agentic-workflow-manager 9.7.1 → 9.8.0

package/dist/src/commands/sensors/coverage/index.js

@@ -12,6 +12,7 @@ const manifest_1 = require("../compatibility/manifest");
 const scan_1 = require("../../../core/ledger/scan");
 const empirical_1 = require("./empirical");
 const path_1 = __importDefault(require("path"));
+const project_1 = require("../project");
 const defaults = { resolve: resolve_1.resolveCoverageInputs, observe: evidence_1.observeDetector, resolveLive: live_1.resolveLiveCompatibility, scan: scan_1.scanProjectLedgers };
 function normalizedMin(value) {
     if (value === undefined)
@@ -34,13 +35,21 @@ async function runCoverage(cwd, dependencies = {}, options = {}) {
         return { schemaVersion: 2, pack: null, registry: null, overall: 'inconclusive', static: { status: 'inconclusive', reason: 'not_configured', classes: [] },
             empirical: empirical(deps, path_1.default.resolve(cwd), {}, min, 'unavailable') };
     }
+    const packageRoot = input.manifest.kind !== 'legacy' && input.manifest.pack.packageRoot
+        ? (() => {
+            const project = (0, project_1.resolveSensorProject)(input.projectRoot);
+            if (project.state !== 'configured')
+                throw new Error(`runCoverage: packageRoot cannot be resolved: ${project.state === 'invalid' ? project.reason : 'manifest missing'}`);
+            return project.packageRoot;
+        })()
+        : input.projectRoot;
     if (input.kind === 'no_reference') {
         return { schemaVersion: 2, pack: input.pack, registry: input.registry, overall: 'inconclusive', static: { status: 'inconclusive', reason: 'no_reference', classes: [] },
             empirical: empirical(deps, input.projectRoot, {}, min, 'unavailable') };
     }
     let live;
     if (input.manifest.kind !== 'legacy') {
-        live = (await deps.resolveLive(input.projectRoot, input.pack, input.registryRoot)).sensors;
+        live = (await deps.resolveLive(packageRoot, input.pack, input.registryRoot)).sensors;
     }
     else {
         live = Object.fromEntries(Object.keys(input.manifest.pack.sensors).map((name) => [name, (0, manifest_1.legacyCompatibility)('legacy manifest without schemaVersion')]));
@@ -48,7 +57,7 @@ async function runCoverage(cwd, dependencies = {}, options = {}) {
     const observations = [];
     for (const [classId, coverageClass] of Object.entries(input.contract.classes)) {
         coverageClass.detectors.forEach((detector, detectorIndex) => {
-            const observed = deps.observe(input.projectRoot, classId, detectorIndex, detector, input.manifest.pack.sensors[detector.sensor]);
+            const observed = deps.observe(packageRoot, classId, detectorIndex, detector, input.manifest.pack.sensors[detector.sensor]);
             observations.push({
                 ...observed,
                 compatibility: live[detector.sensor] ?? {

package/dist/src/commands/sensors/coverage/resolve.js

@@ -70,6 +70,16 @@ function findManifestDirNoFollow(startCwd) {
             if (error.code !== 'ENOENT')
                 throw readFailure(manifestPath, error);
         }
+        const gitMarker = path_1.default.join(dir, '.git');
+        try {
+            const marker = fs_1.default.lstatSync(gitMarker);
+            if (marker.isFile() || marker.isDirectory())
+                return null;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw readFailure(gitMarker, error);
+        }
         const parent = path_1.default.dirname(dir);
         if (parent === dir)
             return null;

