agentic-workflow-manager 3.10.0 → 3.12.0

package/dist/tests/core/install-transaction.test.js

@@ -198,6 +198,115 @@ describe('applyInstallPlan', () => {
         });
     });
 });
+describe('defaultTransactionDeps — cursor-mdc / copilot-instructions renderers (Task 4.3)', () => {
+    // Both renderers are always 'skill'-type: sourcePath is the skill's
+    // DIRECTORY (install-transaction.ts's readSkillMdSource), matching how
+    // discovery.ts/bundle-install.ts set ArtifactIntent.sourcePath for
+    // skills — mirrors the shape makeOp() already assumes for 'link' skills.
+    function makeSkillSource(description, body) {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(tmpWork, 'skill-source-'));
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'SKILL.md'), `---\nname: sample-skill\ndescription: ${description}\n---\n\n${body}\n`);
+        return dir;
+    }
+    it('renders a real Cursor .mdc file through the full validate/stage/replace/verify pipeline', () => {
+        const sourceDir = makeSkillSource('A sample skill', 'Body content for the skill.');
+        const targetPath = path_1.default.join(tmpWork, 'sample-skill.mdc');
+        const plan = {
+            operations: [makeOp('sample-skill', {
+                    type: 'skill', renderer: 'cursor-mdc', output: 'cursor-mdc',
+                    sourcePath: sourceDir, targetPath,
+                })],
+            records: [],
+            reports: [{ owner: 'cursor', targetPath, action: 'install' }],
+        };
+        const summary = (0, install_transaction_1.applyInstallPlan)(plan);
+        expect(summary.modifiedFiles).toEqual([targetPath]);
+        const content = fs_1.default.readFileSync(targetPath, 'utf8');
+        expect(content).toContain('description: A sample skill');
+        expect(content).toContain('alwaysApply: false');
+        expect(content).toContain('Body content for the skill.');
+    });
+    it('renders a real Copilot .instructions.md file through the full validate/stage/replace/verify pipeline', () => {
+        const sourceDir = makeSkillSource('A sample skill', 'Body content for the skill.');
+        const targetPath = path_1.default.join(tmpWork, 'sample-skill.instructions.md');
+        const plan = {
+            operations: [makeOp('sample-skill', {
+                    type: 'skill', renderer: 'copilot-instructions', output: 'copilot-instructions',
+                    sourcePath: sourceDir, targetPath,
+                })],
+            records: [],
+            reports: [{ owner: 'copilot', targetPath, action: 'install' }],
+        };
+        const summary = (0, install_transaction_1.applyInstallPlan)(plan);
+        expect(summary.modifiedFiles).toEqual([targetPath]);
+        const content = fs_1.default.readFileSync(targetPath, 'utf8');
+        expect(content).toContain('applyTo: "**"');
+        expect(content).toContain('Body content for the skill.');
+    });
+    it('validate rejects a malformed skill source (missing description) before any backup/replace happens', () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(tmpWork, 'skill-source-'));
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'SKILL.md'), '---\nname: broken\n---\nBody with no description field.');
+        const targetPath = path_1.default.join(tmpWork, 'broken.mdc');
+        fs_1.default.writeFileSync(targetPath, 'pre-existing content');
+        const plan = {
+            operations: [makeOp('broken', {
+                    type: 'skill', renderer: 'cursor-mdc', output: 'cursor-mdc',
+                    sourcePath: dir, targetPath,
+                })],
+            records: [],
+            reports: [{ owner: 'cursor', targetPath, action: 'install' }],
+        };
+        expect(() => (0, install_transaction_1.applyInstallPlan)(plan)).toThrow();
+        // No backup/replace should have touched the pre-existing target.
+        expect(fs_1.default.readFileSync(targetPath, 'utf8')).toBe('pre-existing content');
+    });
+    it('verify rejects a corrupt/malformed staged .mdc (mirrors the codex-agent-toml malformed-verify case)', () => {
+        const sourceDir = makeSkillSource('A sample skill', 'Body content.');
+        const targetPath = path_1.default.join(tmpWork, 'corrupt.mdc');
+        const plan = {
+            operations: [makeOp('corrupt', {
+                    type: 'skill', renderer: 'cursor-mdc', output: 'cursor-mdc',
+                    sourcePath: sourceDir, targetPath,
+                })],
+            records: [],
+            reports: [{ owner: 'cursor', targetPath, action: 'install' }],
+        };
+        const deps = {
+            ...(0, install_transaction_1.defaultTransactionDeps)(),
+            stage(op) {
+                const parent = path_1.default.dirname(op.targetPath);
+                fs_1.default.mkdirSync(parent, { recursive: true });
+                const staged = path_1.default.join(parent, `.${path_1.default.basename(op.targetPath)}.corrupt-test.staged`);
+                fs_1.default.writeFileSync(staged, 'not a valid rendered .mdc file at all');
+                return staged;
+            },
+        };
+        expect(() => (0, install_transaction_1.applyInstallPlan)(plan, deps)).toThrow('does not look like rendered Cursor .mdc');
+    });
+    it('verify rejects a corrupt/malformed staged .instructions.md', () => {
+        const sourceDir = makeSkillSource('A sample skill', 'Body content.');
+        const targetPath = path_1.default.join(tmpWork, 'corrupt.instructions.md');
+        const plan = {
+            operations: [makeOp('corrupt', {
+                    type: 'skill', renderer: 'copilot-instructions', output: 'copilot-instructions',
+                    sourcePath: sourceDir, targetPath,
+                })],
+            records: [],
+            reports: [{ owner: 'copilot', targetPath, action: 'install' }],
+        };
+        const deps = {
+            ...(0, install_transaction_1.defaultTransactionDeps)(),
+            stage(op) {
+                const parent = path_1.default.dirname(op.targetPath);
+                fs_1.default.mkdirSync(parent, { recursive: true });
+                const staged = path_1.default.join(parent, `.${path_1.default.basename(op.targetPath)}.corrupt-test.staged`);
+                fs_1.default.writeFileSync(staged, 'not a valid rendered instructions file at all');
+                return staged;
+            },
+        };
+        expect(() => (0, install_transaction_1.applyInstallPlan)(plan, deps)).toThrow('does not look like rendered Copilot instructions');
+    });
+});
 describe('beginBackupSession / restoreBackup', () => {
     it('backs up existing targets before mutation and restores them on rollback', () => {
         const fileA = path_1.default.join(tmpWork, 'a.json');

