@dommaker/harness 1.7.0 → 1.8.0

package/src/__tests__/public-value-surface.test.ts

@@ -0,0 +1,182 @@
+/**
+ * 已发布子路径值面全量冻结闸（ADR-0022 追记第 5 条收口）
+ *
+ * 补齐 `public-type-surface.test.ts` 的另一半：那道闸按 `package.json` 的 `exports` 逐入口冻
+ * 结了**类型面**，但值面（运行时导出）只有包根一处被 `public-exports.test.ts` 钉住——
+ * `Object.keys(await import('../index'))` 只看得到 `.` 一个入口。于是「这个函数不在公开面上、
+ * 删它非 breaking」这类定级断言在子路径入口仍无闸可跑，只能靠人工逐条附「各入口源文件 +
+ * 已发布产物 `.d.ts`」双证据（能防这一次，防不了下一次）。
+ *
+ * 落闸前实测的洞（五个入口的运行时键集合 106/29/4/4/24）：`./core` 有 7 个值导出、
+ * `./presets` 有 4 个（即该入口全部）不在包根清单里——删掉它们当前**零测试变红**。
+ * `./gates` 与 `./context` 的值导出恰好是包根的子集，删除会经 `src/index.ts` 的 barrel 链
+ * 撞上包根那条闸，但红名报的是 `.`、不是真正被删的那个入口——定级时照样得再人肉查一遍。
+ *
+ * 口径与类型面闸一致：**公开面 = `exports` 映射，不是只有包根**，入口清单从 `exports` 派生
+ * 而非硬编码，新增子路径未登记冻结清单即红。分工：
+ * - `.` 的值面仍由 `public-exports.test.ts` 冻结（本闸刻意不重复钉——同一个入口两份清单
+ *   必然漂移，且那条判定要逐字保留），本闸只管四个子路径；「两边都不漏」由登记闸与委派闸各钉一条。
+ * - 类型面归 `public-type-surface.test.ts`，含导出写法白名单（堵 `export *` 与入口内联类型
+ *   声明）。值面按运行时事实枚举，无按名字扫描漏算之虞，故本闸不重复那道写法检查。
+ *
+ * 本闸走运行时 `import`：值面的事实只有模块加载后才是真的（`Object.keys` 读到的正是 tsc
+ * 产物出厂的那批键）。它与类型面改动互不影响——`public-exports.test.ts` 的编译期钉在类型面
+ * 被改时会让那个套件「failed to run」（实测向 `src/index.ts` 注一条 `export type { DynamicTask }`
+ * 得 TS2578），本闸在同一注入下 7 项照跑且全绿，值面的清单 diff 不会被类型面的编译期钉连带抹掉。
+ *
+ * 冻结清单不手抄：四子路径 + 包根的 `src` 侧 ts-jest 运行时键与各自 tsc 产物
+ * （`dist/**\/index.js`）逐入口 `Object.keys` 对撞，106/29/4/4/24 全部逐字一致。改动入口清单
+ * 文件时同步改本文件对应条目，diff 即 PR 评审材料；增删符号属公共面 breaking，须按
+ * ADR-0003/0022 走发布级别裁决。
+ */
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+const REPO_ROOT = path.join(__dirname, '../..');
+
+/** 包根值面的既有归属，见文件头分工。 */
+const PACKAGE_ROOT_SUBPATH = '.';
+
+const EXPORTS_MAP = JSON.parse(
+  fs.readFileSync(path.join(REPO_ROOT, 'package.json'), 'utf-8'),
+).exports as Record<string, unknown>;
+
+const ENTRY_SUBPATHS: string[] = Object.keys(EXPORTS_MAP);
+
+/** 每个已发布子路径入口的值面全量清单。增删任一项即公共面 breaking，见文件头。 */
+const PUBLISHED_ENTRY_VALUES: Record<string, string[]> = {
+  './core': [
+    'CONSTRAINTS_END_MARKER',
+    'CONSTRAINTS_START_MARKER',
+    'CSOValidator',
+    'CheckCache',
+    'CheckpointValidator',
+    'ConstraintChecker',
+    'ConstraintViolationError',
+    'GUIDELINES',
+    'IRON_LAWS',
+    'PROMPTS',
+    'PassesGate',
+    'ProjectConfigLoader',
+    'SpecValidator',
+    'checkBeforeExecution',
+    'checkConstraint',
+    'checkConstraints',
+    'constraintChecker',
+    'createPassesGate',
+    'findConstraintsByTrigger',
+    'getAllConstraints',
+    'getCapabilitiesMode',
+    'getConstraint',
+    'getEffectiveConstraints',
+    'getGovernanceConfig',
+    'lintEffectiveConfig',
+    'loadRawProjectConfig',
+    'renderConstraintsByTrigger',
+    'renderConstraintsSection',
+    'resolveContextFiles',
+  ],
+  './presets': [
+    'PRESETS_BY_NAME',
+    'RELAXED_PRESET',
+    'STANDARD_PRESET',
+    'STRICT_PRESET',
+  ],
+  './context': [
+    'KnowledgeInjector',
+    'SessionManager',
+    'TokenBudget',
+    'TokenEstimator',
+  ],
+  './gates': [
+    'CommandGate',
+    'ContractGate',
+    'DEFAULT_COMMAND_BLACKLIST',
