agentic-workflow-manager 9.4.1 → 9.6.0

package/dist/src/commands/sensors/compatibility/safe-file.js

@@ -0,0 +1,286 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setSecureFsForTests = setSecureFsForTests;
+exports.setPortableReadForTests = setPortableReadForTests;
+exports.withProjectLease = withProjectLease;
+exports.writeProjectFile = writeProjectFile;
+exports.removeObservedProjectFile = removeObservedProjectFile;
+exports.withNoFollowDirectory = withNoFollowDirectory;
+exports.withDescriptorBoundWriteDirectory = withDescriptorBoundWriteDirectory;
+exports.withNoFollowChildDirectory = withNoFollowChildDirectory;
+exports.readInspectedBoundedFile = readInspectedBoundedFile;
+exports.readInspectedBoundedFileWithIdentity = readInspectedBoundedFileWithIdentity;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const native_bridge_1 = require("../../../core/secure-fs/native-bridge");
+let secureFsForTest;
+let portableReadForTests = false;
+/** Test-only seam for filesystem race fixtures. Production always uses the packaged bridge. */
+function setSecureFsForTests(boundary) {
+    secureFsForTest = boundary;
+}
+/** Test-only opt-in for Node-level filesystem race fixtures. */
+function setPortableReadForTests(enabled) {
+    portableReadForTests = enabled;
+}
+function activeSecureFs() {
+    return secureFsForTest ?? native_bridge_1.secureFs;
+}
+/** Hold the native project lease for one complete sensor mutation callback. */
+function withProjectLease(projectRoot, operation) {
+    return activeSecureFs().withProjectLease(projectRoot, operation);
+}
+/** Native-only project publication. Production never falls back to pathname writes. */
+function writeProjectFile(projectRoot, destination, content, options) {
+    try {
+        activeSecureFs().writeProjectTransaction(projectRoot, destination, content, options);
+    }
+    catch (error) {
+        throw new Error(`project destination rejected by secure-fs: ${error.message}`);
+    }
+}
+/** Compensate only a file that this transaction read and identity-fenced. */
+function removeObservedProjectFile(projectRoot, destination, identity) {
+    try {
+        const remove = activeSecureFs().removeObservedProjectFile;
+        if (typeof remove !== 'function')
+            throw new Error('secure-fs native bridge does not support identity-fenced removal');
+        remove(projectRoot, destination, identity);
+    }
+    catch (error) {
+        throw new Error(`project destination rejected by secure-fs: ${error.message}`);
+    }
+}
+function sameIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+function snapshotDirectoryChain(directory, failure) {
+    if (!path_1.default.isAbsolute(directory))
+        throw failure();
+    const resolved = path_1.default.resolve(directory);
+    const parsed = path_1.default.parse(resolved);
+    const snapshots = [];
+    let current = parsed.root;
+    for (const component of ['', ...path_1.default.relative(parsed.root, resolved).split(path_1.default.sep).filter(Boolean)]) {
+        if (component)
+            current = path_1.default.join(current, component);
+        let stat;
+        try {
+            stat = fs_1.default.lstatSync(current, { bigint: true });
+        }
+        catch {
+            throw failure();
+        }
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw failure();
+        snapshots.push({ name: current, stat });
+    }
+    return snapshots;
+}
+function assertDirectoryChainUnchanged(snapshots, failure) {
+    for (const snapshot of snapshots) {
+        let current;
+        try {
+            current = fs_1.default.lstatSync(snapshot.name, { bigint: true });
+        }
+        catch {
+            throw failure();
+        }
+        if (!current.isDirectory() || current.isSymbolicLink() || !sameIdentity(current, snapshot.stat))
+            throw failure();
+    }
+}
+function withPortableValidatedDirectory(directory, failure, operation) {
+    const snapshots = snapshotDirectoryChain(directory, failure);
+    let result;
+    let operationError;
+    try {
+        result = operation(directory);
+    }
+    catch (error) {
+        operationError = error;
+    }
+    assertDirectoryChainUnchanged(snapshots, failure);
+    if (operationError !== undefined)
+        throw operationError;
+    return result;
+}
+function procfsDescriptorBridgeAvailable() {
+    try {
+        return process.platform === 'linux' && fs_1.default.statSync('/proc/self/fd').isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function withOpenedNoFollowDirectory(open, failure, operation) {
+    let descriptor;
+    try {
+        descriptor = open();
+        const opened = fs_1.default.fstatSync(descriptor, { bigint: true });
+        if (!opened.isDirectory())
+            throw failure();
+        return operation(`/proc/self/fd/${descriptor}`);
+    }
+    catch {
+        throw failure();
+    }
+    finally {
+        if (descriptor !== undefined) {
+            try {
+                fs_1.default.closeSync(descriptor);
+            }
+            catch { /* best effort descriptor cleanup */ }
+        }
+    }
+}
+/**
+ * Bind a directory without following an observable symlink. Linux uses a
+ * descriptor path so ancestor renames cannot redirect work. Other platforms
+ * validate every component and its identity before and after the operation;
+ * Node exposes no portable openat equivalent, so any observable change fails
+ * closed rather than being accepted as a pathname race.
