agentic-workflow-manager 9.6.0 → 9.6.1

package/dist/src/commands/context/index.js

@@ -15,7 +15,9 @@ function runContextOrchestrators(collected, opts) {
         // un usuario que tipee el nombre declarado exacto (con un caracter que el saneo
         // quita, p.ej. `_` o un byte de control) se lleva un falso "not composed" (R3.5/R3.6).
         const verifyNormalized = (0, text_1.sanitizeDeclaredField)(opts.verify);
-        const found = composed.some((o) => o.name === verifyNormalized);
+        // A dropped raw identity must not borrow a retained declaration's sanitized name.
+        const found = !collected.droppedNames.includes(opts.verify)
+            && composed.some((o) => o.name === verifyNormalized);
         if (!found) {
             const available = composed.map((o) => o.name).join(', ') || '(none)';
             return {

package/dist/src/core/discovery.js

@@ -34,6 +34,73 @@ function readArtifactDescription(filePath) {
         return '';
     }
 }
+function inspectSkillDirectory(parent, expected) {
+    const stat = fs_1.default.lstatSync(parent, { bigint: true });
+    if (stat.isSymbolicLink())
+        throw new Error(`${parent}: must not be a symbolic link`);
+    if (!stat.isDirectory())
+        throw new Error(`${parent}: must be a directory`);
+    if (typeof stat.dev !== 'bigint' || typeof stat.ino !== 'bigint' || stat.dev < 0n || stat.ino <= 0n) {
+        throw new Error(`${parent}: directory identity is unobservable`);
+    }
+    if (expected && (stat.dev !== expected.dev || stat.ino !== expected.ino)) {
+        throw new Error(`${parent}: directory identity changed after inspection`);
+    }
+    return stat;
+}
+/** CTX-CONSTITUTION-052: bind the inspected leaf to its observable parent chain. */
+function readSkillDescription(file) {
+    const absolute = path_1.default.resolve(file);
+    const parents = [];
+    for (let parent = path_1.default.dirname(absolute);; parent = path_1.default.dirname(parent)) {
+        parents.unshift(parent);
+        if (parent === path_1.default.dirname(parent))
+            break;
+    }
+    const inspectedParents = parents.map(parent => ({ path: parent, stat: inspectSkillDirectory(parent) }));
+    const validateParents = () => {
+        for (const parent of inspectedParents)
+            inspectSkillDirectory(parent.path, parent.stat);
+    };
+    let inspected;
+    try {
+        inspected = fs_1.default.lstatSync(file, { bigint: true });
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    // A parent swapped before leaf lstat must not establish a new trusted identity.
+    validateParents();
+    if (inspected.isSymbolicLink())
+        throw new Error('must not be a symbolic link');
+    if (!inspected.isFile())
+        throw new Error('must be a regular file');
+    if (typeof inspected.dev !== 'bigint' || typeof inspected.ino !== 'bigint'
+        || typeof inspected.size !== 'bigint' || inspected.dev < 0n
+        || inspected.ino <= 0n || inspected.size < 0n) {
+        throw new Error('file identity or size is unobservable');
+    }
+    const flags = fs_1.default.constants.O_RDONLY | (fs_1.default.constants.O_NOFOLLOW ?? 0) | (fs_1.default.constants.O_NONBLOCK ?? 0);
+    const fd = fs_1.default.openSync(file, flags);
+    try {
+        const opened = fs_1.default.fstatSync(fd, { bigint: true });
+        if (!opened.isFile())
+            throw new Error('must be a regular file');
+        if (opened.dev !== inspected.dev || opened.ino !== inspected.ino || opened.size !== inspected.size) {
+            throw new Error('file identity or size changed after inspection');
+        }
+        // Reject substitutions observable after open, while retaining descriptor authority.
+        validateParents();
+        const raw = fs_1.default.readFileSync(fd, 'utf-8');
+        const frontmatter = (0, frontmatter_2.matchFrontmatterBlock)(raw);
+        return frontmatter === null ? '' : (0, frontmatter_2.readFrontmatterDescription)(frontmatter);
+    }
+    finally {
+        fs_1.default.closeSync(fd);
+    }
+}
 function collisionError(kind, name, first, second) {
     return new Error(`Artifact name collision: ${kind} "${name}" exists in both ${first} and ${second}. ` +
         `Remove or rename one of them, or declare "${name}" in "overrides" of the later registry's awm-registry.json.`);
@@ -54,7 +121,7 @@ function mergeEntry(kind, byName, entry, rootOverrides) {
 }
 /**
  * Scans skills directories across all provided content roots and returns all valid skills.
- * A valid skill is a directory that contains a SKILL.md file.
+ * A valid skill is a directory that contains a regular, non-symlink SKILL.md file.
  * Throws on name collision across roots unless the later root declares the name in its awm-registry.json overrides.
  */
 function discoverSkills(roots = (0, registries_1.contentRoots)()) {
@@ -68,12 +135,20 @@ function discoverSkills(roots = (0, registries_1.contentRoots)()) {
             if (!entry.isDirectory())
                 continue;
             const skillPath = path_1.default.join(dir, entry.name);
-            if (!fs_1.default.existsSync(path_1.default.join(skillPath, 'SKILL.md')))
-                continue;
+            const skillFile = path_1.default.join(skillPath, 'SKILL.md');
+            let description;
+            try {
+                description = readSkillDescription(skillFile);
+                if (description === null)
+                    continue;
+            }
+            catch (e) {
+                throw new Error(`${skillFile}: cannot read (${e instanceof Error ? e.message : String(e)})`);
+            }
             mergeEntry('skill', byName, {
                 name: entry.name,
                 path: skillPath,
-                description: readArtifactDescription(path_1.default.join(skillPath, 'SKILL.md')),
+                description,
             }, overrides);
         }
     }