+    'GATE_DEFINITIONS',
+    'PerformanceGate',
+    'ReviewGate',
+    'SecurityGate',
+    'SpecAcceptanceGate',
+    'assertGateRegistryClosed',
+    'createCheckerGate',
+    'createCommandGate',
+    'createContractGate',
+    'createPerformanceGate',
+    'createReviewGate',
+    'createSecurityGate',
+    'createSpecAcceptanceGate',
+    'decisionFromResult',
+    'getCommandGate',
+    'getCommandRiskLevel',
+    'getGate',
+    'isCommandAllowed',
+    'listRegisteredGates',
+    'registeredGateCount',
+    'runGates',
+  ],
+};
+
+/** exports 子路径 → 承载它的显式清单源文件。形态对不上返回 null，由映射闸 fail-loud。 */
+function sourceFileForSubpath(subpath: string): string | null {
+  if (subpath === PACKAGE_ROOT_SUBPATH) return 'src/index.ts';
+  const rest = subpath.replace(/^\.\//, '');
+  return /^[a-z][a-z0-9-]*$/.test(rest) ? `src/${rest}/index.ts` : null;
+}
+
+/** 同上，但产 ts-jest 可解析的相对说明符（本包未自引用发布名，只能按源码路径 import）。 */
+function moduleSpecifierForSubpath(subpath: string): string | null {
+  const rel = sourceFileForSubpath(subpath);
+  if (rel === null) return null;
+  return `../${rel.replace(/^src\//, '').replace(/\.ts$/, '')}`;
+}
+
+async function runtimeKeysOf(subpath: string): Promise<string[]> {
+  const specifier = moduleSpecifierForSubpath(subpath);
+  expect(specifier).not.toBeNull();
+  const mod: Record<string, unknown> = await import(specifier as string);
+  return Object.keys(mod).sort();
+}
+
+describe('已发布子路径值面全量冻结（ADR-0022 追记 5）', () => {
+  it('exports 的每个子路径都映射到存在的显式清单源文件（新增子路径不得绕过本闸）', () => {
+    const unmapped = ENTRY_SUBPATHS.filter((sub) => {
+      const rel = sourceFileForSubpath(sub);
+      return rel === null || !fs.existsSync(path.join(REPO_ROOT, rel));
+    });
+    expect(unmapped).toEqual([]);
+  });
+
+  it('冻结清单覆盖除包根外的全部已发布子路径（新增入口须先登记清单）', () => {
+    expect(Object.keys(PUBLISHED_ENTRY_VALUES).sort()).toEqual(
+      ENTRY_SUBPATHS.filter((sub) => sub !== PACKAGE_ROOT_SUBPATH).sort(),
+    );
+  });
+
+  it('包根值面确有既有归属（本闸委派 `.`，两边都不钉即公共面失控）', () => {
+    const sibling = fs.readFileSync(path.join(__dirname, 'public-exports.test.ts'), 'utf-8');
+    expect(sibling).toContain('Object.keys(mod)');
+  });
+
+  for (const sub of ENTRY_SUBPATHS) {
+    if (sub === PACKAGE_ROOT_SUBPATH) continue; // 委派给 public-exports.test.ts，见文件头
+    if (moduleSpecifierForSubpath(sub) === null) continue; // 映射闸已负责红，此处不重复报
+    const frozen = PUBLISHED_ENTRY_VALUES[sub];
+    if (frozen === undefined) continue; // 未登记入口由登记闸负责红，此处不重复报
+
+    describe(`入口点 ${sub}`, () => {
+      it('运行时导出键集合与冻结清单逐字一致（增删即 breaking，需发布级别裁决）', async () => {
+        const actual = await runtimeKeysOf(sub);
+        // 解析塌掉不得退化成空集合假绿；冻结清单自身不得有重复项（重复 + 缺失会互相抵掉 diff）
+        expect(actual.length).toBeGreaterThan(0);
+        expect(new Set(frozen).size).toBe(frozen.length);
+        expect({
+          entry: sub,
+          missing: frozen.filter((key) => !actual.includes(key)),
+          extra: actual.filter((key) => !frozen.includes(key)),
+        }).toEqual({ entry: sub, missing: [], extra: [] });
+        expect(actual.length).toBe(frozen.length);
+      });
+    });
+  }
+});

