agentic-workflow-manager 9.20.4 → 9.22.0

package/dist/src/commands/change/index.js

@@ -23,7 +23,8 @@ const record_io_1 = require("../../core/changes/record-io");
 const text_safety_1 = require("../../core/changes/text-safety");
 const types_1 = require("../../core/changes/types");
 const validate_shape_1 = require("../../core/changes/validate-shape");
-const REMEDY_RECEIPT = 'commit your work, then run awm sensors run';
+/** RF-4.7: full-gate run; cache may reuse when inputs unchanged — never claim every binary must re-exec. */
+const REMEDY_RECEIPT = 'commit your work, then run full-gate awm sensors run (cache may reuse unchanged sensors)';
 const REMEDY_SPLIT = 'split the change into smaller ones';
 const REMEDY_SENSORS = 'reduce the sensors listed in .awm/sensors.json (the sensor receipt makes the record too large)';
 /** R3.4: the remedy that names the cause of an oversized record: the sensor receipt when it outweighs the module list, else the change itself. */
@@ -257,8 +258,18 @@ function failure(json, code, message, remedy) {
 const deriveOnce = (run) => (run.derived ??= (0, derive_1.deriveFields)(run.root, run.mergeBaseSha));
 function lateFiles(run, commit) {
     if (!run.late.has(commit)) {
-        const files = (0, git_1.changedFiles)(run.root, commit, run.head)?.filter((f) => !f.startsWith(`${types_1.RECORD_DIR}/`));
-        run.late.set(commit, files === undefined ? null : { count: files.length, first: files.slice(0, MAX_LATE_PATHS) });
+        const raw = (0, git_1.changedFiles)(run.root, commit, run.head);
+        if (raw === null) {
+            run.late.set(commit, null);
+        }
+        else {
+            // RF-4.5/4.6: when a schema-2 receipt covers every sensor with authored inputs,
+            // measured ∪ always-measured ∪ inputs-glob rematch count; otherwise schema-1 rules.
+            const receiptRead = (0, receipt_1.readReceipt)(run.root, commit);
+            const receipt = receiptRead.ok ? receiptRead.receipt : null;
+            const files = (0, receipt_1.filterLateFilesForReceipt)(raw, receipt, types_1.RECORD_DIR);
+            run.late.set(commit, { count: files.length, first: files.slice(0, MAX_LATE_PATHS) });
+        }
     }
     return run.late.get(commit) ?? null;
 }

package/dist/src/commands/preflight/checks.js

@@ -19,6 +19,7 @@ const registries_2 = require("../../core/registries");
 const check_1 = require("../../core/currentness/check");
 const store_1 = require("../../core/model-policy/store");
 const setup_readiness_1 = require("../../core/model-policy/setup-readiness");
+const awm_gitignore_1 = require("../../core/awm-gitignore");
 const MANIFEST = path_1.default.join('.awm', 'sensors.json');
 function checkRoutingSetup(cwd) {
     const guidance = (0, setup_readiness_1.routingSetupGuidance)((0, store_1.readEffectivePolicy)(cwd));
@@ -325,6 +326,24 @@ function checkSensorsBaseline(cwd, status) {
             + 'so the gate only chases new problems',
     };
 }
+/**
+ * RF-3.4 — advisory only: enabled sensors without effective `inputs` are not cacheable.
+ * Sourced from `computeSensorStatus().warnings` so status and preflight stay aligned.
+ * Omitted when there is nothing to warn about (including opt-out / native-gate).
+ */
+function checkSensorsInputs(status) {
+    const warnings = status.warnings ?? [];
+    if (warnings.length === 0)
+        return null;
+    const names = warnings.map(entry => entry.sensor).join(', ');
+    return {
+        id: 'sensors-inputs',
+        ok: false,
+        advisory: true,
+        detail: `${names} lack effective inputs and are not cacheable`,
+        remedy: 'declare inputs on those sensors (project override or pack variant) so results can be reused',
+    };
+}
 /**
  * Empirical diagnostics intentionally name only stable execution facts. Sensor output
  * can include source, environment values, or tool-specific unbounded text; preflight
@@ -441,6 +460,12 @@ function extractHost(remote) {
  * a PR/MR at all (merge locally, keep the branch as-is), so gating the whole harness on
  * missing tooling here would be wrong. It is FYI, never a blocker.
  */
+function checkAwmGitignore(cwd) {
+    const result = (0, awm_gitignore_1.evaluateAwmGitignorePolicy)(path_1.default.resolve(cwd));
+    if (result.ok)
+        return { id: 'awm-gitignore', ok: true, detail: result.detail };
+    return { id: 'awm-gitignore', ok: false, detail: result.detail, remedy: result.remedy };
+}
 function checkHost(cwd) {
     let remote;
     try {
@@ -521,6 +546,9 @@ async function preflight(cwd = process.cwd(), opts = {}) {
     }
     const sensorStatus = await (0, status_1.computeSensorStatus)(cwd);
     const manifestExists = sensorStatus.mode !== 'missing';
+    // RF-3.4: advisory inputs/cacheability warning (status.warnings is empty for
+    // opt-out / native-gate / missing, so this stays quiet there).
+    const sensorsInputs = checkSensorsInputs(sensorStatus);
     const contextKernel = checkContextKernel(cwd);
     const checks = [
         checkContext(cwd),
@@ -534,12 +562,15 @@ async function preflight(cwd = process.cwd(), opts = {}) {
                 ...(sensorStatus.mode !== 'invalid' ? [await checkTools(cwd, sensorStatus), checkPack(cwd, sensorStatus)] : []),
                 checkSensorsBaseline(cwd, sensorStatus),
             ] : []),
+        ...(sensorsInputs ? [sensorsInputs] : []),
         // The empirical mode is intentionally opt-in: ordinary preflight remains a
         // quick static inspection and must not dispatch project software.
         ...(opts.verifySensors === true ? [await checkSensorExecution(cwd)] : []),
         // Strict mode is the only path that contacts authoritative npm/Git sources.
         ...(opts.requireCurrent === true ? [checkCompatibility()] : []),
         ...checkRoutingSetup(cwd),
+        // Blocking .awm versioning policy (D-024 / #218).
+        checkAwmGitignore(cwd),
         // Runs unconditionally — orthogonal to sensor configuration entirely, this is
         // about PR/MR tooling, not sensors.
         checkHost(cwd),