+ */
+function withNoFollowDirectory(directory, failure, operation) {
+    const noFollow = fs_1.default.constants.O_NOFOLLOW;
+    const directoryFlag = fs_1.default.constants.O_DIRECTORY;
+    if (!path_1.default.isAbsolute(directory))
+        throw failure();
+    if (typeof noFollow !== 'number' || typeof directoryFlag !== 'number' || !procfsDescriptorBridgeAvailable()) {
+        return withPortableValidatedDirectory(directory, failure, operation);
+    }
+    let descriptor;
+    try {
+        const parsed = path_1.default.parse(directory);
+        descriptor = fs_1.default.openSync(parsed.root, fs_1.default.constants.O_RDONLY | noFollow | directoryFlag);
+        const relative = path_1.default.relative(parsed.root, path_1.default.resolve(directory));
+        for (const component of relative.split(path_1.default.sep).filter(Boolean)) {
+            const next = fs_1.default.openSync(`/proc/self/fd/${descriptor}/${component}`, fs_1.default.constants.O_RDONLY | noFollow | directoryFlag);
+            fs_1.default.closeSync(descriptor);
+            descriptor = next;
+        }
+        const finalDescriptor = descriptor;
+        descriptor = undefined;
+        return withOpenedNoFollowDirectory(() => finalDescriptor, failure, operation);
+    }
+    catch {
+        throw failure();
+    }
+    finally {
+        if (descriptor !== undefined) {
+            try {
+                fs_1.default.closeSync(descriptor);
+            }
+            catch { /* already closed during a failed handoff */ }
+        }
+    }
+}
+/**
+ * Run a filesystem mutation only through a descriptor-bound directory path.
+ * Identity snapshots are sufficient for bounded reads, but cannot make a
+ * pathname write safe: a parent can be replaced after the snapshot and before
+ * `mkdtemp`, staging, or publication. Platforms without the Linux descriptor
+ * bridge therefore reject before the mutation callback begins.
+ */
+function withDescriptorBoundWriteDirectory(directory, failure, operation) {
+    const noFollow = fs_1.default.constants.O_NOFOLLOW;
+    const directoryFlag = fs_1.default.constants.O_DIRECTORY;
+    if (typeof noFollow !== 'number' || typeof directoryFlag !== 'number' || !procfsDescriptorBridgeAvailable())
+        throw failure();
+    return withNoFollowDirectory(directory, failure, operation);
+}
+/** Open one direct child from a previously bound directory without path re-resolution. */
+function withNoFollowChildDirectory(parentDirectory, component, failure, operation) {
+    const noFollow = fs_1.default.constants.O_NOFOLLOW;
+    const directoryFlag = fs_1.default.constants.O_DIRECTORY;
+    if (!component || component === '.' || component === '..' || /[\\/]/.test(component))
+        throw failure();
+    if (typeof noFollow !== 'number' || typeof directoryFlag !== 'number' || !procfsDescriptorBridgeAvailable()) {
+        return withPortableValidatedDirectory(path_1.default.join(parentDirectory, component), failure, operation);
+    }
+    return withOpenedNoFollowDirectory(() => fs_1.default.openSync(path_1.default.join(parentDirectory, component), fs_1.default.constants.O_RDONLY | noFollow | directoryFlag), failure, operation);
+}
+/** Read the exact regular file that was previously inspected. */
+function readInspectedBoundedFile(file, inspected, maxBytes, failure) {
+    // The JS descriptor bridge passes /proc/self/fd paths internally on Linux.
