agentic-workflow-manager 9.21.0 → 9.22.1

package/dist/src/commands/sensors/run.js

@@ -9,6 +9,8 @@ exports.detectPackDrift = detectPackDrift;
 exports.shouldRun = shouldRun;
 exports.resolveConcurrency = resolveConcurrency;
 exports.runSensors = runSensors;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const baseline_1 = require("./baseline");
@@ -28,11 +30,205 @@ const prepare_1 = require("./prepare");
 const verdict_1 = require("./verdict");
 const project_1 = require("./project");
 const read_only_observation_1 = require("./read-only-observation");
+const inputs_digest_1 = require("./inputs-digest");
+const result_cache_1 = require("./result-cache");
+const cli_version_1 = require("../../core/cli-version");
+const worktree_1 = require("../../core/changes/worktree");
+const git_1 = require("../../core/changes/git");
 // Sensor JSON output can be several MB on large repos (e.g. `eslint --format json`
 // with thousands of findings). A 1MB cap killed the child with SIGTERM when
 // exceeded — which previously surfaced as a false "timeout".
 /** Hard ceiling on parallel sensors: past this, they only contend for the same cores. */
 const MAX_CONCURRENCY = 4;
+/** Relative POSIX under gitRoot; realpath both sides (Windows-safe). Empty when same path. */
+function posixJoinRel(root, abs) {
+    return (0, inputs_digest_1.toSafeRepoRel)(root, abs);
+}
+function effectiveClosureOnly(projectOrPack, liveSensor) {
+    if (projectOrPack && projectOrPack.closureOnly !== undefined)
+        return projectOrPack.closureOnly;
+    if (liveSensor && liveSensor.closureOnly !== undefined)
+        return liveSensor.closureOnly;
+    return false;
+}
+function effectiveInputs(manifestInputs, variant) {
+    if (manifestInputs && manifestInputs.length > 0)
+        return manifestInputs;
+    if (variant?.inputs && variant.inputs.length > 0)
+        return variant.inputs;
+    return undefined;
+}
+function includePackageJsonForVariant(variant) {
+    if (!variant)
+        return false;
+    if (variant.command.packageManager)
+        return true;
+    if (variant.requirements.packageJsonFields && variant.requirements.packageJsonFields.length > 0)
+        return true;
+    if (variant.probe.kind === 'package-script-present')
+        return true;
+    return false;
+}
+function sliceSkipExecution(name, requestedScope) {
+    return {
+        name,
+        timeoutMs: 1,
+        timeoutSource: 'fallback',
+        requestedScope,
+        effectiveScope: 'full',
+        syntheticStatus: 'skipped',
+        syntheticReason: 'closureOnly: skipped by --slice',
+    };
+}
+function buildCachePlan(args) {
+    const toolVersion = args.liveState?.toolVersion;
+    const runtimeVersion = args.liveState?.runtimeVersion;
+    const command = args.variant?.command ?? args.command ?? null;
+    const fingerprintParts = {
+        variantId: args.liveState?.variantId ?? args.variant?.id ?? null,
+        command,
+        changedCommand: args.variant?.changedCommand,
+        cliVersion: (0, cli_version_1.cliVersion)(),
+        inputs: args.inputGlobs,
+        toolVersion,
+        runtimeVersion,
+    };
+    // Cache requires live versions (RF-2.10). Receipt measurements still need a fingerprint
+    // when versions are absent so project-declared sensors with inputs do not demote RF-4.6.