package/dist/src/core/orchestrators.js

@@ -17,6 +17,7 @@ exports.collectAndWarn = collectAndWarn;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const registries_1 = require("./registries");
+const discovery_1 = require("./discovery");
 const text_1 = require("./text");
 const ALLOWED_FIELDS = ['name', 'appliesWhen', 'terminatesTo'];
 // These fields are semantically short (a short identity, a short trigger condition, a
@@ -24,6 +25,24 @@ const ALLOWED_FIELDS = ['name', 'appliesWhen', 'terminatesTo'];
 // untrusted input whose fields flow straight into the AI-provider context payload, so an
 // unbounded string here would let a crafted registry bloat/DoS that context.
 const MAX_FIELD_LENGTH = 500;
+function discoverDeclaredSkillNames() {
+    let names = new Set();
+    const diagnostics = [];
+    const acceptedRoots = [];
+    for (const root of (0, registries_1.contentRoots)()) {
+        try {
+            // Admit the entire root only after global collision/override resolution succeeds.
+            const skills = (0, discovery_1.discoverSkills)([...acceptedRoots, root]);
+            names = new Set(skills.map((skill) => skill.name));
+            acceptedRoots.push(root);
+        }
+        catch (e) {
+            const message = e instanceof Error ? e.message : String(e);
+            diagnostics.push(`${(0, text_1.sanitizeDiagnosticText)(root)}: orchestrator skill discovery unavailable (${(0, text_1.sanitizeDiagnosticText)(message)})`);
+        }
+    }
+    return { names, diagnostics };
+}
 function readDeclaredOrchestrators(root) {
     const file = path_1.default.join(root, registries_1.REGISTRY_MANIFEST_NAME);
     // Shares the same trust boundary as readRegistryManifest (registries.ts): a manifest
@@ -35,7 +54,7 @@ function readDeclaredOrchestrators(root) {
         exists = (0, registries_1.assertRegularRegistryFile)(file);
     }
     catch (e) {
-        return { orchestrators: [], diagnostics: [`${file}: ${e instanceof Error ? e.message : String(e)}`] };
+        return { orchestrators: [], diagnostics: [(0, text_1.sanitizeDiagnosticText)(`${file}: ${e instanceof Error ? e.message : String(e)}`)] };
     }
     if (!exists)
         return { orchestrators: [], diagnostics: [] };
@@ -44,28 +63,27 @@ function readDeclaredOrchestrators(root) {
         contents = fs_1.default.readFileSync(file, 'utf-8');
     }
     catch (e) {
-        return { orchestrators: [], diagnostics: [`${file}: cannot read manifest (${e instanceof Error ? e.message : String(e)})`] };
+        return { orchestrators: [], diagnostics: [(0, text_1.sanitizeDiagnosticText)(`${file}: cannot read manifest (${e instanceof Error ? e.message : String(e)})`)] };
     }
     let raw;
     try {
         raw = JSON.parse(contents);
     }
     catch (e) {
-        return { orchestrators: [], diagnostics: [`${file}: manifest is not valid JSON (${e instanceof Error ? e.message : String(e)})`] };
+        return { orchestrators: [], diagnostics: [(0, text_1.sanitizeDiagnosticText)(`${file}: manifest is not valid JSON (${e instanceof Error ? e.message : String(e)})`)] };
     }
     const decl = raw?.orchestrator;
     if (decl === undefined)
         return { orchestrators: [], diagnostics: [] };
     if (typeof decl !== 'object' || decl === null || Array.isArray(decl)) {
-        return { orchestrators: [], diagnostics: [`${file}: "orchestrator" must be an object`] };
+        return { orchestrators: [], diagnostics: [(0, text_1.sanitizeDiagnosticText)(`${file}: "orchestrator" must be an object`)] };
     }
     const problems = [];
     const entries = decl;
     for (const key of Object.keys(entries)) {
         if (!ALLOWED_FIELDS.includes(key)) {
-            // key comes straight from an untrusted registry's JSON — JSON.stringify keeps the
-            // diagnostic single-line and unambiguous even if the key contains newlines or other
-            // control characters, which would otherwise let a crafted key forge extra log lines.
+            // Quote keys unambiguously; sanitize the complete diagnostic below because
+            // JSON.stringify preserves Unicode line separators and C1 controls.
             problems.push(`unknown field ${JSON.stringify(key)} — the contract admits only ${ALLOWED_FIELDS.join(', ')}`);
         }
     }
@@ -79,7 +97,7 @@ function readDeclaredOrchestrators(root) {
         }
     }
     if (problems.length > 0) {
-        return { orchestrators: [], diagnostics: [`${file}: invalid "orchestrator" declaration — ${problems.join('; ')}`] };
+        return { orchestrators: [], diagnostics: [(0, text_1.sanitizeDiagnosticText)(`${file}: invalid "orchestrator" declaration — ${problems.join('; ')}`)] };
     }
     return {
         orchestrators: [{
@@ -126,13 +144,19 @@ function readDeclaredOrchestrators(root) {
  */
 function collectDeclaredOrchestrators() {
     const declared = [];
-    const diagnostics = [];
+    const droppedNames = [];
+    const { names: availableSkillNames, diagnostics } = discoverDeclaredSkillNames();
     const seenNames = new Set();
     const seenSanitizedNames = new Set();
     for (const reg of (0, registries_1.listRegistries)()) {
         const r = readDeclaredOrchestrators(reg.contentRoot);
         for (const orch of r.orchestrators) {
             const file = path_1.default.join(reg.contentRoot, registries_1.REGISTRY_MANIFEST_NAME);
+            if (!availableSkillNames.has(orch.name)) {
+                droppedNames.push(orch.name);
+                diagnostics.push(`${(0, text_1.sanitizeDiagnosticText)(file)}: orchestrator declaration dropped because skill "${(0, text_1.sanitizeDiagnosticText)(orch.name)}" is not discoverable in configured safe registries`);
+                continue;
+            }
             if (seenNames.has(orch.name)) {
                 diagnostics.push(`${file}: orchestrator "${(0, text_1.stripControlChars)(orch.name)}" duplicates one already declared by an earlier registry — shadowed duplicate dropped`);
                 continue;
@@ -149,7 +173,7 @@ function collectDeclaredOrchestrators() {
         }
         diagnostics.push(...r.diagnostics);
     }
-    return { declared, diagnostics };
+    return { declared, diagnostics, droppedNames };
 }
 /** Recolecta declarados y emite sus diagnosticos como warnings. Punto unico usado por
  *  `InjectionOrchestrator.inputFor`/`statusInputFor` y por `commands/hooks/claude.ts`

package/dist/src/core/text.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stripControlChars = stripControlChars;
+exports.sanitizeDiagnosticText = sanitizeDiagnosticText;
 exports.sanitizeDeclaredField = sanitizeDeclaredField;
 // cli/src/core/text.ts
 /** Neutraliza bytes de control C0 (incluyendo ESC `\x1b`) y DEL de texto que
@@ -16,6 +17,12 @@ function stripControlChars(text) {
     // eslint-disable-next-line no-control-regex -- necesitamos matchear C0 deliberadamente
     return text.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
 }
+/** Keeps an untrusted diagnostic field on one terminal line, without changing
+ * the whitespace policy for multiline public text or composed markdown. */
+function sanitizeDiagnosticText(text) {
+    // eslint-disable-next-line no-control-regex -- remove all C0/C1 controls, including terminal escape bytes
+    return text.replace(/\r\n|[\r\n\t\u2028\u2029]/g, ' ').replace(/[\x00-\x1f\x7f-\x9f]/g, '');
+}
 /**
  * Neutraliza marcado markdown (colapsa `\r?\n` a un espacio y quita
  * `` ` * _ # < > ``) de contenido no confiable antes de interpolarlo en un

package/dist/tests/commands/context.test.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const context_1 = require("../../src/commands/context");
-const collected = (declared, diagnostics = []) => ({ declared, diagnostics });
+const collected = (declared, diagnostics = []) => ({ declared, diagnostics, droppedNames: [] });
 const uno = { name: 'mi-proceso', appliesWhen: 'cuando hay una tarea', terminatesTo: 'development-process' };
 describe('awm context orchestrators', () => {
     it('lista los orquestadores compuestos', () => {
@@ -55,6 +55,14 @@ describe('awm context orchestrators', () => {
         const r = (0, context_1.runContextOrchestrators)(collected([uno]), { json: false, verify: 'de-verdad-no-existe' });
         expect(r.code).toBe(2);
     });
+    it('--verify rejects a dropped raw identity that sanitizes to a retained name', () => {
+        const input = {
+            ...collected([{ name: 'foobar', appliesWhen: 'x', terminatesTo: 'y' }]),
+            droppedNames: ['foo_bar'],
+        };
+        expect((0, context_1.runContextOrchestrators)(input, { json: false, verify: 'foo_bar' }).code).toBe(2);
+        expect((0, context_1.runContextOrchestrators)(input, { json: false, verify: 'foobar' }).code).toBe(0);
+    });
     it('sanea bytes de control antes de escribir a la terminal', () => {
         const hostil = { name: 'x\x1b[31m', appliesWhen: 'w\x07', terminatesTo: 't\x00' };
         const r = (0, context_1.runContextOrchestrators)(collected([hostil]), { json: false });

