agentic-workflow-manager 9.21.0 → 9.22.1

package/dist/tests/commands/changes/list.test.js

@@ -57,20 +57,46 @@ afterEach(() => expect(listReal()).toEqual(realBefore));
 const UNSAFE = /[\u0000-\u001f\u007f-\u009f\u2028\u2029\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/;
 let repo;
 let template;
-beforeAll(() => { template = (0, helpers_1.makeRepo)(); });
-afterAll(() => template.cleanup());
+/** The template plus `buildHistory`, built once: `history()` starts a test from a copy of it (no git process). */
+let historic;
+beforeAll(() => {
+    template = (0, helpers_1.makeRepo)();
+    historic = (0, helpers_1.cloneRepo)(template);
+    buildHistory(historic);
+});
+afterAll(() => { historic.cleanup(); template.cleanup(); });
 beforeEach(() => { repo = (0, helpers_1.cloneRepo)(template); });
 afterEach(() => { jest.restoreAllMocks(); repo.cleanup(); });
 const FIRST = '2026-10-16-first';
+function buildHistory(into) {
+    into.commit({ 'old.ts': '1' }, 'feat: before adoption', '2026-10-16T09:00:00Z');
+    into.commit({ [(0, list_fixtures_1.recordPath)(FIRST)]: (0, list_fixtures_1.record)(FIRST), 'a.ts': '1' }, 'feat: first (#10)', '2026-10-16T20:00:00Z');
+    into.commit({ 'b.ts': '1' }, 'fix: no record', '2026-10-16T21:00:00Z');
+    into.commit({ 'c.ts': '1' }, 'chore(release): v1.0.0 [skip ci]\n\nChange-Record: none', '2026-10-16T22:00:00Z');
+    into.commit({ [(0, list_fixtures_1.recordPath)('2026-10-17-bad')]: '---\nschema: nope\n---\n' }, 'feat: bad record', '2026-10-17T01:00:00Z');
+    into.gitAt('2026-10-17T02:00:00Z', 'tag', '-a', 'v1.0.0', '-m', 'v1.0.0');
+}
+/** The repository after `buildHistory` (a copy of the prebuilt one). */
 function history() {
-    repo.commit({ 'old.ts': '1' }, 'feat: before adoption', '2026-10-16T09:00:00Z');
-    repo.commit({ [(0, list_fixtures_1.recordPath)(FIRST)]: (0, list_fixtures_1.record)(FIRST), 'a.ts': '1' }, 'feat: first (#10)', '2026-10-16T20:00:00Z');
-    repo.commit({ 'b.ts': '1' }, 'fix: no record', '2026-10-16T21:00:00Z');
-    repo.commit({ 'c.ts': '1' }, 'chore(release): v1.0.0 [skip ci]\n\nChange-Record: none', '2026-10-16T22:00:00Z');
-    repo.commit({ [(0, list_fixtures_1.recordPath)('2026-10-17-bad')]: '---\nschema: nope\n---\n' }, 'feat: bad record', '2026-10-17T01:00:00Z');
-    repo.gitAt('2026-10-17T02:00:00Z', 'tag', '-a', 'v1.0.0', '-m', 'v1.0.0');
+    repo.cleanup();
+    repo = (0, helpers_1.cloneRepo)(historic);
 }
 const run = (opts = {}, deps = {}) => (0, changes_1.runChangesList)(repo.root, opts, { now: list_fixtures_1.now, ...deps });
+const sharedRuns = new Map();
+/**
+ * `run(opts)` on the untouched prebuilt history. The command is read-only (R5.7, asserted below), so each distinct run is made once
+ * and its result shared by the tests that only read it.