package/src/__tests__/review-gate.test.ts

@@ -4,16 +4,17 @@
 
 import { describe, it, expect, beforeAll, afterAll } from '@jest/globals';
 import { ReviewGate } from '../gates/review';
-import { mkdirSync, rmSync, writeFileSync } from 'fs';
+import { rmSync, writeFileSync, mkdtempSync } from 'fs';
 import { join } from 'path';
+import { tmpdir } from 'os';
 import { execSync } from 'child_process';
 
 describe('ReviewGate', () => {
-  const tempDir = join(process.cwd(), 'temp-test-review-gate');
+  let tempDir: string;
   let gate: ReviewGate;
 
   beforeAll(() => {
-    mkdirSync(tempDir, { recursive: true });
+    tempDir = mkdtempSync(join(tmpdir(), 'temp-test-review-gate-'));
     gate = new ReviewGate({ minReviewers: 1, requireApproval: true });
     
     // 初始化 git
@@ -40,7 +41,6 @@ describe('ReviewGate', () => {
   describe('check', () => {
     it('本地模式应该返回警告', async () => {
       const result = await gate.check({
-        projectId: 'test-project',
         projectPath: tempDir,
       });
       
@@ -53,7 +53,6 @@ describe('ReviewGate', () => {
       const relaxedGate = new ReviewGate({ requireApproval: false });
       
       const result = await relaxedGate.check({
-        projectId: 'test-project',
         projectPath: tempDir,
       });
       
@@ -82,7 +81,6 @@ describe('ReviewGate', () => {
   describe('checkLocalGit', () => {
     it('应该检查 git 状态', async () => {
       const result = await gate.check({
-        projectId: 'test-project',
         projectPath: tempDir,
       });
       

package/src/__tests__/security-gate.test.ts

@@ -4,15 +4,16 @@
 
 import { describe, it, expect, beforeAll, afterAll } from '@jest/globals';
 import { SecurityGate } from '../gates/security';
-import { mkdirSync, rmSync, writeFileSync } from 'fs';
+import { rmSync, writeFileSync, mkdtempSync } from 'fs';
 import { join } from 'path';
+import { tmpdir } from 'os';
 
 describe('SecurityGate', () => {
-  const tempDir = join(process.cwd(), 'temp-test-security-gate');
+  let tempDir: string;
   let gate: SecurityGate;
 
   beforeAll(() => {
-    mkdirSync(tempDir, { recursive: true });
+    tempDir = mkdtempSync(join(tmpdir(), 'temp-test-security-gate-'));
     
     // 创建 package.json（无漏洞）
     writeFileSync(join(tempDir, 'package.json'), JSON.stringify({
@@ -20,7 +21,7 @@ describe('SecurityGate', () => {
       dependencies: {},
     }));
     
-    gate = new SecurityGate({ enabled: true, severityThreshold: 'high' });
+    gate = new SecurityGate({ severityThreshold: 'high' });
   });
 
   afterAll(() => {
@@ -32,22 +33,9 @@ describe('SecurityGate', () => {
   });
 
   describe('scan', () => {
-    it('禁用时应该返回通过', async () => {
-      const disabledGate = new SecurityGate({ enabled: false });
-      
-      const result = await disabledGate.scan({
-        projectId: 'test-project',
-        projectPath: tempDir,
-      });
-      
-      expect(result.passed).toBe(true);
-      expect(result.message).toContain('安全门禁已禁用');
-    });
-
     // 跳过：依赖真实 npm audit 结果，需要 mock 重构
     it.skip('应该运行 npm audit', async () => {
       const result = await gate.scan({
-        projectId: 'test-project',
         projectPath: tempDir,
       });
       
@@ -57,7 +45,6 @@ describe('SecurityGate', () => {
 
     it.skip('应该返回漏洞分析', async () => {
       const result = await gate.scan({
-        projectId: 'test-project',
         projectPath: tempDir,
       });
       
