agentic-workflow-manager 9.4.1 → 9.5.0

package/dist/src/commands/preflight/checks.js

@@ -83,13 +83,13 @@ function checkContextKernel(cwd) {
         remedy: inspection.remedy,
     };
 }
-function readManifest(cwd) {
-    try {
-        return JSON.parse(fs_1.default.readFileSync(path_1.default.join(cwd, MANIFEST), 'utf-8'));
-    }
-    catch {
+function manifestView(status) {
+    if (!status.pack)
         return null;
-    }
+    const sensors = Object.fromEntries(Object.entries(status.checks).map(([name, check]) => [name, {
+            enabled: check.detail !== 'disabled',
+        }]));
+    return { pack: status.pack, sensors };
 }
 /**
  * Total sensor entries and how many are enabled (`enabled !== false`, so a missing
@@ -111,8 +111,8 @@ function countEnabledSensors(manifest) {
  * `awm sensors init`" look identical from the outside, and on a team the second one is
  * the common case. Requiring the manifest turns the decision into a reviewable diff.
  */
-function checkManifest(cwd, manifest) {
-    if (!fs_1.default.existsSync(path_1.default.join(cwd, MANIFEST))) {
+function checkManifest(status) {
+    if (status.mode === 'missing') {
         return {
             id: 'manifest',
             ok: false,
@@ -121,14 +121,26 @@ function checkManifest(cwd, manifest) {
                 + '`"enabled": false` — an unconfigured repo and a deliberate opt-out must not look alike)',
         };
     }
-    if (!manifest) {
+    if (status.mode === 'invalid') {
         return {
             id: 'manifest',
             ok: false,
-            detail: '.awm/sensors.json is not valid JSON',
+            detail: status.reason === 'schema-unsupported'
+                ? '.awm/sensors.json uses an unsupported schema'
+                : '.awm/sensors.json is not valid JSON',
             remedy: 'fix or regenerate it with `awm sensors init`',
         };
     }
+    if (status.mode === 'native-gate')
+        return { id: 'manifest', ok: true, detail: 'native CI quality authority declared', remedy: 'verify the native CI gate before accepting this run' };
+    if (status.mode === 'opt-out')
+        return { id: 'manifest', ok: true, detail: 'local quality gate deliberately disabled', remedy: 'remove the opt-out declaration or provide a quality gate' };
+    if (status.mode === 'source-unavailable' || status.mode === 'source-ambiguous') {
+        return { id: 'manifest', ok: false, detail: `sensor source ${status.mode}: ${status.reason}`, remedy: status.remedy };
+    }
+    const manifest = manifestView(status);
+    if (!manifest)
+        return { id: 'manifest', ok: false, detail: 'sensor authority is unavailable', remedy: 'repair or regenerate the sensor manifest' };
     const { total, enabled } = countEnabledSensors(manifest);
     // total === 0 is NOT an opt-out: a deliberate opt-out lists every known sensor NAME
     // explicitly with `enabled: false` (total > 0, enabled === 0). Zero entries means
@@ -151,8 +163,7 @@ function checkManifest(cwd, manifest) {
     };
 }
 /** Every enabled sensor's command must resolve. This is the check nothing was calling. */
-async function checkTools(cwd) {
-    const status = await (0, status_1.computeSensorStatus)(cwd);
+async function checkTools(cwd, status) {
     if (status.overall === 'NOT_CONFIGURED') {
         return { id: 'tools', ok: false, detail: 'no manifest to check', remedy: 'run `awm sensors init`' };
     }
@@ -188,7 +199,8 @@ async function checkTools(cwd) {
  * same drift (`packDrift`) but never rewrites the manifest, so this is the blocking
  * surface, and `awm sensors init` is the only thing that adopts the real pack.
  */
-function checkPack(cwd, manifest) {
+function checkPack(cwd, status) {
+    const manifest = manifestView(status);
     if (!manifest)
         return { id: 'pack', ok: true, detail: 'skipped (no manifest)' };
     const detection = (0, init_1.detectStack)(cwd);
@@ -231,7 +243,8 @@ function checkPack(cwd, manifest) {
  * "baseline present" for that same case, reassuring the operator that debt is being
  * suppressed when it silently is not.