+ */
+function onHistory(opts) {
+    const key = JSON.stringify(Object.entries(opts).sort(([a], [b]) => a.localeCompare(b)));
+    let r = sharedRuns.get(key);
+    if (r === undefined) {
+        r = (0, changes_1.runChangesList)(historic.root, opts, { now: list_fixtures_1.now });
+        sharedRuns.set(key, r);
+    }
+    return r;
+}
+const historyJson = () => JSON.parse(onHistory({ since: '48h', format: 'json' }).stdout);
 const json = (opts = {}, deps = {}) => JSON.parse(run({ since: '48h', format: 'json', ...opts }, deps).stdout);
 const failure = (r, code) => {
     expect(r.code).toBe(2);
@@ -209,8 +235,7 @@ describe('awm changes list: adoption (R5.4)', () => {
 });
 describe('awm changes list: classification and derived fields (R5.1, R5.3, R5.4, R5.5)', () => {
     test('classifies and derives', () => {
-        history();
-        const out = json();
+        const out = historyJson();
         const byClass = Object.fromEntries(out.changes.map((c) => [c.subject, c.classification]));
         expect(byClass).toEqual({ 'feat: first (#10)': 'recorded', 'fix: no record': 'missing', 'chore(release): v1.0.0 [skip ci]': 'exempt', 'feat: bad record': 'invalid-record' });
         const first = out.changes.find((c) => c.subject === 'feat: first (#10)');
@@ -219,8 +244,7 @@ describe('awm changes list: classification and derived fields (R5.1, R5.3, R5.4,
         expect(out.repo).toBeNull();
     });
     test('pre-adoption commits are omitted', () => {
-        history();
-        expect(JSON.stringify(json())).not.toContain('before adoption');
+        expect(JSON.stringify(historyJson())).not.toContain('before adoption');
     });
     test('repo identity strips credentials', () => {
         history();
@@ -291,28 +315,24 @@ describe('awm changes list: mixed invalid commits, odd dates and shallow clones
 });
 describe('awm changes list: formats (R5.6)', () => {
     test('json is one document on one line', () => {
-        history();
-        const r = run({ since: '48h', format: 'json' });
+        const r = onHistory({ since: '48h', format: 'json' });
         expect(r.stdout.split('\n')).toHaveLength(2);
         expect(Object.keys(JSON.parse(r.stdout))).toEqual(['schema', 'repo', 'base', 'since', 'adopted', 'truncated', 'omitted', 'changes']);
         expect(JSON.parse(r.stdout).adopted).toBe(true);
     });
     test('voice speaks recorded changes and counts the rest', () => {
-        history();
-        const r = run({ since: '48h', format: 'voice' });
+        const r = onHistory({ since: '48h', format: 'voice' });
         expect(r.stdout).toContain('Primer cambio. feat, verificado, 2 validaciones manuales pendientes.');
         expect(r.stdout).toMatch(/1 cambio\(s\) sin record y 1 con record inválido/);
     });
     test('text is a table with the classification of each change', () => {
-        history();
-        const out = run({ since: '48h' }).stdout;
+        const out = onHistory({ since: '48h' }).stdout;
         for (const word of ['recorded', 'missing', 'exempt', 'invalid-record', 'v1.0.0', '#10'])
             expect(out).toContain(word);
         expect(out.split('\n')[0]).toMatch(/^WHEN\s+CLASSIFICATION/);
     });
     test('text is the default format', () => {
-        history();
-        expect(run({ since: '48h' }).stdout).toBe(run({ since: '48h', format: 'text' }).stdout);
+        expect(onHistory({ since: '48h' }).stdout).toBe(onHistory({ since: '48h', format: 'text' }).stdout);
     });
     test('an empty window says so in text', () => {
         history();
@@ -328,9 +348,8 @@ describe('awm changes list: formats (R5.6)', () => {
         expect(run({ since: '48h', format: 'voice' }, deps).stdout).toMatch(/Hay 2 cambio\(s\) más antiguo\(s\) sin mostrar/);
     });
     test('no format prints anything on stderr when it succeeds', () => {
-        history();
         for (const format of ['text', 'json', 'voice'])
-            expect(run({ since: '48h', format }).stderr).toBe('');
+            expect(onHistory({ since: '48h', format }).stderr).toBe('');
     });
 });
 describe('awm changes list: read-only (R5.7)', () => {

package/dist/tests/commands/job/gate-reconcile.test.js

@@ -425,9 +425,20 @@ describe('reap — limpieza explicita con identidad validada (R2.2)', () => {
         expect(m.aliveWithIdentity).toBe(false);
     });
     test('planReap reporta aliveWithIdentity: true para un proceso genuinamente vivo', () => {
-        const { spawnStructured } = require('../../../src/core/journal/process');
+        // Same full-spawn retry as process.test.ts: on windows-11-arm (and
+        // historically windows-latest) a freshly spawned `node -e` can die
+        // before OpenProcess/pidExistsNative sees it. Re-polling the same pid
+        // never helps; a fresh instance can. Three failures still fail loudly.