package/dist/tests/commands/hooks/install.test.js

@@ -186,6 +186,8 @@ describe('installHook (happy path + merge)', () => {
         fs_1.default.writeFileSync(path_1.default.join(regHooks, 'session-start'), '#!/usr/bin/env bash\necho "{}"', { mode: 0o755 });
         fs_1.default.writeFileSync(path_1.default.join(regHooks, 'run-hook.cmd'), '#!/usr/bin/env bash\nexec bash "$1"', { mode: 0o755 });
         fs_1.default.writeFileSync(path_1.default.join(regSkill, 'SKILL.md'), '---\nname: using-awm\n---\nMUST invoke skills.');
+        fs_1.default.mkdirSync(path_1.default.join(registryRoot, 'skills', 'mi-proceso'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'skills', 'mi-proceso', 'SKILL.md'), '---\nname: mi-proceso\n---\n');
         fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'awm-registry.json'), JSON.stringify({ orchestrator: { name: 'mi-proceso', appliesWhen: 'al arrancar', terminatesTo: 'development-process' } }));
         installHook({ agent: 'claude-code', registryRoot, installMethod: 'symlink' });
         const content = fs_1.default.readFileSync(path_1.default.join(tmpHome, '.awm', 'hooks', 'using-awm.md'), 'utf-8');
@@ -246,6 +248,8 @@ describe('installHook (happy path + merge)', () => {
         fs_1.default.writeFileSync(path_1.default.join(regHooks, 'session-start'), '#!/usr/bin/env bash\necho "{}"', { mode: 0o755 });
         fs_1.default.writeFileSync(path_1.default.join(regHooks, 'run-hook.cmd'), '#!/usr/bin/env bash\nexec bash "$1"', { mode: 0o755 });
         fs_1.default.writeFileSync(path_1.default.join(regSkill, 'SKILL.md'), '---\nname: using-awm\n---\nMUST invoke skills.');
+        fs_1.default.mkdirSync(path_1.default.join(registryRoot, 'skills', 'proceso-valido'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'skills', 'proceso-valido', 'SKILL.md'), '---\nname: proceso-valido\n---\n');
         fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'awm-registry.json'), JSON.stringify({ orchestrator: { name: 'proceso-valido', appliesWhen: 'al arrancar', terminatesTo: 'development-process' } }));
         const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => { });
         let result;

package/dist/tests/commands/hooks/resync.test.js

@@ -101,6 +101,8 @@ describe('resyncInstalledHooks', () => {
         fs_1.default.writeFileSync(path_1.default.join(regHooks, 'session-start'), '#!/usr/bin/env bash\necho "{}"', { mode: 0o755 });
         fs_1.default.writeFileSync(path_1.default.join(regHooks, 'run-hook.cmd'), '#!/usr/bin/env bash\nexec bash "$1"', { mode: 0o755 });
         fs_1.default.writeFileSync(path_1.default.join(regSkill, 'SKILL.md'), '---\nname: using-awm\n---\nMUST invoke skills.');
+        fs_1.default.mkdirSync(path_1.default.join(registryRoot, 'skills', 'mi-proceso'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'skills', 'mi-proceso', 'SKILL.md'), '---\nname: mi-proceso\n---\n');
         fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'awm-registry.json'), JSON.stringify({ orchestrator: { name: 'mi-proceso', appliesWhen: 'al arrancar', terminatesTo: 'development-process' } }));
         const { installHook } = require('../../../src/commands/hooks/install');
         installHook({ agent: 'claude-code', registryRoot, installMethod: 'symlink' });

package/dist/tests/core/context/orchestrator.test.js

@@ -255,6 +255,8 @@ describe('InjectionOrchestrator (declared orchestrators from an installed regist
         const registryRoot = (0, registries_1.registryContentRoot)('declaring');
         fs_1.default.mkdirSync(path_1.default.join(registryRoot, 'skills/using-awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'skills/using-awm/SKILL.md'), '---\nversion: "1.0.0"\n---\nBODY');
+        fs_1.default.mkdirSync(path_1.default.join(registryRoot, 'skills/mi-proceso'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'skills/mi-proceso/SKILL.md'), '---\nname: mi-proceso\n---\n');
         fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'awm-registry.json'), JSON.stringify({
             orchestrator: { name: 'mi-proceso', appliesWhen: 'al arrancar', terminatesTo: 'development-process' },
         }));

package/dist/tests/core/discovery-multiroot.test.js

@@ -60,4 +60,9 @@ describe('discovery multi-root', () => {
         expect(discoverSkills([rootA, rootB]).length).toBe(1);
         expect(discoverAgents([rootA, rootB])).toEqual([]);
     });
+    it('rejects a real directory named SKILL.md as a nonregular artifact without blocking', () => {
+        fs_1.default.mkdirSync(path_1.default.join(rootA, 'skills', 'unsafe', 'SKILL.md'), { recursive: true });
+        const { discoverSkills } = require('../../src/core/discovery');
+        expect(() => discoverSkills([rootA])).toThrow(/SKILL\.md.*regular file/);
+    });
 });

