owlrunkit 0.14.0 → 0.15.0

package/scripts/runkit-contract/lifecycle-orchestration.mjs

@@ -89,6 +89,98 @@ function ensureRegularDirectory(directoryPath, label) {
   return regularDirectory(directoryPath, label);
 }
 
+function verificationExecutableGate(executable) {
+  if (!path.isAbsolute(executable)) {
+    return {
+      valid: false,
+      issueCode: "verify_executable_absolute_path_required",
+      message: "verify executable after -- must be an absolute path.",
+    };
+  }
+  let stat;
+  try {
+    stat = lstatSync(executable);
+  } catch {
+    return {
+      valid: false,
+      issueCode: "verify_executable_missing",
+      message: "verify executable must be a regular file, not a symlink.",
+    };
+  }
+  if (stat.isSymbolicLink()) {
+    return {
+      valid: false,
+      issueCode: "verify_executable_symlink_rejected",
+      message: "verify executable must be a regular file, not a symlink.",
+    };
+  }
+  if (!stat.isFile()) {
+    return {
+      valid: false,
+      issueCode: "verify_executable_not_regular_file",
+      message: "verify executable must be a regular file, not a symlink.",
+    };
+  }
+  return { valid: true };
+}
+
+function recordRejectedVerificationPreflight({
+  workspaceRoot,
+  executionRoot,
+  runId,
+  verificationId,
+  executable,
+  commandArgv,
+  issueCode,
+}) {
+  const preflightsRoot = path.join(executionRoot, "verification-preflights");
+  const realRoot = ensureRegularDirectory(
+    preflightsRoot,
+    "Verification preflight directory",
+  );
+  if (
+    realRoot !== path.resolve(preflightsRoot)
+    || !within(realpathSync(executionRoot), realRoot)
+    || !within(realpathSync(workspaceRoot), realRoot)
+  ) {
+    throw new Error("Verification preflight directory must remain inside the execution.");
+  }
+  writeJsonExclusiveAtomically(path.join(realRoot, `${verificationId}.json`), {
+    schemaVersion: "OwlCodaRunKitVerificationPreflightV1",
+    runId,
+    verificationId,
+    status: "rejected",
+    issueCode,
+    executable,
+    commandArgvSha256: sha256(JSON.stringify(commandArgv)),
+    authorizationGranted: false,
+  });
+}
+
+function recordRejectedFinalizeAttempt({
+  workspaceRoot,
+  runId,
+  verificationId,
+  outputRoot,
+  finalizeRequestPath,
+  finalized,
+}) {
+  const relativeRequestPath = relativeToWorkspace(workspaceRoot, finalizeRequestPath);
+  const artifactPath = path.join(outputRoot, "finalize-result.json");
+  writeJsonExclusiveAtomically(artifactPath, {
+    schemaVersion: "OwlCodaRunKitVerificationFinalizeAttemptV1",
+    runId,
+    verificationId,
+    status: "rejected",
+    gateStatus: finalized.status,
+    finalizeRequestPath: relativeRequestPath,
+    finalizeRequestSha256: sha256(readFileSync(finalizeRequestPath)),
+    result: finalized,
+    authorizationGranted: false,
+  });
+  return relativeToWorkspace(workspaceRoot, artifactPath);
+}
+
 function gitVersion() {
   return execFileSync("git", ["--version"], { encoding: "utf8" })
     .trim()
@@ -203,6 +295,20 @@ function runHighLevelVerifyWithinControlTransaction({
   const { executionRoot, pinGate } = loadActiveExecution(workspaceRoot, runId);
   if (pinGate.status !== "valid") return { ...pinGate, authorizationGranted: false };
   regularDirectory(executionRoot, "Execution directory");
+  const [executable] = commandArgv;
+  const executableGate = verificationExecutableGate(executable);
+  if (!executableGate.valid) {
+    recordRejectedVerificationPreflight({
+      workspaceRoot,
+      executionRoot,
+      runId,
+      verificationId,
+      executable,
+      commandArgv,
+      issueCode: executableGate.issueCode,
+    });
+    throw new Error(executableGate.message);
+  }
   for (const [name, label, create] of [
     ["delivery-packets", "Delivery packet directory", false],
     ["snapshots", "Snapshot directory", true],
@@ -213,9 +319,6 @@ function runHighLevelVerifyWithinControlTransaction({
     if (create) ensureRegularDirectory(directoryPath, label);
     else regularDirectory(directoryPath, label);
   }
-  const [executable] = commandArgv;
-  if (!path.isAbsolute(executable)) throw new Error("verify executable after -- must be an absolute path.");
-  regularFile(executable, "verify executable");
   const realCwd = realpathSync(cwd === "." ? workspaceRoot : path.join(workspaceRoot, cwd));
   if (!within(workspaceRoot, realCwd)) throw new Error("verify cwd escapes the workspace through a symlink.");
   for (const outputPath of [
@@ -269,7 +372,19 @@ function runHighLevelVerifyWithinControlTransaction({
   };
   writeJsonExclusiveAtomically(finalizeRequestPath, finalizeRequest);
   const finalized = runFinalize({ workspaceRoot, runId, request: finalizeRequest });
-  if (finalized.status !== "accepted_passed") return finalized;
+  if (finalized.status !== "accepted_passed") {
+    return {
+      ...finalized,
+      finalizeResultPath: recordRejectedFinalizeAttempt({
+        workspaceRoot,
+        runId,
+        verificationId,
+        outputRoot,
+        finalizeRequestPath,
+        finalized,
+      }),
+    };
+  }
   return {
     status: "verified",
     exitCode: 0,

