agentic-workflow-manager 9.7.0 → 9.8.0

package/README.md

@@ -41,9 +41,13 @@ This generates the runnable output under `dist/index.js`.
 ### 4. Running the Tests
 Before submitting a PR, ensure that the core discovery/executor functionality passes the existing test suite:
 ```bash
+npm run native:build
 npm test
 ```
-The goal is to maintain 100% passing tests for any new CLI parameter flags.
+`native:build` creates the ignored, host-specific `secure-fs` artifact required
+by the integration fixtures; it must be run again after a clean checkout or a
+change under `native/`. The goal is to maintain 100% passing tests for any new
+CLI parameter flags.
 
 ### 5. Local Execution (Testing changes locally)
 

package/dist/src/commands/doctor.js

@@ -19,6 +19,7 @@ const collect_1 = require("../core/dashboard/collect");
 const render_html_1 = require("../core/dashboard/render-html");
 const render_terminal_1 = require("../core/dashboard/render-terminal");
 const write_html_1 = require("../core/dashboard/write-html");
+const bundles_1 = require("../core/bundles");
 function glyph(status) {
     if (status === 'ok')
         return picocolors_1.default.green('✔');
@@ -127,6 +128,7 @@ function renderProviderReport(report) {
 }
 function runDoctor(opts = {}) {
     const resolveTargets = opts.resolveTargets ?? agent_targets_1.resolveAgentTargets;
+    const reporter = opts.reporter ?? (0, bundles_1.createBundleDiagnosticReporter)((message) => process.stderr.write(`${message}\n`));
     const invalid = (message) => { process.stderr.write(`awm doctor: ${message}\n`); return 2; };
     const htmlRequested = opts.html !== undefined;
     if (opts.json && opts.full)
@@ -143,7 +145,7 @@ function runDoctor(opts = {}) {
             const target = htmlRequested ? (0, write_html_1.resolveHtmlTarget)({ cwd, target: opts.html, force: opts.force }) : undefined;
             const targets = resolveTargets({ prefs: (0, config_1.readPreferences)(), explicit: opts.agent });
             const collectSnapshot = opts.collectSnapshot ?? collect_1.collectDashboardSnapshot;
-            const context = (0, context_1.gatherContext)({ cwd, agents: targets });
+            const context = (0, context_1.gatherContext)({ cwd, agents: targets, reporter });
             const snapshot = collectSnapshot({ cwd, now: new Date().toISOString(), adapters: {
                     ...(0, collect_1.productionDashboardAdapters)(context),
                 } });
@@ -175,7 +177,7 @@ function runDoctor(opts = {}) {
     }
     let report;
     try {
-        const ctx = (0, context_1.gatherContext)({ cwd: opts.cwd, agents: targets });
+        const ctx = (0, context_1.gatherContext)({ cwd: opts.cwd, agents: targets, reporter });
         const providers = ctx.providers ?? [];
         report = { providers, overall: (0, checks_1.computeProviderOverall)(providers) };
     }

package/dist/src/commands/export.js

@@ -8,14 +8,17 @@ exports.registerExportCommand = registerExportCommand;
 const picocolors_1 = __importDefault(require("picocolors"));
 const path_1 = __importDefault(require("path"));
 const export_1 = require("../core/export");
+const bundles_1 = require("../core/bundles");
 function runExportCommand(name, flags, deps = {}) {
     const log = deps.log ?? console.log;
+    const reporter = deps.reporter ?? (0, bundles_1.createBundleDiagnosticReporter)((message) => process.stderr.write(`${message}\n`));
     const opts = {
         name,
         target: flags.target,
         out: flags.out,
         roots: deps.roots,
         zip: deps.zip,
+        reporter,
     };
     const summary = (0, export_1.runExport)(opts);
     log(picocolors_1.default.dim(`Exported ${summary.kind} "${name}"`));

