agentic-workflow-manager 3.1.0 → 3.2.1

package/dist/tests/core/reconciliation.test.js

@@ -0,0 +1,165 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// tests/core/reconciliation.test.ts
+//
+// Exercises the REAL planReconciliation (no mocks) end-to-end: seeds a real
+// registry content root with a baseline bundle, an ambient bundle, and a
+// project-scope bundle, then verifies the computed plan only reconciles the
+// machine-scope (baseline + ambient) artifacts — and, applied via the real
+// applyInstallPlan, actually fixes both a MISSING target and a STALE target.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+function writeBundle(contentRoot, name, scope, skills, dependsOn = []) {
+    fs_1.default.mkdirSync(path_1.default.join(contentRoot, 'bundles', name), { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(contentRoot, 'bundles', name, 'bundle.json'), JSON.stringify({
+        name, version: '1.0.0', scope, dependsOn,
+        skills: skills.map((s) => ({ name: s })), workflows: [], agents: [],
+    }));
+    for (const skill of skills) {
+        fs_1.default.mkdirSync(path_1.default.join(contentRoot, 'skills', skill), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(contentRoot, 'skills', skill, 'SKILL.md'), `# ${skill}`);
+    }
+}
+function addToCatalog(contentRoot, name, scope) {
+    const catalogFile = path_1.default.join(contentRoot, 'catalog.json');
+    const catalog = JSON.parse(fs_1.default.readFileSync(catalogFile, 'utf-8'));
+    catalog.bundles.push({ name, source: `./bundles/${name}`, version: '1.0.0', scope });
+    fs_1.default.writeFileSync(catalogFile, JSON.stringify(catalog));
+}
+describe('planReconciliation (real, unmocked)', () => {
+    let tmpHome;
+    let contentRoot;
+    let originalHome;
+    let originalAwmHome;
+    beforeEach(() => {
+        tmpHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-reconcile-'));
+        originalHome = process.env.HOME;
+        originalAwmHome = process.env.AWM_HOME;
+        process.env.HOME = tmpHome;
+        process.env.AWM_HOME = path_1.default.join(tmpHome, '.awm');
+        jest.resetModules();
+        contentRoot = path_1.default.join(tmpHome, 'registry');
+        fs_1.default.mkdirSync(contentRoot, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(contentRoot, 'catalog.json'), JSON.stringify({
+            version: 1,
+            bundles: [
+                { name: 'dev', source: './bundles/dev', version: '1.0.0', scope: 'baseline' },
+                { name: 'ambient-x', source: './bundles/ambient-x', version: '1.0.0', scope: 'ambient' },
+                { name: 'proj-y', source: './bundles/proj-y', version: '1.0.0', scope: 'project' },
+            ],
+        }));
+        writeBundle(contentRoot, 'dev', 'baseline', ['brainstorming']);
+        writeBundle(contentRoot, 'ambient-x', 'ambient', ['ambient-skill']);
+        writeBundle(contentRoot, 'proj-y', 'project', ['proj-skill']);
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
+        if (originalHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = originalHome;
+        if (originalAwmHome === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = originalAwmHome;
+    });
+    it('plans only the machine-scope (baseline + ambient) artifacts, excluding project-scope bundles', () => {
+        const { planReconciliation } = require('../../src/core/reconciliation');
+        const plan = planReconciliation({ targets: ['claude-code'], roots: [contentRoot] });
+        const names = plan.operations.map((op) => op.name).sort();
+        expect(names).toEqual(['ambient-skill', 'brainstorming']); // proj-skill excluded (R — project bundles are `awm sync`'s job, not `awm update`'s)
+        const claudeSkillsDir = path_1.default.join(tmpHome, '.claude', 'skills');
+        const targets = plan.operations.map((op) => op.targetPath).sort();
+        expect(targets).toEqual([
+            path_1.default.join(claudeSkillsDir, 'ambient-skill'),
+            path_1.default.join(claudeSkillsDir, 'brainstorming'),
+        ]);
+    });
+    it('reconciles drift end-to-end when applied: installs a MISSING target and replaces a STALE one', () => {
+        const claudeSkillsDir = path_1.default.join(tmpHome, '.claude', 'skills');
+        fs_1.default.mkdirSync(claudeSkillsDir, { recursive: true });
+        // Drift scenario 1 — stale: 'brainstorming' exists but as a plain file
+        // with the wrong content (as if it were copied once and the registry
+        // has since diverged), not a symlink to the registry source.
+        fs_1.default.writeFileSync(path_1.default.join(claudeSkillsDir, 'brainstorming'), 'stale, wrong content');
+        // Drift scenario 2 — missing: 'ambient-skill' was never installed at all.