package/dist/src/commands/sensors/compatibility/contract.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSensorInputs = parseSensorInputs;
 exports.parseSemgrepPolicy = parseSemgrepPolicy;
 exports.resolveSemgrepPolicy = resolveSemgrepPolicy;
 exports.parseStructuredCommand = parseStructuredCommand;
@@ -77,6 +78,48 @@ function assetArray(value, source, location, allowEmpty = false) {
         invalid(source, `${location} must be a ${allowEmpty ? '' : 'nonempty '}array`);
     return value.map((item, index) => asset(item, source, `${location}[${index}]`));
 }
+/**
+ * Validate authored sensor `inputs` globs (RF-1.5).
+ * Matching (later digests) uses pinned picomatch with options `{ dot: true, posix: true }`
+ * and without `nocase` (paths come from `git ls-files`, already normalized).
+ * Supported patterns: `*`, `**`, `?`, character classes. Brace expansion, `!` negation,
+ * and parentheses / picomatch extglobs (`@(a|b)`, `+(a)`, `*(a)`, `?(a)`) are rejected
+ * here so authors never depend on unsupported syntax.
+ *
+ * Throws field-scoped Error messages (no "Invalid sensor pack/manifest" prefix) so both
+ * pack and project parsers can soft-isolate or wrap without a misleading product noun.
+ * `source` is accepted for call-site parity with other parsers; it is unused.
+ */
+function parseSensorInputs(value, _source, location) {
+    if (!Array.isArray(value) || value.length === 0) {
+        throw new Error(`${location} must be a nonempty array`);
+    }
+    return value.map((item, index) => inputGlob(item, `${location}[${index}]`));
+}
+function inputGlob(value, location) {
+    if (typeof value !== 'string' || value.trim().length === 0 || /[\0-\x1f\x7f]/.test(value)) {
+        throw new Error(`${location} must be a nonempty single-line string without NUL or control characters`);
+    }
+    const parsed = value;
+    if (parsed.startsWith('/') || /^[A-Za-z]:[\\/]/.test(parsed) || parsed.startsWith('\\\\')) {
+        throw new Error(`${location} must be a relative glob (absolute paths are invalid)`);
+    }
+    if (parsed.includes('\\'))
+        throw new Error(`${location} must use POSIX separators`);
+    if (parsed.includes('{') || parsed.includes('}')) {
+        throw new Error(`${location} must not use brace expansion`);
+    }
+    if (parsed.includes('!')) {
+        throw new Error(`${location} must not use negation (!)`);
+    }
+    if (parsed.includes('(') || parsed.includes(')')) {
+        throw new Error(`${location} must not use parentheses or picomatch extglobs`);
+    }
+    if (parsed.split('/').some(part => part === '' || part === '.' || part === '..')) {
+        throw new Error(`${location} must be a contained relative glob (no empty, ., or .. segments)`);
+    }
+    return parsed;
+}
 const SEMGREP_POLICY_REF = 'shared/semgrep-policy.json';
 const MAX_POLICY_BYTES = 64 * 1024;
 function contained(root, candidate) {
@@ -201,7 +244,7 @@ function parseStructuredCommand(input, source, location = 'command') {
 }
 function parseVariant(input, source, location) {
     const value = record(input, source, location);
-    fields(value, ['id', 'priority', 'requirements', 'certifiedRange', 'command', 'changedCommand', 'assets', 'formatter', 'probe', 'policyRef'], source, location);
+    fields(value, ['id', 'priority', 'requirements', 'certifiedRange', 'command', 'changedCommand', 'assets', 'formatter', 'probe', 'policyRef', 'inputs'], source, location);
     const certifiedRange = text(value.certifiedRange, source, `${location}.certifiedRange`);
     if (semver_1.default.validRange(certifiedRange) === null)
         invalid(source, `${location}.certifiedRange must be a valid semver range`);
@@ -239,6 +282,7 @@ function parseVariant(input, source, location) {
     const changedCommand = 'changedCommand' in value ? parseStructuredCommand(value.changedCommand, source) : undefined;
     if (changedCommand && !changedCommand.fileInput)
         invalid(source, `${location}.changedCommand must declare fileInput`);
+    const inputs = 'inputs' in value ? parseSensorInputs(value.inputs, source, `${location}.inputs`) : undefined;
     return {
         id: id(value.id, source, `${location}.id`),
         priority: value.priority,
@@ -253,6 +297,7 @@ function parseVariant(input, source, location) {
         ...(policy ? { policyRef: SEMGREP_POLICY_REF } : {}),
         command: parseStructuredCommand(value.command, source),
         ...(changedCommand ? { changedCommand } : {}),
+        ...(inputs ? { inputs } : {}),
     };
 }
 function parseHardening(input, source) {
@@ -288,7 +333,7 @@ function assertNoEqualPriorityOverlap(variants) {
 }
 function parseSensor(input, source, location, variantIds) {
     const value = record(input, source, location);
-    fields(value, ['applicability', 'variants', 'fast', 'timeout'], source, location);
+    fields(value, ['applicability', 'variants', 'fast', 'timeout', 'closureOnly'], source, location);
     if (!Array.isArray(value.variants) || value.variants.length === 0)
         invalid(source, `${location}.variants must be a nonempty array`);
     const variants = value.variants.map((variant, index) => parseVariant(variant, source, `${location}.variants[${index}]`));
@@ -320,6 +365,8 @@ function parseSensor(input, source, location, variantIds) {
         invalid(source, `${location}.applicability must declare a condition`);
     if ('fast' in value && typeof value.fast !== 'boolean')
         invalid(source, `${location}.fast must be a boolean`);
+    if ('closureOnly' in value && typeof value.closureOnly !== 'boolean')
+        invalid(source, `${location}.closureOnly must be a boolean`);
     let timeout;
     if ('timeout' in value) {
         try {
@@ -329,7 +376,13 @@ function parseSensor(input, source, location, variantIds) {
             invalid(source, error instanceof Error ? error.message : `${location}.timeout must be a positive safe integer`);
         }
     }
-    return { applicability, variants, ...('fast' in value ? { fast: value.fast } : {}), ...(timeout !== undefined ? { timeout } : {}) };
+    return {
+        applicability,
+        variants,
+        ...('fast' in value ? { fast: value.fast } : {}),
+        ...('closureOnly' in value ? { closureOnly: value.closureOnly } : {}),
+        ...(timeout !== undefined ? { timeout } : {}),
+    };
 }
 function legacyCompatibility() {
     return {