package/dist/tests/core/discovery-parent-race.test.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const discovery_1 = require("../../src/core/discovery");
+describe('real skill parent races', () => {
+    let fixture;
+    let root;
+    let skillDir;
+    let skillFile;
+    beforeEach(() => {
+        fixture = fs_1.default.mkdtempSync(path_1.default.join(fs_1.default.realpathSync(os_1.default.tmpdir()), 'skill-parent-race-'));
+        root = path_1.default.join(fixture, 'registry');
+        skillDir = path_1.default.join(root, 'skills', 'safe');
+        skillFile = path_1.default.join(skillDir, 'SKILL.md');
+        fs_1.default.mkdirSync(skillDir, { recursive: true });
+        fs_1.default.writeFileSync(skillFile, '---\ndescription: Inside skill\n---\n');
+    });
+    afterEach(() => {
+        jest.restoreAllMocks();
+        fs_1.default.rmSync(fixture, { recursive: true, force: true });
+    });
+    it('reads an unchanged skill through its descriptor', () => {
+        expect((0, discovery_1.discoverSkills)([root])).toEqual([
+            { name: 'safe', path: skillDir, description: 'Inside skill' },
+        ]);
+    });
+    describe.each(['root', 'skills', 'skill directory'])('%s substitution', (component) => {
+        it.each(['symlink', 'directory'])('rejects a %s swapped after parent inspection before reading outside bytes', (replacement) => {
+            const parent = component === 'root' ? root : component === 'skills' ? path_1.default.dirname(skillDir) : skillDir;
+            const outside = path_1.default.join(fixture, 'outside');
+            const outsideFile = path_1.default.join(outside, path_1.default.relative(parent, skillFile));
+            fs_1.default.mkdirSync(path_1.default.dirname(outsideFile), { recursive: true });
+            fs_1.default.writeFileSync(outsideFile, '---\ndescription: Outside skill\n---\n');
+            const lstat = fs_1.default.lstatSync;
+            let swapped = false;
+            // Keep real lstat results; only schedule a real rename/symlink at the race boundary.
+            jest.spyOn(fs_1.default, 'lstatSync').mockImplementation(((...args) => {
+                const stat = lstat(...args);
+                if (args[0] === parent && !swapped) {
+                    swapped = true;
+                    fs_1.default.renameSync(parent, path_1.default.join(fixture, 'original-parent'));
+                    if (replacement === 'symlink')
+                        fs_1.default.symlinkSync(outside, parent, 'junction');
+                    else
+                        fs_1.default.renameSync(outside, parent);
+                }
+                return stat;
+            }));
+            const read = jest.spyOn(fs_1.default, 'readFileSync');
+            expect(() => (0, discovery_1.discoverSkills)([root])).toThrow(/symbolic link|directory identity/i);
+            expect(swapped).toBe(true);
+            expect(read.mock.calls.filter(([file]) => typeof file === 'number'
+                || String(file).startsWith(fixture + path_1.default.sep))).toEqual([]);
+        });
+    });
+    it('rejects an observable parent symlink introduced after open and closes the descriptor without reading', () => {
+        const open = fs_1.default.openSync;
+        let descriptor;
+        jest.spyOn(fs_1.default, 'openSync').mockImplementation((...args) => {
+            descriptor = open(...args);
+            const moved = path_1.default.join(fixture, 'original-parent');
+            fs_1.default.renameSync(skillDir, moved);
+            fs_1.default.symlinkSync(moved, skillDir, 'junction');
+            return descriptor;
+        });
+        const read = jest.spyOn(fs_1.default, 'readFileSync');
+        const close = jest.spyOn(fs_1.default, 'closeSync');
+        let thrown;
+        try {
+            (0, discovery_1.discoverSkills)([root]);
+        }
+        catch (error) {
+            thrown = error;
+        }
+        if (process.platform === 'win32') {
+            // Windows holds the opened file's parent directory handle, so the
+            // replacement itself is denied before a symlink can be introduced.
+            // This is the same security guarantee: outside bytes cannot be read.
+            expect(thrown).toBeInstanceOf(Error);
+            expect(thrown.message).toMatch(/EPERM.*rename|rename.*EPERM/i);
+        }
+        else {
+            expect(thrown).toBeInstanceOf(Error);
+            expect(thrown.message).toMatch(/symbolic link/i);
+            expect(close).toHaveBeenCalledWith(descriptor);
+        }
+        expect(read.mock.calls.filter(([file]) => typeof file === 'number'
+            || String(file).startsWith(fixture + path_1.default.sep))).toEqual([]);
+    });
+});

package/dist/tests/core/discovery-safe-read.test.js

@@ -0,0 +1,115 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const discovery_1 = require("../../src/core/discovery");
+jest.mock('fs');
+const root = path_1.default.resolve('registry');
+const skillDir = path_1.default.join(root, 'skills', 'safe');
+const skillFile = path_1.default.join(skillDir, 'SKILL.md');
+const content = '---\ndescription: >-\n  Ordinary skill\n---\n';
+const descriptor = 42;
+const inspected = {
+    dev: 7n, ino: 9007199254740993n, size: BigInt(Buffer.byteLength(content)),
+    isFile: () => true, isSymbolicLink: () => false, isDirectory: () => false,
+};
+const directory = { dev: 7n, ino: 8n, isFile: () => false, isSymbolicLink: () => false, isDirectory: () => true };
+describe.each([true, false])('skill descriptor safety (O_NOFOLLOW available: %s)', (noFollowAvailable) => {
+    beforeEach(() => {
+        jest.resetAllMocks();
+        const actual = jest.requireActual('fs');
+        jest.replaceProperty(fs_1.default, 'constants', {
+            ...actual.constants,
+            O_NOFOLLOW: noFollowAvailable ? 0x20000 : undefined,
+            O_NONBLOCK: 0x800,
+        });
+        fs_1.default.existsSync.mockReturnValue(true);
+        fs_1.default.readdirSync.mockReturnValue([{ name: 'safe', isDirectory: () => true }]);
+        fs_1.default.lstatSync.mockImplementation((file) => {
+            if (file === skillFile)
+                return inspected;
+            if (file.endsWith('awm-registry.json'))
+                throw Object.assign(new Error('missing'), { code: 'ENOENT' });
+            return directory;
+        });
+        fs_1.default.openSync.mockReturnValue(descriptor);
+        fs_1.default.fstatSync.mockReturnValue(inspected);
+        fs_1.default.readFileSync.mockReturnValue(content);
+    });
+    afterEach(() => jest.restoreAllMocks());
+    it('reads an ordinary skill from the validated descriptor and closes it', () => {
+        expect((0, discovery_1.discoverSkills)([root])).toEqual([{ name: 'safe', path: skillDir, description: 'Ordinary skill' }]);
+        expect(fs_1.default.readFileSync).toHaveBeenCalledWith(descriptor, 'utf-8');
+        expect(fs_1.default.closeSync).toHaveBeenCalledWith(descriptor);
+        const flags = fs_1.default.openSync.mock.calls[0][1];
+        expect(typeof flags).toBe('number');
+        if (noFollowAvailable)
+            expect(flags & fs_1.default.constants.O_NOFOLLOW).toBe(fs_1.default.constants.O_NOFOLLOW);
+        expect(flags & fs_1.default.constants.O_NONBLOCK).toBe(fs_1.default.constants.O_NONBLOCK);
+    });
+    it.each([
+        ['another inode', { ino: inspected.ino + 1n }],
+        ['another device', { dev: inspected.dev + 1n }],
+        ['changed size', { size: inspected.size + 1n }],
+        ['FIFO replacement', { isFile: () => false }],
+        ['symlink replacement', { isFile: () => false, isSymbolicLink: () => true }],
+        ['unobservable device', { dev: undefined }],
+        ['unobservable inode', { ino: undefined }],
+    ])('rejects %s after inspection, without reading replacement bytes', (_label, change) => {
+        fs_1.default.fstatSync.mockReturnValue({ ...inspected, ...change });
+        expect(() => (0, discovery_1.discoverSkills)([root])).toThrow(/SKILL\.md.*(identity|regular|size|symbolic)/i);
+        expect(fs_1.default.readFileSync).not.toHaveBeenCalled();
+        expect(fs_1.default.closeSync).toHaveBeenCalledWith(descriptor);
+    });
+    it('opens nonblocking so a FIFO replacement cannot hang before fstat rejects it', () => {
+        // No FIFO is created: the open mock enforces the flag needed to avoid blocking.
+        fs_1.default.openSync.mockImplementation((_file, flags) => {
+            if (!(flags & fs_1.default.constants.O_NONBLOCK))
+                throw new Error('would block opening FIFO');
+            return descriptor;
+        });
+        fs_1.default.fstatSync.mockReturnValue({ ...inspected, isFile: () => false });
+        expect(() => (0, discovery_1.discoverSkills)([root])).toThrow(/regular file/i);
+        expect(fs_1.default.readFileSync).not.toHaveBeenCalled();
+        expect(fs_1.default.closeSync).toHaveBeenCalledWith(descriptor);
+    });
+    it.each(['openSync', 'fstatSync', 'readFileSync'])('fails closed on %s errors', (operation) => {
+        fs_1.default[operation].mockImplementation(() => { throw new Error('replaced or unreadable'); });
+        expect(() => (0, discovery_1.discoverSkills)([root])).toThrow(/SKILL\.md.*replaced or unreadable/);
+        if (operation === 'openSync')
+            expect(fs_1.default.closeSync).not.toHaveBeenCalled();
+        else
+            expect(fs_1.default.closeSync).toHaveBeenCalledWith(descriptor);
+        if (operation !== 'readFileSync')
+            expect(fs_1.default.readFileSync).not.toHaveBeenCalled();
+    });
+    it.each([root, path_1.default.join(root, 'skills'), skillDir])('rejects an observable directory symlink at %s', (linked) => {
+        const lstat = fs_1.default.lstatSync.getMockImplementation();
+        fs_1.default.lstatSync.mockImplementation((file, options) => file === linked
+            ? { ...directory, isDirectory: () => false, isSymbolicLink: () => true }
+            : lstat(file, options));
+        expect(() => (0, discovery_1.discoverSkills)([root])).toThrow(/symbolic link/i);
+        expect(fs_1.default.openSync).not.toHaveBeenCalled();
+        expect(fs_1.default.readFileSync).not.toHaveBeenCalled();
+    });
+    it.each(['dev', 'ino', 'size'])('fails closed when inspected %s is unobservable', (field) => {
+        const unknown = { ...inspected, [field]: undefined };
+        const lstat = fs_1.default.lstatSync.getMockImplementation();
+        fs_1.default.lstatSync.mockImplementation((file, options) => file === skillFile ? unknown : lstat(file, options));
+        fs_1.default.fstatSync.mockReturnValue(unknown);
+        expect(() => (0, discovery_1.discoverSkills)([root])).toThrow(/identity|size/i);
+        expect(fs_1.default.readFileSync).not.toHaveBeenCalled();
+    });
+    it.each(['dev', 'ino'])('fails closed when parent %s is unobservable', (field) => {
+        const lstat = fs_1.default.lstatSync.getMockImplementation();
+        fs_1.default.lstatSync.mockImplementation((file, options) => file === skillDir
+            ? { ...directory, [field]: undefined }
+            : lstat(file, options));
+        expect(() => (0, discovery_1.discoverSkills)([root])).toThrow(/directory identity/i);
+        expect(fs_1.default.openSync).not.toHaveBeenCalled();
+        expect(fs_1.default.readFileSync).not.toHaveBeenCalled();
+    });
+});