+        expect(fs_1.default.existsSync(path_1.default.join(claudeSkillsDir, 'ambient-skill'))).toBe(false);
+        const { planReconciliation } = require('../../src/core/reconciliation');
+        const { applyInstallPlan } = require('../../src/core/install-transaction');
+        const plan = planReconciliation({ targets: ['claude-code'], roots: [contentRoot] });
+        const summary = applyInstallPlan(plan);
+        expect(summary.installed.sort()).toEqual([
+            'ambient-skill → claude-code',
+            'brainstorming → claude-code',
+        ]);
+        // Stale target is now a real symlink to the registry source, not the old file.
+        const brainstormingStat = fs_1.default.lstatSync(path_1.default.join(claudeSkillsDir, 'brainstorming'));
+        expect(brainstormingStat.isSymbolicLink()).toBe(true);
+        expect(fs_1.default.realpathSync(path_1.default.join(claudeSkillsDir, 'brainstorming')))
+            .toBe(fs_1.default.realpathSync(path_1.default.join(contentRoot, 'skills', 'brainstorming')));
+        // Missing target now exists as a symlink too.
+        const ambientStat = fs_1.default.lstatSync(path_1.default.join(claudeSkillsDir, 'ambient-skill'));
+        expect(ambientStat.isSymbolicLink()).toBe(true);
+        expect(fs_1.default.realpathSync(path_1.default.join(claudeSkillsDir, 'ambient-skill')))
+            .toBe(fs_1.default.realpathSync(path_1.default.join(contentRoot, 'skills', 'ambient-skill')));
+    });
+    it('scopes to the selected agent target only', () => {
+        const { planReconciliation } = require('../../src/core/reconciliation');
+        const plan = planReconciliation({ targets: ['opencode'], roots: [contentRoot] });
+        const owners = new Set(plan.operations.flatMap((op) => op.owners));
+        expect(owners).toEqual(new Set(['opencode']));
+    });
+    // NOTE on the two tests below: `resolveBundleClosure` (bundles.ts) already
+    // treats a `dependsOn` entry naming a bundle that isn't in the catalog as
+    // silently absent from the closure — it does NOT throw (verified directly:
+    // a baseline bundle with `dependsOn: ['does-not-exist']` resolves its own
+    // artifacts fine; the ghost name is just dropped). So a plain dangling
+    // `dependsOn` string never reaches `planReconciliation`'s
+    // `try { expandBundleArtifacts(...) } catch { continue; }` guard at all —
+    // the first test below confirms that directly. To actually force the catch
+    // branch (and check it skips only the one broken bundle, not the whole
+    // batch, and doesn't silently eat some other bug), the second test injects
+    // a bundle whose `dependsOn` field is malformed in a way that genuinely
+    // breaks closure resolution (`dependsOn` is not an array, so
+    // `resolveBundleClosure`'s `for (const dep of b.dependsOn)` throws) —
+    // mirroring the kind of real, unresolvable-closure error the catch is
+    // meant to guard against.
+    it('tolerates a plain dangling dependsOn reference without needing the catch — the bundle installs normally', () => {
+        writeBundle(contentRoot, 'dangling-dep', 'baseline', ['dangling-skill'], ['does-not-exist']);
+        addToCatalog(contentRoot, 'dangling-dep', 'baseline');
+        const { planReconciliation } = require('../../src/core/reconciliation');
+        const plan = planReconciliation({ targets: ['claude-code'], roots: [contentRoot] });
+        const names = plan.operations.map((op) => op.name).sort();
+        // 'dangling-skill' installs fine even though its bundle's dependsOn
+        // points nowhere — resolveBundleClosure just drops the missing dep.
+        expect(names).toEqual(['ambient-skill', 'brainstorming', 'dangling-skill']);
+    });
+    it('skips a bundle whose closure genuinely fails to resolve, without aborting reconciliation for the rest', () => {
+        // Malformed dependsOn (not an array) makes resolveBundleClosure throw
+        // when it tries to iterate it — a real "unresolvable closure" error,
+        // unlike a plain dangling name reference (see test above).
+        writeBundle(contentRoot, 'broken', 'baseline', ['broken-skill'], 5);
+        addToCatalog(contentRoot, 'broken', 'baseline');
+        const { planReconciliation } = require('../../src/core/reconciliation');
+        let plan;
+        expect(() => {
+            plan = planReconciliation({ targets: ['claude-code'], roots: [contentRoot] });
+        }).not.toThrow();
+        // The healthy bundles (baseline 'dev' + ambient 'ambient-x') still
+        // reconcile correctly.