package/dist/src/commands/init.js

@@ -138,6 +138,14 @@ async function runInit(opts = {}) {
         (0, paths_1.noteWindowsCaveat)((m) => console.log(picocolors_1.default.dim(`ℹ ${m}`)));
     }
     const cwd = opts.cwd ?? process.cwd();
+    const report = opts.reporter ?? (0, bundles_1.createBundleDiagnosticReporter)((message) => process.stderr.write(`${message}\n`));
+    const reportedDiagnostics = new Set();
+    const reporter = (diagnostic) => {
+        if (reportedDiagnostics.has(diagnostic))
+            return;
+        reportedDiagnostics.add(diagnostic);
+        report(diagnostic);
+    };
     const agent = opts.agent === undefined ? 'claude-code' : (0, providers_1.requireAgentTarget)(opts.agent);
     // R2: gate BEFORE anything is read or written — an unsupported provider
     // version must never touch preferences.json or any provider file.
@@ -190,7 +198,7 @@ async function runInit(opts = {}) {
         // that exact run won't roll those specific artifacts back — every
         // other target (preferences, hook, injection, previously-installed
         // bundle content) is covered.
-        const preSyncBundles = (0, bundles_1.discoverAllBundles)();
+        const preSyncBundles = (0, bundles_1.discoverAllBundles)(undefined, reporter);
         const mutationTargets = (0, mutation_targets_1.planInitMutationTargets)({
             cwd,
             agent,
@@ -207,7 +215,7 @@ async function runInit(opts = {}) {
                 // step's failure instead of being reported as its own cause.
                 (0, registries_1.assertSyncedRegistriesUsable)((await mergedActions.syncCache()) ?? []);
             }
-            const bundles = (0, bundles_1.discoverAllBundles)();
+            const bundles = (0, bundles_1.discoverAllBundles)(undefined, reporter);
             const ctx = (0, context_1.gatherContext)({ cwd, bundles, agent });
             // In machineOnly mode, null out the project context so project steps are skipped
             const effectiveCtx = opts.machineOnly