package/dist/tests/core/discovery.test.js

@@ -15,16 +15,30 @@ const WORKFLOWS_ROOT = CONTENT_ROOT;
 // For backward-compat with mock expectations that check SKILLS_DIR-style paths:
 const SKILLS_DIR = path_1.default.join(CONTENT_ROOT, 'skills');
 const WORKFLOWS_DIR = path_1.default.join(CONTENT_ROOT, 'workflows');
+const directoryStat = { dev: 1n, ino: 3n, isDirectory: () => true, isSymbolicLink: () => false };
+const skillStat = { dev: 1n, ino: 2n, size: 0n, isFile: () => true, isSymbolicLink: () => false };
 describe('Artifact Discovery', () => {
     beforeEach(() => {
         jest.clearAllMocks();
-        fs_1.default.lstatSync.mockImplementation(() => {
+        fs_1.default.lstatSync.mockImplementation((p) => {
+            if (!p.endsWith('.md') && !p.endsWith('.json'))
+                return directoryStat;
             const error = Object.assign(new Error('missing'), { code: 'ENOENT' });
             throw error;
         });
+        fs_1.default.openSync.mockReturnValue(42);
+        fs_1.default.fstatSync.mockReturnValue(skillStat);
+        fs_1.default.readFileSync.mockReturnValue('');
     });
     describe('discoverSkills', () => {
         it('should return a list of skill directories that contain a SKILL.md', () => {
+            fs_1.default.lstatSync.mockImplementation((p) => {
+                if (p.endsWith('SKILL.md'))
+                    return skillStat;
+                if (!p.endsWith('.json'))
+                    return directoryStat;
+                throw Object.assign(new Error('missing'), { code: 'ENOENT' });
+            });
             fs_1.default.existsSync.mockImplementation((p) => {
                 if (p === SKILLS_DIR)
                     return true;
@@ -48,6 +62,19 @@ describe('Artifact Discovery', () => {
             const skills = (0, discovery_1.discoverSkills)([SKILLS_ROOT]);
             expect(skills).toEqual([]);
         });
+        it.each(['fifo', 'symlink'])('rejects a %s SKILL.md before attempting any read', (kind) => {
+            fs_1.default.existsSync.mockReturnValue(true);
+            fs_1.default.readdirSync.mockReturnValue([{ name: 'unsafe', isDirectory: () => true }]);
+            fs_1.default.lstatSync.mockImplementation((p) => {
+                if (p.endsWith('SKILL.md'))
+                    return { isFile: () => false, isSymbolicLink: () => kind === 'symlink' };
+                if (!p.endsWith('.json'))
+                    return directoryStat;
+                throw Object.assign(new Error('missing'), { code: 'ENOENT' });
+            });
+            expect(() => (0, discovery_1.discoverSkills)([SKILLS_ROOT])).toThrow(/regular file|symbolic link/);
+            expect(fs_1.default.readFileSync).not.toHaveBeenCalled();
+        });
         it('should skip skill directories without a SKILL.md', () => {
             fs_1.default.existsSync.mockImplementation((p) => {
                 if (p === SKILLS_DIR)

