agentic-workflow-manager 9.20.4 → 9.22.0

package/dist/src/commands/sensors/run.js

@@ -9,6 +9,8 @@ exports.detectPackDrift = detectPackDrift;
 exports.shouldRun = shouldRun;
 exports.resolveConcurrency = resolveConcurrency;
 exports.runSensors = runSensors;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const baseline_1 = require("./baseline");
@@ -28,11 +30,205 @@ const prepare_1 = require("./prepare");
 const verdict_1 = require("./verdict");
 const project_1 = require("./project");
 const read_only_observation_1 = require("./read-only-observation");
+const inputs_digest_1 = require("./inputs-digest");
+const result_cache_1 = require("./result-cache");
+const cli_version_1 = require("../../core/cli-version");
+const worktree_1 = require("../../core/changes/worktree");
+const git_1 = require("../../core/changes/git");
 // Sensor JSON output can be several MB on large repos (e.g. `eslint --format json`
 // with thousands of findings). A 1MB cap killed the child with SIGTERM when
 // exceeded — which previously surfaced as a false "timeout".
 /** Hard ceiling on parallel sensors: past this, they only contend for the same cores. */
 const MAX_CONCURRENCY = 4;
+/** Relative POSIX under gitRoot; realpath both sides (Windows-safe). Empty when same path. */
+function posixJoinRel(root, abs) {
+    return (0, inputs_digest_1.toSafeRepoRel)(root, abs);
+}
+function effectiveClosureOnly(projectOrPack, liveSensor) {
+    if (projectOrPack && projectOrPack.closureOnly !== undefined)
+        return projectOrPack.closureOnly;
+    if (liveSensor && liveSensor.closureOnly !== undefined)
+        return liveSensor.closureOnly;
+    return false;
+}
+function effectiveInputs(manifestInputs, variant) {
+    if (manifestInputs && manifestInputs.length > 0)
+        return manifestInputs;
+    if (variant?.inputs && variant.inputs.length > 0)
+        return variant.inputs;
+    return undefined;
+}
+function includePackageJsonForVariant(variant) {
+    if (!variant)
+        return false;
+    if (variant.command.packageManager)
+        return true;
+    if (variant.requirements.packageJsonFields && variant.requirements.packageJsonFields.length > 0)
+        return true;
+    if (variant.probe.kind === 'package-script-present')
+        return true;
+    return false;
+}
+function sliceSkipExecution(name, requestedScope) {
+    return {
+        name,
+        timeoutMs: 1,
+        timeoutSource: 'fallback',
+        requestedScope,
+        effectiveScope: 'full',
+        syntheticStatus: 'skipped',
+        syntheticReason: 'closureOnly: skipped by --slice',
+    };
+}
+function buildCachePlan(args) {
+    const toolVersion = args.liveState?.toolVersion;
+    const runtimeVersion = args.liveState?.runtimeVersion;
+    const command = args.variant?.command ?? args.command ?? null;
+    const fingerprintParts = {
+        variantId: args.liveState?.variantId ?? args.variant?.id ?? null,
+        command,
+        changedCommand: args.variant?.changedCommand,
+        cliVersion: (0, cli_version_1.cliVersion)(),
+        inputs: args.inputGlobs,
+        toolVersion,
+        runtimeVersion,
+    };
+    // Cache requires live versions (RF-2.10). Receipt measurements still need a fingerprint
+    // when versions are absent so project-declared sensors with inputs do not demote RF-4.6.