+    const cacheFingerprint = (0, result_cache_1.computeSensorFingerprint)(fingerprintParts);
+    const fingerprint = cacheFingerprint
+        ?? (0, result_cache_1.computeSensorFingerprint)(fingerprintParts, { allowMissingLiveVersions: true });
+    if (fingerprint === null)
+        return null;
+    const packageRootRel = posixJoinRel(args.gitRoot, args.packageRoot);
+    const sensorsJsonRel = posixJoinRel(args.gitRoot, args.manifestPath);
+    const includePackageJson = args.variant
+        ? includePackageJsonForVariant(args.variant)
+        : Boolean(args.command?.packageManager);
+    const alwaysMeasuredRepoRels = (0, inputs_digest_1.buildAlwaysMeasuredPaths)({
+        sensorsJsonRel,
+        assetRels: args.assets ?? args.variant?.assets ?? [],
+        configFileRels: args.variant?.requirements.configFiles ?? [],
+        includePackageJson,
+        packageRootRel: packageRootRel === '' ? '' : packageRootRel,
+    });
+    const digest = (0, inputs_digest_1.computeCacheInputDigest)({
+        gitRoot: args.gitRoot,
+        packageRoot: args.packageRoot,
+        inputGlobs: args.inputGlobs,
+        alwaysMeasuredRepoRels,
+    });
+    if (!digest.ok)
+        return null;
+    const projectKey = `sha256:${crypto_1.default.createHash('sha256').update(`${args.manifestPath}\0${args.packageRoot}`).digest('hex')}`;
+    // Baseline is excluded from the cache digest but required for validate (RF-2.12 / RF-4.5).
+    // Derive from the already-safe packageRootRel — do NOT posixJoinRel an absolute path to a
+    // often-missing baseline file (realpath falls back → Windows path.relative goes absolute).
+    const baselineForValidate = packageRootRel === ''
+        ? inputs_digest_1.CACHE_DIGEST_BASELINE_REL
+        : (0, inputs_digest_1.joinRepoRel)(packageRootRel, inputs_digest_1.CACHE_DIGEST_BASELINE_REL);
+    const validateAlwaysMeasuredRepoRels = [...new Set([
+            ...alwaysMeasuredRepoRels,
+            baselineForValidate,
+        ])].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    const rootRel = packageRootRel === '' ? '' : packageRootRel;
+    return {
+        gitRoot: args.gitRoot,
+        projectKey,
+        sensorFingerprint: fingerprint,
+        inputDigest: digest.digest,
+        inputGlobs: args.inputGlobs,
+        packageRootRel: rootRel,
+        alwaysMeasuredRepoRels,
+        measuredPaths: digest.matchedPaths,
+        validateAlwaysMeasuredRepoRels,
+        cacheable: cacheFingerprint !== null,
+    };
+}
+function measurementFromPlan(plan) {
+    return {
+        inputs: [...plan.inputGlobs],
+        packageRootRel: plan.packageRootRel,
+        inputDigest: plan.inputDigest,
+        sensorFingerprint: plan.sensorFingerprint,
+        measuredPaths: [...plan.measuredPaths],
+        alwaysMeasuredPaths: [...plan.validateAlwaysMeasuredRepoRels],
+    };
+}
+async function runPreparedSlot(slot, projectCwd, baseline, cacheEnabled, writeCache) {
+    const { execution, cachePlan } = slot;
+    // RF-2.2/2.6/6.1: synthetic skip/disabled/inconclusive prepare results must not
+    // be overridden by a prior cache hit.
+    const synthetic = execution.syntheticStatus !== undefined;
+    // RF-2.10: cacheable is false without live versions — still attach measurements below.