package/dist/tests/core/orchestrators.test.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
+const command_result_1 = require("../../src/core/command-result");
 const orchestrators_1 = require("../../src/core/orchestrators");
 const registries_1 = require("../../src/core/registries");
 function registryWith(manifest) {
@@ -16,6 +17,7 @@ function registryWith(manifest) {
 describe('readDeclaredOrchestrators', () => {
     const created = [];
     afterEach(() => {
+        jest.restoreAllMocks();
         for (const r of created.splice(0))
             fs_1.default.rmSync(r, { recursive: true, force: true });
     });
@@ -176,6 +178,62 @@ describe('readDeclaredOrchestrators', () => {
         expect(diagnostics[0].split('\n')).toHaveLength(1);
         expect(diagnostics[0]).toContain(JSON.stringify('evil\nfake-warning: injected line'));
     });
+    describe('single-line diagnostic boundary', () => {
+        const hostile = 'before\u2028\u2029\u0085\r\n\t'
+            + String.fromCharCode(...Array.from({ length: 32 }, (_, i) => i))
+            + String.fromCharCode(...Array.from({ length: 33 }, (_, i) => 127 + i)) + 'after';
+        it('sanitizes unknown metadata keys without accepting the declaration', () => {
+            const root = registryWith({
+                orchestrator: { name: 'x', appliesWhen: 'y', terminatesTo: 'none', [hostile]: true },
+            });
+            created.push(root);
+            const result = (0, orchestrators_1.readDeclaredOrchestrators)(root);
+            expect(result.orchestrators).toEqual([]);
+            expect(result.diagnostics).toHaveLength(1);
+            expect(result.diagnostics[0]).toContain('unknown field');
+            expect(result.diagnostics[0]).toContain('before');
+            expect(result.diagnostics[0]).toContain('after');
+            const stderrBoundary = jest.fn(command_result_1.diagnosticsToStderr);
+            stderrBoundary(result.diagnostics);
+            expect(stderrBoundary.mock.calls[0][0].join('')).not.toMatch(/[\u2028\u0085]/);
+            expect(stderrBoundary.mock.results[0].value).not.toMatch(/[\u2028\u0085]/);
+            // eslint-disable-next-line no-control-regex -- reject all terminal controls and line separators
+            expect(result.diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
+        });
+        it.each(['inspection', 'read', 'parse', 'shape', 'fields'])('sanitizes %s diagnostics, including paths and error text', (branch) => {
+            // Mock hostile paths instead of creating filenames that are invalid on Windows.
+            const root = path_1.default.join(os_1.default.tmpdir(), hostile);
+            const error = new Error(hostile);
+            jest.spyOn(fs_1.default, 'lstatSync').mockImplementation(() => {
+                if (branch === 'inspection')
+                    throw error;
+                return { isFile: () => true, isSymbolicLink: () => false };
+            });
+            jest.spyOn(fs_1.default, 'readFileSync').mockImplementation(() => {
+                if (branch === 'read')
+                    throw error;
+                if (branch === 'parse')
+                    return `{ ${hostile}`;
+                return JSON.stringify({ orchestrator: branch === 'shape' ? [] : {} });
+            });
+            if (branch === 'parse')
+                jest.spyOn(JSON, 'parse').mockImplementationOnce(() => { throw new SyntaxError(hostile); });
+            const result = (0, orchestrators_1.readDeclaredOrchestrators)(root);
+            expect(result.orchestrators).toEqual([]);
+            expect(result.diagnostics).toHaveLength(1);
+            expect(result.diagnostics[0]).toContain('awm-registry.json');
+            expect(result.diagnostics[0]).toContain('before');
+            expect(result.diagnostics[0]).toContain('after');
+            // eslint-disable-next-line no-control-regex -- reject all terminal controls and line separators
+            expect(result.diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
+        });
+        it('preserves valid raw fields and structural parsing without skill discovery', () => {
+            const declaration = { name: hostile, appliesWhen: hostile, terminatesTo: hostile };
+            const root = registryWith({ orchestrator: declaration });
+            created.push(root);
+            expect((0, orchestrators_1.readDeclaredOrchestrators)(root)).toEqual({ orchestrators: [declaration], diagnostics: [] });
+        });
+    });
 });
 describe('collectDeclaredOrchestrators', () => {
     // Isolates AWM_HOME per CLAUDE.md's testing rule ("ningun test puede tocar el ~/.awm
@@ -199,6 +257,11 @@ describe('collectDeclaredOrchestrators', () => {
         fs_1.default.mkdirSync(root, { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(root, 'awm-registry.json'), JSON.stringify(manifest));
     }
+    function writeSkill(registryName, skillName) {
+        const skillDir = path_1.default.join((0, registries_1.registryContentRoot)(registryName), 'skills', skillName);
+        fs_1.default.mkdirSync(skillDir, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(skillDir, 'SKILL.md'), `---\nname: ${skillName}\n---\n\n# ${skillName}\n`);
+    }
     it('dedupea por nombre entre dos registries, conservando el primero por orden de registries.json', () => {
         (0, registries_1.writeRegistriesConfig)([
             { name: 'first', remote: 'unused' },
@@ -210,6 +273,7 @@ describe('collectDeclaredOrchestrators', () => {
         writeManifest('second', {
             orchestrator: { name: 'shared', appliesWhen: 'segundo', terminatesTo: 'b' },
         });
+        writeSkill('first', 'shared');
         const { declared, diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
         expect(declared).toHaveLength(1);
         expect(declared[0]).toEqual({ name: 'shared', appliesWhen: 'primero', terminatesTo: 'a' });
@@ -217,23 +281,60 @@ describe('collectDeclaredOrchestrators', () => {
         expect(diagnostics[0]).toMatch(/shared/);
         expect(diagnostics[0]).toMatch(/duplicate|shadow/i);
     });
-    it('sanea el nombre antes de interpolarlo en el diagnostico de duplicado', () => {
-        (0, registries_1.writeRegistriesConfig)([
-            { name: 'first', remote: 'unused' },
-            { name: 'second', remote: 'unused' },
-        ]);
-        const nombreHostil = 'shared\x1b[31m';
+    it('keeps missing-skill diagnostics single-line with hostile metadata and portable paths', () => {
+        (0, registries_1.writeRegistriesConfig)([{ name: 'first', remote: 'unused' }]);
+        const nombreHostil = 'shared\r\nforged\t\x1b[31m\x00\x7f\x85\x9b\u2028\u2029';
         writeManifest('first', {
             orchestrator: { name: nombreHostil, appliesWhen: 'primero', terminatesTo: 'a' },
         });
-        writeManifest('second', {
-            orchestrator: { name: nombreHostil, appliesWhen: 'segundo', terminatesTo: 'b' },
-        });
+        writeSkill('first', 'real-skill');
         const { diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
         expect(diagnostics).toHaveLength(1);
-        // eslint-disable-next-line no-control-regex -- verificamos la ausencia deliberada de C0
-        expect(diagnostics[0]).not.toMatch(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/);
-        expect(diagnostics[0]).toContain('shared[31m');
+        // eslint-disable-next-line no-control-regex -- diagnostic must contain no terminal controls or line separators
+        expect(diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