+        const names = plan.operations.map((op) => op.name).sort();
+        expect(names).toEqual(['ambient-skill', 'brainstorming']);
+        // The broken bundle is cleanly absent — no partial/broken entry for
+        // 'broken-skill' or any operation touching it.
+        expect(names).not.toContain('broken-skill');
+        expect(plan.operations.some((op) => op.sourcePath?.includes('broken'))).toBe(false);
+        // Applying the plan end-to-end still works (no dangling reference to
+        // the broken bundle leaked into the plan).
+        const { applyInstallPlan } = require('../../src/core/install-transaction');
+        expect(() => applyInstallPlan(plan)).not.toThrow();
+    });
+});

package/dist/tests/core/registries-sync.test.js

@@ -93,7 +93,7 @@ describe('syncRegistries (git fixtures locales)', () => {
         m.writeRegistriesConfig([{ name: 'personal', remote: source }]);
         const awmDir = path_1.default.join(tmpHome, '.awm');
         fs_1.default.mkdirSync(awmDir, { recursive: true });
-        fs_1.default.writeFileSync(path_1.default.join(awmDir, 'preferences.json'), JSON.stringify({ defaultAgent: 'claude', installMethod: 'symlink', defaultScope: 'local', pins: { personal: '9.9.9' } }));
+        fs_1.default.writeFileSync(path_1.default.join(awmDir, 'preferences.json'), JSON.stringify({ defaultAgent: 'claude-code', installMethod: 'symlink', defaultScope: 'local', pins: { personal: '9.9.9' } }));
         const results = await m.syncRegistries();
         expect(results[0].action).toBe('error');
         // El dir no debe quedar en disco tras el fallo
@@ -110,7 +110,7 @@ describe('syncRegistries (git fixtures locales)', () => {
         m.writeRegistriesConfig([{ name: 'personal', remote: source }]);
         const awmDir = path_1.default.join(tmpHome, '.awm');
         fs_1.default.mkdirSync(awmDir, { recursive: true });
-        fs_1.default.writeFileSync(path_1.default.join(awmDir, 'preferences.json'), JSON.stringify({ defaultAgent: 'claude', installMethod: 'symlink', defaultScope: 'local', pins: { personal: '1.0.0' } }));
+        fs_1.default.writeFileSync(path_1.default.join(awmDir, 'preferences.json'), JSON.stringify({ defaultAgent: 'claude-code', installMethod: 'symlink', defaultScope: 'local', pins: { personal: '1.0.0' } }));
         const results = await m.syncRegistries();
         expect(results).toEqual([{ name: 'personal', action: 'recloned', version: 'v1.0.0' }]);
     });
@@ -174,7 +174,7 @@ describe('syncRegistries (git fixtures locales)', () => {
         expect(r1).toEqual([{ name: 'personal', action: 'recloned', version: 'v1.1.0' }]);
         // establece pin a la versión anterior
         const awmDir = path_1.default.join(tmpHome, '.awm');
-        fs_1.default.writeFileSync(path_1.default.join(awmDir, 'preferences.json'), JSON.stringify({ defaultAgent: 'claude', installMethod: 'symlink', defaultScope: 'local', pins: { personal: '1.0.0' } }));
+        fs_1.default.writeFileSync(path_1.default.join(awmDir, 'preferences.json'), JSON.stringify({ defaultAgent: 'claude-code', installMethod: 'symlink', defaultScope: 'local', pins: { personal: '1.0.0' } }));
         // segunda sync con pin: retrocede a v1.0.0
         const r2 = await m.syncRegistries();
         expect(r2).toEqual([{ name: 'personal', action: 'pulled', version: 'v1.0.0' }]);
@@ -188,7 +188,7 @@ describe('syncRegistries (git fixtures locales)', () => {
         m.writeRegistriesConfig([{ name: 'personal', remote: source }]);
         const awmDir = path_1.default.join(tmpHome, '.awm');
         fs_1.default.mkdirSync(awmDir, { recursive: true });
-        fs_1.default.writeFileSync(path_1.default.join(awmDir, 'preferences.json'), JSON.stringify({ defaultAgent: 'claude', installMethod: 'symlink', defaultScope: 'local', channel: 'dev' }));
+        fs_1.default.writeFileSync(path_1.default.join(awmDir, 'preferences.json'), JSON.stringify({ defaultAgent: 'claude-code', installMethod: 'symlink', defaultScope: 'local', channel: 'dev' }));
         // primera sync en canal dev: queda en HEAD (no en el tag)
         const r1 = await m.syncRegistries();
         expect(r1).toEqual([{ name: 'personal', action: 'recloned', version: 'HEAD' }]);

package/dist/tests/core/renderers/canonical-agent.test.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const canonical_agent_1 = require("../../../src/core/renderers/canonical-agent");
+// Real canonical agent content from the awm-baseline-registry (registries/baseline/agents/development-process.md),
+// which the installer materializes at ~/.awm/registries/baseline/agents/development-process.md.