+        const { spawnStructured, refIsAlive } = require('../../../src/core/journal/process');
         const s = (0, types_1.emptyState)('r');
-        const { child, ref } = spawnStructured(['node', '-e', 'setTimeout(()=>{}, 5000)'], process.cwd(), 'nLive');
+        let { child, ref } = spawnStructured(['node', '-e', 'setTimeout(()=>{}, 5000)'], process.cwd(), 'nLive');
+        for (let attempt = 1; attempt < 3 && !refIsAlive(ref); attempt++) {
+            try {
+                child.kill('SIGKILL');
+            }
+            catch { /* already gone */ }
+            ({ child, ref } = spawnStructured(['node', '-e', 'setTimeout(()=>{}, 5000)'], process.cwd(), 'nLive'));
+        }
         s.jobs['vivo'] = job({ id: 'vivo', executionState: 'running', processRef: ref });
         try {
             const plan = (0, reap_1.planReap)(s);

package/dist/tests/commands/preflight/sensors-inputs.test.js

@@ -0,0 +1,110 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const checks_1 = require("../../../src/commands/preflight/checks");
+const preflight_1 = require("../../../src/commands/preflight");
+/**
+ * RF-3.4 — preflight surfaces a non-blocking (advisory) warning when configured
+ * enabled sensors lack effective `inputs`. Opt-out / native-gate must stay quiet.
+ */
+describe('preflight sensors-inputs warning (RF-3.4)', () => {
+    const dirs = [];
+    const homes = [];
+    let previousHome;
+    beforeEach(() => {
+        previousHome = process.env.AWM_HOME;
+        const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pf-inputs-home-'));
+        homes.push(home);
+        process.env.AWM_HOME = home;
+        fs_1.default.writeFileSync(path_1.default.join(home, 'registries.json'), JSON.stringify([]));
+    });
+    afterEach(() => {
+        if (previousHome === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = previousHome;
+    });
+    afterAll(() => {
+        for (const dir of dirs)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        for (const home of homes)
+            fs_1.default.rmSync(home, { recursive: true, force: true });
+    });
+    function project(opts = {}) {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pf-inputs-'));
+        dirs.push(dir);
+        for (const f of opts.context ?? ['AGENTS.md']) {
+            fs_1.default.writeFileSync(path_1.default.join(dir, f), '# ctx\n');
+        }
+        for (const b of opts.bins ?? ['eslint']) {
+            fs_1.default.mkdirSync(path_1.default.join(dir, 'node_modules', '.bin'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(dir, 'node_modules', '.bin', b), '');
+        }
+        if (opts.manifest !== undefined) {
+            fs_1.default.mkdirSync(path_1.default.join(dir, '.awm'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), typeof opts.manifest === 'string' ? opts.manifest : JSON.stringify(opts.manifest));
+        }
+        return dir;
+    }
+    function check(report, id) {
+        return report.checks.find(c => c.id === id);
+    }
+    function onlyProjectSensor(extra = {}) {
+        return {
+            schemaVersion: 3,
+            mode: 'project-sensors',
+            sensors: {
+                custom: {
+                    source: 'project',
+                    enabled: true,
+                    command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                    formatter: 'exit-code',
+                    ...extra,
+                },
+            },
+        };
+    }
+    it('emits an advisory sensors-inputs warning when an enabled sensor lacks inputs', async () => {
+        const dir = project({ manifest: onlyProjectSensor() });
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report.status).toBe('ready');
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(0);