  */
-function checkSensorsBaseline(cwd, manifest) {
+function checkSensorsBaseline(cwd, status) {
+    const manifest = manifestView(status);
     const enabled = manifest ? countEnabledSensors(manifest).enabled : 0;
     if (enabled === 0) {
         return { id: 'sensors-baseline', ok: true, detail: 'no enabled sensors — nothing to baseline' };
@@ -432,17 +445,21 @@ async function preflight(cwd = process.cwd(), opts = {}) {
         || (opts.requireCurrent !== undefined && typeof opts.requireCurrent !== 'boolean')) {
         throw new Error('preflight options must contain optional boolean verifySensors and requireCurrent');
     }
-    const manifest = readManifest(cwd);
-    const manifestExists = fs_1.default.existsSync(path_1.default.join(cwd, MANIFEST));
+    const sensorStatus = await (0, status_1.computeSensorStatus)(cwd);
+    const manifestExists = sensorStatus.mode !== 'missing';
     const contextKernel = checkContextKernel(cwd);
     const checks = [
         checkContext(cwd),
         ...(contextKernel ? [contextKernel] : []),
-        checkManifest(cwd, manifest),
+        checkManifest(sensorStatus),
         // Skipped when there is no manifest: reporting "tools broken" (or nudging toward
         // a baseline that has nothing to snapshot) on a repo that was never set up
         // buries the one thing the operator needs to read.
-        ...(manifestExists ? [await checkTools(cwd), checkPack(cwd, manifest), checkSensorsBaseline(cwd, manifest)] : []),
+        ...(manifestExists && !['native-gate', 'opt-out', 'source-unavailable', 'source-ambiguous'].includes(sensorStatus.mode ?? '')
+            ? [
+                ...(sensorStatus.mode !== 'invalid' ? [await checkTools(cwd, sensorStatus), checkPack(cwd, sensorStatus)] : []),
+                checkSensorsBaseline(cwd, sensorStatus),
+            ] : []),
         // The empirical mode is intentionally opt-in: ordinary preflight remains a
         // quick static inspection and must not dispatch project software.
         ...(opts.verifySensors === true ? [await checkSensorExecution(cwd)] : []),
@@ -455,17 +472,31 @@ async function preflight(cwd = process.cwd(), opts = {}) {
     const blockingFailure = (check) => !check.ok && check.advisory !== true;
     const invalidContextKernel = contextKernel !== null && blockingFailure(contextKernel);
     const status = invalidContextKernel ? 'degraded'
-        : !manifestExists ? 'not_configured'
-            : checks.some(blockingFailure) ? 'degraded'
-                : 'ready';
+        : sensorStatus.mode === 'native-gate' ? 'native_gate'
+            : sensorStatus.mode === 'opt-out' ? 'ungated'
+                : !manifestExists ? 'not_configured'
+                    : checks.some(blockingFailure) ? 'degraded'
+                        : 'ready';
     const currentness = opts.requireCurrent === true ? await (0, check_1.checkCurrentness)(cwd) : undefined;
     if (currentness) {
         checks.splice(checks.length - 1, 0, checkAuthoritativeCurrentness(currentness));
     }
     const strictFailure = checks.some(blockingFailure);
     const strictStatus = invalidContextKernel ? 'degraded'
-        : !manifestExists ? 'not_configured'
-            : strictFailure ? 'degraded'
-                : 'ready';
-    return currentness ? { status: strictStatus, checks, currentness } : { status, checks };
+        : sensorStatus.mode === 'native-gate' ? 'native_gate'
+            : sensorStatus.mode === 'opt-out' ? 'ungated'
+                : !manifestExists ? 'not_configured'
+                    : strictFailure ? 'degraded'
+                        : 'ready';
+    const authorityRemedy = sensorStatus.remedy
+        ?? (sensorStatus.mode === 'native-gate' ? 'verify the declared native CI quality gate before accepting this run'
+            : sensorStatus.mode === 'opt-out' ? 'remove the opt-out declaration or provide a quality gate' : undefined);