package/dist/src/commands/job/exec-wrapper.js

@@ -17,19 +17,33 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const process_1 = require("../../core/journal/process");
+const paths_1 = require("../../core/journal/paths");
+const types_1 = require("../../core/journal/types");
+const native_bridge_1 = require("../../core/secure-fs/native-bridge");
 const fingerprint_1 = require("../../core/journal/fingerprint");
 const redact_1 = require("../../core/journal/redact");
 const atomic_file_1 = require("../../core/atomic-file");
+function validateSidecarIdentity(logsRoot, jobId, nonce) {
+    if (typeof logsRoot !== 'string' || logsRoot.length === 0 || logsRoot.length > 4096 || /[\u0000-\u001F\u007F]/.test(logsRoot)
+        || typeof jobId !== 'string' || !/^[A-Za-z0-9_-][A-Za-z0-9_.-]{0,127}$/.test(jobId)
+        || typeof nonce !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(nonce)
+        || jobId.length + nonce.length > 230)
+        throw new Error('unsafe or unbounded sidecar identity');
+}
 function claimPath(logsRoot, jobId, nonce) {
+    validateSidecarIdentity(logsRoot, jobId, nonce);
     return path_1.default.join(logsRoot, `${jobId}.${nonce}.claim`);
 }
 function identityPath(logsRoot, jobId, nonce) {
+    validateSidecarIdentity(logsRoot, jobId, nonce);
     return path_1.default.join(logsRoot, `${jobId}.${nonce}.identity.json`);
 }
 function resultPath(logsRoot, jobId, nonce) {
+    validateSidecarIdentity(logsRoot, jobId, nonce);
     return path_1.default.join(logsRoot, `${jobId}.${nonce}.result.json`);
 }
 function logPath(logsRoot, jobId, nonce) {
+    validateSidecarIdentity(logsRoot, jobId, nonce);
     return path_1.default.join(logsRoot, `${jobId}.${nonce}.log`);
 }
 function replayVerdict(logsRoot, jobId, nonce) {
@@ -45,11 +59,46 @@ const MAX_LOG_BYTES = 1024 * 1024; // retencion acotada (R2.5)
 // dispara, tipicamente entregados en 1 tick del event loop) sin acercarse a
 // una espera perceptible si un descendiente hereda los fds y nunca cierra.
 const STDIO_GRACE_MS = 300;
+/** Only a committed generation intent may suppress controller output. A user
+ * job with the same name retains normal verifier logs. Never persist model
+ * output (which may include prompts/source bodies) in generation custody. */
+function isCommittedController(logsRoot, repoRoot, jobId, nonce, argv) {
+    if (!/^controller-gen-[1-9][0-9]*$/.test(jobId))
+        return false;
+    try {
+        const bytes = native_bridge_1.secureFs.readRegularFile(path_1.default.resolve(logsRoot, '..', 'state.json'), 1024 * 1024).bytes;
+        const state = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        if (!(0, types_1.isWellFormedState)(state))
+            throw new Error('controller custody journal invalid');
+        const actual = fs_1.default.lstatSync(logsRoot, { bigint: true });
+        const expected = fs_1.default.lstatSync((0, paths_1.logsDir)(repoRoot, state.branch), { bigint: true });
+        if (!actual.isDirectory() || actual.isSymbolicLink() || !expected.isDirectory() || expected.isSymbolicLink()
+            || actual.ino === 0n || actual.dev !== expected.dev || actual.ino !== expected.ino)
+            throw new Error('controller custody directory identity invalid');
+        const committed = state.generations.some(gen => gen.controllerJobId === jobId && jobId === `controller-gen-${gen.n}`
+            && gen.spawnNonce === nonce && gen.resumePrompt === undefined && (0, types_1.isControllerRecoveryAction)(gen.resumeAction)
+            && gen.launchArgvDigest === (0, process_1.argvDigest)(argv));
+        if (committed)
+            return true;
+        const ordinary = state.jobs[jobId];
+        if (ordinary?.spawnNonce === nonce && (0, process_1.argvDigest)(ordinary.argv) === (0, process_1.argvDigest)(argv))
+            return false;
+        throw new Error('controller custody launch identity unproven');
+    }
+    catch {
+        throw new Error('controller custody identity unavailable or unsafe: refusing launch before claim');
+    }
+}
 async function runExecWrapper(opts) {
     const { logsRoot, jobId, nonce, argv, cwd } = opts;
+    validateSidecarIdentity(logsRoot, jobId, nonce);
     const repoRoot = opts.repoRoot ?? process.cwd();
-    if (argv.length === 0)
-        throw new Error('argv vacio');
+    if (!Array.isArray(argv) || argv.length === 0 || argv.length > 256
+        || argv.some(argument => typeof argument !== 'string' || argument.length > 65536 || argument.includes('\0'))
+        || argv[0].length === 0 || argv.reduce((bytes, argument) => bytes + Buffer.byteLength(argument, 'utf8'), 0) > 1024 * 1024)
+        throw new Error('argv invalid or unbounded');
+    const safeCwd = (0, fingerprint_1.resolveWorkingDirectory)(repoRoot, cwd).absolute;
+    const omitControllerOutput = isCommittedController(logsRoot, repoRoot, jobId, nonce, argv);
     fs_1.default.mkdirSync(logsRoot, { recursive: true, mode: 0o700 });
     // (1) claim exclusivo DURABLE — wx + fsync de archivo y de directorio
     let fd;
@@ -77,7 +126,6 @@ async function runExecWrapper(opts) {
     // process group por job, independiente del supervisor (R4.7: shell:false,
     // argv como array, secretos solo por referencia de entorno).
     const [exe, ...args] = argv;
-    const safeCwd = (0, fingerprint_1.resolveWorkingDirectory)(repoRoot, cwd).absolute;
     const child = (0, child_process_1.spawn)(exe, args, {
         cwd: safeCwd, shell: false, detached: true,
         env: { ...process.env, [process_1.NONCE_ENV]: nonce },
@@ -105,6 +153,8 @@ async function runExecWrapper(opts) {
     const outputChunks = [];
     const logFile = logPath(logsRoot, jobId, nonce);
     const capture = (chunk) => {
+        if (omitControllerOutput)
+            return;
         if (captured >= MAX_LOG_BYTES)
             return;
         const accepted = chunk.subarray(0, MAX_LOG_BYTES - captured);