+    const cacheFingerprint = (0, result_cache_1.computeSensorFingerprint)(fingerprintParts);
+    const fingerprint = cacheFingerprint
+        ?? (0, result_cache_1.computeSensorFingerprint)(fingerprintParts, { allowMissingLiveVersions: true });
+    if (fingerprint === null)
+        return null;
+    const packageRootRel = posixJoinRel(args.gitRoot, args.packageRoot);
+    const sensorsJsonRel = posixJoinRel(args.gitRoot, args.manifestPath);
+    const includePackageJson = args.variant
+        ? includePackageJsonForVariant(args.variant)
+        : Boolean(args.command?.packageManager);
+    const alwaysMeasuredRepoRels = (0, inputs_digest_1.buildAlwaysMeasuredPaths)({
+        sensorsJsonRel,
+        assetRels: args.assets ?? args.variant?.assets ?? [],
+        configFileRels: args.variant?.requirements.configFiles ?? [],
+        includePackageJson,
+        packageRootRel: packageRootRel === '' ? '' : packageRootRel,
+    });
+    const digest = (0, inputs_digest_1.computeCacheInputDigest)({
+        gitRoot: args.gitRoot,
+        packageRoot: args.packageRoot,
+        inputGlobs: args.inputGlobs,
+        alwaysMeasuredRepoRels,
+    });
+    if (!digest.ok)
+        return null;
+    const projectKey = `sha256:${crypto_1.default.createHash('sha256').update(`${args.manifestPath}\0${args.packageRoot}`).digest('hex')}`;
+    // Baseline is excluded from the cache digest but required for validate (RF-2.12 / RF-4.5).
+    // Derive from the already-safe packageRootRel — do NOT posixJoinRel an absolute path to a
+    // often-missing baseline file (realpath falls back → Windows path.relative goes absolute).
+    const baselineForValidate = packageRootRel === ''
+        ? inputs_digest_1.CACHE_DIGEST_BASELINE_REL
+        : (0, inputs_digest_1.joinRepoRel)(packageRootRel, inputs_digest_1.CACHE_DIGEST_BASELINE_REL);
+    const validateAlwaysMeasuredRepoRels = [...new Set([
+            ...alwaysMeasuredRepoRels,
+            baselineForValidate,
+        ])].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    const rootRel = packageRootRel === '' ? '' : packageRootRel;
+    return {
+        gitRoot: args.gitRoot,
+        projectKey,
+        sensorFingerprint: fingerprint,
+        inputDigest: digest.digest,
+        inputGlobs: args.inputGlobs,
+        packageRootRel: rootRel,
+        alwaysMeasuredRepoRels,
+        measuredPaths: digest.matchedPaths,
+        validateAlwaysMeasuredRepoRels,
+        cacheable: cacheFingerprint !== null,
+    };
+}
+function measurementFromPlan(plan) {
+    return {
+        inputs: [...plan.inputGlobs],
+        packageRootRel: plan.packageRootRel,
+        inputDigest: plan.inputDigest,
+        sensorFingerprint: plan.sensorFingerprint,
+        measuredPaths: [...plan.measuredPaths],
+        alwaysMeasuredPaths: [...plan.validateAlwaysMeasuredRepoRels],
+    };
+}
+async function runPreparedSlot(slot, projectCwd, baseline, cacheEnabled, writeCache) {
+    const { execution, cachePlan } = slot;
+    // RF-2.2/2.6/6.1: synthetic skip/disabled/inconclusive prepare results must not
+    // be overridden by a prior cache hit.
+    const synthetic = execution.syntheticStatus !== undefined;
+    // RF-2.10: cacheable is false without live versions — still attach measurements below.