package/dist/src/commands/sensors/exec.js

@@ -98,6 +98,20 @@ function validateOptions(opts) {
     if (opts.killGraceMs !== undefined && (!Number.isSafeInteger(opts.killGraceMs) || opts.killGraceMs < 0))
         throw new Error('exec options killGraceMs must be a non-negative safe integer');
 }
+/** Run sensor commands with the same Node runtime that launched AWM. Package
+ * manager wrappers resolve `node` through PATH, so an older inherited Node can
+ * otherwise run a sensor even when the CLI itself is running on a supported
+ * runtime. Keep every inherited entry after the runtime directory: tools and
+ * project-local shims remain available to the child. */
+function sensorEnvironment(inputEnvironment) {
+    const runtimeDir = path_1.default.dirname(process.execPath);
+    const inheritedPath = process.env.PATH;
+    return {
+        ...process.env,
+        PATH: inheritedPath ? `${runtimeDir}${path_1.default.delimiter}${inheritedPath}` : runtimeDir,
+        ...inputEnvironment,
+    };
+}
 function collectSpawn(input, opts) {
     validateOptions(opts);
     const maxBuffer = opts.maxBuffer ?? DEFAULT_MAX_BUFFER;
@@ -164,6 +178,7 @@ function collectSpawn(input, opts) {
                 shell: true,
                 cwd: opts.cwd,
                 detached: !(0, paths_1.isWindowsNative)(),
+                env: sensorEnvironment(input.environment),
                 stdio: ['ignore', 'pipe', 'pipe'],
             })
             : (0, child_process_1.spawn)(prlimit ?? input.executable, prlimit
@@ -172,7 +187,7 @@ function collectSpawn(input, opts) {
                 shell: false,
                 cwd: opts.cwd,
                 detached: !(0, paths_1.isWindowsNative)(),
-                ...(input.environment ? { env: { ...process.env, ...input.environment } } : {}),
+                env: sensorEnvironment(input.environment),
                 // stdin closed: a sensor must never block waiting for input, and the
                 // EOF also tells watch-mode-capable tools (vitest, jest) to run once.
                 stdio: prlimit ? ['ignore', stdoutFd, stderrFd] : ['ignore', 'pipe', 'pipe'],

package/dist/src/commands/sensors/migrate.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.planV2Migration = planV2Migration;
 exports.replaceV2ManifestWithV3 = replaceV2ManifestWithV3;
+exports.replaceLegacyManifestWithV3 = replaceLegacyManifestWithV3;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const contract_1 = require("./compatibility/contract");
@@ -67,7 +68,7 @@ function exactLogicalSource(input, pack) {
         throw new Error('v2 migration source must contain an exact resolved pack');
     let parsedSource;
     try {
-        parsedSource = (0, contract_1.parseSensorPack)(JSON.parse(source.content), 'v2 migration resolved source');
+        parsedSource = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
     }
     catch {
         throw new Error('v2 migration source exact v2 pack is invalid');
@@ -79,7 +80,7 @@ function exactLogicalSource(input, pack) {
 function assertSourceCompatibleWithManifest(source, manifest) {
     let parsedSource;
     try {
-        parsedSource = (0, contract_1.parseSensorPack)(JSON.parse(source.content), 'v2 migration resolved source');
+        parsedSource = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
     }
     catch {
         throw new Error('v2 migration source exact v2 pack is invalid');
@@ -94,6 +95,23 @@ function assertSourceCompatibleWithManifest(source, manifest) {
         }
     }
 }
+function assertSourceCompatibleWithCandidate(source, candidate) {
+    let parsedSource;
+    try {
+        parsedSource = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