+        expect(check(report, 'sensors-inputs')).toMatchObject({
+            ok: false,
+            advisory: true,
+            detail: expect.stringMatching(/custom/i),
+            remedy: expect.stringMatching(/inputs|cache/i),
+        });
+        expect(check(report, 'sensors-inputs').detail).toMatch(/not cacheable|no effective inputs|lacks inputs/i);
+        expect((0, preflight_1.formatReport)(report)).toMatch(/⚠.*sensors-inputs/s);
+    });
+    it('omits sensors-inputs when every enabled sensor has effective inputs', async () => {
+        const dir = project({ manifest: onlyProjectSensor({ inputs: ['**/*.ts'] }) });
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report.status).toBe('ready');
+        expect(check(report, 'sensors-inputs')).toBeUndefined();
+    });
+    it('does not warn for disabled sensors that lack inputs', async () => {
+        const dir = project({
+            manifest: onlyProjectSensor({ enabled: false }),
+        });
+        const report = await (0, checks_1.preflight)(dir);
+        expect(check(report, 'sensors-inputs')).toBeUndefined();
+    });
+    it.each([
+        ['native-gate', 'CI is authoritative.', 'native_gate'],
+        ['opt-out', 'No local gate.', 'ungated'],
+    ])('emits no sensors-inputs warning for v3 %s', async (mode, reason, status) => {
+        const dir = project({
+            manifest: { schemaVersion: 3, mode, reason },
+        });
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report.status).toBe(status);
+        expect(check(report, 'sensors-inputs')).toBeUndefined();
+    });
+});

package/dist/tests/commands/registry-sync-honesty.test.js

@@ -0,0 +1,175 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// #238 S2 / SG-7 — soft (add/list) vs hard (sync/update/init/registry add) sync failure UX.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const registry_sync_report_1 = require("../../src/core/registry-sync-report");
+describe('registry-sync-report pure helpers (#238 S2)', () => {
+    it('formatClassifiedRegistryFailure includes name, remote, class, fatal, remedy — never URL userinfo', () => {
+        const token = 'ghp_TESTSECRET_DO_NOT_ECHO';
+        const text = (0, registry_sync_report_1.formatClassifiedRegistryFailure)({
+            name: 'baseline',
+            remote: `https://${token}@example.test/baseline.git`,
+            err: new Error(`fatal: could not read Username for 'https://${token}@example.test': terminal prompts disabled`),
+        });
+        expect(text).toContain('baseline');
+        expect(text).toContain('example.test/baseline.git');
+        expect(text).toMatch(/authentication/i);
+        expect(text).toMatch(/terminal prompts disabled/i);
+        expect(text).toMatch(/credential\.helper/);
+        expect(text).not.toContain(token);
+        expect(text).not.toMatch(/ghp_/);
+    });
+    it('formatRegistrySyncSoftFailure states cached version plus SG-6 cause/remedy', () => {
+        const classified = (0, registry_sync_report_1.formatClassifiedRegistryFailure)({
+            name: 'docs',
+            remote: 'https://example.test/docs.git',
+            err: new Error('fatal: unable to access: Could not resolve host: example.test'),
+        });
+        const soft = (0, registry_sync_report_1.formatRegistrySyncSoftFailure)({
+            name: 'docs',
+            cachedVersion: '1.4.0',
+            classifiedMessage: classified,
+        });
+        expect(soft).toMatch(/cached version v1\.4\.0/i);
+        expect(soft).toContain('docs');
+        expect(soft).toMatch(/network/i);
+        expect(soft).toMatch(/Could not resolve host/i);
+        expect(soft).toMatch(/remedy:/);
+        // B3: soft line must not say "sync failed" twice before the classified clause.