+        expect(diagnostics[0]).toContain('shared');
+        expect(diagnostics[0]).toContain('forged');
+        expect(diagnostics[0]).toContain('declaration dropped');
+    });
+    it('keeps discovery diagnostics single-line for hostile override metadata', () => {
+        (0, registries_1.writeRegistriesConfig)([{ name: 'hostile', remote: 'unused' }]);
+        writeManifest('hostile', { overrides: ['../forged\r\nwarning:\t\x1b[31m\x85\u2028'] });
+        writeSkill('hostile', 'real-skill');
+        const { diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
+        expect(diagnostics).toHaveLength(1);
+        expect(diagnostics[0]).toContain('discovery unavailable');
+        expect(diagnostics[0]).toContain('forged');
+        // eslint-disable-next-line no-control-regex -- diagnostic must contain no terminal controls or line separators
+        expect(diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
+    });
+    it('excludes a later colliding root without losing earlier or subsequent healthy roots', () => {
+        (0, registries_1.writeRegistriesConfig)(['first', 'collision', 'last'].map((name) => ({ name, remote: 'unused' })));
+        for (const name of ['first', 'collision', 'last']) {
+            writeManifest(name, { orchestrator: { name: `${name}-process`, appliesWhen: 'x', terminatesTo: 'none' } });
+            writeSkill(name, `${name}-process`);
+        }
+        writeSkill('first', 'shared');
+        writeSkill('collision', 'shared');
+        // This name belongs only to the excluded root and must not poison later admission.
+        writeSkill('collision', 'last-process');
+        const { declared, diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
+        expect(declared.map((d) => d.name)).toEqual(['first-process', 'last-process']);
+        expect(diagnostics).toHaveLength(2);
+        expect(diagnostics[0]).toMatch(/collision.*discovery unavailable.*Artifact name collision/);
+        expect(diagnostics[1]).toMatch(/collision-process.*not discoverable/);
+    });
+    it('admits a later root with a declared override', () => {
+        (0, registries_1.writeRegistriesConfig)(['first', 'override'].map((name) => ({ name, remote: 'unused' })));
+        writeSkill('first', 'shared');
+        writeSkill('override', 'shared');
+        writeSkill('override', 'override-process');
+        writeManifest('override', {
+            overrides: ['shared'],
+            orchestrator: { name: 'override-process', appliesWhen: 'x', terminatesTo: 'none' },
+        });
+        const { declared, diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
+        expect(declared.map((d) => d.name)).toEqual(['override-process']);
+        expect(diagnostics).toEqual([]);
     });
     it('emite un diagnostico de colision post-saneo entre nombres crudos distintos, sin descartar ninguno', () => {
         (0, registries_1.writeRegistriesConfig)([
@@ -244,12 +345,14 @@ describe('collectDeclaredOrchestrators', () => {
             orchestrator: { name: 'foo_bar', appliesWhen: 'x', terminatesTo: 'a' },
         });
         writeManifest('second', {
-            orchestrator: { name: 'foo*bar', appliesWhen: 'y', terminatesTo: 'b' },
+            orchestrator: { name: 'foobar', appliesWhen: 'y', terminatesTo: 'b' },
         });
+        writeSkill('first', 'foo_bar');
+        writeSkill('second', 'foobar');
         const { declared, diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
         // Ambas declaraciones son genuinamente distintas (nombre crudo distinto) — ninguna se descarta.
         expect(declared).toHaveLength(2);
-        expect(declared.map((d) => d.name).sort()).toEqual(['foo*bar', 'foo_bar']);
+        expect(declared.map((d) => d.name).sort()).toEqual(['foo_bar', 'foobar']);
         // Pero se advierte de la colision post-saneo (ambas renderizan como "foobar").
         expect(diagnostics).toHaveLength(1);
         expect(diagnostics[0]).toMatch(/foobar/);
@@ -266,9 +369,63 @@ describe('collectDeclaredOrchestrators', () => {
         writeManifest('second', {
             orchestrator: { name: 'dos', appliesWhen: 'y', terminatesTo: 'b' },
         });
+        writeSkill('first', 'uno');
+        writeSkill('second', 'dos');
         const { declared, diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
         expect(declared).toHaveLength(2);
         expect(declared.map((d) => d.name).sort()).toEqual(['dos', 'uno']);
         expect(diagnostics).toEqual([]);
     });
+    it('omite una declaracion cuyo skill no existe y la diagnostica', () => {
+        (0, registries_1.writeRegistriesConfig)([{ name: 'phantom', remote: 'unused' }]);
+        writeManifest('phantom', {
+            orchestrator: { name: 'phantom-process', appliesWhen: 'x', terminatesTo: 'none' },
+        });
+        writeSkill('phantom', 'real-skill');
+        const { declared, diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
+        expect(declared).toEqual([]);
+        expect(diagnostics).toHaveLength(1);
+        expect(diagnostics[0]).toMatch(/phantom-process/);
+        expect(diagnostics[0]).toMatch(/declaration dropped|skill/i);
+    });
+    it('resuelve una declaracion contra un skill de otro registry configurado', () => {
+        (0, registries_1.writeRegistriesConfig)([
+            { name: 'declarations', remote: 'unused' },
+            { name: 'skills', remote: 'unused' },
+        ]);
+        writeManifest('declarations', {
+            orchestrator: { name: 'cross-registry', appliesWhen: 'x', terminatesTo: 'none' },
+        });
+        writeSkill('skills', 'cross-registry');
+        const { declared, diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
+        expect(declared).toEqual([{ name: 'cross-registry', appliesWhen: 'x', terminatesTo: 'none' }]);
+        expect(diagnostics).toEqual([]);
+    });
+    it('diagnostica un root cuyo discovery falla y conserva una declaracion sana', () => {
+        (0, registries_1.writeRegistriesConfig)([
+            { name: 'broken', remote: 'unused' },
+            { name: 'healthy', remote: 'unused' },
+        ]);
+        writeManifest('broken', {
+            orchestrator: { name: 'broken-process', appliesWhen: 'x', terminatesTo: 'none' },
+        });
+        fs_1.default.writeFileSync(path_1.default.join((0, registries_1.registryContentRoot)('broken'), 'skills'), 'not a directory');
+        writeManifest('healthy', {
+            orchestrator: { name: 'healthy-process', appliesWhen: 'x', terminatesTo: 'none' },
+        });
+        writeSkill('healthy', 'healthy-process');
+        const { declared, diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
+        expect(declared).toEqual([{ name: 'healthy-process', appliesWhen: 'x', terminatesTo: 'none' }]);
+        expect(diagnostics.join('\n')).toMatch(/broken.*discovery unavailable/i);
+    });
+    it('conserva terminatesTo aunque no corresponda a un skill descubierto', () => {
+        (0, registries_1.writeRegistriesConfig)([{ name: 'registry', remote: 'unused' }]);
+        writeManifest('registry', {
+            orchestrator: { name: 'entry-process', appliesWhen: 'x', terminatesTo: 'missing-successor' },
+        });
+        writeSkill('registry', 'entry-process');
+        const { declared, diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
+        expect(declared).toEqual([{ name: 'entry-process', appliesWhen: 'x', terminatesTo: 'missing-successor' }]);
+        expect(diagnostics).toEqual([]);
+    });
 });

