agentic-workflow-manager 9.4.1 → 9.6.0

package/dist/src/commands/sensors/status.js

@@ -7,11 +7,12 @@ exports.computeSensorStatus = computeSensorStatus;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../../core/paths");
-const manifest_1 = require("./compatibility/manifest");
 const contract_1 = require("./compatibility/contract");
 const discovery_1 = require("./compatibility/discovery");
-const pack_source_1 = require("./compatibility/pack-source");
 const resolve_1 = require("./compatibility/resolve");
+const project_1 = require("./project");
+const source_1 = require("./compatibility/source");
+const registries_1 = require("../../core/registries");
 /** First non-flag token after `npx` — the tool the command actually runs. */
 function npxTool(parts) {
     for (let i = 1; i < parts.length; i++) {
@@ -94,10 +95,7 @@ function checkStructuredCommand(command, cwd, assets = []) {
  * into a health check. A selected variant still proves that its current tool
  * and runtime ranges are compatible; its probe state remains unverifiable.
  */
-function resolveStaticV2Compatibility(cwd, manifest) {
-    const source = manifest.registryRoot === undefined
-        ? (0, pack_source_1.resolvePackSource)(manifest.pack)
-        : (0, pack_source_1.resolvePackSource)(manifest.pack, { registries: [{ name: 'manifest-provenance', remote: 'local', contentRoot: manifest.registryRoot }] });
+function resolveStaticV2Compatibility(cwd, manifest, source) {
     const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
     if (parsed.kind !== 'v2')
         throw new Error(`sensor pack "${manifest.pack}" does not provide a v2 compatibility contract`);
@@ -135,57 +133,104 @@ function staticCompatibilityCheck(sensor, live) {
     }
     return null;
 }
-async function computeSensorStatus(cwd = process.cwd()) {
-    const manifestPath = path_1.default.join(cwd, '.awm', 'sensors.json');
-    if (!fs_1.default.existsSync(manifestPath)) {
-        return { overall: 'NOT_CONFIGURED', pack: null, checks: {} };
+function resolvedSourceMetadata(source) {
+    return {
+        reason: source.kind === 'logical' ? 'configured-v3' : source.kind,
+        source: { kind: source.kind, registry: source.source.registry.name },
+    };
+}
+function projectMetadata(project, mode, reason, extra = {}) {
+    return {
+        mode, reason, projectRoot: project.projectRoot, manifestPath: project.manifestPath,
+        ...(project.state === 'configured' ? { packageRoot: project.packageRoot } : {}),
+        ...extra,
+    };
+}
+function sourceFailure(project, pack, source) {
+    if (source.kind === 'source-unavailable') {
+        return {
+            overall: 'DEGRADED', pack, checks: {},
+            ...projectMetadata(project, 'source-unavailable', source.reason, { remedy: source.remedy }),
+        };
     }
-    let manifest;
+    return {
+        overall: 'DEGRADED', pack, checks: {},
+        ...projectMetadata(project, 'source-ambiguous', source.reason, { remedy: source.remedy, candidates: source.candidates }),
+    };
+}
+function invalidStatus(project, pack, reason = 'manifest-malformed', remedy = 'repair-sensor-manifest') {
+    return {
+        overall: 'DEGRADED', pack, checks: {},
+        ...projectMetadata(project, 'invalid', reason, { remedy }),
+    };
+}
+async function computeSensorStatus(cwd = process.cwd()) {
+    let project;
     try {
-        const raw = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf-8'));
-        const parsed = (0, manifest_1.parseSensorManifest)(raw, manifestPath);
-        if (parsed.kind === 'v2') {
-            // Monorepo support (mirrors run.ts/init.ts): detection and structured-command
-            // asset resolution both need to see the real package, not the (possibly
-            // unrelated) directory the manifest lives in.