+    if (cacheEnabled && cachePlan?.cacheable && !synthetic) {
+        const cached = (0, result_cache_1.readResultCache)(cachePlan.gitRoot, {
+            sensorId: execution.name,
+            projectKey: cachePlan.projectKey,
+            sensorFingerprint: cachePlan.sensorFingerprint,
+            inputDigest: cachePlan.inputDigest,
+        });
+        if (cached) {
+            const raw = {
+                name: cached.raw.name,
+                status: cached.raw.status,
+                errors: cached.raw.errors,
+                ...(cached.raw.failureKind ? { failureKind: cached.raw.failureKind } : {}),
+                ...(cached.raw.certification ? { certification: cached.raw.certification } : {}),
+                ...(cached.raw.skipReason ? { skipReason: cached.raw.skipReason } : {}),
+                cached: true,
+                cacheProvenance: {
+                    ...(cached.originCommit ? { originCommit: cached.originCommit } : {}),
+                    originDirty: cached.originDirty,
+                    inputDigest: cached.inputDigest,
+                    sensorFingerprint: cached.sensorFingerprint,
+                },
+                measurement: measurementFromPlan(cachePlan),
+                execution: {
+                    timeoutMs: execution.timeoutMs,
+                    timeoutSource: execution.timeoutSource,
+                    elapsedMs: 0,
+                    requestedScope: execution.requestedScope,
+                    effectiveScope: execution.effectiveScope,
+                },
+            };
+            return baseline ? (0, result_1.applyBaseline)(raw, baseline[execution.name]) : raw;
+        }
+    }
+    const raw = await (0, result_1.executePrepared)(execution, projectCwd);
+    if (cacheEnabled && writeCache && cachePlan?.cacheable && !synthetic && (0, result_cache_1.canCacheRawResult)(raw) && execution.requestedScope === 'full') {
+        const after = (0, inputs_digest_1.computeCacheInputDigest)({
+            gitRoot: cachePlan.gitRoot,
+            packageRoot: projectCwd,
+            inputGlobs: cachePlan.inputGlobs,
+            alwaysMeasuredRepoRels: cachePlan.alwaysMeasuredRepoRels,
+        });
+        if (after.ok && after.digest === cachePlan.inputDigest) {
+            const state = (0, worktree_1.gitState)(cachePlan.gitRoot, true);
+            const originCommit = state.kind === 'ok' ? state.commit : null;
+            const originDirty = state.kind === 'ok' ? state.dirty : true;
+            try {
+                (0, result_cache_1.writeResultCache)(cachePlan.gitRoot, {
+                    schema: 1,
+                    sensorId: execution.name,
+                    projectKey: cachePlan.projectKey,
+                    sensorFingerprint: cachePlan.sensorFingerprint,
+                    inputDigest: cachePlan.inputDigest,
+                    originCommit,
+                    originDirty,
+                    raw: (0, result_cache_1.toCacheRaw)(raw),
+                });
+            }
+            catch {
+                // Cache write is best-effort beside the verdict; never fail the run.
+            }
+        }
+    }
+    const withMeasurement = cachePlan
+        ? { ...raw, measurement: measurementFromPlan(cachePlan) }
+        : raw;
+    return baseline ? (0, result_1.applyBaseline)(withMeasurement, baseline[execution.name]) : withMeasurement;
+}
 async function resolveLiveFromSource(cwd, source, packSelection) {
     try {
         const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
@@ -215,6 +411,22 @@ async function runSensors(opts = {}) {
     const drift = parsed.kind === 'legacy' ? detectPackDrift(manifestDir, parsed.pack) : undefined;
     const requestedScope = opts.changed ? 'changed' : 'full';
     const prepared = [];
+    const cacheEnabled = opts.useCache === true && !opts.ignoreBaseline && !opts.readOnly;
+    const writeCache = cacheEnabled && requestedScope === 'full';
+    // Realpath so Windows git toplevel / Node path forms agree before cache digests.