@@ -70,7 +57,6 @@ describe('SecurityGate', () => {
   describe('severityThreshold', () => {
     it.skip('high 阈值应该检查 critical + high', async () => {
       const result = await gate.scan({
-        projectId: 'test-project',
         projectPath: tempDir,
       });
       
@@ -89,7 +75,6 @@ describe('SecurityGate', () => {
   describe('analyzeResult', () => {
     it.skip('应该解析 npm audit JSON 或返回 passed', async () => {
       const result = await gate.scan({
-        projectId: 'test-project',
         projectPath: tempDir,
       });
       

package/src/__tests__/skip-semantics.test.ts

@@ -18,6 +18,7 @@ import type { Constraint, ConstraintContext } from '../types/constraint';
 import type { ExecutionTrace } from '../types/trace';
 import * as fs from 'fs';
 import * as path from 'path';
+import * as os from 'os';
 import { execSync } from 'child_process';
 
 /** 套件共用 checker：显式 no-op 记录器（trace 断言的用例自带记录器实例） */
@@ -32,10 +33,10 @@ function makeConstraint(
 }
 
 describe('skip 三态语义（ADR-0001）', () => {
-  const tempDir = path.join(process.cwd(), 'temp-test-skip-semantics');
+  let tempDir: string;
 
   beforeAll(() => {
-    fs.mkdirSync(tempDir, { recursive: true });
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'temp-test-skip-semantics-'));
     execSync('git init', { cwd: tempDir });
     execSync('git config user.email "test@test.com"', { cwd: tempDir });
     execSync('git config user.name "Test"', { cwd: tempDir });
@@ -227,9 +228,10 @@ describe('skip 三态语义（ADR-0001）', () => {
   });
 
   describe('detectTrigger 补 code_implementation 推断', () => {
-    const triggerDir = path.join(tempDir, 'trigger-probe');
+    let triggerDir: string;
 
     beforeAll(() => {
+      triggerDir = path.join(tempDir, 'trigger-probe');
       // src/ 下有已提交 .ts 文件 → detectSourceRoots 命中 'src'
       fs.mkdirSync(path.join(triggerDir, 'src'), { recursive: true });
       fs.writeFileSync(path.join(triggerDir, 'src', 'existing.ts'), 'export const x = 1;');

package/src/__tests__/spec-validator.test.ts

@@ -6,13 +6,14 @@ import { describe, it, expect, beforeAll, afterAll } from '@jest/globals';
 import { SpecValidator } from '../core/spec/validator';
 import * as fs from 'fs';
 import * as path from 'path';
+import * as os from 'os';
 
 describe('SpecValidator', () => {
-  const tempDir = path.join(process.cwd(), 'temp-test-spec');
+  let tempDir: string;
   let validator: SpecValidator;
 
   beforeAll(() => {
-    fs.mkdirSync(tempDir, { recursive: true });
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'temp-test-spec-'));
     validator = SpecValidator.getInstance();
   });
 