package/scripts/runkit-contract/onboarding-doctor.mjs

@@ -9,16 +9,18 @@ import {
 import path from "node:path";
 
 import {
+  CORE_VERSION,
   currentCoreIdentity,
   validateProjectConfigV2,
 } from "./core-contract.mjs";
 import {
   expectedRegistryTarballUrl,
   isCanonicalSha512Integrity,
+  validateStoredRegistryAdoptionEvidence,
 } from "./registry-adoption-gate.mjs";
 
 const PACKAGE_NAME = "owlrunkit";
-const EXPECTED_VERSION = "0.14.0";
+const EXPECTED_VERSION = CORE_VERSION;
 const MAX_JSON_BYTES = 1_048_576;
 const MAX_JSON_DEPTH = 64;
 const MAX_JSON_NODES = 50_000;
@@ -473,6 +475,119 @@ function readProjectScripts(root) {
   }
 }
 
+function ignoreFileCoversRuntime(root, ignoreFile) {
+  let text;
+  try {
+    text = readWorkspaceFileBounded(root, ignoreFile, { optional: true });
+  } catch {
+    return false;
+  }
+  if (text === null) return false;
+  let ignored = false;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    const negated = line.startsWith("!");
+    const pattern = (negated ? line.slice(1) : line)
+      .replace(/^\/+/, "")
+      .replace(/^\*\*\//, "")
+      .replace(/\/\*\*$/, "")
+      .replace(/\/+$/, "");
+    if (pattern === ".owlcoda" || pattern === ".owlcoda/runkit") {
+      ignored = !negated;
+    } else if (negated && pattern.startsWith(".owlcoda/runkit/")) {
+      ignored = false;
+    }
+  }
+  return ignored;
+}
+
+const BROAD_COLLECTION_TOOLS = Object.freeze([
+  {
+    tool: "biome",
+    command: /\bbiome\s+(?:check|format|lint)\b/,
+    ignoreFile: "biome.json",
+    ignoreFileSupported: false,
+  },
+  {
+    tool: "eslint",
+    command: /\beslint\b/,
+    ignoreFile: ".eslintignore",
+    ignoreFileSupported: true,
+  },
+  {
+    tool: "jest",
+    command: /\bjest\b/,
+    ignoreFile: "jest.config.*",
+    ignoreFileSupported: false,
+  },
+  {
+    tool: "markdownlint",
+    command: /\bmarkdownlint(?:-cli2)?\b/,
+    ignoreFile: ".markdownlintignore",
+    ignoreFileSupported: true,
+  },
+  {
+    tool: "prettier",
+    command: /\bprettier\b/,
+    ignoreFile: ".prettierignore",
+    ignoreFileSupported: true,
+  },
+  {
+    tool: "stylelint",
+    command: /\bstylelint\b/,
+    ignoreFile: ".stylelintignore",
+    ignoreFileSupported: true,
+  },
+  {
+    tool: "vitest",
+    command: /\bvitest\b/,
+    ignoreFile: "vitest.config.*",
+    ignoreFileSupported: false,
+  },
+]);
+
+function hasBroadDotTarget(command) {
+  return /(?:^|\s|&&|\|\||;)(?:["']?\.\/?["']?)(?=\s|$|&&|\|\||;)/.test(command);
+}
+
+function runtimeIsolationCheck(root) {
+  let manifest;
+  try {
+    manifest = readWorkspaceJsonBounded(root, "package.json");
+  } catch {
+    return {
+      status: "unknown",
+      affectedScripts: [],
+      recommendedIgnore: ".owlcoda/runkit/",
+    };
+  }
+  const affectedScripts = [];
+  for (const [script, value] of Object.entries(manifest.scripts ?? {}).sort(([left], [right]) =>
+    left.localeCompare(right))) {
+    if (typeof value !== "string" || !hasBroadDotTarget(value)) continue;
+    for (const descriptor of BROAD_COLLECTION_TOOLS) {
+      if (!descriptor.command.test(value)) continue;
+      if (
+        descriptor.ignoreFileSupported
+        && ignoreFileCoversRuntime(root, descriptor.ignoreFile)
+      ) {
+        continue;
+      }
+      affectedScripts.push({
+        ignoreFile: descriptor.ignoreFile,
+        script,
+        tool: descriptor.tool,
+      });
+    }
+  }
+  return {
+    status: affectedScripts.length === 0 ? "ok" : "warning",
+    affectedScripts,
+    recommendedIgnore: ".owlcoda/runkit/",
+  };
+}
+
 function configCheck(root) {
   try {
     const config = readWorkspaceJsonBounded(
@@ -496,14 +611,81 @@ function profilesCheck(root) {
       { optional: true },
     );
     if (profiles === null) return { status: "missing" };
-    return profiles.schemaVersion === "OwlCodaRunKitProfilesV1" && Array.isArray(profiles.profiles)
-      ? { status: "ok", count: profiles.profiles.length }
-      : { status: "invalid" };
+    if (
+      profiles.schemaVersion !== "OwlCodaRunKitProfilesV1"
+      || !Array.isArray(profiles.profiles)
+    ) {
+      return { status: "invalid" };
+    }
+    const launcherWarnings = [];
+    for (const profile of profiles.profiles) {
+      for (const command of profile?.commands ?? []) {
+        const identity = `${profile?.id ?? "unknown"}:${command?.id ?? "unknown"}`;
+        if (typeof command?.executable !== "string" || !path.isAbsolute(command.executable)) {
+          launcherWarnings.push(`profile_launcher_not_absolute:${identity}`);
+          continue;
+        }
+        try {
+          const stat = lstatSync(command.executable);
+          if (stat.isSymbolicLink()) {
+            launcherWarnings.push(`profile_launcher_symlink_rejected:${identity}`);
+          } else if (!stat.isFile() || realpathSync(command.executable) !== path.resolve(command.executable)) {
+            launcherWarnings.push(`profile_launcher_not_regular_file:${identity}`);
+          }
+        } catch {
+          launcherWarnings.push(`profile_launcher_unavailable:${identity}`);
+        }
+      }
+    }
+    return {
+      status: "ok",
+      count: profiles.profiles.length,
+      launcherWarnings: [...new Set(launcherWarnings)].sort(),
+    };
   } catch {
     return { status: "invalid" };
   }
 }
 