-            const projectCwd = parsed.pack.packageRoot ? path_1.default.resolve(cwd, parsed.pack.packageRoot) : cwd;
-            const checks = {};
-            let compatibility;
-            try {
-                compatibility = resolveStaticV2Compatibility(projectCwd, parsed.pack);
-            }
-            catch (error) {
-                const detail = error instanceof Error ? error.message : 'live compatibility unavailable';
-                for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
-                    checks[name] = sensor.enabled === false ? { ok: true, detail: 'disabled' } : { ok: false, detail };
-                }
-                return { overall: 'DEGRADED', pack: parsed.pack.pack, checks };
-            }
-            for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
-                if (sensor.enabled === false) {
-                    checks[name] = { ok: true, detail: 'disabled' };
-                    continue;
-                }
-                checks[name] = staticCompatibilityCheck(sensor, compatibility[name])
-                    ?? checkStructuredCommand(sensor.command, projectCwd, sensor.assets);
-            }
-            return { overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED', pack: parsed.pack.pack, checks };
-        }
-        manifest = parsed.pack;
+        project = (0, project_1.resolveSensorProject)(cwd);
     }
     catch {
-        // Preserve the historic diagnostic path for a hand-edited legacy manifest:
-        // malformed v2 is fail-closed, while a legacy `sensors:null` is surfaced as
-        // degraded rather than crashing the status command.
+        const root = typeof cwd === 'string' && cwd.trim() !== '' ? path_1.default.resolve(cwd) : process.cwd();
+        return { overall: 'DEGRADED', pack: null, checks: {}, mode: 'invalid', reason: 'invalid-start-cwd', projectRoot: root, manifestPath: path_1.default.join(root, '.awm', 'sensors.json'), remedy: 'provide-an-existing-project-directory' };
+    }
+    if (project.state === 'missing') {
+        return { overall: 'NOT_CONFIGURED', pack: null, checks: {}, ...projectMetadata(project, 'missing', 'manifest-absent', { remedy: 'run-awm-sensors-bootstrap' }) };
+    }
+    if (project.state === 'invalid') {
+        let pack = null;
         try {
-            const raw = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf-8'));
+            const raw = JSON.parse(fs_1.default.readFileSync(project.manifestPath, 'utf-8'));
             if (raw && typeof raw === 'object' && !Array.isArray(raw) && !('schemaVersion' in raw) && typeof raw.pack === 'string') {
-                return { overall: 'DEGRADED', pack: raw.pack, checks: {} };
+                pack = raw.pack;
             }
         }
         catch { /* malformed JSON is not configured */ }
-        return { overall: 'NOT_CONFIGURED', pack: null, checks: {} };
+        const reason = project.reason.includes('unsupported manifest schemaVersion') ? 'schema-unsupported' : 'manifest-malformed';
+        return invalidStatus(project, pack, reason);
     }
+    const packageRoot = project.packageRoot;
+    const parsed = project.manifest;
+    if (parsed.kind === 'v3' && parsed.pack.mode !== 'project-sensors') {
+        return {
+            overall: 'NOT_CONFIGURED', pack: null, checks: {},
+            ...projectMetadata(project, parsed.pack.mode, `${parsed.pack.mode}-declared`, { declarationReason: parsed.pack.reason }),
+        };
+    }
+    if (parsed.kind === 'v2' || parsed.kind === 'v3') {
+        const parsedPack = parsed.pack;
+        let resolution;
+        try {
+            resolution = (0, source_1.resolveSensorSource)(parsed, { registries: (0, registries_1.listRegistries)() });
+        }
+        catch {
+            return invalidStatus(project, parsedPack.pack, 'sensor-source-invalid', 'repair-or-run-awm-update');
+        }
+        if (!('source' in resolution))
+            return sourceFailure(project, parsedPack.pack, resolution);
+        const sourceMeta = resolvedSourceMetadata(resolution);
+        const manifest = parsedPack;
+        const checks = {};
+        let compatibility;
+        try {
+            compatibility = resolveStaticV2Compatibility(packageRoot, manifest, resolution.source);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : 'live compatibility unavailable';
+            for (const [name, sensor] of Object.entries(manifest.sensors))
+                checks[name] = sensor.enabled === false ? { ok: true, detail: 'disabled' } : { ok: false, detail };
+            return { overall: 'DEGRADED', pack: manifest.pack, checks, ...projectMetadata(project, 'project-sensors', sourceMeta.reason, { ...sourceMeta }) };
+        }
+        for (const [name, sensor] of Object.entries(manifest.sensors)) {
+            checks[name] = sensor.enabled === false ? { ok: true, detail: 'disabled' }
+                : staticCompatibilityCheck(sensor, compatibility[name]) ?? checkStructuredCommand(sensor.command, packageRoot, sensor.assets);
+        }
+        return {
+            overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED',
+            pack: manifest.pack, checks,
+            ...projectMetadata(project, 'project-sensors', sourceMeta.reason, { ...sourceMeta }),
+        };
+    }
+    const manifest = parsed.pack;
     const checks = {};
     for (const [name, config] of Object.entries(manifest.sensors ?? {})) {
         if (config.enabled === false) {
@@ -196,14 +241,10 @@ async function computeSensorStatus(cwd = process.cwd()) {
             checks[name] = { ok: false, detail: 'no cmd configured' };
             continue;
         }
-        checks[name] = checkCmd(config.cmd, cwd);
-    }
-    // `Object.values({}).every(...)` is vacuously true — a manifest with zero sensor
-    // entries (the registry had no pack.json for this stack; see init.ts) must not read
-    // as READY just because there was nothing to fail. Same false-green `checkManifest`
-    // guards against in preflight.