package/dist/src/commands/plan/index.js

@@ -1,13 +1,39 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.exitCodeFor = exitCodeFor;
 exports.formatReport = formatReport;
 exports.registerPlanCommand = registerPlanCommand;
 const validate_1 = require("../../core/plan/validate");
+const admission_1 = require("../../core/admission");
+const check_1 = require("../../core/currentness/check");
+const run_1 = require("../sensors/run");
+const config_1 = require("../../utils/config");
+const providers_1 = require("../../providers");
+const registries_1 = require("../../core/registries");
+const registry_contracts_1 = require("../../core/admission/registry-contracts");
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const store_1 = require("../../core/journal/store");
+const migration_1 = require("../../core/migration");
 const SUPPORTED_SCHEMA = 'compact-slices/v1';
 const MAX_PATH_LENGTH = 4096;
 const MAX_DIAGNOSTICS = 20;
 const MAX_DIAGNOSTIC_LENGTH = 4096;
+function journalObservation(cwd) {
+    try {
+        const branch = (0, child_process_1.execFileSync)('git', ['branch', '--show-current'], { cwd, encoding: 'utf8', stdio: 'pipe' }).trim();
+        if (!branch)
+            return { journalState: null, journalCorrupt: true };
+        const journal = (0, store_1.readJournal)(cwd, branch);
+        return { journalState: journal.state, journalCorrupt: journal.corrupt };
+    }
+    catch {
+        return { journalState: null, journalCorrupt: true };
+    }
+}
 function assertText(value, name) {
     if (typeof value !== 'string' || value.length === 0 || value.length > MAX_PATH_LENGTH || value.startsWith('--') || /[\u0000-\u001F\u007F-\u009F]/.test(value)) {
         throw new Error(`${name} must be a non-empty path without control characters`);
@@ -19,6 +45,15 @@ function terminalSafe(value) {
 function assertDependencies(deps) {
     if (!deps || typeof deps.validatePlanFile !== 'function')
         throw new Error('validatePlanFile must be a function');
+    if (deps.admitPlan !== undefined && typeof deps.admitPlan !== 'function')
+        throw new Error('admitPlan must be a function');
+}
+function admissionOutput(report, json) {
+    report = (0, admission_1.sanitizeAdmissionReport)(report);
+    if (json)
+        return `${JSON.stringify(report)}\n`;
+    const diagnostic = report.diagnostics[0];
+    return `Plan admission: ${report.state}${report.provider ? ` (${terminalSafe(report.provider)})` : ''}${diagnostic ? `\n- ${terminalSafe(diagnostic.code)}: ${terminalSafe(diagnostic.message)}` : ''}\n`;
 }
 function boundedDiagnostics(diagnostics) {
     if (!Array.isArray(diagnostics))
@@ -34,16 +69,42 @@ function boundedDiagnostics(diagnostics) {
         };
     });
 }
+function assertReport(report) {
+    if (!report || typeof report !== 'object' || Array.isArray(report))
+        throw new Error('plan validator returned an invalid report');
+    switch (report.state) {
+        case 'valid':
+            (0, validate_1.assertVerifiedValidPlanReport)(report);
+            return;
+        case 'migration-required':
+            if (report.reason !== 'unmarked-plan')
+                throw new Error('plan validator returned an invalid migration reason');
+            return;
+        case 'invalid':
+            boundedDiagnostics(report.diagnostics);
+            return;
+        case 'unsupported':
+            if (typeof report.schema !== 'string' || report.schema.length === 0 || report.schema.length > MAX_PATH_LENGTH) {
+                throw new Error('plan validator returned an invalid unsupported schema');
+            }
+            boundedDiagnostics(report.diagnostics);
+            return;
+        default:
+            throw new Error('plan validator returned an unknown report state');
+    }
+}
 function reportPayload(report, planPath) {
+    assertReport(report);
     switch (report.state) {
         case 'valid':
             return {
                 state: report.state, path: planPath, schema: report.schema, planId: report.manifest.planId,
+                planDigest: report.planDigest,
                 requirements: report.manifest.requirements.length, sources: report.manifest.sources.length,
                 commands: report.manifest.commands.length, slices: report.manifest.slices.length, completeOwnership: true,
             };
-        case 'legacy':
-            return { state: report.state, path: planPath, message: 'existing full-quality path applies; compact optimization was not requested.' };
+        case 'migration-required':
+            return { state: report.state, path: planPath, reason: report.reason };
         case 'invalid':
             return { state: report.state, path: planPath, diagnostics: boundedDiagnostics(report.diagnostics) };
         case 'unsupported':
@@ -56,15 +117,16 @@ function reportPayload(report, planPath) {
     }
 }
 function exitCodeFor(report) {
-    return report.state === 'valid' || report.state === 'legacy' ? 0 : 2;
+    assertReport(report);
+    return report.state === 'valid' ? 0 : 2;
 }
 function formatReport(report, planPath) {
     const payload = reportPayload(report, planPath);
     switch (report.state) {
         case 'valid':
             return `Plan validation: valid "${terminalSafe(planPath)}" (${terminalSafe(report.schema)}; ${payload.slices} slices; ${payload.requirements} requirements; complete ownership)\n`;
-        case 'legacy':
-            return `Plan validation: legacy "${terminalSafe(planPath)}" — existing full-quality path applies; compact optimization was not requested.\n`;
+        case 'migration-required':