+export function readProfileLauncherReadiness({ workspaceRoot } = {}) {
+  const profiles = profilesCheck(resolveBoundedWorkspaceRoot(workspaceRoot));
+  const launcherWarnings = profiles.launcherWarnings ?? [];
+  return {
+    status: profiles.status,
+    launcherWarnings,
+    ready: profiles.status === "ok" && launcherWarnings.length === 0,
+  };
+}
+
+function adoptionCheck(root, localInstall = readLocalInstallBinding({ workspaceRoot: root })) {
+  try {
+    const evidence = readWorkspaceJsonBounded(
+      root,
+      path.join(".owlcoda", "runkit", "adoption", `${PACKAGE_NAME}-${EXPECTED_VERSION}.json`),
+      { optional: true },
+    );
+    if (evidence === null) return { status: "missing", version: EXPECTED_VERSION };
+    const validation = validateStoredRegistryAdoptionEvidence({
+      evidence,
+      packageName: PACKAGE_NAME,
+      version: EXPECTED_VERSION,
+      localInstall,
+    });
+    return {
+      status: validation.valid ? "ok" : "invalid",
+      version: EXPECTED_VERSION,
+      issueCodes: validation.issueCodes,
+    };
+  } catch {
+    return { status: "invalid", version: EXPECTED_VERSION };
+  }
+}
+
+export function readAdoptionReadiness({ workspaceRoot } = {}) {
+  const root = resolveBoundedWorkspaceRoot(workspaceRoot);
+  return adoptionCheck(root);
+}
+
 export async function runDoctor({
   workspaceRoot,
   registryUrl,
@@ -524,6 +706,8 @@ export async function runDoctor({
   const nodeOk = Number(process.versions.node.split(".")[0]) >= 20;
   const config = configCheck(root);
   const profiles = profilesCheck(root);
+  const adoption = adoptionCheck(root, installed);
+  const runtimeIsolation = runtimeIsolationCheck(root);
   const checks = {
     node: {
       status: nodeOk ? "ok" : "unsupported",
@@ -542,10 +726,12 @@ export async function runDoctor({
       ? { status: "ok", version: registry.version }
       : { status: "issue", issueCodes: registry.issueCodes ?? [] },
     profiles,
+    adoption,
     projectScripts: {
       status: "observed",
       detected: readProjectScripts(root),
     },
+    runtimeIsolation,
   };
   const issueCodes = [...(registry.issueCodes ?? [])];
   if (!nodeOk) issueCodes.push("node_version_unsupported");
@@ -569,8 +755,17 @@ export async function runDoctor({
     issueCodes.push("registry_install_binding_mismatch");
   }
   const uniqueIssues = [...new Set(issueCodes)].sort();
+  const warningCodes = [
+    ...runtimeIsolation.affectedScripts
+      .map(({ script, tool }) => `runkit_runtime_collection_risk:${tool}:${script}`),
+    ...(profiles.launcherWarnings ?? []),
+  ].sort();
   const nextAllowedAction = uniqueIssues.length === 0
-    ? "detect_profiles"
+    ? (profiles.launcherWarnings ?? []).length > 0
+      ? "review_profile_launchers"
+      : adoption.status === "ok"
+        ? "plan_new_execution"
+        : "adopt_current_release"
     : uniqueIssues.some((code) => code === "node_version_unsupported")
       ? "upgrade_node"
       : uniqueIssues.some((code) => code === "core_version_mismatch")
@@ -585,6 +780,7 @@ export async function runDoctor({
     status: uniqueIssues.length === 0 ? "ready" : "issues_found",
     checks,
     issueCodes: uniqueIssues,
+    warningCodes,
     nextAllowedAction,
     authorizationGranted: false,
   };
@@ -598,9 +794,11 @@ export function formatDoctorHuman(report) {
     `Installed package: ${report.checks.installedPackage.status}`,
     `Registry: ${report.checks.registry.status}`,
     `Profiles: ${report.checks.profiles.status}`,
+    `Adoption: ${report.checks.adoption.status}`,
     ...(report.issueCodes.length > 0 ? [`Issues: ${report.issueCodes.join(", ")}`] : []),
-    `Next: ${report.nextAllowedAction === "detect_profiles"
-      ? "owlrunkit profiles detect --workspace . --dry-run"
+    ...(report.warningCodes.length > 0 ? [`Warnings: ${report.warningCodes.join(", ")}`] : []),
+    `Next: ${report.nextAllowedAction === "adopt_current_release"
+      ? `owlrunkit adopt --workspace . --exact ${PACKAGE_NAME}@${EXPECTED_VERSION}`
       : report.nextAllowedAction}`,
     "",
   ].join("\n");

package/scripts/runkit-contract/profile-onboarding.mjs

@@ -1,5 +1,8 @@
 import {
   existsSync,
+  lstatSync,
+  readdirSync,
+  realpathSync,
 } from "node:fs";
 import path from "node:path";
 
@@ -13,20 +16,172 @@ import {
   safeRelativePath,
 } from "./provenance-common.mjs";
 