-    if (Object.keys(manifest.sensors ?? {}).length === 0) {
-        return { overall: 'DEGRADED', pack: manifest.pack, checks };
+        checks[name] = checkCmd(config.cmd, packageRoot);
     }
-    return { overall: Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED', pack: manifest.pack, checks };
+    return {
+        overall: Object.keys(manifest.sensors ?? {}).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED',
+        pack: manifest.pack, checks, ...projectMetadata(project, 'project-sensors', 'legacy-v1'),
+    };
 }

package/dist/src/core/init/steps.js

@@ -23,7 +23,8 @@ exports.stepContextInjection = stepContextInjection;
 const registries_1 = require("../registries");
 const install_1 = require("../../commands/hooks/install");
 const bundle_install_1 = require("../bundle-install");
-const init_1 = require("../../commands/sensors/init");
+const bootstrap_1 = require("../../commands/sensors/bootstrap");
+const detection_1 = require("../../commands/sensors/detection");
 const profile_1 = require("../profile");
 const context_1 = require("../diagnostics/context");
 const detector_1 = require("./detector");
@@ -66,15 +67,15 @@ exports.defaultActions = {
         contentDir: o.contentDir,
     }),
     initSensors: async (o) => {
-        const result = await (0, init_1.initSensors)({ cwd: o.cwd, registryRoot: o.registryRoot, configure: o.configure });
-        // `unavailablePack`/`manifest` viajan a proposito: `stepSensors` los reporta.
-        // Este wrapper proyectaba solo `detection`, asi que cualquier hallazgo nuevo de
-        // initSensors moria aca en silencio antes de llegar al step que lo muestra.
-        return {
-            detection: result.detection,
-            manifest: { pack: result.manifest.pack },
-            ...(result.unavailablePack ? { unavailablePack: result.unavailablePack } : {}),
-        };
+        const plan = await (0, bootstrap_1.planSensorBootstrap)(o.cwd, { mode: 'project-sensors', registryRoot: o.registryRoot, configure: o.configure });
+        if (plan.kind === 'blocked')
+            throw new Error(`sensor bootstrap blocked: ${plan.reason}; ${plan.remedy}`);
+        if (plan.kind === 'migrate')
+            throw new Error('sensor init does not migrate an existing v2 manifest; run awm sensors bootstrap');
+        if (plan.kind === 'create')
+            (0, bootstrap_1.applySensorBootstrap)(plan);
+        const pack = plan.kind === 'create' && plan.manifest.mode === 'project-sensors' ? plan.manifest.pack : (0, detection_1.detectStack)(o.cwd).pack;
+        return { detection: { pack }, manifest: { pack } };
     },
     addExtension: (root, name) => { (0, profile_1.addExtension)(root, name); },
     ensureProfile: (root) => { (0, profile_1.ensureProfile)(root); },
@@ -325,7 +326,19 @@ async function stepSensors(d) {
         return ok('project.sensors', 'project', 'skipped', 'no project');
     if (proj.sensors.present)
         return ok('project.sensors', 'project', 'skipped');
-    const res = await d.actions.initSensors({ cwd: proj.root, registryRoot: d.sensorPacksRoot, configure: true });
+    if (!d.sensorPacksRoot)
+        return ok('project.sensors', 'project', 'skipped', 'no configured sensor-pack registry');
+    let res;
+    try {
+        res = await d.actions.initSensors({ cwd: proj.root, registryRoot: d.sensorPacksRoot, configure: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (/^(?:source-unavailable|source-unsupported|registry-root-not-configured|sensor-variant-unresolvable):/.test(message)) {
+            return ok('project.sensors', 'project', 'skipped', message);
+        }
+        throw error;
+    }
     // A registry without the detected pack yields a fallback (or empty) manifest. The
     // step still succeeded — a manifest was written — but reporting a bare 'applied'
     // would let `awm init` hand back a quality gate that measures less than the

package/dist/src/core/secure-fs/native-bridge.js

@@ -0,0 +1,209 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.secureFs = exports.PROJECT_DESTINATION_ALREADY_EXISTS_MESSAGE = void 0;
+exports.nativeArtifactStatus = nativeArtifactStatus;
+exports.loadNativeSecureFsBridge = loadNativeSecureFsBridge;
+exports.createSecureFsBoundary = createSecureFsBoundary;