+            return `Plan validation: migration-required "${terminalSafe(planPath)}" (${terminalSafe(report.reason)})\nMigrate this plan to compact-slices/v1 before execution.\n`;
         case 'invalid':
             return `Plan validation: invalid "${terminalSafe(planPath)}"\n${payload.diagnostics.map(diagnostic => `- ${terminalSafe(diagnostic.code)}: ${terminalSafe(diagnostic.message)}${diagnostic.field ? ` (${terminalSafe(diagnostic.field)})` : ''}`).join('\n')}\n`;
         case 'unsupported':
@@ -73,11 +135,25 @@ function formatReport(report, planPath) {
             throw new Error('plan validator returned an unknown report state');
     }
 }
-function registerPlanCommand(program, deps = { validatePlanFile: validate_1.validatePlanFile }) {
+function registerPlanCommand(program, deps = { validatePlanFile: validate_1.validatePlanFile, admitPlan: admission_1.admitPlan }) {
     if (!program || typeof program.command !== 'function')
         throw new Error('program must be a Commander command');
     assertDependencies(deps);
     const plan = program.command('plan').description('inspect plan contracts');
+    plan.command('migration-facts <plan-path>')
+        .description('collect read-only durable migration facts')
+        .option('--cwd <path>')
+        .option('--historical-root <path>', 'admitted sibling #148 worktree')
+        .requiredOption('--issue <https-url...>', 'durable issue links, including #126')
+        .option('--json')
+        .action((planPath, options) => {
+        assertText(planPath, 'plan path');
+        const cwd = options.cwd ?? process.cwd();
+        assertText(cwd, '--cwd');
+        const report = options.historicalRoot ? (0, migration_1.collectIssue148HistoricalFacts)(options.historicalRoot, options.issue) : (deps.collectMigrationFacts ?? migration_1.collectMigrationFacts)(planPath, cwd, options.issue);
+        process.stdout.write(options.json ? `${JSON.stringify(report)}\n` : `Migration facts: ${report.state}\n`);
+        process.exitCode = report.state === 'supported-completion' ? 0 : 2;
+    });
     plan
         .command('validate <plan-path>')
         .description('validate a compact plan without modifying it')
@@ -95,4 +171,46 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
         const code = exitCodeFor(report);
         process.exitCode = code;
     });
+    plan
+        .command('admit <plan-path>')
+        .description('read-only fail-closed compact-plan admission')
+        .requiredOption('--provider <target>', 'target provider')
+        .requiredOption('--cwd <path>', 'repository root for plan containment and source resolution')
+        .option('--execution-mode <mode>', 'explicit override: interactivo or desatendido')
+        .option('--require-current', 'require authoritative consumed-contract currentness')
+        .option('--verify-sensors', 'require an empirical sensor pass')
+        .option('--json', 'emit one stable JSON report')
+        .action(async (planPath, options) => {
+        assertText(planPath, 'plan path');
+        assertText(options.cwd, '--cwd');
+        assertText(options.provider, '--provider');
+        const admission = deps.admitPlan ?? admission_1.admitPlan;
+        const preferences = deps.readPreferences ?? config_1.readPreferences;
+        const currentnessCheck = deps.checkCurrentness ?? check_1.checkCurrentness;
+        const sensorRun = deps.runSensors ?? run_1.runSensors;
+        const registryInventory = deps.listRegistries ?? registries_1.listRegistries;
+        const planReport = deps.validatePlanFile(planPath, options.cwd);
+        // The mode comes from the same authenticated bytes/digest that produced
+        // planReport. Never reopen the path to parse a mutable header.
+        const executionMode = options.executionMode === undefined
+            ? planReport.state === 'valid' ? (planReport.executionMode ?? 'interactivo') : 'interactivo'
+            : options.executionMode === 'desatendido' ? 'desatendido' : options.executionMode === 'interactivo' ? 'interactivo' : options.executionMode;
+        const journal = executionMode === 'desatendido' ? journalObservation(options.cwd) : {};
+        const normalizedPlanPath = path_1.default.relative(options.cwd, path_1.default.resolve(options.cwd, planPath)).replace(/\\/g, '/');
+        const enabledAgents = preferences().enabledAgents;
+        // The documented order is plan, provider, currentness, sensors, journal,
+        // capabilities. Do not call the full composer early: that would resolve a
+        // capability before empirical evidence gates have had their ordered turn.
+        const earlyBoundary = planReport.state !== 'valid' || !(0, providers_1.isAgentTarget)(options.provider) || !enabledAgents.includes(options.provider);
+        if (earlyBoundary) {
+            const report = await admission({ plan: planReport, provider: options.provider, cwd: options.cwd, enabledAgents, executionMode, planPath: normalizedPlanPath, ...journal });
+            process.stdout.write(admissionOutput(report, options.json === true));
+            process.exitCode = 2;
+            return;
+        }
+        const report = await (0, registry_contracts_1.admitRegistryPlan)({ plan: planReport, provider: options.provider, cwd: options.cwd, enabledAgents, executionMode, planPath: normalizedPlanPath, ...journal, requireCurrent: options.requireCurrent === true, verifySensors: options.verifySensors === true }, { admitPlan: admission, listRegistries: registryInventory, checkCurrentness: currentnessCheck, runSensors: sensorRun });
+        process.stdout.write(admissionOutput(report, options.json === true));
+        if (report.state !== 'admitted')
+            process.exitCode = 2;
+    });
 }