package/dist/src/commands/sensors/compatibility/manifest.js

@@ -196,7 +196,7 @@ function parseProjectSensor(input, source, location) {
         invalid(source, `${location}.variantId is forbidden on source:"project" entries`);
     if ('initializedCompatibility' in value)
         invalid(source, `${location}.initializedCompatibility is forbidden on source:"project" entries`);
-    fields(value, ['source', 'enabled', 'command', 'formatter', 'fast', 'timeout', 'assets', 'applicability', 'description'], source, location);
+    fields(value, ['source', 'enabled', 'command', 'formatter', 'fast', 'timeout', 'assets', 'applicability', 'description', 'inputs', 'closureOnly'], source, location);
     if (value.source !== 'project')
         invalid(source, `${location}.source must be "project"`);
     if (typeof value.enabled !== 'boolean')
@@ -226,6 +226,13 @@ function parseProjectSensor(input, source, location) {
             invalid(source, `${location}.fast must be a boolean`);
         sensor.fast = value.fast;
     }
+    if ('closureOnly' in value) {
+        if (typeof value.closureOnly !== 'boolean')
+            invalid(source, `${location}.closureOnly must be a boolean`);
+        sensor.closureOnly = value.closureOnly;
+    }
+    if ('inputs' in value)
+        sensor.inputs = (0, contract_1.parseSensorInputs)(value.inputs, source, `${location}.inputs`);
     if ('timeout' in value) {
         try {
             sensor.timeout = (0, timeout_1.positiveTimeout)(value.timeout, `${location}.timeout`);
@@ -251,7 +258,7 @@ function parseV2Sensor(input, source, location) {
     if (value.source === 'project') {
         invalid(source, `${location}.source "project" requires schemaVersion 3; migrate-to-v3`);
     }
-    fields(value, ['enabled', 'fast', 'timeout', 'variantId', 'command', 'assets', 'policyRef', 'initializedCompatibility'], source, location);
+    fields(value, ['enabled', 'fast', 'timeout', 'variantId', 'command', 'assets', 'policyRef', 'initializedCompatibility', 'inputs', 'closureOnly'], source, location);
     if (typeof value.enabled !== 'boolean')
         invalid(source, `${location}.enabled must be a boolean`);
     const sensor = {
@@ -279,6 +286,13 @@ function parseV2Sensor(input, source, location) {
             invalid(source, `${location}.fast must be a boolean`);
         sensor.fast = value.fast;
     }
+    if ('closureOnly' in value) {
+        if (typeof value.closureOnly !== 'boolean')
+            invalid(source, `${location}.closureOnly must be a boolean`);
+        sensor.closureOnly = value.closureOnly;
+    }
+    if ('inputs' in value)
+        sensor.inputs = (0, contract_1.parseSensorInputs)(value.inputs, source, `${location}.inputs`);
     if ('timeout' in value) {
         try {
             sensor.timeout = (0, timeout_1.positiveTimeout)(value.timeout, `${location}.timeout`);

package/dist/src/commands/sensors/index.js

@@ -51,14 +51,18 @@ function registerSensorsCommand(program) {
         .option('--fast', 'run fast sensors only (tsc, lint)')
         .option('--slow', 'run slow sensors only (semgrep, mutation)')
         .option('--all', 'run all sensors regardless of speed')
+        .option('--slice', 'run every selected sensor except pack/project closureOnly (slice DONE gate)')
         .option('--changed', 'scope sensors that support it to the files changed vs --base')
         .option('--base <ref>', 'comparison point for --changed (default: HEAD, i.e. uncommitted work)')
+        .option('--no-cache', 'ignore fingerprint result cache and execute every selected sensor')
         .action(async (opts) => {
         // R2.2b: the receipt belongs to the manifest that runs (the one `runSensors` resolves from this cwd), not to the cwd.
         const pre = (0, receipt_1.isFullSelection)(opts) ? (0, receipt_1.captureReceiptPrecondition)((0, run_1.findManifestDir)(process.cwd()) ?? process.cwd()) : null;
         const output = await (0, run_1.runSensors)({
-            fast: opts.fast, slow: opts.slow, all: opts.all,
+            fast: opts.fast, slow: opts.slow, all: opts.all, slice: opts.slice,
             changed: opts.changed, base: opts.base,
+            // RF-2.11: only this CLI action enables the cache (unless --no-cache).
+            useCache: opts.cache !== false,
         });
         // Emit the verdict ALWAYS — an empty `sensors` with overall:'not_certified'
         // must be visible, never a silent exit-0 that reads as "clean".
@@ -177,6 +181,11 @@ function registerSensorsCommand(program) {
         for (const [name, gap] of Object.entries(status.uninitialized ?? {})) {
             console.log(`  ${picocolors_1.default.yellow('–')}  ${name.padEnd(12)} not initialized: ${gap.state}/${gap.reason}`);
         }
+        // RF-3.4: enabled sensors without effective inputs are not cacheable.
+        // Non-blocking — same attribution pattern as uninitialized; does not exit.
+        for (const warning of status.warnings ?? []) {
+            console.log(`  ${picocolors_1.default.yellow('⚠')}  ${warning.sensor.padEnd(12)} ${warning.detail}`);
+        }
         console.log('');
         if (status.overall !== 'READY')
             process.exit(1);