package/src/__tests__/sub-barrels-explicit.test.ts

@@ -0,0 +1,87 @@
+/**
+ * 子 barrel 显式清单闸（harness#137，判据同 ADR-0003 / ADR-0022）
+ *
+ * ADR-0003 的「禁 export *」此前只钉到五个 `exports` 入口（`public-type-surface.test.ts`
+ * 的写法白名单闸），子目录 `index.ts` 的星号再导出不受管——星号让「这个 barrel 到底
+ * 对外给了什么」无法按名字回答，同名遮蔽（两个 `types.ts` 撞名）也在此处静默发生。
+ * 本闸把它扩到 src 下全部 barrel：**逐文件、逐条**登记豁免，未登记的 `export *` 即红。
+ *
+ * 与两道公共面闸的分工：入口清单（`src/index.ts` 等五个）由 `public-type-surface.test.ts`
+ * 与 `public-value-surface.test.ts` 逐字冻结，本闸不重复钉入口，只管**入口之外**的目录级
+ * barrel；新增子 barrel 星号由本闸管住。
+ */
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+const SRC_DIR = path.join(__dirname, '..');
+
+/**
+ * 已核无星号的 barrel 若日后引入 `export *`，需要在这里登记理由。
+ * 当前为空：harness#137 已把 8 处目录级星号全部改成显式清单（`failure/types.ts` 那处
+ * 是兼容再导出 shim，随票删除而非改写清单）。
+ */
+const STAR_EXEMPTIONS: Record<string, string> = {};
+
+/** 收集 src 下所有目录级 barrel（`<dir>/index.ts`），不含 `__tests__` 内的测试辅助文件 */
+function listBarrels(dir: string, out: string[] = []): string[] {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (!entry.isDirectory() || entry.name === '__tests__') continue;
+    const indexTs = path.join(full, 'index.ts');
+    if (fs.existsSync(indexTs)) out.push(indexTs);
+    listBarrels(full, out);
+  }
+  return out;
+}
+
+/** 行首 `export *` / `export type *` / `export * as ns`（去注释后判定） */
+const STAR_EXPORT_RE = /^export\s+(?:type\s+\*)\s*|^export\s+\*/;
+
+function stripComments(code: string): string {
+  return code.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+}
+
+function starExports(barrel: string): string[] {
+  const text = stripComments(fs.readFileSync(barrel, 'utf-8'));
+  return text
+    .split('\n')
+    .map(line => line.trim())
+    .filter(line => STAR_EXPORT_RE.test(line));
+}
+
+describe('子 barrel 显式清单（harness#137）', () => {
+  const barrels = [path.join(SRC_DIR, 'index.ts'), ...listBarrels(SRC_DIR)];
+
+  it('扫到了 barrel（扫空即说明遍历失效，不得假绿）', () => {
+    expect(barrels.length).toBeGreaterThan(5);
+  });
+
+  it('src 下每个目录 barrel 都不含 `export *`（豁免须逐条登记理由）', () => {
+    const offenders = barrels
+      .map(barrel => ({
+        barrel: path.relative(SRC_DIR, barrel),
+        stars: starExports(barrel),
+      }))
+      .filter(entry => entry.stars.length > 0 && !STAR_EXEMPTIONS[entry.barrel]);
+    expect(offenders).toEqual([]);
+  });
+
+  it('豁免登记是死账：登记过却已无星号的条目须撤销（防豁免面只增不减）', () => {
+    const stale = Object.keys(STAR_EXEMPTIONS).filter(
+      rel => !starExports(path.join(SRC_DIR, rel)).length
+    );
+    expect(stale).toEqual([]);
+  });
+
+  it('failure/types.ts 兼容再导出 shim 已删除（转发链第三跳收口）', () => {
+    // 正本在 src/types/failure.ts（工单 14 归位），原模块路径经双仓核实无引用方
+    expect(fs.existsSync(path.join(SRC_DIR, 'failure', 'types.ts'))).toBe(false);
+  });
+
+  it('failure barrel 直连类型正本，不再经 shim 中转', () => {
+    const text = stripComments(fs.readFileSync(path.join(SRC_DIR, 'failure', 'index.ts'), 'utf-8'));
+    expect(text).toContain("from '../types/failure'");
+    expect(text).not.toMatch(/from '\.\/types'/);
+  });
+});

package/src/__tests__/test-fixture-hygiene.test.ts

@@ -0,0 +1,53 @@
+/**
+ * 测试夹具卫生闸（harness#145）
+ *
+ * 钉住一件事：`__tests__` 里的文件系统夹具根一律经 `fs.mkdtempSync` 取每轮唯一目录，
+ * 不得再出现「cwd 下固定名 temp-test 目录」这种夹具形状。
+ *
+ * 固定名的危害：同一 checkout 的两个并发 jest 进程共享该路径，一方的 afterAll rmSync
+ * 会删掉另一方在用的夹具（表现为像产品 bug 的 flaky）；被 kill 的运行还会留下目录，
+ * 下一轮从脏夹具起步。唯一后缀（mkdtemp 前缀以 `-` 结尾）从根上消掉这两条。
+ *
+ * 只判「名字是否唯一」，不判「落在哪个父目录」：cwd 锚定行为本身是被测语义的套件
+ * （injection-writer / init-injection / parentDir opt-out）留在 cwd 是有意为之。
+ */
+
+import { describe, it, expect } from '@jest/globals';
+import * as fs from 'fs';
+import * as path from 'path';
+
+/** 固定名夹具形状：cwd 拼一个字面量 temp-test 目录名，且该名字不以 `-` 结尾（非 mkdtemp 前缀） */
+const FIXED_FIXTURE_RE = /(?:path\.)?join\(\s*process\.cwd\(\)\s*,\s*(['"])temp-test-([^'"]*)\1\s*\)/g;
+
+function collectTestFiles(dir: string, out: string[] = []): string[] {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === 'coverage') continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) collectTestFiles(full, out);
+    else if (entry.name.endsWith('.test.ts')) out.push(full);
+  }
+  return out;
+}
+
+describe('测试夹具卫生（#145）', () => {
+  const repoRoot = path.join(__dirname, '..', '..');
+  const files = collectTestFiles(repoRoot);
+
+  it('扫描面非空（防止 glob 失效把闸扫成空集）', () => {
+    expect(files.length).toBeGreaterThan(100);
+  });
+
+  it('__tests__ 内不存在固定名 temp-test-* 夹具目录', () => {
+    const offenders: string[] = [];
+    for (const file of files) {
+      fs.readFileSync(file, 'utf-8').split('\n').forEach((line, idx) => {
+        FIXED_FIXTURE_RE.lastIndex = 0;
+        let m: RegExpExecArray | null;
+        while ((m = FIXED_FIXTURE_RE.exec(line)) !== null) {
+          if (!m[2].endsWith('-')) offenders.push(`${path.relative(repoRoot, file)}:${idx + 1}: ${line.trim()}`);
+        }
+      });
+    }
+    expect(offenders).toEqual([]);
+  });
+});