+const canonicalWithModePrimary = `---
+name: development-process
+description: Use as agent profile to orchestrate the development lifecycle - invokes the development-process skill which contains the full orchestration logic
+mode: primary
+---
+
+# Development Process Orchestrator
+
+You are a development orchestrator. You do NOT write code directly.
+
+## On Every Conversation Start
+
+1. **Invoke the \`development-process\` skill.** This skill contains the complete orchestration logic: state detection, lifecycle phases, decision rules, and the full catalog of available skills.
+2. Follow the skill's instructions exactly - it will guide you through identifying project state, recommending the next phase, and delegating to the correct skill.
+
+## Rules
+
+- NEVER start writing code without first invoking \`development-process\`
+- NEVER duplicate orchestration logic here - the skill is the single source of truth
+- NEVER invoke a downstream skill without user approval
+`;
+it('parses name, description, and instructions from valid frontmatter', () => {
+    const source = `---
+name: my-agent
+description: Does a thing
+---
+
+Body text here.
+`;
+    expect((0, canonical_agent_1.parseCanonicalAgent)(source)).toEqual({
+        name: 'my-agent',
+        description: 'Does a thing',
+        instructions: 'Body text here.',
+    });
+});
+it('ignores provider-only mode while retaining canonical instructions', () => {
+    const parsed = (0, canonical_agent_1.parseCanonicalAgent)(canonicalWithModePrimary);
+    expect(parsed).toEqual({
+        name: 'development-process',
+        description: 'Use as agent profile to orchestrate the development lifecycle - invokes the development-process skill which contains the full orchestration logic',
+        instructions: expect.stringContaining('You do NOT write code directly.'),
+    }); // verifies R8, R9
+});
+it.each([
+    ['---\nname: Bad Name\ndescription: x\n---\nbody', 'invalid agent name'],
+    ['---\nname: ok\ndescription:\n---\nbody', 'non-empty description'],
+    ['---\nname: ok\ndescription: x\n---\n', 'non-empty instruction body'],
+    ['name: ok', 'frontmatter'],
+    ['---\nname: ok\nnot a field\n---\nbody', 'invalid canonical agent frontmatter line'],
+    ['---\nname: ok\ndescription: first\ndescription: second\n---\nbody', 'duplicate canonical agent frontmatter key: description'],
+])('rejects invalid canonical agent sources', (source, message) => {
+    expect(() => (0, canonical_agent_1.parseCanonicalAgent)(source)).toThrow(message); // verifies R17
+});

package/dist/tests/core/renderers/codex-agent.test.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const codex_agent_1 = require("../../../src/core/renderers/codex-agent");
+const canonical = `---
+name: development-process
+description: Orchestrates the development lifecycle
+mode: primary
+---
+
+# Development Process
+
+Invoke the \`development-process\` skill before implementation.
+`;
+it('renders deterministic native Codex TOML', () => {
+    expect((0, codex_agent_1.renderCodexAgent)(canonical)).toBe(`name = "development-process"
+description = "Orchestrates the development lifecycle"
+developer_instructions = """
+# Development Process
+
+Invoke the \`development-process\` skill before implementation.
+"""
+`); // verifies R8, R9
+});
+it.each([
+    ['---\nname: Bad Name\ndescription: x\n---\nbody', 'invalid agent name'],
+    ['---\nname: ok\ndescription:\n---\nbody', 'non-empty description'],
+    ['---\nname: ok\ndescription: x\n---\n', 'non-empty instruction body'],
+    ['name: ok', 'frontmatter'],
+])('rejects invalid canonical agents before rendering', (source, message) => {
+    expect(() => (0, codex_agent_1.renderCodexAgent)(source)).toThrow(message); // verifies R17
+});
+it('escapes an embedded backslash and runs of double quotes of varying length in the instructions body', () => {
+    const instructionsBody = [
+        'Backslash: \\',
+        'One quote: "',
+        'Three quotes: """',
+        'Four quotes: """"',
+        'Five quotes: """""',
+        'Seven quotes: """""""',
+        'Eight quotes: """"""""',
+    ].join('\n');
+    const source = `---
+name: quote-agent
+description: Handles many quotes
+---
+
+${instructionsBody}
+`;
+    expect((0, codex_agent_1.renderCodexAgent)(source)).toBe(`name = "quote-agent"
+description = "Handles many quotes"
+developer_instructions = """
+Backslash: \\\\
+One quote: \\"
+Three quotes: \\"\\"\\"
+Four quotes: \\"\\"\\"\\"
+Five quotes: \\"\\"\\"\\"\\"
+Seven quotes: \\"\\"\\"\\"\\"\\"\\"
+Eight quotes: \\"\\"\\"\\"\\"\\"\\"\\"
+"""
+`); // verifies R8, R9 (guards against greedy triple-quote-run escaping producing invalid TOML)
+});
+it('escapes U+007F (DEL) in single-line TOML string fields', () => {
+    const source = `---
+name: ok
+description: hasdel
+---
+
+Body text.