+    const gitRootRaw = (0, git_1.repoRoot)(manifestDir) ?? manifestDir;
+    let gitRoot = gitRootRaw;
+    try {
+        gitRoot = fs_1.default.realpathSync.native(path_1.default.resolve(gitRootRaw));
+    }
+    catch {
+        try {
+            gitRoot = fs_1.default.realpathSync(path_1.default.resolve(gitRootRaw));
+        }
+        catch {
+            gitRoot = path_1.default.resolve(gitRootRaw);
+        }
+    }
     const activeManifest = parsed.pack;
     const sensorsMap = activeManifest.sensors ?? {};
     const packSelected = projectSensorsManifest !== null && hasSelectedPack(projectSensorsManifest);
@@ -240,6 +452,10 @@ async function runSensors(opts = {}) {
             const fast = projectEntry.fast ?? false;
             if (!shouldRun(fast, opts))
                 continue;
+            if (opts.slice && effectiveClosureOnly(projectEntry, undefined)) {
+                prepared.push({ execution: sliceSkipExecution(name, requestedScope), cachePlan: null });
+                continue;
+            }
             const markers = [
                 ...(projectEntry.applicability?.allFiles ?? []),
                 ...(projectEntry.applicability?.anyFiles ?? []),
@@ -255,9 +471,27 @@ async function runSensors(opts = {}) {
                 projectTimeout: projectEntry.timeout,
                 applicabilityPaths,
             });
-            prepared.push(projectEntry.enabled === false
+            const disabled = projectEntry.enabled === false
                 ? { ...execution, command: undefined, syntheticStatus: 'skipped', syntheticReason: 'disabled' }
-                : execution);
+                : execution;
+            // Project-declared sensors have no live tool/runtime versions → never cache (RF-2.10),
+            // but still attach digests/measurements when authored inputs exist (RF-4.6).
+            let projectPlan = null;
+            const projectInputs = effectiveInputs(projectEntry.inputs, undefined);
+            if (projectInputs) {
+                projectPlan = buildCachePlan({
+                    gitRoot,
+                    packageRoot: projectCwd,
+                    manifestPath: configured.manifestPath,
+                    sensorId: name,
+                    inputGlobs: projectInputs,
+                    variant: undefined,
+                    liveState: undefined,
+                    assets: projectEntry.assets,
+                    command: projectEntry.command,
+                });
+            }
+            prepared.push({ execution: disabled, cachePlan: projectPlan });
             continue;
         }
         const liveSensor = parsed.kind !== 'legacy' ? live?.pack.sensors[name] : undefined;
@@ -294,6 +528,10 @@ async function runSensors(opts = {}) {
             : entry.fast ?? false;
         if (!shouldRun(fast, opts))
             continue;
+        if (opts.slice && effectiveClosureOnly(packBoundSensor, liveSensor)) {
+            prepared.push({ execution: sliceSkipExecution(name, requestedScope), cachePlan: null });
+            continue;
+        }
         const execution = parsed.kind !== 'legacy'
             ? (0, prepare_1.prepareV2Sensor)({
                 name,
@@ -309,14 +547,33 @@ async function runSensors(opts = {}) {
                 requestedScope,
                 changed: changed ?? undefined,
             });
-        prepared.push(packBoundSensor.enabled === false
+        const ready = packBoundSensor.enabled === false
             ? { ...execution, command: undefined, syntheticStatus: 'skipped', syntheticReason: 'disabled' }
-            : execution);
+            : execution;
+        // Measurement (and optional cache) when the sensor has authored inputs — even under
+        // `--no-cache`, so schema-2 receipts still carry digests (RF-4.3 / RF-2.9).
+        let cachePlan = null;
+        if (parsed.kind !== 'legacy') {
+            const variantId = packBoundSensor.variantId;
+            const variant = liveSensor?.variants.find((candidate) => candidate.id === variantId)
+                ?? liveSensor?.variants.find((candidate) => candidate.id === liveState?.variantId);
+            const inputs = effectiveInputs(packBoundSensor.inputs, variant);
+            if (inputs) {
+                cachePlan = buildCachePlan({
+                    gitRoot,
+                    packageRoot: projectCwd,
+                    manifestPath: configured.manifestPath,
+                    sensorId: name,
+                    inputGlobs: inputs,
+                    variant,
+                    liveState,
+                    assets: packBoundSensor.assets ?? variant?.assets,
+                });
+            }
+        }
+        prepared.push({ execution: ready, cachePlan });
     }
-    const results = await pooled(prepared.map(entry => async () => {
-        const result = await (0, result_1.executePrepared)(entry, projectCwd);
-        return baseline ? (0, result_1.applyBaseline)(result, baseline[entry.name]) : result;
-    }), resolveConcurrency(activeManifest, prepared.length));
+    const results = await pooled(prepared.map(slot => async () => runPreparedSlot(slot, projectCwd, baseline, cacheEnabled, writeCache)), resolveConcurrency(activeManifest, prepared.length));
     let overall = (0, verdict_1.reduceVerdict)(results);
     // Legacy commands retain operational compatibility but their shell-backed
     // contract cannot certify a green run.

