sensors)) {
+        if ((0, manifest_1.isPackBoundManifestSensor)(sensor) && sensor.policyRef)
             (0, contract_1.resolveSemgrepPolicy)(sensor.policyRef, path_1.default.join(packRoot, 'pack.json'), `sensors.${name}`);
     }
-    const selected = [...new Set(Object.values(manifest.sensors).flatMap(sensor => sensor.assets ?? []))].map((asset, index) => containedAsset(asset, `assets[${index}]`)).sort();
+    const priorProject = priorProjectSensors(projectRoot);
+    // Project entries win on name collision so regen never drops them (RF-3.1).
+    const manifest = {
+        ...packBound,
+        sensors: { ...packBound.sensors, ...priorProject },
+    };
+    const selected = [...new Set(Object.values(packBound.sensors).flatMap(sensor => sensor.assets ?? []))].map((asset, index) => containedAsset(asset, `assets[${index}]`)).sort();
     // Establish every registry authority and read every selected byte before the
     // first project mutation. A bad later asset must not strand an earlier one.
     const publications = input.configure === false ? [] : selected.map(asset => {
         const selectedSource = selectedRegistryAsset(packRoot, asset);
         return { asset, content: readSelectedRegistryAsset(packRoot, selectedSource, asset) };
     });
+    const manifestExists = fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'));
     return (0, safe_file_1.withProjectLease)(projectRoot, () => {
         const configRoot = manifest.packageRoot ? containedPackageRoot(projectRoot, manifest.packageRoot) : projectRoot;
         const prior = priorAssets(projectRoot);
@@ -273,7 +297,8 @@ function materializePortableSensors(input) {
                         preserved.push(publication.asset);
                 }
             }
-            atomicWrite(projectRoot, '.awm/sensors.json', (0, manifest_1.serializeManifestV3)(manifest), true);
+            // Replace when regenerating over an existing manifest so project entries can be re-merged.
+            atomicWrite(projectRoot, '.awm/sensors.json', (0, manifest_1.serializeManifestV3)(manifest), !manifestExists);
         }
         catch (error) {
             for (const entry of created.reverse()) {

package/dist/src/commands/sensors/compatibility/source.js

@@ -49,10 +49,11 @@ function resolveSensorSource(manifest, deps) {
             || !v3.source || typeof v3.source.registry !== 'string') {
             throw new Error('sensor source resolution requires a valid project-sensors manifest');
         }
-        if (!/^[a-z][a-z0-9-]*$/.test(v3.source.registry)) {
+        const registryName = v3.source.registry;
+        if (!/^[a-z][a-z0-9-]*$/.test(registryName)) {
             throw new Error('sensor source registry must be a stable lowercase id');
         }
-        const matches = registries.filter(entry => entry?.name === v3.source.registry);
+        const matches = registries.filter(entry => entry?.name === registryName);
         if (matches.length !== 1)
             return unavailable('registry-not-installed');
         const source = (0, pack_source_1.listPackSources)(v3.pack, { registries: matches })[0];

package/dist/src/commands/sensors/coverage/render.js

@@ -225,8 +225,9 @@ function assertCoverageEnvelope(report, renderer) {
         return;
     }
     if (staticReport.reason === 'no_reference') {
-        if (report.overall !== 'inconclusive' || !isNonBlankString(report.pack) || !isNonBlankString(report.registry)
-            || staticReport.classes.length !== 0) {
+        const packReferenced = isNonBlankString(report.pack) && isNonBlankString(report.registry);
+        const onlyProject = report.pack === null && report.registry === null;
+        if (report.overall !== 'inconclusive' || staticReport.classes.length !== 0 || (!packReferenced && !onlyProject)) {
             invalidReport(renderer);
         }
         if (report.empirical !== undefined) {
@@ -303,6 +304,11 @@ function renderCoverageHuman(report) {
         return ['Sensor coverage', 'Overall: inconclusive', 'Reason: sensors are not configured', 'Run: awm sensors init', ...(report.empirical ? [empiricalHuman(report)] : []), ''].join('\n');
     }
     if (report.static.reason === 'no_reference') {
+        if (report.pack === null && report.registry === null) {
+            return ['Sensor coverage', 'Pack: none', 'Overall: inconclusive',
+                'No pack coverage reference (project-declared sensors only)',
+                ...(report.empirical ? [empiricalHuman(report)] : []), ''].join('\n');
+        }
         return ['Sensor coverage', `Pack: ${safeHumanText(report.pack ?? 'unknown')}`, `Registry: ${safeHumanText(report.registry ?? 'unknown')}`,
             'Overall: inconclusive', `No coverage reference for pack '${safeHumanText(report.pack ?? 'unknown')}'`, ...(report.empirical ? [empiricalHuman(report)] : []), ''].join('\n');
     }