package/dist/src/commands/registry/add.js

@@ -26,7 +26,7 @@ function deriveRegistryName(remote) {
     const base = remote.replace(/[/\\]+$/, '').split(/[/\\:]/).pop() ?? '';
     return base.replace(/\.git$/, '');
 }
-async function addRegistry(remote, nameOverride) {
+async function addRegistry(remote, nameOverride, reporter) {
     const name = nameOverride ?? deriveRegistryName(remote);
     if (!name || name === '.' || name.includes('..') || /[/\\]/.test(name)) {
         return { ok: false, error: `Invalid registry name "${name}" — use --name <simple-dir-name>` };
@@ -61,7 +61,7 @@ async function addRegistry(remote, nameOverride) {
         (0, discovery_1.discoverSkills)(roots);
         (0, discovery_1.discoverWorkflows)(roots);
         (0, discovery_1.discoverAgents)(roots);
-        (0, bundles_1.discoverAllBundles)(roots);
+        (0, bundles_1.discoverAllBundles)(roots, reporter);
     }
     catch (e) {
         fs_1.default.rmSync(dest, { recursive: true, force: true });

package/dist/src/commands/registry/index.js

@@ -28,10 +28,11 @@ function registerRegistryCommand(program) {
         .option('--install-all', 'install every bundle from the new registry for the default agent')
         .option('--no-install', 'skip the bundle install offer')
         .action(async (remote, options) => {
+        const reporter = (0, bundles_1.createBundleDiagnosticReporter)((message) => process.stderr.write(`${message}\n`));
         (0, prompts_1.intro)(picocolors_1.default.bgCyan(picocolors_1.default.black(' AWM - Add Registry ')));
         const s = (0, prompts_1.spinner)();
         s.start('Cloning and validating registry...');
-        const result = await (0, add_1.addRegistry)(remote, options.name);
+        const result = await (0, add_1.addRegistry)(remote, options.name, reporter);
         if (!result.ok) {
             s.stop('Failed.');
             console.error(picocolors_1.default.red(result.error));
@@ -49,7 +50,7 @@ function registerRegistryCommand(program) {
         }
         // Bundle install offer — failure NEVER reverts the add.
         try {
-            const available = (0, install_bundles_1.bundlesInRegistry)(result.contentRoot);
+            const available = (0, install_bundles_1.bundlesInRegistry)(result.contentRoot, reporter);
             if (available.length > 0) {
                 const prefs = (0, config_1.getPreferences)();
                 const projectRoot = (0, profile_1.findProjectRoot)(process.cwd()) ?? process.cwd();
@@ -82,7 +83,7 @@ function registerRegistryCommand(program) {
                     }
                 }
                 if (selection) {
-                    for (const r of (0, install_bundles_1.installBundlesFromRegistry)(result.contentRoot, selection, agents, projectRoot)) {
+                    for (const r of (0, install_bundles_1.installBundlesFromRegistry)(result.contentRoot, selection, agents, projectRoot, reporter)) {
                         for (const line of r.installed)
                             console.log(picocolors_1.default.green(`  ✓ ${line}`));
                         for (const sk of r.skipped)
@@ -103,6 +104,7 @@ function registerRegistryCommand(program) {
     reg.command('list')
         .description('list configured additional registries')
         .action(() => {
+        const reporter = (0, bundles_1.createBundleDiagnosticReporter)((message) => process.stderr.write(`${message}\n`));
         const regs = (0, registries_1.listRegistries)();
         if (regs.length === 0) {
             console.log(picocolors_1.default.dim('No additional registries. Add one with `awm registry add <git-url>`.'));
@@ -125,12 +127,12 @@ function registerRegistryCommand(program) {
             try {
                 const counts = [
                     `${(0, discovery_1.discoverSkills)([r.contentRoot]).length} skills`,
-                    `${(0, bundles_1.discoverAllBundles)([r.contentRoot]).length} bundles`,
+                    `${(0, bundles_1.discoverAllBundles)([r.contentRoot], reporter).length} bundles`,
                     `${(0, discovery_1.discoverWorkflows)([r.contentRoot]).length} workflows`,
                     `${(0, discovery_1.discoverAgents)([r.contentRoot]).length} agents`,
                 ].join(', ');
                 console.log(`${picocolors_1.default.cyan(r.name)}  ${r.remote}  ${picocolors_1.default.dim(counts)}`);
-                for (const o of (0, status_1.overrideStatus)(r.contentRoot, earlier)) {
+                for (const o of (0, status_1.overrideStatus)(r.contentRoot, earlier, reporter)) {
                     console.log(o.active
                         ? picocolors_1.default.yellow(`    ↑ override active: ${o.name}`)
                         : picocolors_1.default.dim(`    ∅ override with no effect: ${o.name}`));