package/dist/src/commands/sensors/init.js

@@ -12,6 +12,7 @@ const path_1 = __importDefault(require("path"));
 const pack_source_1 = require("./compatibility/pack-source");
 const bootstrap_1 = require("./bootstrap");
 const unresolved_1 = require("./unresolved");
+const awm_gitignore_1 = require("../../core/awm-gitignore");
 /** Read a pack only through the shared source resolver.  Init is a registry
  * boundary: a pack path that is absent is harmless, but a symlink or escaping
  * claimed source is never silently downgraded to an empty manifest. */
@@ -165,12 +166,17 @@ async function initSensors(opts = {}) {
     }
     if (plan.kind === 'migrate')
         throw new Error('initSensors does not migrate existing v2 manifests; run awm sensors bootstrap');
-    if (plan.kind === 'noop')
+    if (plan.kind === 'noop') {
+        // Repair path: existing project `.awm/` should still get the managed block (GI-1 remedy).
+        if (fs_1.default.existsSync(path_1.default.join(cwd, '.awm')))
+            (0, awm_gitignore_1.upsertAwmGitignore)(cwd);
         return {
             // No manifest is written or synthesized here. The compatibility API only
             // retains its historical result shape for callers that inspect detection.
             manifest: {}, detection: detectStack(detectionCwd), configured: [], status: 'already-configured',
         };
+    }
     (0, bootstrap_1.applySensorBootstrap)(plan);
+    (0, awm_gitignore_1.upsertAwmGitignore)(cwd);
     return { manifest: plan.manifest, detection: detectStack(detectionCwd), configured: [], status: 'created', ...(plan.unresolved && plan.unresolved.length > 0 ? { unresolved: plan.unresolved } : {}) };
 }