package/dist/tests/core/provider-artifacts.test.js

@@ -61,4 +61,15 @@ describe('scanLegacyArtifacts', () => {
         expect(legacyRemove).not.toHaveBeenCalledWith(agentPath);
         expect(fs_1.default.existsSync(agentPath)).toBe(true);
     });
+    it('Gap C — an agent with a null global skill dir (copilot) at global scope skips cleanly instead of crashing', () => {
+        // Copilot's skill.global is null (no user-level skill discovery mechanism —
+        // providers/index.ts) and its skill renderer is 'copilot-instructions', not
+        // 'link', so scanLegacyArtifacts's `dir === null` guard (config[scope]) is
+        // the same defensive shape this task's null-skip audit covers for the other
+        // 4 files. Proves the call is a clean no-op for copilot at 'global' scope —
+        // no crash, nothing listed — rather than throwing on a null target dir.
+        expect(() => (0, provider_artifacts_1.scanLegacyArtifacts)(['copilot'], 'global')).not.toThrow();
+        const listed = (0, provider_artifacts_1.scanLegacyArtifacts)(['copilot'], 'global');
+        expect(listed).toEqual([]);
+    });
 });

package/dist/tests/core/renderers/copilot-instructions.test.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const copilot_instructions_1 = require("../../../src/core/renderers/copilot-instructions");
+// Real SKILL.md frontmatter shape (mirrors skills/using-awm/SKILL.md).
+const skill = `---
+name: using-awm
+version: "1.2.3"
+description: Use when starting any development conversation
+---
+
+# Using AWM
+
+MUST invoke skills per the tiered policy.
+`;
+it('renders Copilot .instructions.md frontmatter with applyTo: "**" and the body verbatim', () => {
+    expect((0, copilot_instructions_1.renderCopilotInstructions)(skill)).toBe(`---
+applyTo: "**"
+---
+
+# Using AWM
+
+MUST invoke skills per the tiered policy.
+`);
+});
+it('embeds the body content even when the description contains a colon (description is not itself rendered)', () => {
+    const source = `---
+name: colon-skill
+description: Use when starting: development conversation
+---
+
+Body content survives.
+`;
+    const rendered = (0, copilot_instructions_1.renderCopilotInstructions)(source);
+    expect(rendered).toBe(`---
+applyTo: "**"
+---
+
+Body content survives.
+`);
+});
+it.each([
+    ['no frontmatter at all', 'just a plain markdown body'],
+    ['missing description', '---\nname: ok\n---\nBody.'],
+    ['empty body', '---\nname: ok\ndescription: fine\n---\n'],
+])('rejects invalid skill sources before rendering (%s)', (_label, source) => {
+    expect(() => (0, copilot_instructions_1.renderCopilotInstructions)(source)).toThrow();
+});

package/dist/tests/core/renderers/cursor-mdc.test.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const cursor_mdc_1 = require("../../../src/core/renderers/cursor-mdc");
+// Real SKILL.md frontmatter shape (mirrors skills/using-awm/SKILL.md).
+const skill = `---
+name: using-awm
+version: "1.2.3"
+description: Use when starting any development conversation
+---
+
+# Using AWM
+
+MUST invoke skills per the tiered policy.
+`;
+it('renders Cursor .mdc frontmatter as an Agent Requested rule (description + blank globs + alwaysApply: false)', () => {
+    expect((0, cursor_mdc_1.renderCursorMdc)(skill)).toBe(`---
+description: Use when starting any development conversation
+globs:
+alwaysApply: false
+---
+
+# Using AWM
+
+MUST invoke skills per the tiered policy.
+`);
+});
+it('quotes a description containing a colon so it does not break YAML parsing', () => {
+    const source = `---
+name: colon-skill
+description: Use when starting: development conversation
+---
+
+Body content.
+`;
+    const rendered = (0, cursor_mdc_1.renderCursorMdc)(source);
+    expect(rendered).toContain('description: "Use when starting: development conversation"');
+    // Sanity: the naive unquoted form would be invalid YAML (parsed as a
+    // nested mapping key) — this asserts we never emit it.
+    expect(rendered).not.toContain('description: Use when starting: development conversation');
+});
+it('quotes a description starting with a YAML-special character', () => {