+`;
+    expect((0, codex_agent_1.renderCodexAgent)(source)).toBe(`name = "ok"
+description = "has\\u007fdel"
+developer_instructions = """
+Body text.
+"""
+`); // verifies R8, R9
+});
+it('escapes U+007F (DEL) embedded in the multiline instructions body', () => {
+    const del = String.fromCharCode(0x7f);
+    const source = `---
+name: ok
+description: fine
+---
+
+Body${del}text.
+`;
+    expect((0, codex_agent_1.renderCodexAgent)(source)).toBe(`name = "ok"
+description = "fine"
+developer_instructions = """
+Body\\u007ftext.
+"""
+`); // verifies R8, R9
+});
+it('escapes other C0 control characters (e.g. NUL, U+000B) embedded in the multiline instructions body while leaving tab and newline raw', () => {
+    const nul = String.fromCharCode(0x00);
+    const vt = String.fromCharCode(0x0b);
+    const unitSep = String.fromCharCode(0x1f);
+    const source = `---
+name: ok
+description: fine
+---
+
+Body${nul}with${vt}control${unitSep}chars\tand\na newline.
+`;
+    expect((0, codex_agent_1.renderCodexAgent)(source)).toBe(`name = "ok"
+description = "fine"
+developer_instructions = """
+Body\\u0000with\\u000bcontrol\\u001fchars\tand
+a newline.
+"""
+`); // verifies R8, R9
+});
+it('escapes other C0 control characters (e.g. NUL, U+000B) in single-line TOML string fields', () => {
+    const nul = String.fromCharCode(0x00);
+    const vt = String.fromCharCode(0x0b);
+    const source = `---
+name: ok
+description: has${nul}nul${vt}vt
+---
+
+Body text.
+`;
+    expect((0, codex_agent_1.renderCodexAgent)(source)).toBe(`name = "ok"
+description = "has\\u0000nul\\u000bvt"
+developer_instructions = """
+Body text.
+"""
+`); // verifies R8, R9
+});

package/dist/tests/core/versioning.test.js

@@ -152,7 +152,7 @@ describe('versioning core', () => {
         it('lee channel dev y pin por nombre desde preferences', () => {
             const awmDir = path_1.default.join(tmpHome, '.awm');
             fs_1.default.mkdirSync(awmDir, { recursive: true });
-            fs_1.default.writeFileSync(path_1.default.join(awmDir, 'preferences.json'), JSON.stringify({ defaultAgent: 'claude', installMethod: 'symlink', defaultScope: 'local', channel: 'dev', pins: { base: '1.2.0', equipo: '0.3.0' } }));
+            fs_1.default.writeFileSync(path_1.default.join(awmDir, 'preferences.json'), JSON.stringify({ defaultAgent: 'claude-code', installMethod: 'symlink', defaultScope: 'local', channel: 'dev', pins: { base: '1.2.0', equipo: '0.3.0' } }));
             const { machineVersionOpts } = require('../../src/core/versioning');
             expect(machineVersionOpts('base')).toEqual({ pin: '1.2.0', channel: 'dev' });
             expect(machineVersionOpts('equipo')).toEqual({ pin: '0.3.0', channel: 'dev' });

package/dist/tests/integration/codex-provider-isolated.test.js

@@ -0,0 +1,235 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// cli/tests/integration/codex-provider-isolated.test.ts
+//
+// Task 9, Step 5 — a genuinely-real, isolated-home E2E: unlike the rest of the
+// suite (which stubs installBundle/installHook/etc. to observe call shape),
+// this test lets `awm init --agent codex` run its REAL pipeline end-to-end
+// (real symlinks, real Codex TOML rendering, real preferences writes) against
+// a hand-seeded registry fixture, then asserts on the actual resulting
+// filesystem — never against the real `~/.awm` (CLAUDE.md's "never touch
+// ~/.awm" rule; HOME/AWM_HOME are isolated tmpdirs for the whole test, same
+// pattern as tests/commands/hooks/install.test.ts).