+    }
+    catch {
+        throw new Error('legacy migration source exact v2 pack is invalid');
+    }
+    if (parsedSource.kind !== 'v2' || parsedSource.pack.name !== candidate.pack) {
+        throw new Error('legacy migration source must contain the exact v2 pack');
+    }
+    for (const [name, sensor] of Object.entries(candidate.sensors)) {
+        if (!parsedSource.pack.sensors[name]?.variants.some(variant => variant.id === sensor.variantId)) {
+            throw new Error('legacy migration source is not compatible with selected manifest sensors');
+        }
+    }
+}
 function hasPhysicalSensorPath(value, registryRoots) {
     if (typeof value === 'string') {
         const normalized = path_1.default.posix.normalize(value.replace(/\\/g, '/')).toLowerCase();
@@ -207,3 +225,45 @@ function replaceV2ManifestWithV3(manifestPath, candidate, source) {
         });
     });
 }
+/**
+ * Replace an explicitly bootstrapped legacy manifest with the v3 declaration
+ * selected from one current logical pack. Legacy commands have no structured
+ * variant identity, so equivalence cannot be asserted; the caller must have
+ * re-probed every selected v3 sensor before this fenced publication.
+ */
+function replaceLegacyManifestWithV3(manifestPath, candidate, source) {
+    if (typeof manifestPath !== 'string' || !path_1.default.isAbsolute(manifestPath) || path_1.default.normalize(manifestPath) !== manifestPath
+        || manifestPath.includes('\0') || path_1.default.basename(manifestPath) !== 'sensors.json'
+        || path_1.default.basename(path_1.default.dirname(manifestPath)) !== '.awm') {
+        throw new Error('legacy migration manifest path must be the canonical project manifest <project>/.awm/sensors.json');
+    }
+    const manifestDirectory = path_1.default.dirname(manifestPath);
+    const projectRoot = path_1.default.dirname(manifestDirectory);
+    (0, safe_file_1.withProjectLease)(projectRoot, () => {
+        const originalFailure = (_reason) => new Error('legacy migration original manifest must be readable JSON');
+        let inspected;
+        let original;
+        try {
+            inspected = inspectManifest(manifestPath, originalFailure);
+            original = JSON.parse(inspected.content.toString('utf8'));
+        }
+        catch {
+            throw new Error('legacy migration original manifest must be readable JSON');
+        }
+        const before = (0, manifest_1.parseSensorManifest)(original, manifestPath);
+        const after = (0, manifest_1.parseSensorManifest)(candidate, 'legacy migration candidate');
+        if (before.kind !== 'legacy' || after.kind !== 'v3' || after.pack.mode !== 'project-sensors') {
+            throw new Error('legacy migration candidate semantic mismatch');
+        }
+        const logicalSource = exactLogicalSource({ kind: 'logical', source }, after.pack.pack);
+        assertSourceCompatibleWithCandidate(logicalSource, after.pack);
+        if (after.pack.source.registry !== logicalSource.registry.name || hasPhysicalSensorPath(after.pack.sensors, [logicalSource.registry.contentRoot])
+            || hasPhysicalSensorPath(after.pack.packageRoot, [])) {
+            throw new Error('legacy migration candidate contains an unsafe source or physical path');
+        }
+        assertManifestUnchanged(manifestPath, inspected);
+        (0, safe_file_1.writeProjectFile)(projectRoot, '.awm/sensors.json', Buffer.from((0, manifest_1.serializeManifestV3)(after.pack), 'utf8'), {
+            mode: 'replace', expected: inspected.content, expectedIdentity: inspected.identity, createParents: false,
+        });
+    });
+}