+    if (cacheEnabled && cachePlan?.cacheable && !synthetic) {
+        const cached = (0, result_cache_1.readResultCache)(cachePlan.gitRoot, {
+            sensorId: execution.name,
+            projectKey: cachePlan.projectKey,
+            sensorFingerprint: cachePlan.sensorFingerprint,
+            inputDigest: cachePlan.inputDigest,
+        });
+        if (cached) {
+            const raw = {
+                name: cached.raw.name,
+                status: cached.raw.status,
+                errors: cached.raw.errors,
+                ...(cached.raw.failureKind ? { failureKind: cached.raw.failureKind } : {}),
+                ...(cached.raw.certification ? { certification: cached.raw.certification } : {}),
+                ...(cached.raw.skipReason ? { skipReason: cached.raw.skipReason } : {}),
+                cached: true,
+                cacheProvenance: {
+                    ...(cached.originCommit ? { originCommit: cached.originCommit } : {}),
+                    originDirty: cached.originDirty,
+                    inputDigest: cached.inputDigest,
+                    sensorFingerprint: cached.sensorFingerprint,
+                },
+                measurement: measurementFromPlan(cachePlan),
+                execution: {
+                    timeoutMs: execution.timeoutMs,
+                    timeoutSource: execution.timeoutSource,
+                    elapsedMs: 0,
+                    requestedScope: execution.requestedScope,
+                    effectiveScope: execution.effectiveScope,
+                },
+            };
+            return baseline ? (0, result_1.applyBaseline)(raw, baseline[execution.name]) : raw;
+        }
+    }
+    const raw = await (0, result_1.executePrepared)(execution, projectCwd);
+    if (cacheEnabled && writeCache && cachePlan?.cacheable && !synthetic && (0, result_cache_1.canCacheRawResult)(raw) && execution.requestedScope === 'full') {
+        const after = (0, inputs_digest_1.computeCacheInputDigest)({
+            gitRoot: cachePlan.gitRoot,
+            packageRoot: projectCwd,
+            inputGlobs: cachePlan.inputGlobs,
+            alwaysMeasuredRepoRels: cachePlan.alwaysMeasuredRepoRels,
+        });
+        if (after.ok && after.digest === cachePlan.inputDigest) {
+            const state = (0, worktree_1.gitState)(cachePlan.gitRoot, true);
+            const originCommit = state.kind === 'ok' ? state.commit : null;
+            const originDirty = state.kind === 'ok' ? state.dirty : true;
+            try {
+                (0, result_cache_1.writeResultCache)(cachePlan.gitRoot, {
+                    schema: 1,
+                    sensorId: execution.name,
+                    projectKey: cachePlan.projectKey,
+                    sensorFingerprint: cachePlan.sensorFingerprint,
+                    inputDigest: cachePlan.inputDigest,
+                    originCommit,
+                    originDirty,
+                    raw: (0, result_cache_1.toCacheRaw)(raw),
+                });
+            }
+            catch {
+                // Cache write is best-effort beside the verdict; never fail the run.
+            }
+        }
+    }
+    const withMeasurement = cachePlan
+        ? { ...raw, measurement: measurementFromPlan(cachePlan) }
+        : raw;
+    return baseline ? (0, result_1.applyBaseline)(withMeasurement, baseline[execution.name]) : withMeasurement;
+}
 async function resolveLiveFromSource(cwd, source, packSelection) {
     try {
         const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
@@ -215,6 +411,22 @@ async function runSensors(opts = {}) {
     const drift = parsed.kind === 'legacy' ? detectPackDrift(manifestDir, parsed.pack) : undefined;
     const requestedScope = opts.changed ? 'changed' : 'full';
     const prepared = [];
+    const cacheEnabled = opts.useCache === true && !opts.ignoreBaseline && !opts.readOnly;
+    const writeCache = cacheEnabled && requestedScope === 'full';
+    // Realpath so Windows git toplevel / Node path forms agree before cache digests.