+//
+// Matches the plan's illustrative Task 9 Step 5 snippet: OpenCode is enabled
+// (and really initialized) alongside Claude Code BEFORE the real
+// `awm init --agent codex` run, exactly the "OpenCode already enabled, then
+// Codex joins" scenario this whole plan exists to support. This used to trip
+// install-planner.ts's `assertCompleteSharedGroup` (R14, Task 5) — OpenCode
+// and Codex share the exact same physical skills directory (~/.agents/skills,
+// providers/index.ts) — because `core/init/steps.ts`'s `stepDevCore`/
+// `stepAmbient` passed a `[agent]` singleton as `selectedAgents`, which R14
+// refuses whenever a co-owner of the shared target is independently enabled.
+// That was a confirmed BLOCKER (found in post-implementation QA): it made
+// `awm init --agent codex` structurally fail whenever OpenCode was already
+// enabled, and vice versa. Fixed by having `stepDevCore`/`stepAmbient`
+// compute the complete shared-skill-target group among currently-enabled
+// agents (`install-planner.ts`'s `agentsSharingSkillTarget`, used via
+// `steps.ts`'s `sharedInstallAgents`) instead of a singleton — see
+// tests/core/init/steps.test.ts for the unit-level coverage of that
+// computation. This test proves the real end-to-end flow now succeeds.
+//
+// While building this fixture, this test also caught and fixed a real,
+// previously-untested bug: `runInit` called `assertClaudeBaselinePreserved`
+// unconditionally, even when the run's OWN target was claude-code — meaning
+// any genuinely successful `awm init` (no --agent, the CLI's default/most
+// common path) with real registry content would falsely throw "Claude Code
+// baseline changed during a non-Claude init" and exit 2. See
+// src/commands/init.ts's `beforeClaudeFacts` guard.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+describe('codex provider — isolated home E2E (Task 9)', () => {
+    let tmpHome;
+    let tmpWork;
+    let originalHome;
+    let originalAwmHome;
+    let writeSpy;
+    function stdout() {
+        return writeSpy.mock.calls.map((c) => c[0]).join('');
+    }
+    beforeEach(() => {
+        tmpHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-e2e-home-'));
+        tmpWork = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-e2e-work-'));
+        originalHome = process.env.HOME;
+        originalAwmHome = process.env.AWM_HOME;
+        process.env.HOME = tmpHome;
+        process.env.AWM_HOME = path_1.default.join(tmpHome, '.awm');
+        jest.resetModules();
+        // Every runInit/runDoctor call in this suite writes a full text report to
+        // stdout — mock it so the real test suite's own output stays readable, and
+        // recover it via `stdout()` where a test needs to inspect the JSON payload.
+        writeSpy = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    });
+    afterEach(() => {
+        writeSpy.mockRestore();
+        fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
+        fs_1.default.rmSync(tmpWork, { recursive: true, force: true });
+        if (originalHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = originalHome;
+        if (originalAwmHome === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = originalAwmHome;
+    });
+    /** Hand-seeds a registry content root with everything a real `awm init` needs:
+     *  hooks (Claude + Codex), the bootstrap skill, one baseline bundle providing
+     *  both a skill and a Codex-native agent artifact. No git repo involved — the
+     *  registry cache is content-root-shaped, exactly what a real clone produces. */
+    function seedPublicRegistryFixture(root) {
+        fs_1.default.mkdirSync(path_1.default.join(root, 'hooks'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'hooks/session-start'), '#!/bin/sh\necho "{}"\n', { mode: 0o755 });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'hooks/run-hook.cmd'), '#!/bin/sh\nexec sh "$1"\n', { mode: 0o755 });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'hooks/codex-session-start'), '#!/bin/sh\necho "{}"\n', { mode: 0o755 });
+        fs_1.default.mkdirSync(path_1.default.join(root, 'skills/using-awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'skills/using-awm/SKILL.md'), '---\nname: using-awm\n---\nMUST invoke skills.');
+        fs_1.default.mkdirSync(path_1.default.join(root, 'skills/development-process'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'skills/development-process/SKILL.md'), '---\nname: development-process\n---\nOrchestrates the dev lifecycle.');
+        fs_1.default.mkdirSync(path_1.default.join(root, 'agents'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'agents/development-process.md'), '---\nname: development-process\ndescription: Orchestrates the dev lifecycle.\n---\nFollow the AWM development process end to end.');
+        fs_1.default.writeFileSync(path_1.default.join(root, 'catalog.json'), JSON.stringify({