package/dist/src/commands/sensors/prepare.js

@@ -30,6 +30,8 @@ function validateRunOptions(opts) {
         throw new Error('run option ignoreBaseline must be a boolean');
     if (opts.base !== undefined && (typeof opts.base !== 'string' || opts.base.trim() === ''))
         throw new Error('run option base must be a nonempty string');
+    if (opts.readOnly !== undefined && typeof opts.readOnly !== 'boolean')
+        throw new Error('run option readOnly must be a boolean');
     if (opts.changed && opts.ignoreBaseline) {
         throw new Error('refusing to combine --changed with a baseline capture: a partial run cannot define the accepted set');
     }

package/dist/src/commands/sensors/result.js

@@ -91,6 +91,8 @@ function interpretResult(prepared, raw) {
         return withEvidence({ name: prepared.name, status: 'inconclusive', errors: [], skipReason: reason });
     }
     if (raw.code === 0) {
+        if (format === generic_1.parseGenericOutput)
+            return withEvidence({ name: prepared.name, status: 'pass', errors: [] });
         const errors = format(raw.stdout);
         return withEvidence({ name: prepared.name, status: errors.length ? 'fail' : 'pass', errors });
     }

package/dist/src/commands/sensors/run.js

@@ -8,8 +8,10 @@ exports.findManifestDir = findManifestDir;
 exports.detectPackDrift = detectPackDrift;
 exports.resolveConcurrency = resolveConcurrency;
 exports.runSensors = runSensors;
+const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
 const baseline_1 = require("./baseline");
 const result_1 = require("./result");
 Object.defineProperty(exports, "applyBaseline", { enumerable: true, get: function () { return result_1.applyBaseline; } });
@@ -30,6 +32,59 @@ const project_1 = require("./project");
 const MAX_BUFFER = 64 * 1024 * 1024;
 /** Hard ceiling on parallel sensors: past this, they only contend for the same cores. */
 const MAX_CONCURRENCY = 4;
+const READ_ONLY_MAX_ENTRIES = 250_000;
+const READ_ONLY_MAX_BYTES = 1024 * 1024 * 1024;
+/**
+ * A git status only sees tracked and non-ignored paths, while a sensor can
+ * mutate ignored runtime files (notably `.awm/`) just as easily. Hash the
+ * actual project tree instead. The scan is deliberately bounded: inability to
+ * observe the whole declared project means no admission certificate.
+ */
+function filesystemSnapshot(root) {
+    try {
+        const digest = crypto_1.default.createHash('sha256');
+        let entriesSeen = 0;
+        let bytesSeen = 0;
+        const visit = (directory, relative) => {
+            const entries = fs_1.default.readdirSync(directory, { withFileTypes: true })
+                .sort((left, right) => left.name.localeCompare(right.name));
+            for (const entry of entries) {
+                // Git's internal bookkeeping changes as a consequence of normal
+                // observation, not project sensor execution. Everything else,
+                // including ignored/untracked `.awm`, is evidence-relevant.
+                if (relative === '' && entry.name === '.git')
+                    continue;
+                if (++entriesSeen > READ_ONLY_MAX_ENTRIES)
+                    throw new Error('snapshot-entry-limit');
+                const child = path_1.default.join(directory, entry.name);
+                const childRelative = relative === '' ? entry.name : `${relative}/${entry.name}`;
+                const stat = fs_1.default.lstatSync(child);
+                digest.update(`${childRelative}\0${stat.mode}\0${stat.size}\0`);
+                if (stat.isDirectory()) {
+                    digest.update('directory\0');
+                    visit(child, childRelative);
+                }
+                else if (stat.isFile()) {
+                    if ((bytesSeen += stat.size) > READ_ONLY_MAX_BYTES)
+                        throw new Error('snapshot-byte-limit');
+                    digest.update('file\0');
+                    digest.update(fs_1.default.readFileSync(child));
+                }
+                else if (stat.isSymbolicLink()) {
+                    digest.update(`symlink\0${fs_1.default.readlinkSync(child)}\0`);
+                }
+                else {
+                    digest.update(`special\0${stat.rdev}\0`);
+                }
+            }
+        };
+        visit(root, '');
+        return digest.digest('hex');
+    }
+    catch {
+        return null;
+    }
+}
 async function resolveLiveFromSource(cwd, source, packSelection) {
     try {
         const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
@@ -141,6 +196,10 @@ async function runSensors(opts = {}) {
         return { sensors: [], overall: 'not_certified', mode: 'invalid', reason, projectRoot: project.projectRoot, manifestPath: project.manifestPath, remedy: 'repair-sensor-manifest' };
     }
     const manifestDir = project.projectRoot;
+    const beforeReadOnly = opts.readOnly ? filesystemSnapshot(manifestDir) : undefined;
+    if (opts.readOnly && beforeReadOnly === null) {
+        return { sensors: [], overall: 'not_certified', projectRoot: project.projectRoot, manifestPath: project.manifestPath, mode: 'invalid', reason: 'read-only-observation-unavailable', remedy: 'run admission from a readable git worktree' };
+    }
     const parsed = project.manifest;
     const authority = { projectRoot: project.projectRoot, manifestPath: project.manifestPath };
     if (parsed.kind === 'v3' && (parsed.pack.mode === 'native-gate' || parsed.pack.mode === 'opt-out')) {
@@ -205,7 +264,7 @@ async function runSensors(opts = {}) {
         overall = 'not_certified';
     if (overall === 'skipped' && drift && drift.detection.pack !== 'generic')
         overall = 'not_certified';
-    return {
+    const output = {
         sensors: results,
         overall,
         ...authority,
@@ -216,4 +275,8 @@ async function runSensors(opts = {}) {
         ...(drift?.drift ? { packDrift: drift.drift } : {}),
         ...(changed ? { changedScope: { files: changed.files.length, ...(changed.error ? { error: changed.error } : {}) } } : {}),
     };
+    if (opts.readOnly && filesystemSnapshot(manifestDir) !== beforeReadOnly) {
+        return { ...output, overall: 'not_certified', reason: 'read-only-mutation-detected', remedy: 'sensor execution changed the worktree; repair it before using this evidence for admission' };
+    }
+    return output;
 }