+    const gitRootRaw = (0, git_1.repoRoot)(manifestDir) ?? manifestDir;
+    let gitRoot = gitRootRaw;
+    try {
+        gitRoot = fs_1.default.realpathSync.native(path_1.default.resolve(gitRootRaw));
+    }
+    catch {
+        try {
+            gitRoot = fs_1.default.realpathSync(path_1.default.resolve(gitRootRaw));
+        }
+        catch {
+            gitRoot = path_1.default.resolve(gitRootRaw);
+        }
+    }
     const activeManifest = parsed.pack;
     const sensorsMap = activeManifest.sensors ?? {};
     const packSelected = projectSensorsManifest !== null && hasSelectedPack(projectSensorsManifest);
@@ -240,6 +452,10 @@ async function runSensors(opts = {}) {
             const fast = projectEntry.fast ?? false;
             if (!shouldRun(fast, opts))
                 continue;
+            if (opts.slice && effectiveClosureOnly(projectEntry, undefined)) {
+                prepared.push({ execution: sliceSkipExecution(name, requestedScope), cachePlan: null });
+                continue;
+            }
             const markers = [
                 ...(projectEntry.applicability?.allFiles ?? []),
                 ...(projectEntry.applicability?.anyFiles ?? []),
@@ -255,9 +471,27 @@ async function runSensors(opts = {}) {
                 projectTimeout: projectEntry.timeout,
                 applicabilityPaths,
             });
-            prepared.push(projectEntry.enabled === false
+            const disabled = projectEntry.enabled === false
                 ? { ...execution, command: undefined, syntheticStatus: 'skipped', syntheticReason: 'disabled' }
-                : execution);
+                : execution;
+            // Project-declared sensors have no live tool/runtime versions → never cache (RF-2.10),
+            // but still attach digests/measurements when authored inputs exist (RF-4.6).
+            let projectPlan = null;
+            const projectInputs = effectiveInputs(projectEntry.inputs, undefined);
+            if (projectInputs) {
+                projectPlan = buildCachePlan({
+                    gitRoot,
+                    packageRoot: projectCwd,
+                    manifestPath: configured.manifestPath,
+                    sensorId: name,
+                    inputGlobs: projectInputs,
+                    variant: undefined,
+                    liveState: undefined,
+                    assets: projectEntry.assets,
+                    command: projectEntry.command,
+                });
+            }
+            prepared.push({ execution: disabled, cachePlan: projectPlan });
             continue;
         }
         const liveSensor = parsed.kind !== 'legacy' ? live?.pack.sensors[name] : undefined;
@@ -294,6 +528,10 @@ async function runSensors(opts = {}) {
             : entry.fast ?? false;
         if (!shouldRun(fast, opts))
             continue;
+        if (opts.slice && effectiveClosureOnly(packBoundSensor, liveSensor)) {
+            prepared.push({ execution: sliceSkipExecution(name, requestedScope), cachePlan: null });
+            continue;
+        }
         const execution = parsed.kind !== 'legacy'
             ? (0, prepare_1.prepareV2Sensor)({
                 name,
@@ -309,14 +547,33 @@ async function runSensors(opts = {}) {
                 requestedScope,
                 changed: changed ?? undefined,
             });
-        prepared.push(packBoundSensor.enabled === false
+        const ready = packBoundSensor.enabled === false
             ? { ...execution, command: undefined, syntheticStatus: 'skipped', syntheticReason: 'disabled' }
-            : execution);
+            : execution;
+        // Measurement (and optional cache) when the sensor has authored inputs — even under
+        // `--no-cache`, so schema-2 receipts still carry digests (RF-4.3 / RF-2.9).
+        let cachePlan = null;
+        if (parsed.kind !== 'legacy') {
+            const variantId = packBoundSensor.variantId;
+            const variant = liveSensor?.variants.find((candidate) => candidate.id === variantId)
+                ?? liveSensor?.variants.find((candidate) => candidate.id === liveState?.variantId);
+            const inputs = effectiveInputs(packBoundSensor.inputs, variant);
+            if (inputs) {
+                cachePlan = buildCachePlan({
+                    gitRoot,
+                    packageRoot: projectCwd,
+                    manifestPath: configured.manifestPath,
+                    sensorId: name,
+                    inputGlobs: inputs,
+                    variant,
+                    liveState,
+                    assets: packBoundSensor.assets ?? variant?.assets,
+                });
+            }
+        }
+        prepared.push({ execution: ready, cachePlan });
     }
-    const results = await pooled(prepared.map(entry => async () => {
-        const result = await (0, result_1.executePrepared)(entry, projectCwd);
-        return baseline ? (0, result_1.applyBaseline)(result, baseline[entry.name]) : result;
-    }), resolveConcurrency(activeManifest, prepared.length));
+    const results = await pooled(prepared.map(slot => async () => runPreparedSlot(slot, projectCwd, baseline, cacheEnabled, writeCache)), resolveConcurrency(activeManifest, prepared.length));
     let overall = (0, verdict_1.reduceVerdict)(results);
     // Legacy commands retain operational compatibility but their shell-backed
     // contract cannot certify a green run.