+    // They are already descriptor-bound; the native loader correctly rejects the
+    // procfs symlink representation, so retain this narrow internal path only.
+    const descriptorBoundInternalPath = process.platform === 'linux' && file.startsWith('/proc/self/fd/');
+    // The native boundary is mandatory in every shipped runtime. The
+    // filesystem race corpus opts into the portable path through a test-only
+    // seam; environment variables can never weaken production reads.
+    if (!secureFsForTest && !descriptorBoundInternalPath && !portableReadForTests) {
+        return readInspectedBoundedFileWithIdentity(file, inspected, maxBytes, failure).content;
+    }
+    // Test adapters observe the same boundary, then deliberately exercise the
+    // legacy race fixtures below. They are never selected by production code.
+    if (secureFsForTest)
+        secureFsForTest.readRegularFile(file, maxBytes);
+    const noFollow = fs_1.default.constants.O_NOFOLLOW;
+    const directorySnapshots = typeof noFollow === 'number' && procfsDescriptorBridgeAvailable()
+        ? undefined
+        : snapshotDirectoryChain(path_1.default.dirname(file), () => failure('identity'));
+    let descriptor;
+    try {
+        descriptor = fs_1.default.openSync(file, fs_1.default.constants.O_RDONLY | (typeof noFollow === 'number' ? noFollow : 0));
+    }
+    catch {
+        throw failure('open');
+    }
+    try {
+        let opened;
+        try {
+            opened = fs_1.default.fstatSync(descriptor, { bigint: true });
+        }
+        catch {
+            throw failure('identity');
+        }
+        if (!opened.isFile())
+            throw failure('regular');
+        if (!sameIdentity(opened, inspected))
+            throw failure('identity');
+        if (opened.size !== inspected.size)
+            throw failure('size');
+        const limit = BigInt(maxBytes);
+        if (opened.size > limit)
+            throw failure('limit');
+        const buffer = Buffer.allocUnsafe(maxBytes + 1);
+        const count = fs_1.default.readSync(descriptor, buffer, 0, buffer.length, null);
+        if (!Number.isSafeInteger(count) || count < 0 || count > maxBytes)
+            throw failure('limit');
+        if (BigInt(count) !== opened.size)
+            throw failure('size');
+        const after = fs_1.default.fstatSync(descriptor, { bigint: true });
+        if (!after.isFile() || !sameIdentity(after, opened))
+            throw failure('identity');
+        if (after.size !== opened.size)
+            throw failure('size');
+        if (directorySnapshots)
+            assertDirectoryChainUnchanged(directorySnapshots, () => failure('identity'));
+        return buffer.subarray(0, count);
+    }
+    finally {
+        fs_1.default.closeSync(descriptor);
+    }
+}
+/**
+ * Preserve the opaque identity minted by the same native handle that supplied
+ * the bytes. Replacement callers must pass this observation back unchanged.