+exports.resolvePackageRoot = resolvePackageRoot;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const supportedPlatforms = new Set(['linux', 'darwin', 'win32']);
+const supportedArchitectures = new Set(['x64', 'arm64']);
+function artifactPath(root, platform, arch) {
+    if (!supportedPlatforms.has(platform) || !supportedArchitectures.has(arch)) {
+        throw new Error(`secure-fs native bridge does not support ${platform}-${arch}`);
+    }
+    return path_1.default.join(root, 'prebuilds', `${platform}-${arch}`, 'secure_fs.node');
+}
+function nativeArtifactStatus(options) {
+    const artifact = artifactPath(options.root, options.platform, options.arch);
+    return { status: fs_1.default.existsSync(artifact) ? 'available' : 'missing', platform: options.platform, arch: options.arch, path: artifact };
+}
+function loadNativeSecureFsBridge(options) {
+    const status = nativeArtifactStatus(options);
+    if (status.status !== 'available')
+        throw new Error(`secure-fs native artifact is unavailable for ${status.platform}-${status.arch}`);
+    let loaded;
+    try {
+        loaded = options.load(status.path);
+    }
+    catch {
+        throw new Error(`secure-fs native artifact is incompatible for ${status.platform}-${status.arch}`);
+    }
+    if (!loaded || typeof loaded !== 'object'
+        || typeof loaded.acquireProjectLease !== 'function'
+        || typeof loaded.releaseProjectLease !== 'function'
+        || typeof loaded.readRegularFile !== 'function'
+        || typeof loaded.writeProjectTransaction !== 'function'
+        || typeof loaded.removeObservedProjectFile !== 'function') {
+        throw new Error(`secure-fs native artifact is incompatible for ${status.platform}-${status.arch}`);
+    }
+    return loaded;
+}
+const IDENTITY_TOKEN_BYTES = 24;
+const NATIVE_DESTINATION_EXISTS_CODE = 'AWM_SECURE_FS_DESTINATION_EXISTS';
+exports.PROJECT_DESTINATION_ALREADY_EXISTS_MESSAGE = 'project destination already exists';
+const identityObservations = new WeakMap();
+function absoluteFile(value, label) {
+    if (typeof value === 'string' && value.includes('\0'))
+        throw new Error(`${label} must not contain a NUL byte`);
+    if (typeof value !== 'string' || !path_1.default.isAbsolute(value) || path_1.default.normalize(value) !== value)
+        throw new Error(`${label} must be an absolute normalized path`);
+    return value;
+}
+function isNativeDestinationExistsError(error) {
+    return !!error && typeof error === 'object'
+        && error.code === NATIVE_DESTINATION_EXISTS_CODE;
+}
+function boundedBytes(value, label) {
+    if (!Buffer.isBuffer(value))
+        throw new Error(`${label} must be a Buffer`);
+    return value;
+}
+function projectDestination(value) {
+    if (typeof value !== 'string' || !value || value.includes('\\')
+        || path_1.default.posix.isAbsolute(value) || path_1.default.win32.isAbsolute(value) || /^[A-Za-z]:/.test(value)) {
+        throw new Error('destination must be a canonical project-relative path');
+    }
+    const components = value.split('/');
+    if (components.some(component => !component || component === '.' || component === '..' || component.includes(':') || component.includes('\0'))) {
+        throw new Error('destination must contain only safe project-relative components');
+    }
+    return components.join(path_1.default.sep);
+}
+function positiveSafeInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new Error(`${label} must be a positive safe integer`);
+    return value;
+}
+function nativeIdentity(value) {
+    if (!Buffer.isBuffer(value) || value.length !== IDENTITY_TOKEN_BYTES
+        || value.toString('ascii', 0, 4) !== 'SFSI' || value[4] !== 1
+        || (value[5] !== 1 && value[5] !== 2) || value[6] !== 0 || value[7] !== 0) {
+        throw new Error('secure-fs native bridge returned invalid read identity');
+    }
+    const expectedKind = process.platform === 'win32' ? 2 : 1;
+    if (value[5] !== expectedKind)
+        throw new Error('secure-fs native bridge returned identity for the wrong platform');
+    return Buffer.from(value);
+}
+function secureReadResult(file, value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('secure-fs native bridge returned invalid read result');
+    const candidate = value;
+    if (!Buffer.isBuffer(candidate.bytes))