package/dist/src/commands/registry/install-bundles.js

@@ -9,16 +9,16 @@ const bundles_1 = require("../../core/bundles");
 const bundle_install_1 = require("../../core/bundle-install");
 /** Bundles disponibles en un content root concreto (candidatos a instalar tras el add).
  * Uses single-root discovery to avoid surfacing cross-registry collision errors here. */
-function bundlesInRegistry(contentRoot) {
-    return (0, bundles_1.discoverBundles)(contentRoot).map((b) => b.name);
+function bundlesInRegistry(contentRoot, reporter) {
+    return (0, bundles_1.discoverBundles)(contentRoot, reporter).map((b) => b.name);
 }
 /**
  * Instala bundles del registry `contentRoot` para los agentes dados.
  * `selection` = 'all' instala todos los del registry; una lista instala solo esos.
  * Las dependencias se resuelven contra TODOS los roots (pueden vivir en el base).
  */
-function installBundlesFromRegistry(contentRoot, selection, agents, projectRoot) {
-    const allBundles = (0, bundles_1.discoverAllBundles)();
+function installBundlesFromRegistry(contentRoot, selection, agents, projectRoot, reporter) {
+    const allBundles = (0, bundles_1.discoverAllBundles)(undefined, reporter);
     const candidates = allBundles.filter((b) => b.contentRoot === contentRoot);
     const wanted = selection === 'all' ? candidates : candidates.filter((b) => selection.includes(b.name));
     const results = [];

package/dist/src/commands/registry/status.js

@@ -13,7 +13,7 @@ const bundles_1 = require("../../core/bundles");
 function canDiscoverRegistryContent(contentRoot, safeRoots) {
     return safeRoots.has(contentRoot);
 }
-function artifactNamesInRoot(root) {
+function artifactNamesInRoot(root, reporter) {
     const names = new Set();
     for (const s of (0, discovery_1.discoverSkills)([root]))
         names.add(s.name);
@@ -21,17 +21,17 @@ function artifactNamesInRoot(root) {
         names.add(w.name);
     for (const a of (0, discovery_1.discoverAgents)([root]))
         names.add(a.name);
-    for (const b of (0, bundles_1.discoverAllBundles)([root]))
+    for (const b of (0, bundles_1.discoverAllBundles)([root], reporter))
         names.add(b.name);
     return names;
 }
-function overrideStatus(contentRoot, earlierRoots) {
+function overrideStatus(contentRoot, earlierRoots, reporter) {
     const declared = Array.from((0, registries_1.readRegistryManifest)(contentRoot).overrides);
     if (declared.length === 0)
         return [];
     const earlier = new Set();
     for (const root of earlierRoots) {
-        for (const n of artifactNamesInRoot(root))
+        for (const n of artifactNamesInRoot(root, reporter))
             earlier.add(n);
     }
     return declared.map((name) => ({ name, active: earlier.has(name) }));