package/dist/src/commands/sensors/status.js

@@ -9,6 +9,7 @@ const path_1 = __importDefault(require("path"));
 const paths_1 = require("../../core/paths");
 const contract_1 = require("./compatibility/contract");
 const discovery_1 = require("./compatibility/discovery");
+const live_1 = require("./compatibility/live");
 const resolve_1 = require("./compatibility/resolve");
 const project_1 = require("./project");
 const source_1 = require("./compatibility/source");
@@ -100,12 +101,13 @@ function resolveStaticV2Compatibility(cwd, manifest, source) {
     if (parsed.kind !== 'v2')
         throw new Error(`sensor pack "${manifest.pack}" does not provide a v2 compatibility contract`);
     const evidence = (0, discovery_1.discoverProjectEvidence)(cwd, parsed.pack);
+    const executionPack = (0, live_1.bindContainedRuntimeCommands)(parsed.pack, evidence.pythonEnvironmentRoot);
     const resolutionEvidence = {
         ...evidence,
         ...(manifest.packSelection === 'explicit' ? { packSelection: 'explicit' } : {}),
     };
-    const initial = (0, resolve_1.resolveProjectCompatibility)(parsed.pack, resolutionEvidence).sensors;
-    return Object.fromEntries(Object.entries(parsed.pack.sensors).map(([name, sensor]) => {
+    const initial = (0, resolve_1.resolveProjectCompatibility)(executionPack, resolutionEvidence).sensors;
+    return Object.fromEntries(Object.entries(executionPack.sensors).map(([name, sensor]) => {
         const variant = initial[name]?.variantId === null
             ? null
             : sensor.variants.find(candidate => candidate.id === initial[name]?.variantId) ?? null;
@@ -115,11 +117,11 @@ function resolveStaticV2Compatibility(cwd, manifest, source) {
         const probeStatus = variant?.probe.kind === 'config-present'
             ? (evidence.configFiles.length > 0 ? 'matched' : 'not-matched')
             : variant?.probe.kind === 'package-script-present'
-                ? (evidence.scripts.length > 0 ? 'matched' : 'not-matched')
+                ? (variant.probe.script !== undefined && evidence.scripts.includes(variant.probe.script) ? 'matched' : 'not-matched')
                 : undefined;
         return [name, probeStatus === undefined
                 ? initial[name]
-                : (0, resolve_1.resolveSensorCompatibility)(sensor, { ...resolutionEvidence, probe: { status: probeStatus } }, { pack: parsed.pack.name, sensor: name })];
+                : (0, resolve_1.resolveSensorCompatibility)(sensor, { ...resolutionEvidence, probe: { status: probeStatus } }, { pack: executionPack.name, sensor: name })];
     }));
 }
 function staticCompatibilityCheck(sensor, live) {

