@nanobpm/nano-workforce 0.123.0 → 0.123.1

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [0.123.1](https://github.com/nanobpm/nano-workforce/compare/v0.123.0...v0.123.1) (2026-08-22)
+
+
+### Bug Fixes
+
+* **readiness:** inject deterministic exec in readiness-gate e2e ([#450](https://github.com/nanobpm/nano-workforce/issues/450)) ([#452](https://github.com/nanobpm/nano-workforce/issues/452)) ([5597d2a](https://github.com/nanobpm/nano-workforce/commit/5597d2aaacf361677fcc54ef277d05345eff8446)), closes [nano-ide#446](https://github.com/nano-ide/issues/446)
+
 # [0.123.0](https://github.com/nanobpm/nano-workforce/compare/v0.122.0...v0.123.0) (2026-08-22)
 
 

package/e2e/readiness-gate.e2e.ts

@@ -23,6 +23,34 @@ import { dirname, join, resolve } from "node:path";
 import { after, before, describe, test } from "node:test";
 import { fileURLToPath } from "node:url";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
+import type { CommandResult, ProbeExec } from "../app/readiness.ts";
+import { __setProbeExecForTest } from "../workers/readiness-probe/worker.ts";
+
+// A synchronous, in-memory ProbeExec so the probe resolves WITHIN the testkit's virtual-clock drain
+// fixpoint instead of spawning a REAL subprocess (real-time work `settle()` cannot deterministically
+// await — issue #450). It maps the hermetic shell builtins these scenarios use to a deterministic
+// `CommandResult` — `true` → exit 0 (green), `false` → exit 1 (never green) — mirroring the real
+// commands' semantics exactly, but with zero real time. Any OTHER command, or any HTTP call, is an
+// unintended probe escape: because `probeSingleShot` catches a thrown/rejected probe error and folds
+// it into a silent "not ready", an escape would otherwise be INVISIBLE and could let a bounded
+// not-ready scenario still pass, masking a regression (reviewer note). So we record every escape and
+// assert none occurred in teardown, failing the suite loudly instead of swallowing it.
+const unexpectedProbeIO: string[] = [];
+const deterministicExec: ProbeExec = {
+  run(command: string): Promise<CommandResult> {
+    const cmd = command.trim();
+    if (cmd !== "true" && cmd !== "false") {
+      unexpectedProbeIO.push(`command: ${cmd}`);
+      return Promise.resolve({ code: 127, stdout: "", stderr: "" });
+    }
+    const code = cmd === "true" ? 0 : 1;
+    return Promise.resolve({ code, stdout: "", stderr: "" });
+  },
+  httpGet(url: string): Promise<never> {
+    unexpectedProbeIO.push(`http: ${url}`);
+    return Promise.reject(new Error(`readiness-gate e2e: unexpected real HTTP probe (command probes only)`));
+  },
+};
 
 const APP_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 let dbSeq = 0;
@@ -32,6 +60,7 @@ const GITHUB_ENV_OVERRIDES: Record<string, string> = {
   GITHUB_TOKEN: "",
 };
 const savedEnv = new Map<string, string | undefined>();
+let savedProbeExec: ProbeExec | undefined;
 
 interface TakenFlow {
   from: string;
@@ -61,6 +90,11 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
       savedEnv.set(k, process.env[k]);
       process.env[k] = v;
     }
+    // Inject the deterministic exec so the probe never spawns a real subprocess under the virtual
+    // clock (issue #450). Scenario-agnostic: it maps each scenario's command by string. Capture the
+    // prior override and restore exactly that in teardown, so the seam is restored to its real prior
+    // state rather than assuming production.
+    savedProbeExec = __setProbeExecForTest(deterministicExec);
   });
 
   after(() => {
@@ -68,6 +102,13 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
       if (v === undefined) delete process.env[k];
       else process.env[k] = v;
     }
+    // Restore the prior exec — the seam must never outlive this suite.
+    __setProbeExecForTest(savedProbeExec);
+    // Fail loudly if the probe ever escaped the hermetic `true`/`false` builtins (an unexpected
+    // command or any HTTP call). `probeSingleShot` folds a probe error into a silent "not ready", so
+    // without this assertion an escape would be invisible and could let a bounded not-ready scenario
+    // still pass, masking a regression.
+    assert.deepEqual(unexpectedProbeIO, [], `readiness-gate e2e saw unexpected probe I/O: ${unexpectedProbeIO.join(", ")}`);
   });
 
   test("READY: a green probe publishes readiness-ready and the gate releases through wait-ready → gate-ready", async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.123.0",
+  "version": "0.123.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/workers/readiness-probe/worker.ts

@@ -103,10 +103,38 @@ export function readGateVars(vars: { gateKey?: unknown; probeTimeout?: unknown }
   return { gateKey, probeTimeout };
 }
 
+// ── Deterministic-exec test seam (issue #450) ───────────────────────────────────────────────────
+// The probe's I/O runs through {@link defaultProbeExec} — a REAL `node:child_process` subprocess (for
+// `command` probes) / `fetch` (for `http`). A real subprocess is real-time async work that spans
+// multiple macrotasks, which the urban-testkit's *virtual-clock* `settle()`/`drain()` fixpoint cannot
+// deterministically await: it can return before the probe publishes `readiness-ready`, so a gate-flow
+// e2e races the subprocess (the same fire-and-forget-across-teardown hazard behind the testkit
+// use-after-free, nano-ide#446). An e2e under the virtual clock injects a synchronous, in-memory
+// `ProbeExec` here so the probe resolves *within* the drain fixpoint — no real spawn, no wall-clock
+// race — while production leaves the override unset and uses `defaultProbeExec()`. Deliberately a
+// process-scoped seam (not urban worker DI, which `bootTestApp` does not expose per-worker); the e2e
+// sets it before creating instances and clears it in teardown so it can never leak into production.
+let probeExecOverride: ProbeExec | undefined;
+
+/** Test-only seam: inject a deterministic {@link ProbeExec} for e2es driven by the virtual clock, or
+ *  pass `undefined` to restore the production {@link defaultProbeExec}. Never called in production.
+ *  Returns the PREVIOUS override so a caller can narrowly scope its change with `try/finally`
+ *  (restore the prior value rather than assuming production), keeping the seam safe even if the set
+ *  and clear are not lexically paired. */
+export function __setProbeExecForTest(exec: ProbeExec | undefined): ProbeExec | undefined {
+  const previous = probeExecOverride;
+  probeExecOverride = exec;
+  return previous;
+}
+
+function resolveProbeExec(): ProbeExec {
+  return probeExecOverride ?? defaultProbeExec();
+}
+
 const handler: AppJobHandler<In, Out> = async (job, app) => {
   const probe = parseProbe(job.variables.probe);
   const { gateKey } = readGateVars(job.variables);
-  const exec = defaultProbeExec();
+  const exec = resolveProbeExec();
   const result = await probeSingleShot({
     probe,
     exec,