+        throw new Error('secure-fs native bridge returned invalid read bytes');
+    const bytes = Buffer.from(candidate.bytes);
+    const token = Object.freeze({});
+    identityObservations.set(token, { file, bytes: Buffer.from(bytes), identity: nativeIdentity(candidate.identity) });
+    return Object.freeze({ bytes, identity: token });
+}
+function writeOptions(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('transaction options must be an object');
+    const candidate = value;
+    if (candidate.mode !== 'create' && candidate.mode !== 'replace')
+        throw new Error('transaction mode must be create or replace');
+    if (typeof candidate.createParents !== 'boolean')
+        throw new Error('transaction createParents must be boolean');
+    if (candidate.mode === 'create') {
+        if (candidate.expected !== undefined || candidate.expectedIdentity !== undefined)
+            throw new Error('create transaction cannot have replacement expectations');
+        return { mode: 'create', createParents: candidate.createParents };
+    }
+    if (!Buffer.isBuffer(candidate.expected))
+        throw new Error('replace transaction requires expected Buffer bytes');
+    if (!candidate.expectedIdentity || typeof candidate.expectedIdentity !== 'object')
+        throw new Error('replace transaction requires expected identity token');
+    const observation = identityObservations.get(candidate.expectedIdentity);
+    if (!observation)
+        throw new Error('replace transaction requires an opaque identity token from readRegularFile');
+    if (!candidate.expected.equals(observation.bytes))
+        throw new Error('replace expected bytes do not match the identity observation');
+    return {
+        mode: 'replace',
+        expected: Buffer.from(observation.bytes),
+        expectedIdentity: Buffer.from(observation.identity),
+        createParents: candidate.createParents,
+    };
+}
+function createSecureFsBoundary(load) {
+    return Object.freeze({
+        withProjectLease(projectRoot, operation) {
+            const validatedRoot = absoluteFile(projectRoot, 'projectRoot');
+            if (typeof operation !== 'function')
+                throw new Error('project lease operation must be a function');
+            const binding = load();
+            let token;
+            try {
+                token = binding.acquireProjectLease(validatedRoot);
+            }
+            catch (error) {
+                const message = String(error);
+                if (message.includes('project lease is already held'))
+                    throw new Error('project lease conflict');
+                if (message.includes('rejected path ancestor'))
+                    throw new Error('project destination is unsafe for lease');
+                throw new Error('project lease acquisition failed');
+            }
+            if (!token || typeof token !== 'object' || Array.isArray(token)) {
+                throw new Error('secure-fs native bridge returned invalid project lease token');
+            }
+            try {
+                return operation();
+            }
+            finally {
+                binding.releaseProjectLease(token);
+            }
+        },
+        readRegularFile(file, maxBytes) {
+            const validatedFile = absoluteFile(file, 'file');
+            const validatedMaxBytes = positiveSafeInteger(maxBytes, 'maxBytes');
+            const result = load().readRegularFile(validatedFile, validatedMaxBytes);
+            return secureReadResult(validatedFile, result);
+        },
+        writeProjectTransaction(projectRoot, destination, content, options) {
+            const validatedRoot = absoluteFile(projectRoot, 'projectRoot');
+            const validatedDestination = projectDestination(destination);
+            const validatedContent = boundedBytes(content, 'content');
+            const validatedOptions = writeOptions(options);
+            try {
+                load().writeProjectTransaction(validatedRoot, validatedDestination, validatedContent, validatedOptions);
+            }
+            catch (error) {
+                if (isNativeDestinationExistsError(error))
+                    throw new Error(exports.PROJECT_DESTINATION_ALREADY_EXISTS_MESSAGE);
+                throw error;
+            }
+        },