+    const authority = {
+        mode: sensorStatus.mode ?? 'invalid',
+        reason: sensorStatus.reason ?? 'sensor-authority-unavailable',
+        projectRoot: sensorStatus.projectRoot ?? path_1.default.resolve(cwd),
+        manifestPath: sensorStatus.manifestPath ?? path_1.default.join(path_1.default.resolve(cwd), MANIFEST),
+        ...(authorityRemedy ? { remedy: authorityRemedy } : {}),
+    };
+    return currentness ? { status: strictStatus, checks, currentness, ...authority } : { status, checks, ...authority };
 }

package/dist/src/commands/sensors/compatibility/manifest.js

@@ -209,9 +209,54 @@ function parseV2Manifest(value, source) {
     }
     return manifest;
 }
+function parseV3ProjectManifest(value, source) {
+    fields(value, ['schemaVersion', 'mode', 'pack', 'packSelection', 'source', 'packageRoot', 'sensors', 'concurrency'], source, 'root');
+    const sourceValue = record(value.source, source, 'source');
+    fields(sourceValue, ['registry'], source, 'source');
+    const sensorsInput = record(value.sensors, source, 'sensors');
+    const sensors = {};
+    for (const name of Object.keys(sensorsInput))
+        sensors[id(name, source, 'sensor id')] = parseV2Sensor(sensorsInput[name], source, `sensors.${name}`);
+    const manifest = {
+        schemaVersion: 3,
+        mode: 'project-sensors',
+        pack: id(value.pack, source, 'pack'),
+        source: { registry: id(sourceValue.registry, source, 'source.registry') },
+        sensors,
+    };
+    if ('packSelection' in value) {
+        if (value.packSelection !== 'explicit')
+            invalid(source, 'packSelection must be "explicit" when present');
+        manifest.packSelection = 'explicit';
+    }
+    if ('packageRoot' in value)
+        manifest.packageRoot = asset(value.packageRoot, source, 'packageRoot');
+    if ('concurrency' in value) {
+        if (typeof value.concurrency !== 'number' || !Number.isSafeInteger(value.concurrency) || value.concurrency <= 0)
+            invalid(source, 'concurrency must be a positive safe integer');
+        manifest.concurrency = value.concurrency;
+    }
+    return manifest;
+}
+function parseV3Manifest(value, source) {
+    if (value.schemaVersion !== 3)
+        invalid(source, `unsupported manifest schemaVersion ${String(value.schemaVersion)}; supported: legacy, 2, 3; upgrade or migrate the manifest`);
+    if (value.mode === 'project-sensors')
+        return parseV3ProjectManifest(value, source);
+    if (value.mode !== 'native-gate' && value.mode !== 'opt-out')
+        invalid(source, 'schemaVersion 3 mode must be "project-sensors", "native-gate", or "opt-out"');
+    fields(value, ['schemaVersion', 'mode', 'reason'], source, 'root');
+    return { schemaVersion: 3, mode: value.mode, reason: text(value.reason, source, 'reason') };
+}
 function parseSensorManifest(input, source) {
     const value = record(input, source, 'root');
-    return 'schemaVersion' in value ? { kind: 'v2', pack: parseV2Manifest(value, source) } : { kind: 'legacy', pack: parseLegacyManifest(value, source) };
+    if (!('schemaVersion' in value))
+        return { kind: 'legacy', pack: parseLegacyManifest(value, source) };
+    if (value.schemaVersion === 2)
+        return { kind: 'v2', pack: parseV2Manifest(value, source) };
+    if (value.schemaVersion === 3)
+        return { kind: 'v3', pack: parseV3Manifest(value, source) };
+    invalid(source, `unsupported manifest schemaVersion ${String(value.schemaVersion)}; supported: legacy, 2, 3; upgrade or migrate the manifest`);
 }
 function serializeManifestV2(input) {
     const parsed = parseSensorManifest(input, 'manifest serialization');

package/dist/src/commands/sensors/compatibility/pack-source.js

@@ -3,11 +3,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.listPackSources = listPackSources;