package/dist/src/commands/sensors/inputs-digest.js

@@ -0,0 +1,315 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CACHE_DIGEST_BASELINE_REL = exports.MAX_DIGEST_FILE_BYTES = exports.ABSENT_MARKER = exports.PICOMATCH_DIGEST_OPTIONS = void 0;
+exports.isSafeRepoRel = isSafeRepoRel;
+exports.toSafeRepoRel = toSafeRepoRel;
+exports.joinRepoRel = joinRepoRel;
+exports.buildAlwaysMeasuredPaths = buildAlwaysMeasuredPaths;
+exports.repoPathMatchesInputGlobs = repoPathMatchesInputGlobs;
+exports.computeCacheInputDigest = computeCacheInputDigest;
+/// <reference path="../../types/picomatch-posix.d.ts" />
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const posix_1 = __importDefault(require("picomatch/posix"));
+const git_1 = require("../../core/changes/git");
+/**
+ * Picomatch options for sensor input digests (RF-1.5 / RF-1.6).
+ * `dot: true` so patterns like `*` match `.env`; `posix: true` enables POSIX
+ * character classes. No `nocase` — paths come from `git ls-files` (already
+ * normalized). Callers force POSIX path separators via `picomatch/posix`.
+ */
+exports.PICOMATCH_DIGEST_OPTIONS = { dot: true, posix: true };
+/** Explicit marker contributed when a listed path is gone (ENOENT on lstat). */
+exports.ABSENT_MARKER = 'ABSENT';
+/** Hard ceiling on file content hashed into a digest contribution (QA-6). */
+exports.MAX_DIGEST_FILE_BYTES = 1024 * 1024;
+// Baseline is re-applied every run (RF-2.13) and must never enter the cache
+// digest (RF-2.12), even when authored globs like **/*.json would match it.
+/** Repo-root-relative path of the baseline file (never cache-digest measured). */
+exports.CACHE_DIGEST_BASELINE_REL = '.awm/sensors.baseline.json';
+function isExcludedFromCacheDigest(repoRel) {
+    const norm = repoRel.split(path_1.default.sep).join('/');
+    return norm === exports.CACHE_DIGEST_BASELINE_REL || norm.endsWith('/' + exports.CACHE_DIGEST_BASELINE_REL);
+}
+const LOCKFILE_NAMES = [
+    'package-lock.json',
+    'pnpm-lock.yaml',
+    'yarn.lock',
+    'bun.lockb',
+    'Pipfile.lock',
+    'poetry.lock',
+    'uv.lock',
+];
+/**
+ * Repo-root-relative path safety (QA-2): nonempty POSIX segments, no `.` / `..`,
+ * no absolute / drive / backslash forms.
+ */
+function isSafeRepoRel(repoRel) {
+    if (typeof repoRel !== 'string' || repoRel.length === 0 || repoRel !== repoRel.trim())
+        return false;
+    if (repoRel.includes('\\') || repoRel.startsWith('/') || /^[A-Za-z]:/.test(repoRel))
+        return false;
+    return repoRel.split('/').every((segment) => segment !== '' && segment !== '.' && segment !== '..');
+}
+function requireSafeRepoRel(repoRel, label) {
+    const norm = repoRel.split(path_1.default.sep).join('/');
+    if (!isSafeRepoRel(norm))
+        throw new Error(`${label} must be a safe relative path (no ., .., absolute, or escape)`);
+    return norm;
+}
+function resolveRealPath(p) {
+    const resolved = path_1.default.resolve(p);
+    try {
+        return fs_1.default.realpathSync.native(resolved);
+    }
+    catch {
+        try {
+            return fs_1.default.realpathSync(resolved);
+        }
+        catch {
+            return resolved;
+        }
+    }
+}
+function posixRel(from, to) {
+    return path_1.default.relative(from, to).split(path_1.default.sep).join('/');
+}
+/**
+ * Repo-root-relative POSIX path from an absolute (or cwd-relative) path.
+ * Realpaths both sides before `path.relative` so Windows drive-letter / casing /
+ * separator mismatches (git toplevel vs Node paths) cannot yield an absolute
+ * relative string that later fails `isSafeRepoRel`.
+ */
+function toSafeRepoRel(gitRoot, absolutePath, label = 'path') {
+    if (typeof gitRoot !== 'string' || gitRoot.trim() === '')
+        throw new Error('gitRoot must be a nonempty string');
+    if (typeof absolutePath !== 'string' || absolutePath.trim() === '') {