package/dist/src/commands/watch/archive-unused.js

@@ -0,0 +1,138 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.watchJournalStatus = watchJournalStatus;
+exports.archiveUnusedWatch = archiveUnusedWatch;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+const types_1 = require("../../core/journal/types");
+const store_1 = require("../../core/journal/store");
+const paths_1 = require("../../core/journal/paths");
+const atomic_file_1 = require("../../core/atomic-file");
+const lock_1 = require("./lock");
+function controlledDirectory(directory) {
+    try {
+        const stat = fs_1.default.lstatSync(directory);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error(`unused bootstrap archive rejects unsafe directory: ${directory}`);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+}
+/** Read-only status of this branch, not directory-wide journal-first inference.
+ * A corrupt or linked tree is never reported as absence. No plan body, prompt,
+ * command argv or task/verdict content crosses this public observation. */
+function watchJournalStatus(repoRoot, branch) {
+    const file = (0, paths_1.statePath)(repoRoot, branch);
+    try {
+        for (const directory of [path_1.default.join(repoRoot, '.awm'), path_1.default.join(repoRoot, '.awm/journal'), (0, paths_1.journalDir)(repoRoot, branch)])
+            controlledDirectory(directory);
+        const stat = fs_1.default.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return { state: 'corrupt', bootstrapUnused: false };
+    }
+    catch (error) {
+        return { state: error.code === 'ENOENT' ? 'missing' : 'corrupt', bootstrapUnused: false };
+    }
+    const current = (0, store_1.readJournal)(repoRoot, branch);
+    if (current.corrupt || !current.state || current.state.branch !== branch)
+        return { state: 'corrupt', bootstrapUnused: false };
+    let bootstrapUnused = false;
+    try {
+        assertUnused(current.state);
+        assertUnusedTree(repoRoot, branch);
+        bootstrapUnused = true;
+    }
+    catch { /* recognized present journal, but never eligible by absence alone */ }
+    const binding = current.state.planBinding;
+    return {
+        state: 'present', cycleState: current.state.cycle.status, bootstrapUnused,
+        ...(binding ? { binding: { path: binding.path, digest: binding.digest, ...(binding.executionDigest ? { executionDigest: binding.executionDigest, executionIdentitySchema: binding.executionIdentitySchema } : {}), schema: binding.schema, executionMode: binding.executionMode, boundAt: binding.boundAt } } : {}),
+    };
+}
+/** Default-deny: only the exact unexecuted bootstrap shape is archivable.
+ * Future runtime fields automatically make this route ineligible. */
+function assertUnused(state) {
+    const initial = (0, types_1.emptyState)(state.branch);
+    const allowed = new Set([...Object.keys(initial), 'planBinding', 'planBindingHistory']);
+    const bootstrap = initial.cycle.nextAction;
+    if (state.schema !== 2 || !state.planBinding || state.cycle.status !== 'IN_PROGRESS'
+        || Object.keys(state).some(key => !allowed.has(key))
+        || Object.keys(state.cycle).some(key => !['status', 'startedAt', 'nextAction'].includes(key))
+        || JSON.stringify(state.cycle.nextAction) !== JSON.stringify(bootstrap)
+        || state.tasks.length !== 0 || state.cycleVerificationPlan.length !== 0
+        || state.generations.length !== 0 || state.dispatches.length !== 0
+        || Object.keys(state.jobs).length !== 0 || state.verdicts.length !== 0 || state.fixes.length !== 0
+        || Object.keys(state.appliedRequests).length !== 0 || state.requestProblems.length !== 0
+        || (state.custodyDecisions?.length ?? 0) !== 0) {