package/dist/src/commands/sensors/status.js

@@ -15,6 +15,61 @@ const project_1 = require("./project");
 const source_1 = require("./compatibility/source");
 const registries_1 = require("../../core/registries");
 const manifest_1 = require("./compatibility/manifest");
+const UNCACHEABLE_DETAIL = 'not cacheable: no effective inputs';
+function hasAuthoredInputs(inputs) {
+    return Array.isArray(inputs) && inputs.length > 0;
+}
+/** RF-1 effective inputs: project override ?? pack-variant inputs. */
+function hasEffectiveInputs(manifestInputs, variantInputs) {
+    return hasAuthoredInputs(manifestInputs) || hasAuthoredInputs(variantInputs);
+}
+function uncacheableWarning(sensor) {
+    return { sensor, detail: UNCACHEABLE_DETAIL };
+}
+function withWarnings(result, warnings) {
+    return warnings.length === 0 ? result : { ...result, warnings };
+}
+function variantInputsFromPack(pack, sensorName, variantId) {
+    if (!pack || !variantId)
+        return undefined;
+    const sensor = pack.sensors[sensorName];
+    const variant = sensor?.variants.find(candidate => candidate.id === variantId);
+    return variant?.inputs;
+}
+function parsePackForInputs(source) {
+    try {
+        const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
+        return parsed.kind === 'v2' ? parsed.pack : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Enabled v2/v3 sensors without effective inputs → RF-3.4 warnings (never blocks overall). */
+function collectConfiguredInputsWarnings(sensors, pack = null) {
+    const warnings = [];
+    for (const [name, raw] of Object.entries(sensors)) {
+        if (raw.enabled === false)
+            continue;
+        if ((0, manifest_1.isProjectDeclaredSensor)(raw)) {
+            if (!hasAuthoredInputs(raw.inputs)) {
+                warnings.push(uncacheableWarning(name));
+            }
+            continue;
+        }
+        const packBound = raw;
+        if (!hasEffectiveInputs(packBound.inputs, variantInputsFromPack(pack, name, packBound.variantId))) {
+            warnings.push(uncacheableWarning(name));
+        }
+    }
+    return warnings;
+}
+/** Legacy v1 sensors never author `inputs` — every enabled entry is uncacheable. */
+function collectLegacyInputsWarnings(sensors) {
+    return Object.entries(sensors)
+        .filter(([, config]) => config?.enabled !== false)
+        .map(([name]) => uncacheableWarning(name));
+}
 /** First non-flag token after `npx` — the tool the command actually runs. */
 function npxTool(parts) {
     for (let i = 1; i < parts.length; i++) {
@@ -356,12 +411,12 @@ async function computeSensorStatus(cwd = process.cwd()) {
                 checks[name] = { ok: false, detail: 'pack-bound sensor requires a nonempty pack' };
             }
         }
-        return {
+        return withWarnings({
             overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED',
             pack: null,
             checks,
             ...projectMetadata(project, 'project-sensors', 'project-declared-only'),
-        };
+        }, collectConfiguredInputsWarnings(parsed.pack.sensors));
     }
     if (parsed.kind === 'v2' || parsed.kind === 'v3') {
         const parsedPack = parsed.pack;
@@ -378,6 +433,7 @@ async function computeSensorStatus(cwd = process.cwd()) {
             return sourceFailure(project, packId ?? 'unknown', resolution);
         const sourceMeta = resolvedSourceMetadata(resolution);
         const liveIds = livePackSensorIds(resolution.source);
+        const packForInputs = parsePackForInputs(resolution.source);
         const packManifest = packBoundOnly(parsedPack);