+            version: 1,
+            bundles: [{ name: 'dev-core', source: 'bundles/dev-core', version: '1.0.0', scope: 'baseline', visibility: 'public' }],
+        }));
+        fs_1.default.mkdirSync(path_1.default.join(root, 'bundles/dev-core'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'bundles/dev-core/bundle.json'), JSON.stringify({
+            name: 'dev-core', description: '', version: '1.0.0', scope: 'baseline', visibility: 'public',
+            dependsOn: [], skills: ['development-process'], workflows: [], agents: ['development-process'],
+        }));
+        fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.awm/registries.json'), JSON.stringify([{ name: 'baseline', remote: 'https://example.invalid/baseline.git' }], null, 2));
+    }
+    function writePrefs(prefs) {
+        const { savePreferences } = require('../../src/utils/config');
+        savePreferences(prefs);
+    }
+    function prefsWith(enabledAgents) {
+        return { defaultAgent: enabledAgents[0], enabledAgents, installMethod: 'symlink', defaultScope: 'local' };
+    }
+    function readPrefs() {
+        return JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpHome, '.awm/preferences.json'), 'utf8'));
+    }
+    /** Cheap recursive content snapshot for "did this subtree change at all" assertions
+     *  (same shape as tests/commands/init.test.ts's snapshotTree). */
+    function snapshotTree(dir) {
+        if (!fs_1.default.existsSync(dir))
+            return null;
+        const walk = (p) => {
+            const st = fs_1.default.lstatSync(p);
+            if (st.isSymbolicLink())
+                return { type: 'symlink', target: fs_1.default.readlinkSync(p) };
+            if (st.isDirectory()) {
+                const entries = fs_1.default.readdirSync(p).sort();
+                return { type: 'dir', entries: Object.fromEntries(entries.map((e) => [e, walk(path_1.default.join(p, e))])) };
+            }
+            return { type: 'file', content: fs_1.default.readFileSync(p, 'utf8') };
+        };
+        return walk(dir);
+    }
+    it('initializes Codex beside a real Claude Code + OpenCode install without touching Claude files', async () => {
+        expect(process.env.HOME).toBe(tmpHome);
+        expect(process.env.AWM_HOME).toBe(path_1.default.join(tmpHome, '.awm'));
+        seedPublicRegistryFixture(path_1.default.join(tmpHome, '.awm/registries/baseline'));
+        const { runInit } = require('../../src/commands/init');
+        // Real, full, unstubbed init for claude-code — installs the real hook,
+        // real global skill symlink and real global agent symlink.
+        const claudeCode = await runInit({ cwd: tmpWork, yes: true });
+        expect(claudeCode).toBeLessThanOrEqual(1);
+        expect(fs_1.default.lstatSync(path_1.default.join(tmpHome, '.claude/skills/development-process')).isSymbolicLink()).toBe(true);
+        expect(readPrefs().enabledAgents).toEqual(['claude-code']);
+        // Real, full, unstubbed init for opencode — enables it alongside Claude
+        // Code and materializes its real ~/.agents/skills symlink, the exact
+        // physical directory Codex shares (providers/index.ts). This is the
+        // scenario the plan's own Task 9 Step 5 snippet illustrates ("OpenCode
+        // already enabled, then Codex joins") and the one the BLOCKER fixed in
+        // core/init/steps.ts (sharedInstallAgents) makes work end-to-end.
+        const opencode = await runInit({ cwd: tmpWork, yes: true, agent: 'opencode' });
+        expect(opencode).toBeLessThanOrEqual(1);
+        expect(readPrefs().enabledAgents).toEqual(['claude-code', 'opencode']);
+        const opencodeSkillLinkBefore = fs_1.default.realpathSync(path_1.default.join(tmpHome, '.agents/skills/development-process'));
+        const claudeBefore = snapshotTree(path_1.default.join(tmpHome, '.claude'));
+        // Real, full, unstubbed init for codex — real Codex hook, real shared
+        // skill symlink (co-owned with OpenCode), real Codex-native TOML agent
+        // render. Before the fix, this call threw: "Shared skill target cannot
+        // diverge; select the complete shared target group: opencode,codex".
+        const codex = await runInit({
+            cwd: tmpWork,
+            yes: true,
+            agent: 'codex',
+            // Real `codex --version` execution is unreliable inside this sandboxed
+            // test runner (subprocess exec of freshly-written fixture binaries is
+            // blocked even with PATH correctly set — verified directly; see task
+            // notes). Every other real-pipeline test in the suite (init.test.ts's
+            // `codexInitOptions`) uses this exact seam for the same reason — R2's
+            // gate itself is unit-tested separately in provider-version.test.ts.