+        expect(soft.match(/sync failed/gi)?.length ?? 0).toBe(1);
+    });
+    it('formatRegistrySyncSoftFailure uses unknown when cachedVersion is null', () => {
+        const soft = (0, registry_sync_report_1.formatRegistrySyncSoftFailure)({
+            name: 'docs',
+            cachedVersion: null,
+            classifiedMessage: 'registry docs sync failed (class=network); remedy: check connectivity',
+        });
+        expect(soft).toMatch(/cached version unknown/i);
+    });
+    it('hardFailOnAnyRegistrySyncError is true when any result is action:error', () => {
+        const ok = [{ name: 'baseline', action: 'pulled', version: 'v1.0.0' }];
+        const mixed = [
+            { name: 'baseline', action: 'pulled', version: 'v1.0.0' },
+            { name: 'docs', action: 'error', error: 'network unreachable' },
+        ];
+        expect((0, registry_sync_report_1.hardFailOnAnyRegistrySyncError)(ok)).toBe(false);
+        expect((0, registry_sync_report_1.hardFailOnAnyRegistrySyncError)(mixed)).toBe(true);
+    });
+    it('formatSoftRegistrySyncFailures emits only usable errored registries with cached version', async () => {
+        const results = [
+            { name: 'ok', action: 'pulled', version: 'v1.0.0' },
+            { name: 'stale', action: 'error', error: 'registry stale sync failed (class=network); remedy: check connectivity' },
+            { name: 'gone', action: 'error', error: 'registry gone sync failed (class=not-found); remedy: verify the remote URL' },
+        ];
+        const lines = await (0, registry_sync_report_1.formatSoftRegistrySyncFailures)(results, {
+            isUsable: (name) => name === 'stale',
+            cachedVersion: (name) => (name === 'stale' ? '2.0.0' : null),
+        });
+        expect(lines).toHaveLength(1);
+        expect(lines[0]).toMatch(/stale/);
+        expect(lines[0]).toMatch(/cached version v2\.0\.0/i);
+        expect(lines[0]).toMatch(/class=network/);
+        expect(lines.join('\n')).not.toMatch(/\bgone\b/);
+    });
+});
+describe('awm sync / update hard-exit on sync error (#238 S2 / SG-7)', () => {
+    const realHome = process.env.HOME;
+    const realAwmHome = process.env.AWM_HOME;
+    let tmpHome;
+    beforeEach(() => {
+        tmpHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-sync-honesty-'));
+        process.env.HOME = tmpHome;
+        process.env.AWM_HOME = path_1.default.join(tmpHome, '.awm');
+        fs_1.default.mkdirSync(process.env.AWM_HOME, { recursive: true });
+        jest.resetModules();
+        jest.doMock('@clack/prompts', () => ({
+            confirm: jest.fn(),
+            isCancel: jest.fn(),
+            intro: jest.fn(),
+            outro: jest.fn(),
+            spinner: jest.fn(() => ({ start: jest.fn(), stop: jest.fn() })),
+        }));
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
+        if (realHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = realHome;
+        if (realAwmHome === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = realAwmHome;
+        jest.resetModules();
+        jest.dontMock('@clack/prompts');
+    });
+    function writePrefs() {
+        const { savePreferences } = require('../../src/utils/config');
+        savePreferences({
+            defaultAgent: 'claude-code',
+            enabledAgents: ['claude-code'],
+            installMethod: 'symlink',
+            defaultScope: 'local',
+        });
+    }
+    function seedUsableDocsRegistry() {
+        const registriesDir = path_1.default.join(process.env.AWM_HOME, 'registries');
+        fs_1.default.mkdirSync(path_1.default.join(registriesDir, 'docs', 'skills'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(registriesDir, 'docs', 'skills', 'x.md'), '# x\n');
+        fs_1.default.writeFileSync(path_1.default.join(process.env.AWM_HOME, 'registries.json'), JSON.stringify([{ name: 'docs', remote: 'https://example.test/docs.git' }]));
+    }
+    it('runSyncCore returns code !== 0 when any registry result is action:error (even if usable on disk)', async () => {
+        writePrefs();
+        seedUsableDocsRegistry();
+        const project = path_1.default.join(tmpHome, 'proj');
+        fs_1.default.mkdirSync(path_1.default.join(project, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(project, '.awm', 'profile.json'), JSON.stringify({ version: 1, extensions: [], agents: ['claude-code'] }));
+        const reconcile = jest.fn(() => []);
+        const { runSyncCore } = require('../../src/commands/sync');
+        const result = await runSyncCore({ cwd: project }, {
+            syncRegistries: async () => [
+                { name: 'docs', action: 'error', error: 'network unreachable' },
+            ],
+            verifyMinCliVersions: () => [],
+            verifyProjectPins: async () => [],
+            syncProfile: () => ({ extensions: [], installed: [], skipped: [], transactionIds: [] }),
+            reconcileProjectSkillLinks: reconcile,
+        });
+        expect(result.code).not.toBe(0);
+        // A1: later stages still run when usable content remains.