-function command(id, script) {
+function resolveRegularExecutable(name) {
+  const pathEntries = (process.env.PATH ?? "").split(path.delimiter);
+  const suffixes = process.platform === "win32"
+    ? (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";")
+    : [""];
+  for (const directory of pathEntries) {
+    for (const suffix of suffixes) {
+      const candidate = path.resolve(directory || ".", `${name}${suffix}`);
+      try {
+        const resolved = realpathSync(candidate);
+        const stat = lstatSync(resolved);
+        if (stat.isFile() && !stat.isSymbolicLink()) return resolved;
+      } catch {
+        // Continue through PATH without treating a missing or unsafe entry as authority.
+      }
+    }
+  }
+  return null;
+}
+
+function command(id, script, executable) {
   return {
     id,
     cwd: ".",
-    executable: "npm",
+    executable,
     argv: ["run", script],
   };
 }
 
+function workspaceCommand(id, workspacePath, script, executable) {
+  return {
+    id,
+    cwd: ".",
+    executable,
+    argv: ["run", "--workspace", workspacePath, script],
+  };
+}
+
 function detectedScripts(manifest) {
   return Object.keys(manifest.scripts ?? {}).sort();
 }
 
-function profileCandidates(root, manifest) {
+function workspacePatterns(manifest) {
+  if (Array.isArray(manifest.workspaces)) return manifest.workspaces;
+  if (
+    manifest.workspaces
+    && typeof manifest.workspaces === "object"
+    && Array.isArray(manifest.workspaces.packages)
+  ) {
+    return manifest.workspaces.packages;
+  }
+  return [];
+}
+
+function safeWorkspacePattern(value) {
+  if (
+    typeof value !== "string"
+    || value.length === 0
+    || path.isAbsolute(value)
+    || value.includes("\\")
+    || value.includes("\0")
+  ) {
+    return null;
+  }
+  const segments = value.split("/");
+  if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+    return null;
+  }
+  const wildcardCount = [...value].filter((character) => character === "*").length;
+  if (wildcardCount === 0) return { kind: "literal", path: value };
+  if (wildcardCount === 1 && value.endsWith("/*")) {
+    return { kind: "children", path: value.slice(0, -2) };
+  }
+  return null;
+}
+
+function discoverWorkspaces(root, manifest) {
+  const warnings = [];
+  const paths = new Set();
+  for (const rawPattern of workspacePatterns(manifest)) {
+    const pattern = safeWorkspacePattern(rawPattern);
+    if (pattern === null) {
+      warnings.push(`unsupported_workspace_pattern:${String(rawPattern)}`);
+      continue;
+    }
+    if (pattern.kind === "literal") {
+      paths.add(pattern.path);
+      continue;
+    }
+    const parent = path.join(root, pattern.path);
+    try {
+      const parentStat = lstatSync(parent);
+      if (
+        parentStat.isSymbolicLink()
+        || !parentStat.isDirectory()
+        || realpathSync(parent) !== path.resolve(parent)
+      ) {
+        warnings.push(`unsafe_workspace_parent:${pattern.path}`);
+        continue;
+      }
+      for (const entry of readdirSync(parent, { withFileTypes: true })
+        .sort((left, right) => left.name.localeCompare(right.name))) {
+        if (entry.isDirectory() && !entry.isSymbolicLink()) {
+          paths.add(`${pattern.path}/${entry.name}`);
+        }
+      }
+    } catch {
+      // A declared workspace pattern may legitimately have no current matches.
+    }
+  }
+