+            assertProviderSupported: () => ({ provider: 'codex', version: '0.150.0' }),
+        });
+        expect(codex).toBeLessThanOrEqual(1);
+        expect(readPrefs().enabledAgents).toEqual(['claude-code', 'opencode', 'codex']);
+        // R1/R7: Codex's global skill dir (~/.agents/skills, shared by design with
+        // OpenCode — providers/index.ts) got a real symlink into the registry —
+        // the SAME physical link OpenCode's own init already produced, now
+        // co-owned by both agents (R15/R15.1) rather than fought over.
+        const skillLink = path_1.default.join(tmpHome, '.agents/skills/development-process');
+        expect(fs_1.default.lstatSync(skillLink).isSymbolicLink()).toBe(true);
+        expect(fs_1.default.realpathSync(skillLink)).toContain(path_1.default.join('.awm/registries/baseline/skills/development-process'));
+        // OpenCode's own skill link is untouched — same physical target, same source.
+        expect(fs_1.default.realpathSync(skillLink)).toBe(opencodeSkillLinkBefore);
+        // R8: the canonical agent got rendered into Codex's native .toml shape.
+        const tomlPath = path_1.default.join(tmpHome, '.codex/agents/development-process.toml');
+        const toml = fs_1.default.readFileSync(tomlPath, 'utf8');
+        expect(toml).toContain('developer_instructions = """');
+        expect(toml).toContain('name = "development-process"');
+        // R18: the Codex hook got installed for real.
+        const hooksJson = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpHome, '.codex/hooks.json'), 'utf8'));
+        expect(hooksJson.hooks.SessionStart).toHaveLength(1);
+        // R19/R19.1/R23: nothing under Claude's baseline moved during the Codex run.
+        expect(snapshotTree(path_1.default.join(tmpHome, '.claude'))).toEqual(claudeBefore);
+    });
+    it('initializes Codex on a machine that has never run a Claude Code init', async () => {
+        // The E2E above inits claude-code FIRST, so ~/.awm/hooks always exists
+        // by the time Codex runs — which is precisely why it never caught this.
+        // A fresh Codex Cloud box has no Claude install at all, and installing
+        // the Codex hook creates ~/.awm/hooks as a side effect of the recursive
+        // mkdir for its own nested ~/.awm/hooks/codex. That flipped Claude's
+        // R19 baseline digest from absent to present-but-empty and aborted init
+        // with "Claude Code baseline changed during a non-Claude init".
+        seedPublicRegistryFixture(path_1.default.join(tmpHome, '.awm/registries/baseline'));
+        const { runInit } = require('../../src/commands/init');
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.awm/hooks'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.claude'))).toBe(false);
+        const codex = await runInit({
+            cwd: tmpWork,
+            yes: true,
+            agent: 'codex',
+            machineOnly: true,
+            assertProviderSupported: () => ({ provider: 'codex', version: '0.150.0' }),
+        });
+        // Exit 2 is the internal-error path the R19 guard aborts through.
+        expect(codex).toBeLessThanOrEqual(1);
+        expect(readPrefs().enabledAgents).toEqual(['codex']);
+        // The Codex hook really installed, and Claude gained no content of its own.
+        const hooksJson = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpHome, '.codex/hooks.json'), 'utf8'));
+        expect(hooksJson.hooks.SessionStart).toHaveLength(1);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.awm/hooks/codex/session-start'))).toBe(true);
+        expect(fs_1.default.readdirSync(path_1.default.join(tmpHome, '.awm/hooks'))).toEqual(['codex']);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.claude/settings.json'))).toBe(false);
+    });
+    it('doctor reports the isolated Codex install as supported/healthy, not against the real ~/.awm', () => {
+        seedPublicRegistryFixture(path_1.default.join(tmpHome, '.awm/registries/baseline'));
+        writePrefs(prefsWith(['claude-code', 'codex']));
+        const { runDoctor } = require('../../src/commands/doctor');
+        // R20: doctor resolves a single explicit provider without needing every
+        // enabled agent to be independently initialized first.
+        runDoctor({ cwd: tmpWork, json: true, agent: 'codex' });
+        const report = JSON.parse(stdout());
+        expect(report.providers.map((p) => p.id)).toEqual(['codex']);
+        const codexReport = report.providers[0];
+        expect(codexReport.checks.find((c) => c.id === 'binary.version').state).toBe('missing');
+    });
+});