package/dist/src/commands/sensors/status.js

@@ -15,6 +15,61 @@ const project_1 = require("./project");
 const source_1 = require("./compatibility/source");
 const registries_1 = require("../../core/registries");
 const manifest_1 = require("./compatibility/manifest");
+const UNCACHEABLE_DETAIL = 'not cacheable: no effective inputs';
+function hasAuthoredInputs(inputs) {
+    return Array.isArray(inputs) && inputs.length > 0;
+}
+/** RF-1 effective inputs: project override ?? pack-variant inputs. */
+function hasEffectiveInputs(manifestInputs, variantInputs) {
+    return hasAuthoredInputs(manifestInputs) || hasAuthoredInputs(variantInputs);
+}
+function uncacheableWarning(sensor) {
+    return { sensor, detail: UNCACHEABLE_DETAIL };
+}
+function withWarnings(result, warnings) {
+    return warnings.length === 0 ? result : { ...result, warnings };
+}
+function variantInputsFromPack(pack, sensorName, variantId) {
+    if (!pack || !variantId)
+        return undefined;
+    const sensor = pack.sensors[sensorName];
+    const variant = sensor?.variants.find(candidate => candidate.id === variantId);
+    return variant?.inputs;
+}
+function parsePackForInputs(source) {
+    try {
+        const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
+        return parsed.kind === 'v2' ? parsed.pack : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Enabled v2/v3 sensors without effective inputs → RF-3.4 warnings (never blocks overall). */
+function collectConfiguredInputsWarnings(sensors, pack = null) {
+    const warnings = [];
+    for (const [name, raw] of Object.entries(sensors)) {
+        if (raw.enabled === false)
+            continue;
+        if ((0, manifest_1.isProjectDeclaredSensor)(raw)) {
+            if (!hasAuthoredInputs(raw.inputs)) {
+                warnings.push(uncacheableWarning(name));
+            }
+            continue;
+        }
+        const packBound = raw;
+        if (!hasEffectiveInputs(packBound.inputs, variantInputsFromPack(pack, name, packBound.variantId))) {
+            warnings.push(uncacheableWarning(name));
+        }
+    }
+    return warnings;
+}
+/** Legacy v1 sensors never author `inputs` — every enabled entry is uncacheable. */
+function collectLegacyInputsWarnings(sensors) {
+    return Object.entries(sensors)
+        .filter(([, config]) => config?.enabled !== false)
+        .map(([name]) => uncacheableWarning(name));
+}
 /** First non-flag token after `npx` — the tool the command actually runs. */
 function npxTool(parts) {
     for (let i = 1; i < parts.length; i++) {
@@ -356,12 +411,12 @@ async function computeSensorStatus(cwd = process.cwd()) {
                 checks[name] = { ok: false, detail: 'pack-bound sensor requires a nonempty pack' };
             }
         }
-        return {
+        return withWarnings({
             overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED',
             pack: null,
             checks,
             ...projectMetadata(project, 'project-sensors', 'project-declared-only'),
-        };
+        }, collectConfiguredInputsWarnings(parsed.pack.sensors));
     }
     if (parsed.kind === 'v2' || parsed.kind === 'v3') {
         const parsedPack = parsed.pack;
@@ -378,6 +433,7 @@ async function computeSensorStatus(cwd = process.cwd()) {
             return sourceFailure(project, packId ?? 'unknown', resolution);