 exports.resolvePackSource = resolvePackSource;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const registries_1 = require("../../../core/registries");
+const safe_file_1 = require("./safe-file");
 const MAX_PACK_BYTES = 1024 * 1024;
+const MAX_DIAGNOSTIC_IDENTITY_LENGTH = 128;
+function diagnosticRegistryName(name) {
+    return name.length <= MAX_DIAGNOSTIC_IDENTITY_LENGTH
+        ? name
+        : `${name.slice(0, MAX_DIAGNOSTIC_IDENTITY_LENGTH - 3)}...`;
+}
 function validPackName(pack) {
     return typeof pack === 'string' && /^[a-z][a-z0-9-]*$/.test(pack);
 }
@@ -17,50 +25,79 @@ function contained(root, candidate) {
 }
 /** Walk each component under contentRoot with lstat: realpath alone would hide an
  * internal symlink whose target happens to remain inside the registry. */
-function inspectContainedPack(root, pack) {
+function inspectContainedPack(root, pack, registryName) {
+    let rootStat;
+    try {
+        rootStat = fs_1.default.lstatSync(root, { bigint: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw new Error(`registry "${registryName}" pack source root cannot be inspected`);
+    }
+    if (rootStat.isSymbolicLink())
+        throw new Error(`registry "${registryName}" pack source root must not be a symbolic link`);
+    if (!rootStat.isDirectory())
+        throw new Error(`registry "${registryName}" pack source root must be a regular directory`);
     const components = ['sensor-packs', pack, 'pack.json'];
     let candidate = root;
     for (let index = 0; index < components.length; index++) {
         candidate = path_1.default.join(candidate, components[index]);
         let stat;
         try {
-            stat = fs_1.default.lstatSync(candidate);
+            stat = fs_1.default.lstatSync(candidate, { bigint: true });
         }
         catch (error) {
             if (error.code === 'ENOENT')
                 return undefined;
             if (error.code === 'ENOTDIR')
-                throw new Error(`pack source ${candidate} has a non-regular or symbolic parent`);
-            throw new Error(`cannot inspect pack source ${candidate}`);
+                throw new Error(`registry "${registryName}" pack source has a non-regular or symbolic parent`);
+            throw new Error(`registry "${registryName}" pack source cannot be inspected`);
         }
         if (stat.isSymbolicLink())
-            throw new Error(`pack source ${candidate} must not contain symbolic links`);
+            throw new Error(`registry "${registryName}" pack source must not contain symbolic links`);
         if (index < components.length - 1 && !stat.isDirectory())
-            throw new Error(`pack source ${candidate} has a non-regular parent`);
+            throw new Error(`registry "${registryName}" pack source has a non-regular parent`);
         if (index === components.length - 1)
             return { candidate, stat };
     }
     throw new Error('pack source component walk did not reach pack.json');
 }
+function readContainedPack(real, inspected, registryName) {
+    const failure = (reason) => {
+        if (reason === 'open')
+            return new Error(`registry "${registryName}" pack source cannot be safely opened`);
+        if (reason === 'regular')
+            return new Error(`registry "${registryName}" pack source must be a contained regular file, never a symbolic link`);
+        if (reason === 'identity')
+            return new Error(`registry "${registryName}" pack source changed identity during safe open`);
+        if (reason === 'size')
+            return new Error(`registry "${registryName}" pack source changed size during safe open`);
+        return new Error(`registry "${registryName}" pack source exceeds the 1 MiB limit`);
+    };
+    return (0, safe_file_1.readInspectedBoundedFile)(real, inspected, MAX_PACK_BYTES, failure).toString('utf8');
+}
 /** Resolve only an exact, regular pack.json beneath the first configured registry.