package/src/__tests__/trace-analyzer-extra.test.ts

@@ -7,16 +7,18 @@ import { TraceAnalyzer, createAnalyzer } from '../monitoring/trace-analyzer';
 import { TraceCollector } from '../monitoring/traces';
 import * as fs from 'fs';
 import * as path from 'path';
+import * as os from 'os';
 import type { ExecutionTrace } from '../types/trace';
 
 describe('TraceAnalyzer - 补充覆盖', () => {
-  const tempDir = path.join(process.cwd(), 'temp-test-analyzer-extra');
-  const logFile = path.join(tempDir, 'traces.log');
+  let tempDir: string;
+  let logFile: string;
   let collector: TraceCollector;
   let analyzer: TraceAnalyzer;
 
   beforeAll(() => {
-    fs.mkdirSync(tempDir, { recursive: true });
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'temp-test-analyzer-extra-'));
+    logFile = path.join(tempDir, 'traces.log');
     fs.writeFileSync(logFile, '');
   });
 

package/src/__tests__/trace-analyzer.test.ts

@@ -11,16 +11,18 @@ import {
 import { TraceCollector } from '../monitoring/traces';
 import * as fs from 'fs';
 import * as path from 'path';
+import * as os from 'os';
 import type { ExecutionTrace, TraceSummary } from '../types/trace';
 
 describe('TraceAnalyzer', () => {
-  const tempDir = path.join(process.cwd(), 'temp-test-analyzer');
-  const logFile = path.join(tempDir, 'traces.log');
+  let tempDir: string;
+  let logFile: string;
   let collector: TraceCollector;
   let analyzer: TraceAnalyzer;
 
   beforeAll(() => {
-    fs.mkdirSync(tempDir, { recursive: true });
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'temp-test-analyzer-'));
+    logFile = path.join(tempDir, 'traces.log');
     fs.writeFileSync(logFile, '');
     collector = new TraceCollector({ traceFile: logFile, enabled: true });
     analyzer = new TraceAnalyzer(collector);

package/src/__tests__/trace-collector.test.ts

@@ -6,15 +6,17 @@ import { describe, it, expect, beforeAll, afterAll, beforeEach } from '@jest/glo
 import { TraceCollector } from '../monitoring/traces';
 import * as fs from 'fs';
 import * as path from 'path';
+import * as os from 'os';
 import type { ExecutionTrace } from '../types/trace';
 
 describe('TraceCollector', () => {
-  const tempDir = path.join(process.cwd(), 'temp-test-traces');
-  const traceFile = path.join(tempDir, 'traces.log');
+  let tempDir: string;
+  let traceFile: string;
   let collector: TraceCollector;
 
   beforeAll(() => {
-    fs.mkdirSync(tempDir, { recursive: true });
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'temp-test-traces-'));
+    traceFile = path.join(tempDir, 'traces.log');
   });
 
   afterAll(() => {

package/src/agents/index.ts

@@ -1,2 +1,13 @@
-export * from './types';
-export * from './lifecycle';
+/**
+ * Agents 模块导出（ADR-0003：显式清单，禁 export *，harness#137）
+ */
+
+export type {
+  AgentStatus,
+  AgentConfig,
+  AgentState,
+  AgentEvent,
+  FallbackStrategy,
+} from './types';
+export { AgentLifecycle } from './lifecycle';
+export type { EventHandler } from './lifecycle';