+ */
+function readInspectedBoundedFileWithIdentity(file, inspected, maxBytes, failure) {
+    if (process.platform === 'linux' && file.startsWith('/proc/self/fd/'))
+        throw failure('identity');
+    let observed;
+    try {
+        observed = activeSecureFs().readRegularFile(file, maxBytes);
+    }
+    catch {
+        throw failure('open');
+    }
+    if (BigInt(observed.bytes.length) !== inspected.size)
+        throw failure('size');
+    return Object.freeze({ content: observed.bytes, identity: observed.identity });
+}

package/dist/src/commands/sensors/compatibility/source.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSensorSource = resolveSensorSource;
+const fs_1 = __importDefault(require("fs"));
+const contract_1 = require("./contract");
+const pack_source_1 = require("./pack-source");
+const MAX_CANDIDATE_IDENTITIES = 32;
+const MAX_DIAGNOSTIC_IDENTITY_LENGTH = 128;
+function diagnosticRegistryName(name) {
+    return name.length <= MAX_DIAGNOSTIC_IDENTITY_LENGTH
+        ? name
+        : `${name.slice(0, MAX_DIAGNOSTIC_IDENTITY_LENGTH - 3)}...`;
+}
+function unavailable(reason) {
+    return { kind: 'source-unavailable', reason, remedy: 'install-registry-or-run-awm-update' };
+}
+function requireRegistries(deps) {
+    if (!deps || !Array.isArray(deps.registries))
+        throw new Error('resolveSensorSource requires a registry inventory');
+    for (const registry of deps.registries) {
+        if (!registry || typeof registry.name !== 'string' || !/^[a-z][a-z0-9-]*$/.test(registry.name)
+            || typeof registry.remote !== 'string' || typeof registry.contentRoot !== 'string' || registry.contentRoot.trim() === '') {
+            throw new Error('resolveSensorSource received an invalid registry inventory entry');
+        }
+    }
+    return deps.registries;
+}
+function compatible(source, manifest) {
+    let parsed;
+    try {
+        parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
+    }
+    catch {
+        throw new Error(`registry "${diagnosticRegistryName(source.registry.name)}" has an invalid sensor pack`);
+    }
+    if (parsed.kind !== 'v2' || parsed.pack.name !== manifest.pack)
+        return false;
+    return Object.entries(manifest.sensors).every(([name, sensor]) => parsed.pack.sensors[name]?.variants.some(variant => variant.id === sensor.variantId) === true);
+}
+/** Resolves only local registry inventory; it never fetches, probes tools, or writes. */
+function resolveSensorSource(manifest, deps) {
+    const registries = requireRegistries(deps);
+    if (manifest.kind === 'v3') {
+        const v3 = manifest.pack;
+        if (!v3 || v3.mode !== 'project-sensors' || typeof v3.pack !== 'string'
+            || !v3.source || typeof v3.source.registry !== 'string') {
+            throw new Error('sensor source resolution requires a valid project-sensors manifest');
+        }
+        if (!/^[a-z][a-z0-9-]*$/.test(v3.source.registry)) {
+            throw new Error('sensor source registry must be a stable lowercase id');
+        }
+        const matches = registries.filter(entry => entry?.name === v3.source.registry);
+        if (matches.length !== 1)
+            return unavailable('registry-not-installed');
+        const source = (0, pack_source_1.listPackSources)(v3.pack, { registries: matches })[0];
+        return source ? { kind: 'logical', source } : unavailable('no-compatible-registry');
+    }
+    if (manifest.kind !== 'v2')
+        throw new Error('sensor source resolution requires a v2 or v3 project-sensors manifest');
+    if (manifest.pack.registryRoot !== undefined && fs_1.default.existsSync(manifest.pack.registryRoot)) {
+        const source = (0, pack_source_1.listPackSources)(manifest.pack.pack, { registries: [{ name: 'manifest-provenance', remote: 'local', contentRoot: manifest.pack.registryRoot }] })[0];
+        if (!source)
+            throw new Error('existing v2 registry provenance does not contain its selected sensor pack');
+        return { kind: 'legacy-bound', source };
+    }
+    const candidates = (0, pack_source_1.listPackSources)(manifest.pack.pack, { registries }).filter(source => compatible(source, manifest.pack));
+    if (candidates.length === 0)
+        return unavailable('no-compatible-registry');
+    if (candidates.length === 1)