  * Registry order is authority; an unsafe claimed source is a hard failure, not a fallback. */
-function resolvePackSource(pack, options = {}) {
+function listPackSources(pack, options = {}) {
     if (!validPackName(pack))
         throw new Error('pack name must be a stable lowercase id');
     const registries = options.registries ?? (0, registries_1.listRegistries)();
     if (!Array.isArray(registries))
         throw new Error('registries must be an array');
+    const sources = [];
     for (const registry of registries) {
-        if (!registry || typeof registry.contentRoot !== 'string' || registry.contentRoot.trim() === '')
-            throw new Error('registry has an invalid content root');
-        const inspected = inspectContainedPack(registry.contentRoot, pack);
+        if (!registry || typeof registry.name !== 'string' || !/^[a-z][a-z0-9-]*$/.test(registry.name) || typeof registry.contentRoot !== 'string' || registry.contentRoot.trim() === '')
+            throw new Error('registry has an invalid identity or content root');
+        const registryName = diagnosticRegistryName(registry.name);
+        const inspected = inspectContainedPack(registry.contentRoot, pack, registryName);
         if (!inspected)
             continue;
         const { candidate, stat } = inspected;
         if (!stat.isFile())
-            throw new Error(`pack source ${candidate} must be a contained regular file, never a symbolic link`);
-        if (stat.size > MAX_PACK_BYTES)
-            throw new Error(`pack source ${candidate} exceeds the 1 MiB limit`);
+            throw new Error(`registry "${registryName}" pack source must be a contained regular file, never a symbolic link`);
+        if (stat.size > BigInt(MAX_PACK_BYTES))
+            throw new Error(`registry "${registryName}" pack source exceeds the 1 MiB limit`);
         let root;
         let real;
         try {
@@ -68,11 +105,18 @@ function resolvePackSource(pack, options = {}) {
             real = fs_1.default.realpathSync(candidate);
         }
         catch {
-            throw new Error(`cannot canonicalize pack source ${candidate}`);
+            throw new Error(`registry "${registryName}" pack source cannot be canonicalized`);
         }
         if (!contained(root, real))
-            throw new Error(`pack source ${candidate} escapes its registry root`);
-        return { path: real, content: fs_1.default.readFileSync(real, 'utf8'), registry };
+            throw new Error(`registry "${registryName}" pack source escapes its registry root`);
+        const content = readContainedPack(real, stat, registryName);
+        sources.push({ path: real, content, registry });
     }
-    throw new Error(`sensor pack "${pack}" was not found in configured registries`);
+    return sources;
+}
+function resolvePackSource(pack, options = {}) {
+    const source = listPackSources(pack, options)[0];
+    if (source)
+        return source;
+    throw new Error('sensor pack was not found in configured registries');
 }

package/dist/src/commands/sensors/compatibility/safe-file.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readInspectedBoundedFile = readInspectedBoundedFile;
+const fs_1 = __importDefault(require("fs"));
+/**
+ * Read the exact regular file that was previously inspected. POSIX gets
+ * O_NOFOLLOW; platforms that do not expose it (notably Windows) compare the
+ * bigint device/inode identity and size across open. Bigints avoid losing the
+ * high bits of Windows file IDs.
+ */
+function readInspectedBoundedFile(file, inspected, maxBytes, failure) {
+    const noFollow = fs_1.default.constants.O_NOFOLLOW;
+    let descriptor;
+    try {
+        descriptor = fs_1.default.openSync(file, fs_1.default.constants.O_RDONLY | (typeof noFollow === 'number' ? noFollow : 0));
+    }
+    catch {
+        throw failure('open');
+    }
+    try {
+        let opened;
+        try {
+            opened = fs_1.default.fstatSync(descriptor, { bigint: true });
+        }
+        catch {
+            throw failure('identity');
+        }
+        if (!opened.isFile())
+            throw failure('regular');
+        if (opened.dev !== inspected.dev || opened.ino !== inspected.ino)
+            throw failure('identity');
+        if (opened.size !== inspected.size)
+            throw failure('size');
+        const limit = BigInt(maxBytes);
+        if (opened.size > limit)
+            throw failure('limit');