         const sourceMeta = resolvedSourceMetadata(resolution);
         const liveIds = livePackSensorIds(resolution.source);
+        const packForInputs = parsePackForInputs(resolution.source);
         const packManifest = packBoundOnly(parsedPack);
         const checks = {};
         let compatibility;
@@ -396,7 +452,10 @@ async function computeSensorStatus(cwd = process.cwd()) {
                         : { ok: false, detail };
                 }
             }
-            return { overall: 'DEGRADED', pack: packId, checks, ...projectMetadata(project, 'project-sensors', sourceMeta.reason, { ...sourceMeta }) };
+            return withWarnings({
+                overall: 'DEGRADED', pack: packId, checks,
+                ...projectMetadata(project, 'project-sensors', sourceMeta.reason, { ...sourceMeta }),
+            }, collectConfiguredInputsWarnings(parsedPack.sensors, packForInputs));
         }
         for (const [name, sensor] of Object.entries(parsedPack.sensors)) {
             if ((0, manifest_1.isProjectDeclaredSensor)(sensor)) {
@@ -408,12 +467,12 @@ async function computeSensorStatus(cwd = process.cwd()) {
                 : staticCompatibilityCheck(packSensor, compatibility[name]) ?? checkStructuredCommand(packSensor.command, packageRoot, packSensor.assets);
         }
         const uninitialized = uninitializedSensors(packManifest, compatibility);
-        return {
+        return withWarnings({
             overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED',
             pack: packId, checks,
             ...(uninitialized ? { uninitialized } : {}),
             ...projectMetadata(project, 'project-sensors', sourceMeta.reason, { ...sourceMeta }),
-        };
+        }, collectConfiguredInputsWarnings(parsedPack.sensors, packForInputs));
     }
     const manifest = parsed.pack;
     const checks = {};
@@ -428,8 +487,8 @@ async function computeSensorStatus(cwd = process.cwd()) {
         }
         checks[name] = checkCmd(config.cmd, packageRoot);
     }
-    return {
+    return withWarnings({
         overall: Object.keys(manifest.sensors ?? {}).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED',
         pack: manifest.pack, checks, ...projectMetadata(project, 'project-sensors', 'legacy-v1'),
-    };
+    }, collectLegacyInputsWarnings(manifest.sensors ?? {}));
 }

package/dist/src/commands/sync.js

@@ -19,6 +19,7 @@ const picocolors_1 = __importDefault(require("picocolors"));
 const paths_1 = require("../core/paths");
 const profile_1 = require("../core/profile");
 const registries_1 = require("../core/registries");
+const registry_sync_report_1 = require("../core/registry-sync-report");
 const bundles_1 = require("../core/bundles");
 const bundle_install_1 = require("../core/bundle-install");
 const profile_pins_1 = require("../core/profile-pins");
@@ -74,9 +75,14 @@ async function runSyncCore(options, deps = {}) {
     }
     const selectedAgents = resolved.targets;
     const syncResults = await d.syncRegistries();
-    for (const r of syncResults) {
-        if (r.action === 'error')
-            console.warn(picocolors_1.default.yellow(`  ⚠  registry ${r.name}: ${r.error}`));
+    // SG-7: any sync/clone failure → non-zero exit. Keep later profile sync / link
+    // repair when usable content remains (audit A1) — aborting here left healthy
+    // registries advanced on disk without reconciling the project tree.