+        expect(reconcile).toHaveBeenCalled();
+    });
+    it('runUpdateCore returns code !== 0 when a registry fails even with usable on-disk content', async () => {
+        writePrefs();
+        seedUsableDocsRegistry();
+        const regenerate = jest.fn(() => []);
+        const planReconciliation = jest.fn(() => ({ operations: [], records: [], reports: [] }));
+        const applyInstallPlan = jest.fn(() => ({ installed: [], skipped: [], transactionId: 'tx', modifiedFiles: [] }));
+        const offerSelfUpdate = jest.fn(async () => { });
+        const { runUpdateCore, updateOutro } = require('../../src/commands/update');
+        const result = await runUpdateCore({}, {
+            syncRegistries: async () => [
+                { name: 'docs', action: 'error', error: 'network unreachable' },
+            ],
+            verifyMinCliVersions: () => [],
+            regenerateGlobalContext: regenerate,
+            planReconciliation,
+            applyInstallPlan,
+            resyncInstalledHooks: () => [],
+            offerSelfUpdate,
+        });
+        expect(result.code).not.toBe(0);
+        expect(result.registries.failed).toEqual(['docs']);
+        // A1: pipeline continues after sync error when content is usable.
+        expect(regenerate).toHaveBeenCalled();
+        expect(planReconciliation).toHaveBeenCalled();
+        expect(applyInstallPlan).toHaveBeenCalled();
+        expect(offerSelfUpdate).toHaveBeenCalled();
+        expect(updateOutro(result)).toMatch(/Finished with registry sync errors|Update failed/i);
+    });
+});

package/dist/tests/commands/sensors/compatibility/contract.test.js

@@ -302,4 +302,64 @@ describe('sensor pack v2 contract', () => {
     ])('rejects malformed pack %j', (input, message) => {
         expect(() => (0, contract_1.parseSensorPack)(input, 'pack.json')).toThrow(message);
     });
+    describe('inputs and sensor-level closureOnly (RF-1.1, RF-1.2, RF-1.5, RF-1.7)', () => {
+        it('accepts inputs on variants and closureOnly on the sensor (RF-1.2 pack defaults)', () => {
+            const pack = validPack();
+            pack.sensors.lint.closureOnly = true;
+            pack.sensors.lint.variants[0].inputs = ['**/*.ts', '**/*.[cm]js'];
+            expect((0, contract_1.parseSensorPack)(pack, 'pack.json')).toMatchObject({
+                kind: 'v2',
+                pack: {
+                    sensors: {
+                        lint: {
+                            closureOnly: true,
+                            variants: [{ inputs: ['**/*.ts', '**/*.[cm]js'] }],
+                        },
+                    },
+                },
+            });
+        });
+        it('treats omitted sensor closureOnly as false and does not invent variant inputs', () => {
+            const parsed = (0, contract_1.parseSensorPack)(validPack(), 'pack.json');
+            expect(parsed).toMatchObject({ kind: 'v2' });
+            if (parsed.kind !== 'v2')
+                throw new Error('expected v2 pack');
+            const lint = parsed.pack.sensors.lint;
+            expect(lint.closureOnly ?? false).toBe(false);
+            expect('inputs' in lint.variants[0]).toBe(false);
+        });
+        it('rejects closureOnly on a variant (RF-1.7 sensor-level only)', () => {
+            const pack = validPack();
+            pack.sensors.lint.variants[0].closureOnly = true;
+            expect(() => (0, contract_1.parseSensorPack)(pack, 'pack.json')).toThrow(/unknown field "closureOnly"/);
+        });
+        it('rejects inputs on the sensor object (inputs belong on variants)', () => {
+            const pack = validPack();
+            pack.sensors.lint.inputs = ['**/*.ts'];
+            expect(() => (0, contract_1.parseSensorPack)(pack, 'pack.json')).toThrow(/unknown field "inputs"/);
+        });
+        it.each([
+            [[''], /nonempty single-line/],
+            [['/abs'], /absolute paths are invalid/],