+        return { kind: 'legacy-rebound', source: candidates[0] };
+    return { kind: 'source-ambiguous', candidates: candidates.map(candidate => diagnosticRegistryName(candidate.registry.name)).sort().slice(0, MAX_CANDIDATE_IDENTITIES), reason: 'multiple-compatible-registries', remedy: 'configure-one-logical-registry' };
+}

package/dist/src/commands/sensors/coverage/index.js

@@ -39,8 +39,8 @@ async function runCoverage(cwd, dependencies = {}, options = {}) {
             empirical: empirical(deps, input.projectRoot, {}, min, 'unavailable') };
     }
     let live;
-    if (input.manifest.kind === 'v2') {
-        live = (await deps.resolveLive(input.projectRoot, input.pack, input.manifest.pack.registryRoot)).sensors;
+    if (input.manifest.kind !== 'legacy') {
+        live = (await deps.resolveLive(input.projectRoot, input.pack, input.registryRoot)).sensors;
     }
     else {
         live = Object.fromEntries(Object.keys(input.manifest.pack.sensors).map((name) => [name, (0, manifest_1.legacyCompatibility)('legacy manifest without schemaVersion')]));

package/dist/src/commands/sensors/coverage/resolve.js

@@ -11,6 +11,9 @@ const contract_1 = require("./contract");
 const contract_2 = require("../compatibility/contract");
 const manifest_1 = require("../compatibility/manifest");
 const pack_source_1 = require("../compatibility/pack-source");
+const source_1 = require("../compatibility/source");
+const safe_file_1 = require("../compatibility/safe-file");
+const registries_1 = require("../../../core/registries");
 function readFailure(file, error) {
     return new Error(`Cannot read ${file}: ${error instanceof Error ? error.message : String(error)}`);
 }
@@ -20,40 +23,33 @@ function readBoundedJson(file) {
         throw new Error('readBoundedJson: file must be a non-empty string');
     let listed;
     try {
-        listed = fs_1.default.lstatSync(file);
+        listed = fs_1.default.lstatSync(file, { bigint: true });
     }
     catch (error) {
         throw readFailure(file, error);
     }
     if (!listed.isFile() || listed.isSymbolicLink())
         throw new Error(`Cannot read ${file}: expected a regular file`);
-    if (listed.size > contract_1.MAX_COVERAGE_FILE_BYTES)
+    if (listed.size > BigInt(contract_1.MAX_COVERAGE_FILE_BYTES))
         throw new Error(`Cannot read ${file}: exceeds 1 MiB limit`);
-    const noFollow = fs_1.default.constants.O_NOFOLLOW;
-    if (typeof noFollow !== 'number')
-        throw new Error(`Cannot read ${file}: platform cannot guarantee no symlink dereference`);
-    let descriptor;
+    const failure = (reason) => {
+        if (reason === 'open')
+            return new Error('cannot be safely opened');
+        if (reason === 'regular')
+            return new Error('expected a regular file');
+        if (reason === 'identity')
+            return new Error('file changed identity during safe open');
+        if (reason === 'size')
+            return new Error('file changed size during safe open');
+        return new Error('exceeds 1 MiB limit');
+    };
     let content;
     try {
-        descriptor = fs_1.default.openSync(file, fs_1.default.constants.O_RDONLY | noFollow);
-        const opened = fs_1.default.fstatSync(descriptor);
-        if (!opened.isFile() || opened.size > contract_1.MAX_COVERAGE_FILE_BYTES) {
-            throw new Error('expected a regular file within the 1 MiB limit');
-        }
-        const buffer = Buffer.allocUnsafe(contract_1.MAX_COVERAGE_FILE_BYTES + 1);
-        const count = fs_1.default.readSync(descriptor, buffer, 0, buffer.length, null);
-        if (!Number.isSafeInteger(count) || count < 0 || count > contract_1.MAX_COVERAGE_FILE_BYTES) {
-            throw new Error('exceeds 1 MiB limit');
-        }
-        content = buffer.subarray(0, count).toString('utf8');
+        content = (0, safe_file_1.readInspectedBoundedFile)(file, listed, contract_1.MAX_COVERAGE_FILE_BYTES, failure).toString('utf8');
     }
     catch (error) {
         throw readFailure(file, error);
     }
-    finally {
-        if (descriptor !== undefined)
-            fs_1.default.closeSync(descriptor);
-    }
     try {
         return JSON.parse(content);
     }
@@ -88,9 +84,19 @@ function resolveCoverageInputs(cwd) {
         return { kind: 'not_configured' };