+    const syncHadErrors = (0, registry_sync_report_1.hardFailOnAnyRegistrySyncError)(syncResults);
+    if (syncHadErrors) {
+        for (const e of (0, registries_1.registrySyncErrors)(syncResults)) {
+            console.error(picocolors_1.default.red(`  ✖  registry ${e.name}: ${e.error}`));
+        }
     }
     try {
         (0, registries_1.assertSyncedRegistriesUsable)(syncResults);
@@ -126,7 +132,7 @@ async function runSyncCore(options, deps = {}) {
     reportProjectLinkRepair(d.reconcileProjectSkillLinks(projectRoot, selectedAgents, (0, registries_2.contentRoots)()));
     if (profile.extensions.length === 0) {
         console.log(picocolors_1.default.yellow('No extensions in .awm/profile.json — nothing to sync. Use `awm add <bundle>` first.'));
-        return { code: 0, selectedAgents };
+        return { code: syncHadErrors ? 1 : 0, selectedAgents };
     }
     const method = options.method === 'copy' ? 'copy' : 'symlink';
     let result;
@@ -150,5 +156,5 @@ async function runSyncCore(options, deps = {}) {
     for (const id of result.transactionIds) {
         console.log(picocolors_1.default.dim(`  transaction ${id} — undo with \`awm backup restore ${id}\``));
     }
-    return { code: 0, selectedAgents, result };
+    return { code: syncHadErrors ? 1 : 0, selectedAgents, result };
 }

package/dist/src/commands/update.js

@@ -26,6 +26,7 @@ const paths_1 = require("../core/paths");
 const config_1 = require("../utils/config");
 const agent_targets_1 = require("../core/agent-targets");
 const registries_1 = require("../core/registries");
+const registry_sync_report_1 = require("../core/registry-sync-report");
 const paths_2 = require("../core/paths");
 const regenerate_1 = require("../core/context/regenerate");
 const reconciliation_1 = require("../core/reconciliation");
@@ -59,11 +60,14 @@ function updateOutro(result) {
     const { registries: reg } = result;
     if (reg.configured === 0)
         return 'Nothing updated — no registries configured on this machine.';
-    if (result.code !== 0)
+    // SG-7: sync errors always yield code ≠ 0. When healthy registries still advanced,
+    // later stages ran — say so instead of the unreachable pre-SG-7 "stale content / exit 0".
+    if (result.code !== 0) {
+        if (reg.failed.length > 0 && reg.synced > 0) {
+            return (`⚠ Finished with registry sync errors — ${reg.synced}/${reg.configured} registries synced `
+                + `(failed: ${reg.failed.join(', ')}); see errors above.`);
+        }
         return 'Update failed — see errors above.';
-    if (reg.failed.length > 0) {
-        return `⚠ Updated with stale content — ${reg.synced}/${reg.configured} registries synced, `
-            + `kept on-disk content for: ${reg.failed.join(', ')}.`;
     }
     return `✅ ${reg.synced} ${reg.synced === 1 ? 'registry' : 'registries'}, skills and hooks updated.`;
 }
@@ -90,8 +94,10 @@ async function runUpdateCore(options = {}, deps = {}) {
     const selectedAgents = resolved.targets;
     const registryResults = await d.syncRegistries();
     for (const r of registryResults) {
-        if (r.action === 'error')
-            console.warn(picocolors_1.default.yellow(`  ⚠  registry ${r.name}: ${r.error}`));
+        if (r.action === 'error') {
+            // Printed below as a hard SG-7 failure — skip the stale warn path.
+            continue;
+        }
         else if (r.disposition === 'regressed') {
             const latest = r.availableVersion && r.availableVersion !== r.version
                 ? ` Latest available: ${r.availableVersion}.`
@@ -131,11 +137,16 @@ async function runUpdateCore(options = {}, deps = {}) {
         console.error(picocolors_1.default.dim("  This machine was never initialized: run 'awm init' first."));
         return { code: 1, selectedAgents, registries };
     }
-    // Falla CERRADO solo cuando el registry quedó sin contenido en disco: ahí lo que sigue
-    // leería un árbol inexistente y el fallo reaparecería más tarde, disfrazado de otra
-    // etapa. Un registry que falló pero conserva su contenido queda stale, no roto — se
-    // sigue (doctrina de `unusableSyncedRegistries`: un registry secundario flaky nunca
-    // aborta la corrida) y el cierre lo nombra en vez de declarar éxito parejo.