+        throw new Error(`${label} must be a nonempty string`);
+    }
+    const from = resolveRealPath(gitRoot);
+    const to = resolveRealPath(absolutePath);
+    const rel = posixRel(from, to);
+    // Empty means the same path; sensors.json / package roots used here are always nested or equal.
+    // Equal packageRoot → '' is allowed only when callers opt in via allowEmpty.
+    if (rel === '')
+        return '';
+    if (path_1.default.win32.isAbsolute(rel) || path_1.default.posix.isAbsolute(rel) || rel.startsWith('..') || /^[A-Za-z]:/.test(rel)) {
+        throw new Error(`${label} must resolve under gitRoot`);
+    }
+    return requireSafeRepoRel(rel, label);
+}
+function staysUnderRoot(rootReal, candidate) {
+    const rel = path_1.default.relative(rootReal, candidate);
+    return rel === '' || (!rel.startsWith('..') && !path_1.default.isAbsolute(rel));
+}
+function joinRepoRel(packageRootRel, file) {
+    if (typeof packageRootRel !== 'string')
+        throw new Error('packageRootRel must be a string');
+    if (typeof file !== 'string' || file.length === 0)
+        throw new Error('file must be a nonempty string');
+    const cleaned = requireSafeRepoRel(file.replace(/^\/+/, ''), 'path');
+    if (packageRootRel === '')
+        return cleaned;
+    const rootRel = requireSafeRepoRel(packageRootRel.replace(/\/+$/, ''), 'packageRootRel');
+    return `${rootRel}/${cleaned}`;
+}
+/** Build the always-measured path set for the *cache* digest (RF-2.12). Never includes baseline.json. */
+function buildAlwaysMeasuredPaths(input) {
+    if (!input || typeof input !== 'object')
+        throw new Error('always-measured input must be an object');
+    if (typeof input.includePackageJson !== 'boolean')
+        throw new Error('includePackageJson must be a boolean');
+    if (typeof input.packageRootRel !== 'string')
+        throw new Error('packageRootRel must be a string');
+    if (!Array.isArray(input.assetRels) || !Array.isArray(input.configFileRels)) {
+        throw new Error('assetRels and configFileRels must be arrays');
+    }
+    const out = new Set();
+    out.add(requireSafeRepoRel(input.sensorsJsonRel.split(path_1.default.sep).join('/'), 'sensorsJsonRel'));
+    for (const asset of input.assetRels) {
+        if (typeof asset !== 'string' || asset.length === 0)
+            throw new Error('asset path must be a nonempty string');
+        out.add(joinRepoRel(input.packageRootRel, asset));
+    }
+    for (const config of input.configFileRels) {
+        if (typeof config !== 'string' || config.length === 0)
+            throw new Error('configFile path must be a nonempty string');
+        out.add(joinRepoRel(input.packageRootRel, config));
+    }
+    if (input.includePackageJson) {
+        out.add(joinRepoRel(input.packageRootRel, 'package.json'));
+        for (const lock of LOCKFILE_NAMES)
+            out.add(joinRepoRel(input.packageRootRel, lock));
+    }
+    else {
+        for (const lock of LOCKFILE_NAMES)
+            out.add(joinRepoRel(input.packageRootRel, lock));
+    }
+    return [...out].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+}
+function listGitFiles(gitRoot) {
+    const out = (0, git_1.runGit)(gitRoot, ['ls-files', '-co', '--exclude-standard', '-z']);
+    if (out === null)
+        return null;
+    return out.split('\0').filter((p) => p.length > 0);
+}
+function matchGlobs(repoRel, packageRootRel, matchers) {
+    let packageRel = repoRel;
+    if (packageRootRel) {
+        const prefix = packageRootRel.endsWith('/') ? packageRootRel : `${packageRootRel}/`;
+        if (repoRel !== packageRootRel && !repoRel.startsWith(prefix))
+            return false;
+        packageRel = repoRel === packageRootRel ? '' : repoRel.slice(prefix.length);
+    }
+    if (packageRel.length === 0)
+        return false;
+    return matchers.some((m) => m(packageRel));