+        removeObservedProjectFile(projectRoot, destination, identity) {
+            const validatedRoot = absoluteFile(projectRoot, 'projectRoot');
+            const validatedDestination = projectDestination(destination);
+            if (!identity || typeof identity !== 'object')
+                throw new Error('remove requires an opaque identity token from readRegularFile');
+            const observation = identityObservations.get(identity);
+            if (!observation)
+                throw new Error('remove requires an opaque identity token from readRegularFile');
+            const observedDestination = path_1.default.join(validatedRoot, validatedDestination);
+            if (observation.file !== observedDestination)
+                throw new Error('remove requires the exact observed destination');
+            load().removeObservedProjectFile(validatedRoot, validatedDestination, Buffer.from(observation.identity));
+        },
+    });
+}
+function resolvePackageRoot(moduleDirectory) {
+    const sourceLayout = path_1.default.resolve(moduleDirectory, '..', '..', '..');
+    return fs_1.default.existsSync(path_1.default.join(sourceLayout, 'package.json'))
+        ? sourceLayout
+        : path_1.default.resolve(sourceLayout, '..');
+}
+const packageRoot = resolvePackageRoot(__dirname);
+exports.secureFs = createSecureFsBoundary(() => loadNativeSecureFsBridge({
+    root: packageRoot,
+    platform: process.platform,
+    arch: process.arch,
+    load: artifact => require(artifact),
+}));

package/dist/tests/commands/preflight/preflight.test.js

@@ -718,4 +718,35 @@ describe('preflight', () => {
         // not the old hardcoded 9 — the shorter id's row must carry visible padding.
         expect(lines[0]).toMatch(/host {12,}@@marker/);
     });
+    it.each([
+        ['native-gate', 'CI is the authority.', 'native_gate', 'native-gate-declared'],
+        ['opt-out', 'No local gate is required.', 'ungated', 'opt-out-declared'],
+    ])('exposes stable authority metadata for %s', async (mode, declarationReason, status, reason) => {
+        const dir = make({ manifest: { schemaVersion: 3, mode, reason: declarationReason } });
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report).toMatchObject({
+            status,
+            mode,
+            reason,
+            projectRoot: dir,
+            manifestPath: path_1.default.join(dir, '.awm', 'sensors.json'),
+            remedy: expect.any(String),
+        });
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+        expect(report.status).not.toBe('ready');
+    });
+    it('derives manifest and tools checks from the same shared authority result', async () => {
+        const dir = make({ manifest: '{not valid json' });
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report).toMatchObject({
+            status: 'degraded',
+            mode: 'invalid',
+            reason: 'manifest-malformed',
+            projectRoot: dir,
+            manifestPath: path_1.default.join(dir, '.awm', 'sensors.json'),
+            remedy: expect.any(String),
+        });
+        expect(check(report, 'manifest').detail).not.toContain('no .awm/sensors.json');
+        expect(check(report, 'tools')).toBeUndefined();
+    });
 });

package/dist/tests/commands/sensors/bootstrap-observational.test.js

@@ -0,0 +1,24 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const bootstrap_1 = require("../../../src/commands/sensors/bootstrap");
+describe('planSensorBootstrap observational boundary', () => {
+    it('does not create project files while reporting a missing explicit mode', async () => {
+        const project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-bootstrap-observe-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(project, 'package.json'), '{"name":"fixture"}\n');
+            const before = fs_1.default.readdirSync(project).sort();
+            await expect((0, bootstrap_1.planSensorBootstrap)(project)).resolves.toMatchObject({ kind: 'blocked', reason: 'mode-required', changes: [] });
+            expect(fs_1.default.readdirSync(project).sort()).toEqual(before);
+            expect(fs_1.default.existsSync(path_1.default.join(project, '.awm'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(project, { recursive: true, force: true });
+        }
+    });
+});