+    // SG-7: any sync/clone failure → non-zero exit with classified message.
+    // Do NOT abort the later stages early when healthy registries already advanced
+    // on disk (audit A1): reconcile / hooks / self-update still run against usable
+    // content, then the command exits ≠ 0 naming the failed registry.
+    const syncHadErrors = (0, registry_sync_report_1.hardFailOnAnyRegistrySyncError)(registryResults);
+    if (syncHadErrors) {
+        for (const e of (0, registries_1.registrySyncErrors)(registryResults)) {
+            console.error(picocolors_1.default.red(`  ✖  registry ${e.name}: ${e.error}`));
+        }
+    }
     try {
         (0, registries_1.assertSyncedRegistriesUsable)(registryResults);
     }
@@ -188,5 +199,5 @@ async function runUpdateCore(options = {}, deps = {}) {
     // pasa `undefined` a propósito, para que la decisión la tome `defaultSelfUpdateMode()`
     // según haya o no un humano en stdin — no este llamador.
     await d.offerSelfUpdate(options.yes === true ? 'assume-yes' : undefined);
-    return { code: 0, selectedAgents, registries };
+    return { code: syncHadErrors ? 1 : 0, selectedAgents, registries };
 }

package/dist/src/core/changes/derive.js

@@ -96,13 +96,16 @@ const fail = (code, message) => ({ ok: false, diagnostic: { code, message: (0, t
  * conventional commit does), while `semver` and `breaking` cover every commit.
  * `mergeBaseSha` must be a full commit id (the output of `mergeBase`); anything else is `invalid-input`.
  */
-function deriveFields(root, mergeBaseSha) {
+function deriveFields(root, mergeBaseSha, pinnedHead) {
     if (typeof root !== 'string' || root.length === 0)
         return fail('invalid-input', 'repository root must be a non-empty string');
     if (typeof mergeBaseSha !== 'string' || !types_1.COMMIT_ID.test(mergeBaseSha))
         return fail('invalid-input', `merge-base must be a full commit id, got "${(0, text_safety_1.esc)(mergeBaseSha)}"`);
-    // HEAD is read once: the log and the diff below both use this sha, so a HEAD that moves meanwhile cannot mix snapshots.
-    const head = (0, git_1.headSha)(root);
+    if (pinnedHead !== undefined && (typeof pinnedHead !== 'string' || !types_1.COMMIT_ID.test(pinnedHead)))
+        return fail('invalid-input', `pinned HEAD must be a full commit id, got "${(0, text_safety_1.esc)(pinnedHead)}"`);
+    // HEAD is read once: the log and the diff below both use this sha, so a HEAD that moves meanwhile cannot mix snapshots. A
+    // command that already pinned HEAD passes it (and checks `headMovedFailure` afterwards), saving one more `rev-parse`.
+    const head = pinnedHead ?? (0, git_1.headSha)(root);
     if (head === null)
         return fail('git-failed', 'git could not read HEAD');
     const range = `${mergeBaseSha}..${head}`;

package/dist/src/core/changes/git.js

@@ -171,8 +171,7 @@ function isCommittedClean(root, rel) {
  * Unknown state, or an unsafe exclusion, counts as dirty: an unreadable repository must never look clean.
  */
 function isDirtyOutside(root, extraExcludes) {
-    const state = (0, worktree_1.gitState)(root, true, extraExcludes);
-    return state.kind !== 'ok' || state.dirty;
+    return (0, worktree_1.treeDirty)(root, true, extraExcludes) !== false;
 }
 /** Repository root with native separators; null outside a repository. Only `rev-parse`: never a (slow, refreshing) `status`. */
 function repoRoot(cwd) {