+}
+/**
+ * Whether a repo-root POSIX path matches authored sensor `inputs` globs under
+ * `packageRootRel` (RF-1.5 picomatch options). Used by receipt late-path validate
+ * so new files matching inputs count as measured (RF-4.5), not only the frozen list.
+ */
+function repoPathMatchesInputGlobs(repoRel, packageRootRel, inputGlobs) {
+    if (typeof repoRel !== 'string' || typeof packageRootRel !== 'string')
+        return false;
+    if (!Array.isArray(inputGlobs) || inputGlobs.some((g) => typeof g !== 'string'))
+        return false;
+    const norm = repoRel.split(path_1.default.sep).join('/');
+    if (!isSafeRepoRel(norm))
+        return false;
+    if (packageRootRel !== '' && !isSafeRepoRel(packageRootRel))
+        return false;
+    const matchers = inputGlobs.map((glob) => (0, posix_1.default)(glob, { ...exports.PICOMATCH_DIGEST_OPTIONS }));
+    return matchGlobs(norm, packageRootRel, matchers);
+}
+function absentContribution(repoRel, reason) {
+    return {
+        path: repoRel,
+        kind: 'absent',
+        marker: exports.ABSENT_MARKER,
+        hash: crypto_1.default.createHash('sha256').update(`ABSENT:${reason}:${repoRel}`).digest('hex'),
+    };
+}
+/**
+ * Hash one matched path without following intermediate symlinks (QA-1) and
+ * without reading files that escape gitRoot or exceed the size cap (QA-2/QA-6).
+ */
+function hashContribution(gitRootReal, repoRel) {
+    if (!isSafeRepoRel(repoRel))
+        return absentContribution(repoRel, 'unsafe-rel');
+    const segments = repoRel.split('/');
+    let current = gitRootReal;
+    for (let i = 0; i < segments.length; i++) {
+        current = path_1.default.join(current, segments[i]);
+        if (!staysUnderRoot(gitRootReal, current))
+            return absentContribution(repoRel, 'escape');
+        let st;
+        try {
+            st = fs_1.default.lstatSync(current);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return absentContribution(repoRel, 'enoent');
+            throw error;
+        }
+        const isLast = i === segments.length - 1;
+        if (st.isSymbolicLink()) {
+            // Intermediate symlink → fail closed (never read through redirected parents).
+            if (!isLast)
+                return absentContribution(repoRel, 'intermediate-symlink');
+            const target = fs_1.default.readlinkSync(current);
+            return {
+                path: repoRel,
+                kind: 'symlink',
+                hash: crypto_1.default.createHash('sha256').update(`symlink:${target}`).digest('hex'),
+            };
+        }
+        if (!isLast) {
+            if (!st.isDirectory())
+                return absentContribution(repoRel, 'not-dir');
+            continue;
+        }
+        if (!st.isFile())
+            return absentContribution(repoRel, 'not-file');
+        if (st.size > exports.MAX_DIGEST_FILE_BYTES)
+            return absentContribution(repoRel, 'oversize');
+        const content = fs_1.default.readFileSync(current);
+        return {
+            path: repoRel,
+            kind: 'file',
+            hash: crypto_1.default.createHash('sha256').update(content).digest('hex'),
+        };
+    }
+    return absentContribution(repoRel, 'empty');
+}
+/**
+ * Compute the cache input digest (RF-2.1 / RF-2.12): git enumeration, picomatch
+ * filter, symlink readlink / ABSENT / file content hashing. Never follows links.
+ */
+function computeCacheInputDigest(opts) {
+    if (!opts || typeof opts !== 'object')
+        throw new Error('digest options must be an object');
+    if (typeof opts.gitRoot !== 'string' || opts.gitRoot.trim() === '')
+        throw new Error('gitRoot must be a nonempty string');
+    if (typeof opts.packageRoot !== 'string' || opts.packageRoot.trim() === '')
+        throw new Error('packageRoot must be a nonempty string');