+        const buffer = Buffer.allocUnsafe(maxBytes + 1);
+        const count = fs_1.default.readSync(descriptor, buffer, 0, buffer.length, null);
+        if (!Number.isSafeInteger(count) || count < 0 || count > maxBytes)
+            throw failure('limit');
+        if (BigInt(count) !== opened.size)
+            throw failure('size');
+        return buffer.subarray(0, count);
+    }
+    finally {
+        fs_1.default.closeSync(descriptor);
+    }
+}

package/dist/src/commands/sensors/compatibility/source.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSensorSource = resolveSensorSource;
+const fs_1 = __importDefault(require("fs"));
+const contract_1 = require("./contract");
+const pack_source_1 = require("./pack-source");
+const MAX_CANDIDATE_IDENTITIES = 32;
+const MAX_DIAGNOSTIC_IDENTITY_LENGTH = 128;
+function diagnosticRegistryName(name) {
+    return name.length <= MAX_DIAGNOSTIC_IDENTITY_LENGTH
+        ? name
+        : `${name.slice(0, MAX_DIAGNOSTIC_IDENTITY_LENGTH - 3)}...`;
+}
+function unavailable(reason) {
+    return { kind: 'source-unavailable', reason, remedy: 'install-registry-or-run-awm-update' };
+}
+function requireRegistries(deps) {
+    if (!deps || !Array.isArray(deps.registries))
+        throw new Error('resolveSensorSource requires a registry inventory');
+    for (const registry of deps.registries) {
+        if (!registry || typeof registry.name !== 'string' || !/^[a-z][a-z0-9-]*$/.test(registry.name)
+            || typeof registry.remote !== 'string' || typeof registry.contentRoot !== 'string' || registry.contentRoot.trim() === '') {
+            throw new Error('resolveSensorSource received an invalid registry inventory entry');
+        }
+    }
+    return deps.registries;
+}
+function compatible(source, manifest) {
+    let parsed;
+    try {
+        parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
+    }
+    catch {
+        throw new Error(`registry "${diagnosticRegistryName(source.registry.name)}" has an invalid sensor pack`);
+    }
+    if (parsed.kind !== 'v2' || parsed.pack.name !== manifest.pack)
+        return false;
+    return Object.entries(manifest.sensors).every(([name, sensor]) => parsed.pack.sensors[name]?.variants.some(variant => variant.id === sensor.variantId) === true);
+}
+/** Resolves only local registry inventory; it never fetches, probes tools, or writes. */
+function resolveSensorSource(manifest, deps) {
+    const registries = requireRegistries(deps);
+    if (manifest.kind === 'v3') {
+        const v3 = manifest.pack;
+        if (!v3 || v3.mode !== 'project-sensors' || typeof v3.pack !== 'string'
+            || !v3.source || typeof v3.source.registry !== 'string') {
+            throw new Error('sensor source resolution requires a valid project-sensors manifest');
+        }
+        if (!/^[a-z][a-z0-9-]*$/.test(v3.source.registry)) {
+            throw new Error('sensor source registry must be a stable lowercase id');
+        }
+        const matches = registries.filter(entry => entry?.name === v3.source.registry);
+        if (matches.length !== 1)
+            return unavailable('registry-not-installed');
+        const source = (0, pack_source_1.listPackSources)(v3.pack, { registries: matches })[0];
+        return source ? { kind: 'logical', source } : unavailable('no-compatible-registry');
+    }
+    if (manifest.kind !== 'v2')
+        throw new Error('sensor source resolution requires a v2 or v3 project-sensors manifest');
+    if (manifest.pack.registryRoot !== undefined && fs_1.default.existsSync(manifest.pack.registryRoot)) {
+        const source = (0, pack_source_1.listPackSources)(manifest.pack.pack, { registries: [{ name: 'manifest-provenance', remote: 'local', contentRoot: manifest.pack.registryRoot }] })[0];
+        if (!source)
+            throw new Error('existing v2 registry provenance does not contain its selected sensor pack');
+        return { kind: 'legacy-bound', source };
+    }
+    const candidates = (0, pack_source_1.listPackSources)(manifest.pack.pack, { registries }).filter(source => compatible(source, manifest.pack));
+    if (candidates.length === 0)
+        return unavailable('no-compatible-registry');
+    if (candidates.length === 1)
+        return { kind: 'legacy-rebound', source: candidates[0] };
+    return { kind: 'source-ambiguous', candidates: candidates.map(candidate => diagnosticRegistryName(candidate.registry.name)).sort().slice(0, MAX_CANDIDATE_IDENTITIES), reason: 'multiple-compatible-registries', remedy: 'configure-one-logical-registry' };