+    const source = `---
+name: special-skill
+description: "*starred description"
+---
+
+Body content.
+`;
+    const rendered = (0, cursor_mdc_1.renderCursorMdc)(source);
+    expect(rendered).toContain('description: "*starred description"');
+});
+it('throws rather than embedding a literal block-scalar indicator as the description', () => {
+    // Regression: a YAML block scalar (`description: >-` / `|-`) means the
+    // real text lives on the FOLLOWING indented lines, not on this line —
+    // the original code took the bare indicator itself as the description,
+    // which would have rendered the literal string ">-" into the .mdc file.
+    const source = `---
+name: block-skill
+description: >-
+  This description spans
+  multiple lines.
+---
+
+Body content.
+`;
+    expect(() => (0, cursor_mdc_1.renderCursorMdc)(source)).toThrow('non-empty description');
+});
+it('quotes a description containing a mid-string " #" (starts a YAML comment, truncating the rest)', () => {
+    // Regression: the original YAML_UNSAFE regex only caught `#` at the START
+    // of the string — a `#` preceded by whitespace ANYWHERE in a plain scalar
+    // also starts a comment. Unquoted, "Use this #important skill" would
+    // render as YAML that silently truncates to "Use this".
+    const source = `---
+name: hash-skill
+description: Use this #important skill
+---
+
+Body content.
+`;
+    const rendered = (0, cursor_mdc_1.renderCursorMdc)(source);
+    expect(rendered).toContain('description: "Use this #important skill"');
+    expect(rendered).not.toContain('description: Use this #important skill');
+});
+it('quotes a description containing an embedded null byte / control character instead of emitting it raw', () => {
+    // Regression: an embedded control/null byte is invalid in a YAML plain
+    // scalar regardless of position — the original code's YAML_UNSAFE regex
+    // needed the [\x00-\x1f\x7f] class to catch this; without it, a null byte
+    // would have been emitted unquoted straight into the frontmatter.
+    const nul = String.fromCharCode(0);
+    const source = `---
+name: nul-skill
+description: Use this${nul}description
+---
+
+Body content.
+`;
+    const rendered = (0, cursor_mdc_1.renderCursorMdc)(source);
+    // JSON.stringify \u-escapes control bytes — the rendered frontmatter must
+    // carry the escaped, quoted form, never the literal raw byte.
+    expect(rendered).toContain(`description: ${JSON.stringify(`Use this${nul}description`)}`);
+    expect(rendered).not.toContain(`description: Use this${nul}description\n`);
+});
+it('escapes an embedded DEL (0x7F) byte, which JSON.stringify alone does not escape', () => {
+    // Regression: JSON.stringify \u-escapes \x00-\x1F but NOT \x7F (DEL isn't in
+    // JSON's own required-escape set), so quoting via JSON.stringify alone would
+    // leave a raw, non-conformant DEL byte inside the YAML double-quoted scalar.
+    // yamlString must escape it itself after JSON.stringify runs.
+    const del = String.fromCharCode(0x7f);
+    const source = `---
+name: del-skill
+description: Use this${del}description
+---
+
+Body content.
+`;
+    const rendered = (0, cursor_mdc_1.renderCursorMdc)(source);
+    expect(rendered).toContain('description: "Use this\\u007fdescription"');
+    expect(rendered).not.toContain(`description: Use this${del}description\n`);
+    expect(rendered).not.toMatch(new RegExp(`description: "[^"]*${del}`));
+});
+it('leaves a plain description unquoted', () => {
+    const source = `---
+name: plain-skill
+description: A perfectly ordinary description
+---
+
+Body content.
+`;
+    expect((0, cursor_mdc_1.renderCursorMdc)(source)).toContain('description: A perfectly ordinary description');
+});
+it.each([
+    ['no frontmatter at all', 'just a plain markdown body'],
+    ['missing description', '---\nname: ok\n---\nBody.'],
+    ['empty body', '---\nname: ok\ndescription: fine\n---\n'],
+])('rejects invalid skill sources before rendering (%s)', (_label, source) => {
+    expect(() => (0, cursor_mdc_1.renderCursorMdc)(source)).toThrow();
+});