+    if (!Array.isArray(opts.inputGlobs) || opts.inputGlobs.some((g) => typeof g !== 'string')) {
+        throw new Error('inputGlobs must be an array of strings');
+    }
+    if (!Array.isArray(opts.alwaysMeasuredRepoRels) || opts.alwaysMeasuredRepoRels.some((p) => typeof p !== 'string')) {
+        throw new Error('alwaysMeasuredRepoRels must be an array of strings');
+    }
+    // Prefer realpathSync.native (same as toSafeRepoRel / run.ts). Mixing native vs
+    // non-native on Windows yields drive-absolute path.relative results and false
+    // "packageRoot must be inside gitRoot" after the sensorsJsonRel fix.
+    let gitRootReal;
+    try {
+        gitRootReal = fs_1.default.realpathSync.native(path_1.default.resolve(opts.gitRoot));
+    }
+    catch {
+        try {
+            gitRootReal = fs_1.default.realpathSync(path_1.default.resolve(opts.gitRoot));
+        }
+        catch {
+            return { ok: false, reason: 'git-failed' };
+        }
+    }
+    let packageRootRel;
+    try {
+        packageRootRel = toSafeRepoRel(gitRootReal, opts.packageRoot, 'packageRoot');
+    }
+    catch {
+        throw new Error('packageRoot must be inside gitRoot');
+    }
+    const listed = listGitFiles(gitRootReal);
+    if (listed === null)
+        return { ok: false, reason: 'git-failed' };
+    const matchers = opts.inputGlobs.map((glob) => (0, posix_1.default)(glob, { ...exports.PICOMATCH_DIGEST_OPTIONS }));
+    const matched = new Set();
+    for (const repoRel of listed) {
+        const norm = repoRel.split(path_1.default.sep).join('/');
+        if (!isSafeRepoRel(norm) || isExcludedFromCacheDigest(norm))
+            continue;
+        if (matchGlobs(norm, packageRootRel === '' ? '' : packageRootRel, matchers))
+            matched.add(norm);
+    }
+    for (const always of opts.alwaysMeasuredRepoRels) {
+        const norm = always.split(path_1.default.sep).join('/');
+        if (!isSafeRepoRel(norm)) {
+            throw new Error(`alwaysMeasuredRepoRels entry must be a safe relative path (no ., .., absolute, or escape): ${norm}`);
+        }
+        if (isExcludedFromCacheDigest(norm))
+            continue;
+        matched.add(norm);
+    }
+    const matchedPaths = [...matched].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    const contributions = matchedPaths.map((p) => hashContribution(gitRootReal, p));
+    const canonical = contributions.map((c) => `${c.path}\0${c.kind}\0${c.hash}`).join('\n');
+    const digest = `sha256:${crypto_1.default.createHash('sha256').update(canonical).digest('hex')}`;
+    return { ok: true, digest, matchedPaths, contributions };
+}

package/dist/src/commands/sensors/prepare.js

@@ -33,9 +33,19 @@ function validateRunOptions(opts) {
         throw new Error('run option base must be a nonempty string');
     if (opts.readOnly !== undefined && typeof opts.readOnly !== 'boolean')
         throw new Error('run option readOnly must be a boolean');
+    if (opts.slice !== undefined && typeof opts.slice !== 'boolean')
+        throw new Error('run option slice must be a boolean');
+    if (opts.useCache !== undefined && typeof opts.useCache !== 'boolean')
+        throw new Error('run option useCache must be a boolean');
     if (opts.changed && opts.ignoreBaseline) {
         throw new Error('refusing to combine --changed with a baseline capture: a partial run cannot define the accepted set');
     }
+    if (opts.slice && opts.all) {
+        throw new Error('refusing to combine --slice with --all: slice already selects the non-closureOnly set');
+    }
+    if (opts.slice && opts.slow) {
+        throw new Error('refusing to combine --slice with --slow: use a full gate for closureOnly/slow sensors');
+    }
 }
 /** Expand the one declared file placeholder into literal structured argv entries. */
 function expandFileInput(command, files) {