         const checks = {};
         let compatibility;
@@ -396,7 +452,10 @@ async function computeSensorStatus(cwd = process.cwd()) {
                         : { ok: false, detail };
                 }
             }
-            return { overall: 'DEGRADED', pack: packId, checks, ...projectMetadata(project, 'project-sensors', sourceMeta.reason, { ...sourceMeta }) };
+            return withWarnings({
+                overall: 'DEGRADED', pack: packId, checks,
+                ...projectMetadata(project, 'project-sensors', sourceMeta.reason, { ...sourceMeta }),
+            }, collectConfiguredInputsWarnings(parsedPack.sensors, packForInputs));
         }
         for (const [name, sensor] of Object.entries(parsedPack.sensors)) {
             if ((0, manifest_1.isProjectDeclaredSensor)(sensor)) {
@@ -408,12 +467,12 @@ async function computeSensorStatus(cwd = process.cwd()) {
                 : staticCompatibilityCheck(packSensor, compatibility[name]) ?? checkStructuredCommand(packSensor.command, packageRoot, packSensor.assets);
         }
         const uninitialized = uninitializedSensors(packManifest, compatibility);
-        return {
+        return withWarnings({
             overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED',
             pack: packId, checks,
             ...(uninitialized ? { uninitialized } : {}),
             ...projectMetadata(project, 'project-sensors', sourceMeta.reason, { ...sourceMeta }),
-        };
+        }, collectConfiguredInputsWarnings(parsedPack.sensors, packForInputs));
     }
     const manifest = parsed.pack;
     const checks = {};
@@ -428,8 +487,8 @@ async function computeSensorStatus(cwd = process.cwd()) {
         }
         checks[name] = checkCmd(config.cmd, packageRoot);
     }
-    return {
+    return withWarnings({
         overall: Object.keys(manifest.sensors ?? {}).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED',
         pack: manifest.pack, checks, ...projectMetadata(project, 'project-sensors', 'legacy-v1'),
-    };
+    }, collectLegacyInputsWarnings(manifest.sensors ?? {}));
 }

package/dist/src/commands/watch/init.js

@@ -18,6 +18,7 @@ const lock_1 = require("./lock");
 const validate_1 = require("../../core/plan/validate");
 const identity_1 = require("../../core/plan/identity");
 const native_bridge_1 = require("../../core/secure-fs/native-bridge");
+const awm_gitignore_1 = require("../../core/awm-gitignore");
 const MAX_VERIFIER_SCAN_DEPTH = 64;
 const MAX_VERIFIER_SCAN_ENTRIES = 10000;
 const MAX_PACKAGE_JSON_BYTES = 256 * 1024;
@@ -81,22 +82,9 @@ function detectRequiredVerifiers(repoRoot) {
     visit(repoRoot, 0);
     return ['test', 'sensors'].filter((kind) => kinds.has(kind));
 }
-/** El journal es gitignoreado (R1.1): sus escrituras jamas alteran fingerprints. */
+/** El journal es gitignoreado (R1.1): bloque gestionado D-024 / #218. */
 function ensureJournalGitignored(repoRoot) {
-    const gi = path_1.default.join(repoRoot, '.gitignore');
-    let current = '';
-    try {
-        if (fs_1.default.lstatSync(gi).isSymbolicLink())
-            throw new Error('.gitignore must not be a symlink');
-        current = fs_1.default.readFileSync(gi, 'utf8');
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-    }
-    if (!current.split('\n').some((l) => l.trim() === '.awm/' || l.trim() === '.awm')) {
-        fs_1.default.writeFileSync(gi, current.length > 0 && !current.endsWith('\n') ? `${current}\n.awm/\n` : `${current}.awm/\n`);
-    }
+    (0, awm_gitignore_1.upsertAwmGitignore)(repoRoot);
 }
 const TERMINAL_JOB_STATES = new Set(['exited', 'cancelled']);
 function rebindBlocker(state) {