+            [['has\u0000nul'], /NUL or control/],
+            [['../escape'], /contained relative glob/],
+            [['src/{a,b}.ts'], /brace expansion/],
+            [['!negated.ts'], /negation/],
+            [[], /must be a nonempty array/],
+            [['@(a|b).ts'], /extglob|parentheses/],
+            [['+(a).ts'], /extglob|parentheses/],
+            [['*(a).ts'], /extglob|parentheses/],
+            [['?(a).ts'], /extglob|parentheses/],
+            [['(a|b).ts'], /extglob|parentheses/],
+        ])('rejects invalid variant inputs %j', (inputs, reason) => {
+            const pack = validPack();
+            pack.sensors.lint.variants[0].inputs = inputs;
+            expect(() => (0, contract_1.parseSensorPack)(pack, 'pack.json')).toThrow(reason);
+        });
+        it('rejects non-boolean sensor closureOnly', () => {
+            const pack = validPack();
+            pack.sensors.lint.closureOnly = 1;
+            expect(() => (0, contract_1.parseSensorPack)(pack, 'pack.json')).toThrow(/closureOnly must be a boolean/);
+        });
+    });
 });

package/dist/tests/commands/sensors/compatibility/manifest.test.js

@@ -396,4 +396,98 @@ describe('sensor manifest contract', () => {
             expect(soft.invalidEntries.some(entry => /not valid JSON|valid JSON/i.test(entry.reason))).toBe(false);
         });
     });
+    describe('inputs and sensor-level closureOnly (RF-1.1, RF-1.3, RF-1.5, RF-1.7, RF-1.8)', () => {
+        it('accepts inputs and closureOnly on pack-bound and project-declared entries', () => {
+            const packBound = {
+                ...validV2Manifest().sensors.lint,
+                inputs: ['**/*.ts', 'src/**/?est.ts'],
+                closureOnly: true,
+            };
+            const project = projectSensor({
+                inputs: ['lib/**/*.js'],
+                closureOnly: false,
+            });
+            const parsed = (0, manifest_1.parseSensorManifest)({
+                schemaVersion: 3,
+                mode: 'project-sensors',
+                pack: 'js-ts',
+                source: { registry: 'baseline' },
+                sensors: { lint: packBound, custom: project },
+            }, 'sensors.json');
+            expect(parsed).toMatchObject({
+                kind: 'v3',
+                pack: {
+                    sensors: {
+                        lint: { inputs: ['**/*.ts', 'src/**/?est.ts'], closureOnly: true },
+                        custom: { inputs: ['lib/**/*.js'], closureOnly: false },
+                    },
+                },
+            });
+        });
+        it('accepts inputs and closureOnly on v2 pack-bound sensors', () => {
+            const manifest = validV2Manifest();
+            manifest.sensors.lint.inputs = ['**/*.[jt]s'];
+            manifest.sensors.lint.closureOnly = true;
+            expect((0, manifest_1.parseSensorManifest)(manifest, 'sensors.json')).toMatchObject({
+                kind: 'v2',
+                pack: { sensors: { lint: { inputs: ['**/*.[jt]s'], closureOnly: true } } },
+            });
+        });
+        it('treats omitted closureOnly as false and does not invent inputs (RF-1.8)', () => {
+            const parsed = (0, manifest_1.parseSensorManifest)(v3WithPackAndProject(), 'sensors.json');
+            expect(parsed).toMatchObject({ kind: 'v3' });
+            if (parsed.kind !== 'v3' || parsed.pack.mode !== 'project-sensors')
+                throw new Error('expected v3 project-sensors');
+            const lint = parsed.pack.sensors.lint;
+            const custom = parsed.pack.sensors.custom;
+            expect(lint.closureOnly ?? false).toBe(false);
+            expect(custom.closureOnly ?? false).toBe(false);
+            expect('inputs' in lint).toBe(false);
+            expect('inputs' in custom).toBe(false);
+        });
+        it.each([
+            [[''], /sensors\.custom\.inputs\[0\] must be a nonempty single-line/],