+  const workspaces = [];
+  for (const workspacePath of [...paths].sort()) {
+    try {
+      const workspaceManifest = readWorkspaceJsonBounded(
+        root,
+        path.join(workspacePath, "package.json"),
+      );
+      workspaces.push({
+        name: typeof workspaceManifest.name === "string"
+          ? workspaceManifest.name
+          : workspacePath,
+        path: workspacePath,
+        scripts: detectedScripts(workspaceManifest),
+      });
+    } catch {
+      warnings.push(`workspace_manifest_unreadable:${workspacePath}`);
+    }
+  }
+  return {
+    workspaces,
+    warnings: [...new Set(warnings)].sort(),
+  };
+}
+
+function profileIdForWorkspace(workspacePath) {
+  return `workspace-${workspacePath.replace(/[^A-Za-z0-9._-]+/g, "-")}`;
+}
+
+function workspaceProfiles(workspaces, npmExecutable) {
+  return workspaces
+    .map((workspace) => {
+      const qualityScripts = workspace.scripts.filter((script) =>
+        ["build", "e2e", "lint", "test", "typecheck"].includes(script));
+      if (qualityScripts.length === 0) return null;
+      const profileId = profileIdForWorkspace(workspace.path);
+      return {
+        id: profileId,
+        paths: [`${workspace.path}/**`],
+        role: "primary",
+        primary: false,
+        requiresProfileIds: [],
+        commands: npmExecutable
+          ? qualityScripts.map((script) => workspaceCommand(
+              `npm-${profileId}-${script}`,
+              workspace.path,
+              script,
+              npmExecutable,
+            ))
+          : [],
+      };
+    })
+    .filter(Boolean);
+}
+
+function profileCandidates(root, manifest, npmExecutable, workspaces) {
   const scripts = new Set(detectedScripts(manifest));
   const candidates = [];
   if (
@@ -35,7 +190,10 @@ function profileCandidates(root, manifest) {
   ) {
     const commands = [...scripts]
       .filter((script) => /^(db:|prisma)/.test(script))
-      .map((script) => command(`npm-${script.replaceAll(":", "-")}`, script));
+      .map((script) => npmExecutable
+        ? command(`npm-${script.replaceAll(":", "-")}`, script, npmExecutable)
+        : null)
+      .filter(Boolean);
     candidates.push({
       id: "database",
       paths: ["prisma/**"],
@@ -51,7 +209,8 @@ function profileCandidates(root, manifest) {
   ) {
     const commands = ["build", "lint", "test", "typecheck"]
       .filter((script) => scripts.has(script))
-      .map((script) => command(`npm-${script}`, script));
+      .map((script) => npmExecutable ? command(`npm-${script}`, script, npmExecutable) : null)
+      .filter(Boolean);
     candidates.push({
       id: "node-quality",
       paths: ["src/**", "tests/**"],
@@ -66,7 +225,9 @@ function profileCandidates(root, manifest) {
     || existsSync(path.join(root, "playwright.config.js"))
     || scripts.has("e2e")
   ) {
-    const commands = scripts.has("e2e") ? [command("npm-e2e", "e2e")] : [];
+    const commands = scripts.has("e2e") && npmExecutable
+      ? [command("npm-e2e", "e2e", npmExecutable)]
+      : [];
     candidates.push({
       id: "web-e2e",
       paths: ["playwright.config.ts", "tests/e2e/**"],
@@ -76,14 +237,32 @@ function profileCandidates(root, manifest) {
       commands,
     });
   }
+  candidates.push(...workspaceProfiles(workspaces, npmExecutable));
   return candidates.sort((left, right) => left.id.localeCompare(right.id));
 }
 