     const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
     const manifest = (0, manifest_1.parseSensorManifest)(readBoundedJson(manifestPath), manifestPath);
-    const source = manifest.kind === 'v2' && manifest.pack.registryRoot !== undefined
-        ? (0, pack_source_1.resolvePackSource)(manifest.pack.pack, { registries: [{ name: 'manifest-provenance', remote: 'local', contentRoot: manifest.pack.registryRoot }] })
-        : (0, pack_source_1.resolvePackSource)(manifest.pack.pack);
+    if (manifest.kind === 'v3' && manifest.pack.mode !== 'project-sensors')
+        return { kind: 'not_configured' };
+    const coverageManifest = manifest;
+    const source = coverageManifest.kind === 'v3'
+        ? (() => {
+            const resolution = (0, source_1.resolveSensorSource)(coverageManifest, { registries: (0, registries_1.listRegistries)() });
+            if (!('source' in resolution))
+                throw new Error(`${resolution.kind}: ${resolution.remedy}`);
+            return resolution.source;
+        })()
+        : coverageManifest.kind === 'v2' && coverageManifest.pack.registryRoot !== undefined
+            ? (0, pack_source_1.resolvePackSource)(coverageManifest.pack.pack, { registries: [{ name: 'manifest-provenance', remote: 'local', contentRoot: coverageManifest.pack.registryRoot }] })
+            : (0, pack_source_1.resolvePackSource)(coverageManifest.pack.pack);
     let sourceJson;
     try {
         sourceJson = JSON.parse(source.content);
@@ -99,14 +105,14 @@ function resolveCoverageInputs(cwd) {
         throw new Error(`Invalid JSON at ${source.path}: ${error instanceof Error ? error.message : String(error)}`);
     }
     const parsedPack = (0, contract_2.parseSensorPack)(sourceJson, source.path);
-    if (parsedPack.pack.name !== manifest.pack.pack) {
-        throw new Error(`Invalid pack at ${source.path}: name must equal '${manifest.pack.pack}'`);
+    if (parsedPack.pack.name !== coverageManifest.pack.pack) {
+        throw new Error(`Invalid pack at ${source.path}: name must equal '${coverageManifest.pack.pack}'`);
     }
     const { coverage } = parsedPack.pack;
     if (coverage === undefined)
-        return { kind: 'no_reference', projectRoot, pack: manifest.pack.pack, registry: source.registry.name, manifest };
+        return { kind: 'no_reference', projectRoot, pack: coverageManifest.pack.pack, registry: source.registry.name, registryRoot: source.registry.contentRoot, manifest: coverageManifest };
     return {
-        kind: 'ready', projectRoot, pack: manifest.pack.pack, registry: source.registry.name,
-        manifest, contract: (0, contract_1.parseCoverageContract)(coverage, source.path),
+        kind: 'ready', projectRoot, pack: coverageManifest.pack.pack, registry: source.registry.name,
+        registryRoot: source.registry.contentRoot, manifest: coverageManifest, contract: (0, contract_1.parseCoverageContract)(coverage, source.path),
     };
 }

package/dist/src/commands/sensors/detection.js

@@ -0,0 +1,31 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectStack = detectStack;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const DETECTORS = [
+    { pack: 'js-ts', files: ['package.json'] },
+    { pack: 'python', files: ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt', 'Pipfile'] },
+];
+/** Read-only stack classification shared by run, bootstrap, and legacy init. */
+function detectStack(cwd) {
+    for (const { pack, files } of DETECTORS) {
+        const indicators = files.filter(file => fs_1.default.existsSync(path_1.default.join(cwd, file)));
+        if (indicators.length > 0)
+            return { pack, indicators };
+    }
+    for (const directory of ['.', 'scripts']) {
+        const absolute = path_1.default.join(cwd, directory);
+        if (!fs_1.default.existsSync(absolute) || !fs_1.default.statSync(absolute).isDirectory())
+            continue;
+        const indicators = fs_1.default.readdirSync(absolute, { withFileTypes: true })
+            .filter(entry => entry.isFile() && entry.name.endsWith('.sh'))
+            .map(entry => directory === '.' ? entry.name : path_1.default.join(directory, entry.name));
+        if (indicators.length > 0)
+            return { pack: 'shell', indicators };
+    }
+    return { pack: 'generic', indicators: [] };
+}