package/dist/src/commands/sensors/bootstrap.js

@@ -51,7 +51,7 @@ function declaration(mode, reason) {
     return { schemaVersion: 3, mode, reason };
 }
 function digest(bytes) { return (0, crypto_1.createHash)('sha256').update(bytes).digest('hex'); }
-async function projectSensors(projectRoot, registryRoot, requestedPack, packageRoot) {
+async function projectSensors(projectRoot, registryRoot, requestedPack, packageRoot, explicitPackSelection = requestedPack !== undefined) {
     const detectionRoot = packageRoot ? path_1.default.resolve(projectRoot, packageRoot) : projectRoot;
     const detected = (0, detection_1.detectStack)(detectionRoot);
     const pack = requestedPack ?? detected.pack;
@@ -76,7 +76,9 @@ async function projectSensors(projectRoot, registryRoot, requestedPack, packageR
         return { reason: 'source-unsupported', remedy: 'install-a-v2-sensor-pack' };
     let live;
     try {
-        live = await (0, live_1.resolveParsedPackCompatibility)(detectionRoot, parsed.pack);
+        live = explicitPackSelection
+            ? await (0, live_1.resolveParsedPackCompatibility)(detectionRoot, parsed.pack, { packSelection: 'explicit' })
+            : await (0, live_1.resolveParsedPackCompatibility)(detectionRoot, parsed.pack);
     }
     catch {
         return { reason: 'compatibility-unresolvable', remedy: 'repair-project-tools-or-select-another-mode' };
@@ -84,6 +86,8 @@ async function projectSensors(projectRoot, registryRoot, requestedPack, packageR
     const sensors = {};
     for (const [name, packSensor] of Object.entries(live.pack.sensors)) {
         const evidence = live.sensors[name];
+        if (evidence.state === 'not-applicable')
+            continue;
         const variant = evidence.variantId === null ? undefined : packSensor.variants.find(item => item.id === evidence.variantId);
         if (!variant)
             return { reason: 'sensor-variant-unresolvable', remedy: 'repair-project-tools-or-select-another-mode' };
@@ -109,8 +113,32 @@ async function planSensorBootstrap(cwd = process.cwd(), input = {}) {
             }
             return { kind: 'noop', projectRoot: project.projectRoot, manifestPath: project.manifestPath, changes: [], dryRun: opts.dryRun };
         }
-        if (project.manifest.kind === 'legacy')
-            return blocked(project.projectRoot, project.manifestPath, opts.dryRun, 'legacy-v1-preserved', 'migrate-the-manifest-explicitly');
+        if (project.manifest.kind === 'legacy') {
+            // Legacy manifests can carry arbitrary commands and per-sensor
+            // semantics that a v3 pack cannot prove equivalent. Replacing
+            // them is therefore a deliberate opt-in, never an automatic
+            // side effect of inspection or an unqualified bootstrap.
+            if (opts.mode !== 'project-sensors') {
+                return blocked(project.projectRoot, project.manifestPath, opts.dryRun, 'legacy-replacement-requires-project-sensors-mode', 'rerun-bootstrap-with-mode-project-sensors');
+            }
+            // The legacy pack name identifies the source to migrate, but must not
+            // activate v2 sensors which require an explicit project opt-in.
+            const planned = await projectSensors(project.projectRoot, opts.registryRoot, project.manifest.pack.pack, undefined, false);
+            if ('reason' in planned)
+                return blocked(project.projectRoot, project.manifestPath, opts.dryRun, planned.reason, planned.remedy, 'candidates' in planned ? planned.candidates : undefined);
+            try {
+                const original = fs_1.default.readFileSync(project.manifestPath);
+                return {
+                    kind: 'migrate', projectRoot: project.projectRoot, manifestPath: project.manifestPath,
+                    changes: planned.changes.map((change, index) => index === 0 ? { ...change, action: 'replace' } : change),
+                    dryRun: opts.dryRun, migration: { kind: 'legacy-v1', manifest: planned.manifest }, source: planned.source,
+                    originalDigest: digest(original),
+                };
+            }
+            catch {
+                return blocked(project.projectRoot, project.manifestPath, opts.dryRun, 'legacy-manifest-unreadable', 'repair-the-manifest-before-bootstrap');
+            }
+        }
         let source;
         try {
             source = (0, source_1.resolveSensorSource)(project.manifest, { registries: (0, registries_1.listRegistries)() });
@@ -152,7 +180,10 @@ function applySensorBootstrap(plan) {
         const current = fs_1.default.readFileSync(plan.manifestPath);
         if (digest(current) !== plan.originalDigest)
             throw new Error('bootstrap migration plan is stale: manifest changed after planning');
-        (0, migrate_2.replaceV2ManifestWithV3)(plan.manifestPath, plan.migration.candidate, plan.source);
+        if ('kind' in plan.migration)
+            (0, migrate_1.replaceLegacyManifestWithV3)(plan.manifestPath, plan.migration.manifest, plan.source);
+        else
+            (0, migrate_2.replaceV2ManifestWithV3)(plan.manifestPath, plan.migration.candidate, plan.source);
         return 'migrated';
     }
     if (plan.manifest.mode === 'project-sensors') {