+        throw new Error('unused bootstrap requerido: el journal tiene ejecución, evidencia o estado no reconocido; no se archiva');
+    }
+}
+function assertUnusedTree(repoRoot, branch) {
+    const root = (0, paths_1.journalDir)(repoRoot, branch);
+    const emptyDirectories = new Set(['requests', 'acks', 'logs', 'export']);
+    for (const entry of fs_1.default.readdirSync(root, { withFileTypes: true })) {
+        const file = path_1.default.join(root, entry.name);
+        if (entry.isSymbolicLink())
+            throw new Error('unused bootstrap rejects symlink artifact');
+        if (entry.name === 'state.json' && entry.isFile())
+            continue;
+        if (emptyDirectories.has(entry.name) && entry.isDirectory() && fs_1.default.readdirSync(file).length === 0)
+            continue;
+        throw new Error(`unused bootstrap has runtime or unrecognized artifact: ${entry.name}`);
+    }
+}
+/** Remove ONLY an unused admission bootstrap from the active namespace by one
+ * recoverable rename. The archived state remains IN_PROGRESS, not COMPLETE;
+ * no task, verdict, cycle evidence, or claimed native execution is generated. */
+function archiveUnusedWatch(repoRoot, branch, planPath) {
+    const canonicalPlan = (0, paths_1.bindingPlanPath)(planPath);
+    const before = (0, store_1.readJournal)(repoRoot, branch);
+    if (before.corrupt || !before.state)
+        throw new Error('unused bootstrap journal inexistente, corrupto o inseguro');
+    const lockPath = (0, paths_1.supervisorLockPath)(repoRoot);
+    try {
+        if (fs_1.default.lstatSync(lockPath).isSymbolicLink())
+            throw new Error('unused bootstrap rejects symlink lock');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const archiveRoot = path_1.default.join(repoRoot, '.awm', 'journal-unused');
+    controlledDirectory(archiveRoot);
+    const lock = (0, lock_1.acquireLock)(repoRoot);
+    try {
+        (0, lock_1.verifyBranchInvariant)(repoRoot, branch);
+        const current = (0, store_1.readJournal)(repoRoot, branch);
+        if (current.corrupt || !current.state || current.state.branch !== branch)
+            throw new Error('unused bootstrap journal corrupto o de otra rama');
+        if (current.state.planBinding?.path !== canonicalPlan)
+            throw new Error('unused bootstrap requiere la misma ruta canónica del plan');
+        assertUnused(current.state);
+        assertUnusedTree(repoRoot, branch);
+        controlledDirectory(archiveRoot);
+        if (!fs_1.default.existsSync(archiveRoot))
+            fs_1.default.mkdirSync(archiveRoot, { mode: 0o700 });
+        controlledDirectory(archiveRoot);
+        (0, atomic_file_1.fsyncDirSync)(path_1.default.dirname(archiveRoot));
+        const source = (0, paths_1.journalDir)(repoRoot, branch);
+        const destination = path_1.default.join(archiveRoot, `${(0, paths_1.branchSlug)(branch)}.${crypto_1.default.randomUUID()}`);
+        if (fs_1.default.existsSync(destination))
+            throw new Error('unused bootstrap archive destination already exists');
+        // A single directory rename is the commit point; before it the source
+        // exists, after it the original byte-for-byte state is recoverable.
+        fs_1.default.renameSync(source, destination);
+        (0, atomic_file_1.fsyncDirSync)(archiveRoot);
+        (0, atomic_file_1.fsyncDirSync)(path_1.default.dirname(source));
+        return { archived: path_1.default.relative(repoRoot, destination).split(path_1.default.sep).join('/'), kind: 'unused-bootstrap', journalId: current.state.journalId };
+    }
+    finally {
+        (0, lock_1.releaseLock)(repoRoot, lock);
+    }
+}