package/dist/tests/core/text.test.js

@@ -1,6 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const text_1 = require("../../src/core/text");
+describe('sanitizeDiagnosticText', () => {
+    it.each([
+        ['a\r\nb\rc\nd\te', 'a b c d e'],
+        ['a\x00\x07\x1b[31m\x7f\x85\x9bz', 'a[31mz'],
+        ['a\u2028b\u2029c', 'a b c'],
+        ['plain *markdown* — café', 'plain *markdown* — café'],
+    ])('sanitizes a single diagnostic field: %j', (input, expected) => {
+        expect((0, text_1.sanitizeDiagnosticText)(input)).toBe(expected);
+    });
+});
 describe('stripControlChars', () => {
     it('elimina ESC y demas bytes de control C0', () => {
         expect((0, text_1.stripControlChars)('a\x1b[31mb\x00c\x07d')).toBe('a[31mbcd');

package/dist/tests/integration/context-orchestrators-e2e.test.js

@@ -14,13 +14,13 @@ function seedRegistry() {
     const home = fs_1.default.realpathSync(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-ctx-e2e-')));
     const awmHome = path_1.default.join(home, '.awm');
     const root = path_1.default.join(awmHome, 'registries', 'test-registry');
-    fs_1.default.mkdirSync(path_1.default.join(root, 'skills', 'using-awm'), { recursive: true });
+    fs_1.default.mkdirSync(path_1.default.join(root, 'skills', 'ejemplo-proceso'), { recursive: true });
     fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify([{ name: 'test-registry', remote: 'https://example.invalid/test.git' }]));
     fs_1.default.writeFileSync(path_1.default.join(root, 'awm-registry.json'), JSON.stringify({
         minCliVersion: '8.5.0',
         orchestrator: { name: 'ejemplo-proceso', appliesWhen: 'cuando hay una tarea sin plan', terminatesTo: 'development-process' },
     }));
-    fs_1.default.writeFileSync(path_1.default.join(root, 'skills', 'using-awm', 'SKILL.md'), '---\nname: using-awm\nversion: "1.0.0"\n---\n\n# using-awm\n');
+    fs_1.default.writeFileSync(path_1.default.join(root, 'skills', 'ejemplo-proceso', 'SKILL.md'), '---\nname: ejemplo-proceso\nversion: "1.0.0"\n---\n\n# ejemplo-proceso\n');
     return home;
 }
 /**
@@ -36,7 +36,7 @@ function seedRealisticRegistry() {
     const home = fs_1.default.realpathSync(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-ctx-e2e-real-')));
     const awmHome = path_1.default.join(home, '.awm');
     const root = path_1.default.join(awmHome, 'registries', 'test-registry');
-    fs_1.default.mkdirSync(path_1.default.join(root, 'skills', 'using-awm'), { recursive: true });
+    fs_1.default.mkdirSync(path_1.default.join(root, 'skills', 'task_capture_process'), { recursive: true });
     fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify([{ name: 'test-registry', remote: 'https://example.invalid/test.git' }]));
     fs_1.default.writeFileSync(path_1.default.join(root, 'awm-registry.json'), JSON.stringify({
         minCliVersion: '8.5.0',
@@ -46,7 +46,7 @@ function seedRealisticRegistry() {
             terminatesTo: 'development-process',
         },
     }));
-    fs_1.default.writeFileSync(path_1.default.join(root, 'skills', 'using-awm', 'SKILL.md'), '---\nname: using-awm\nversion: "1.0.0"\n---\n\n# using-awm\n');
+    fs_1.default.writeFileSync(path_1.default.join(root, 'skills', 'task_capture_process', 'SKILL.md'), '---\nname: task_capture_process\nversion: "1.0.0"\n---\n\n# task_capture_process\n');
     return home;
 }
 /**
@@ -63,7 +63,7 @@ function seedMixedRegistries() {
     const awmHome = path_1.default.join(home, '.awm');
     const sanoRoot = path_1.default.join(awmHome, 'registries', 'sano-registry');
     const rotoRoot = path_1.default.join(awmHome, 'registries', 'roto-registry');
-    fs_1.default.mkdirSync(path_1.default.join(sanoRoot, 'skills', 'using-awm'), { recursive: true });
+    fs_1.default.mkdirSync(path_1.default.join(sanoRoot, 'skills', 'proceso-sano'), { recursive: true });
     fs_1.default.mkdirSync(path_1.default.join(rotoRoot, 'skills', 'using-awm'), { recursive: true });
     fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify([
         { name: 'sano-registry', remote: 'https://example.invalid/sano.git' },
@@ -79,8 +79,20 @@ function seedMixedRegistries() {
         minCliVersion: '8.5.0',
         orchestrator: { name: 'proceso-roto', appliesWhen: 'cuando algo pasa' },
     }));
-    fs_1.default.writeFileSync(path_1.default.join(sanoRoot, 'skills', 'using-awm', 'SKILL.md'), '---\nname: using-awm\nversion: "1.0.0"\n---\n\n# using-awm\n');
-    fs_1.default.writeFileSync(path_1.default.join(rotoRoot, 'skills', 'using-awm', 'SKILL.md'), '---\nname: using-awm\nversion: "1.0.0"\n---\n\n# using-awm\n');
+    fs_1.default.writeFileSync(path_1.default.join(sanoRoot, 'skills', 'proceso-sano', 'SKILL.md'), '---\nname: proceso-sano\nversion: "1.0.0"\n---\n\n# proceso-sano\n');
+    return home;
+}
+function seedPhantomRegistry() {
+    const home = fs_1.default.realpathSync(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-ctx-e2e-phantom-')));
+    const awmHome = path_1.default.join(home, '.awm');
+    const root = path_1.default.join(awmHome, 'registries', 'test-registry');
+    fs_1.default.mkdirSync(path_1.default.join(root, 'skills', 'real-skill'), { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify([{ name: 'test-registry', remote: 'https://example.invalid/test.git' }]));
+    fs_1.default.writeFileSync(path_1.default.join(root, 'awm-registry.json'), JSON.stringify({
+        minCliVersion: '8.5.0',
+        orchestrator: { name: 'phantom-process', appliesWhen: 'cuando hay una tarea sin plan', terminatesTo: 'development-process' },
+    }));
+    fs_1.default.writeFileSync(path_1.default.join(root, 'skills', 'real-skill', 'SKILL.md'), '---\nname: real-skill\nversion: "1.0.0"\n---\n\n# real-skill\n');
     return home;
 }
 function run(home, ...args) {
@@ -142,3 +154,41 @@ describe('awm context orchestrators -- diagnosticos + sanos mezclados (binario r
         expect(r.stderr).toContain('terminatesTo');
     });
 });
+describe('awm context orchestrators -- declaracion phantom (binario real)', () => {
+    let home;
+    beforeAll(() => { home = seedPhantomRegistry(); });
+    afterAll(() => fs_1.default.rmSync(home, { recursive: true, force: true }));
+    it('--verify devuelve 2 y diagnostica una declaracion sin skill resoluble', () => {
+        const r = run(home, 'context', 'orchestrators', '--verify', 'phantom-process');
+        expect(r.status).toBe(2);
+        expect(r.stderr).toMatch(/phantom-process/);
+        expect(r.stderr).toMatch(/declaration dropped|skill/i);
+    });
+});
+describe('awm context orchestrators -- dropped sanitized collision (real binary)', () => {
+    let home;
+    beforeAll(() => {
+        home = seedPhantomRegistry();
+        const awmHome = path_1.default.join(home, '.awm');
+        const phantomRoot = path_1.default.join(awmHome, 'registries', 'test-registry');
+        const retainedRoot = path_1.default.join(awmHome, 'registries', 'retained');
+        fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify([
+            { name: 'test-registry', remote: 'unused' }, { name: 'retained', remote: 'unused' },
+        ]));
+        fs_1.default.writeFileSync(path_1.default.join(phantomRoot, 'awm-registry.json'), JSON.stringify({
+            orchestrator: { name: 'foo_bar', appliesWhen: 'x', terminatesTo: 'none' },
+        }));
+        fs_1.default.mkdirSync(path_1.default.join(retainedRoot, 'skills', 'foobar'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(retainedRoot, 'skills', 'foobar', 'SKILL.md'), '# foobar\n');
+        fs_1.default.writeFileSync(path_1.default.join(retainedRoot, 'awm-registry.json'), JSON.stringify({
+            orchestrator: { name: 'foobar', appliesWhen: 'x', terminatesTo: 'none' },
+        }));
+    });
+    afterAll(() => fs_1.default.rmSync(home, { recursive: true, force: true }));
+    it('verifies the retained raw name and rejects the dropped raw name', () => {
+        expect(run(home, 'context', 'orchestrators', '--verify', 'foobar').status).toBe(0);
+        const dropped = run(home, 'context', 'orchestrators', '--verify', 'foo_bar');
+        expect(dropped.status).toBe(2);
+        expect(dropped.stderr).toContain('declaration dropped');
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.6.0",
+  "version": "9.6.1",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"