+}

package/dist/src/commands/sensors/coverage/resolve.js

@@ -11,6 +11,7 @@ const contract_1 = require("./contract");
 const contract_2 = require("../compatibility/contract");
 const manifest_1 = require("../compatibility/manifest");
 const pack_source_1 = require("../compatibility/pack-source");
+const safe_file_1 = require("../compatibility/safe-file");
 function readFailure(file, error) {
     return new Error(`Cannot read ${file}: ${error instanceof Error ? error.message : String(error)}`);
 }
@@ -20,40 +21,33 @@ function readBoundedJson(file) {
         throw new Error('readBoundedJson: file must be a non-empty string');
     let listed;
     try {
-        listed = fs_1.default.lstatSync(file);
+        listed = fs_1.default.lstatSync(file, { bigint: true });
     }
     catch (error) {
         throw readFailure(file, error);
     }
     if (!listed.isFile() || listed.isSymbolicLink())
         throw new Error(`Cannot read ${file}: expected a regular file`);
-    if (listed.size > contract_1.MAX_COVERAGE_FILE_BYTES)
+    if (listed.size > BigInt(contract_1.MAX_COVERAGE_FILE_BYTES))
         throw new Error(`Cannot read ${file}: exceeds 1 MiB limit`);
-    const noFollow = fs_1.default.constants.O_NOFOLLOW;
-    if (typeof noFollow !== 'number')
-        throw new Error(`Cannot read ${file}: platform cannot guarantee no symlink dereference`);
-    let descriptor;
+    const failure = (reason) => {
+        if (reason === 'open')
+            return new Error('cannot be safely opened');
+        if (reason === 'regular')
+            return new Error('expected a regular file');
+        if (reason === 'identity')
+            return new Error('file changed identity during safe open');
+        if (reason === 'size')
+            return new Error('file changed size during safe open');
+        return new Error('exceeds 1 MiB limit');
+    };
     let content;
     try {
-        descriptor = fs_1.default.openSync(file, fs_1.default.constants.O_RDONLY | noFollow);
-        const opened = fs_1.default.fstatSync(descriptor);
-        if (!opened.isFile() || opened.size > contract_1.MAX_COVERAGE_FILE_BYTES) {
-            throw new Error('expected a regular file within the 1 MiB limit');
-        }
-        const buffer = Buffer.allocUnsafe(contract_1.MAX_COVERAGE_FILE_BYTES + 1);
-        const count = fs_1.default.readSync(descriptor, buffer, 0, buffer.length, null);
-        if (!Number.isSafeInteger(count) || count < 0 || count > contract_1.MAX_COVERAGE_FILE_BYTES) {
-            throw new Error('exceeds 1 MiB limit');
-        }
-        content = buffer.subarray(0, count).toString('utf8');
+        content = (0, safe_file_1.readInspectedBoundedFile)(file, listed, contract_1.MAX_COVERAGE_FILE_BYTES, failure).toString('utf8');
     }
     catch (error) {
         throw readFailure(file, error);
     }
-    finally {
-        if (descriptor !== undefined)
-            fs_1.default.closeSync(descriptor);
-    }
     try {
         return JSON.parse(content);
     }
@@ -88,6 +82,8 @@ function resolveCoverageInputs(cwd) {
         return { kind: 'not_configured' };
     const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
     const manifest = (0, manifest_1.parseSensorManifest)(readBoundedJson(manifestPath), manifestPath);
+    if (manifest.kind === 'v3')
+        throw new Error('schemaVersion 3 sensor manifests require the project resolver');
     const source = manifest.kind === 'v2' && manifest.pack.registryRoot !== undefined
         ? (0, pack_source_1.resolvePackSource)(manifest.pack.pack, { registries: [{ name: 'manifest-provenance', remote: 'local', contentRoot: manifest.pack.registryRoot }] })
         : (0, pack_source_1.resolvePackSource)(manifest.pack.pack);

package/dist/src/commands/sensors/init.js

@@ -246,8 +246,10 @@ async function initSensors(opts = {}) {
         const parsed = (0, manifest_1.parseSensorManifest)(raw, manifestPath);
         if (parsed.kind === 'legacy')
             existing = parsed.pack;
-        else
+        else if (parsed.kind === 'v2')
             existingV2 = parsed.pack;
+        else
+            throw new Error('schemaVersion 3 sensor manifests require the project resolver');
     }
     // `detection` keeps saying what the tree IS; `pack` is what the registry can serve
     // for it. They diverge only when the registry lacks the detected pack.