package/dist/src/commands/watch/generations.js

@@ -88,22 +88,42 @@ function beginGeneration(repoRoot, branch) {
     return gen;
 }
 function promptForGeneration(gen) {
-    return `${gen.resumePrompt}\nGeneracion activa: ${gen.token}. Incluye --generation ${gen.token} en cada comando awm job.`;
+    if (!(0, types_1.isControllerRecoveryAction)(gen.resumeAction) || !/^[a-f0-9]{16}$/.test(gen.token))
+        throw new Error('recovery action invalida: no se persisten prompts libres');
+    const instructions = {
+        'resume-cycle': 'Retoma el plan del ciclo desde el journal.',
+        'resume-next-action': 'Retoma el next_action vigente del journal.',
+        'reconcile-active-jobs': 'Reconcilia los jobs activos existentes del journal sin duplicarlos.',
+    };
+    return `${instructions[gen.resumeAction.kind]}\nGeneracion activa: ${gen.token}. Incluye --generation ${gen.token} en cada comando awm job.`;
+}
+function recoveryAction(action) {
+    if (!(0, types_1.isControllerRecoveryAction)(action))
+        throw new Error('recovery action invalida: no se persisten prompts libres');
+    return { schema: action.schema, kind: action.kind };
 }
 /** Persiste el intent completo ANTES de delegarlo al wrapper. El wrapper usa
  * claim exclusivo por (controllerJobId, spawnNonce), por lo que reemitir este
  * mismo intent tras un crash nunca lanza dos controllers. */
-function launchControllerGeneration(repoRoot, branch, provider, resumePrompt, spawner = (0, runner_1.defaultWrapperSpawner)()) {
+function launchControllerGeneration(repoRoot, branch, provider, action, spawner = (0, runner_1.defaultWrapperSpawner)()) {
+    const requestedAction = recoveryAction(action);
     const s = requireState(repoRoot, branch);
     const gen = activeGeneration(s);
     if (gen === undefined)
         throw new Error('no hay generacion activa para lanzar');
+    if (gen.resumePrompt !== undefined)
+        throw new Error('generacion legacy con prompt: decision explicita requerida; no se reemite');
+    const adapter = (0, adapter_1.adapterFor)(gen.provider ?? provider);
     gen.controllerJobId = gen.controllerJobId ?? `controller-gen-${gen.n}`;
     gen.spawnNonce = gen.spawnNonce ?? crypto_1.default.randomBytes(8).toString('hex');
     gen.provider = gen.provider ?? provider;
-    gen.resumePrompt = gen.resumePrompt ?? resumePrompt;
+    gen.resumeAction = gen.resumeAction ?? requestedAction;
+    const argv = adapter.launchArgv(promptForGeneration(gen));
+    const digest = (0, process_1.argvDigest)(argv);
+    if (gen.launchArgvDigest !== undefined && gen.launchArgvDigest !== digest)
+        throw new Error('controller argv cambio: no se reemite el mismo nonce con otro comando');
+    gen.launchArgvDigest = digest;
     (0, store_1.writeJournal)(repoRoot, branch, s);
-    const argv = (0, adapter_1.adapterFor)(gen.provider).launchArgv(promptForGeneration(gen));
     const job = {
         id: gen.controllerJobId, fingerprint: `generation:${gen.token}`, commandDigest: `generation:${gen.token}`,
         argv, cwd: '.', paths: [], expandedPaths: [], executionState: 'spawn-intent',
@@ -140,8 +160,8 @@ function collectControllerGeneration(repoRoot, branch) {
     if (identity.jobId !== gen.controllerJobId || identity.nonce !== gen.spawnNonce
         || !(0, types_1.isWellFormedProcessRef)(identity.wrapper) || !(0, types_1.isWellFormedProcessRef)(identity.command)
         || identity.wrapper.spawnNonce !== gen.spawnNonce || identity.command.spawnNonce !== gen.spawnNonce
-        || gen.provider === undefined || gen.resumePrompt === undefined
-        || identity.command.argvDigest !== (0, process_1.argvDigest)((0, adapter_1.adapterFor)(gen.provider).launchArgv(promptForGeneration(gen))))
+        || gen.provider === undefined || gen.resumePrompt !== undefined || !(0, types_1.isControllerRecoveryAction)(gen.resumeAction)
+        || gen.launchArgvDigest === undefined || identity.command.argvDigest !== gen.launchArgvDigest)
         return false;
     const changed = gen.wrapperRef?.pid !== identity.wrapper.pid || gen.processRef?.pid !== identity.command.pid;
     gen.wrapperRef = identity.wrapper;
@@ -162,16 +182,19 @@ function controllerGenerationHasUnresolvedClaim(repoRoot, branch, gen) {
 /** Recupera tanto crash-before-spawn como crash-after-spawn-before-journal.
  * Claim sin identidad queda ambiguo y se conserva bajo custodia tras la gracia;
  * nunca se resuelve lanzando otro token/nonce a ciegas. */
-function ensureControllerGeneration(repoRoot, branch, provider, resumePrompt, spawner, ambiguityGraceMs) {
+function ensureControllerGeneration(repoRoot, branch, provider, action, spawner, ambiguityGraceMs) {
+    const requestedAction = recoveryAction(action);
     if (collectControllerGeneration(repoRoot, branch))
         return;
     let gen = activeGeneration(requireState(repoRoot, branch));
     if (gen === undefined)
         return;
+    if (gen.resumePrompt !== undefined)
+        throw new Error('generacion legacy con prompt: decision explicita requerida; no se reemite');
     if (gen.processRef !== undefined || gen.wrapperRef !== undefined)
         return;
     if (gen.controllerJobId === undefined || gen.spawnNonce === undefined) {
-        launchControllerGeneration(repoRoot, branch, provider, resumePrompt, spawner);
+        launchControllerGeneration(repoRoot, branch, provider, requestedAction, spawner);
         return;
     }
     const logs = (0, paths_1.logsDir)(repoRoot, branch);
@@ -194,7 +217,7 @@ function ensureControllerGeneration(repoRoot, branch, provider, resumePrompt, sp
     // El intent ya estaba durable pero el spawn no ocurrio: es seguro reemitir
     // exactamente el mismo nonce. Si el wrapper original solo estaba demorado,
     // su claim wx arbitra cual de ambos ejecuta.
-    launchControllerGeneration(repoRoot, branch, gen.provider ?? provider, gen.resumePrompt ?? resumePrompt, spawner);
+    launchControllerGeneration(repoRoot, branch, gen.provider ?? provider, gen.resumeAction ?? requestedAction, spawner);
 }
 /** Custodia (R4.5): ciclo BLOCKED con razon auditada. QUIEN NO HACE NADA:
  *  no mata, no relanza, no libera lock — el loop sigue vivo auditando. */