+            [['/abs/path'], /sensors\.custom\.inputs\[0\].*absolute paths are invalid/],
+            [['C:/windows'], /sensors\.custom\.inputs\[0\].*absolute paths are invalid/],
+            [['has\u0000nul'], /sensors\.custom\.inputs\[0\].*NUL or control/],
+            [['../escape'], /sensors\.custom\.inputs\[0\].*contained relative glob/],
+            [['foo/../bar'], /sensors\.custom\.inputs\[0\].*contained relative glob/],
+            [['a{b,c}'], /sensors\.custom\.inputs\[0\].*brace expansion/],
+            [['!negated'], /sensors\.custom\.inputs\[0\].*negation/],
+            [['path/with!bang'], /sensors\.custom\.inputs\[0\].*negation/],
+            [[], /sensors\.custom\.inputs must be a nonempty array/],
+            [['@(a|b).ts'], /sensors\.custom\.inputs\[0\].*(?:extglob|parentheses)/],
+            [['+(a).ts'], /sensors\.custom\.inputs\[0\].*(?:extglob|parentheses)/],
+            [['*(a).ts'], /sensors\.custom\.inputs\[0\].*(?:extglob|parentheses)/],
+            [['?(a).ts'], /sensors\.custom\.inputs\[0\].*(?:extglob|parentheses)/],
+            [['(a|b).ts'], /sensors\.custom\.inputs\[0\].*(?:extglob|parentheses)/],
+        ])('rejects invalid project inputs %j', (inputs, reason) => {
+            expect(() => (0, manifest_1.parseSensorManifest)(v3WithPackAndProject({ inputs }), 'sensors.json'))
+                .toThrow(reason);
+        });
+        it('soft-isolates a project entry with bad inputs while keeping siblings', () => {
+            const soft = (0, manifest_1.parseSensorManifestWithIssues)(v3WithPackAndProject({ inputs: ['**/{a,b}.ts'] }), 'sensors.json');
+            expect(soft.invalidEntries).toEqual([
+                expect.objectContaining({
+                    name: 'custom',
+                    reason: expect.stringMatching(/sensors\.custom\.inputs\[0\].*brace expansion/),
+                }),
+            ]);
+            expect(soft.invalidEntries[0]?.reason).not.toMatch(/Invalid sensor pack/);
+            expect(soft).toMatchObject({
+                kind: 'v3',
+                pack: { sensors: { lint: { variantId: 'eslint-9' } } },
+            });
+            expect('custom' in soft.pack.sensors).toBe(false);
+        });
+        it('rejects closureOnly on a non-boolean sensor field', () => {
+            const soft = (0, manifest_1.parseSensorManifestWithIssues)(v3WithPackAndProject({ closureOnly: 'yes' }), 'sensors.json');
+            expect(soft.invalidEntries).toEqual([
+                expect.objectContaining({
+                    name: 'custom',
+                    reason: expect.stringMatching(/sensors\.custom\.closureOnly must be a boolean/),
+                }),
+            ]);
+        });
+    });
 });

package/dist/tests/commands/sensors/exec.test.js

@@ -44,6 +44,7 @@ const exec_1 = require("../../../src/commands/sensors/exec");
 const result_1 = require("../../../src/commands/sensors/result");
 const baseline_1 = require("../../../src/commands/sensors/baseline");
 const prepare_1 = require("../../../src/commands/sensors/prepare");
+const fixture_cleanup_1 = require("../../helpers/fixture-cleanup");
 const sensor = (overrides = {}) => ({
     name: 'lint',
     command: { kind: 'legacy', value: 'node -e "setTimeout(() => {}, 1000)"' },
@@ -401,7 +402,8 @@ describe('runStructuredCommand — Windows local native binaries', () => {
             delete process.env.PATHEXT;
         else
             process.env.PATHEXT = savedPathExt;
-        fs_1.default.rmSync(dir, { recursive: true, force: true });
+        // Windows keeps a just-executed copy of node locked for a moment (EBUSY on unlink).
+        (0, fixture_cleanup_1.removeFixtureTree)(dir);
     });
     it('executes a contained native executable with literal shell-sensitive argv', async () => {
         const executable = path_1.default.join(dir, 'node_modules', '.bin', 'fixture.exe');