 export function detectProfiles({ workspaceRoot } = {}) {
   const root = resolveBoundedWorkspaceRoot(workspaceRoot);
   const manifest = readWorkspaceJsonBounded(root, "package.json");
-  const candidates = profileCandidates(root, manifest);
+  const npmExecutable = resolveRegularExecutable("npm");
+  const discovered = discoverWorkspaces(root, manifest);
+  const candidates = profileCandidates(root, manifest, npmExecutable, discovered.workspaces);
   const primaryCandidates = candidates.filter((profile) => profile.role === "primary");
+  const warnings = primaryCandidates.length > 1
+    ? [`ambiguous_primary_profile:${primaryCandidates.map((profile) => profile.id).join(",")}`]
+    : [];
+  warnings.push(...discovered.warnings);
+  if (
+    npmExecutable === null
+    && (
+      detectedScripts(manifest).some((script) =>
+        /^(build|db:|e2e|lint|prisma|test|typecheck)/.test(script))
+      || discovered.workspaces.some((workspace) => workspace.scripts.some((script) =>
+        /^(build|e2e|lint|test|typecheck)$/.test(script)))
+    )
+  ) {
+    warnings.push("npm_regular_executable_unavailable");
+  }
   return {
     schemaVersion: "OwlCodaRunKitProfileDetectionV1",
     status: "profiles_detected",
@@ -91,10 +270,9 @@ export function detectProfiles({ workspaceRoot } = {}) {
     writesPerformed: 0,
     candidates,
     primaryProfileId: primaryCandidates.length === 1 ? primaryCandidates[0].id : null,
-    warnings: primaryCandidates.length > 1
-      ? [`ambiguous_primary_profile:${primaryCandidates.map((profile) => profile.id).join(",")}`]
-      : [],
+    warnings,
     detectedScripts: detectedScripts(manifest),
+    detectedWorkspaces: discovered.workspaces,
     authorizationGranted: false,
   };
 }