package/dist/tests/core/skill-integrity.test.js

@@ -98,6 +98,24 @@ describe('reconcileAllSkillLinks (#4 — awm update, all providers)', () => {
             fs_1.default.rmSync(home, { recursive: true, force: true });
         }
     });
+    it('Gap C — skips an agent whose skill.global is null (copilot) cleanly instead of crashing', () => {
+        const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-home-'));
+        const prevHome = process.env.HOME;
+        process.env.HOME = home;
+        try {
+            jest.resetModules();
+            const { reconcileAllSkillLinks } = require('../../src/core/skill-integrity');
+            const { providerFor } = require('../../src/providers');
+            expect(providerFor('copilot').skill.global).toBeNull();
+            const res = reconcileAllSkillLinks([path_1.default.join(home, 'no-registry')]);
+            expect(() => reconcileAllSkillLinks([path_1.default.join(home, 'no-registry')])).not.toThrow();
+            expect(res.find((r) => r.agent === 'copilot')).toBeFalsy();
+        }
+        finally {
+            process.env.HOME = prevHome;
+            fs_1.default.rmSync(home, { recursive: true, force: true });
+        }
+    });
 });
 describe('repairGlobalSkills', () => {
     it('re-links repairable to registry content dir and prunes dead; valid untouched; idempotent', () => {

package/dist/tests/providers/index.test.js

@@ -147,7 +147,7 @@ describe('Providers Routing', () => {
             .toBe(path_1.default.join(process.env.HOME, '.agents/skills'));
     });
     it('uses AGENT_TARGETS as the single iterable target catalog', () => {
-        expect(providers_1.AGENT_TARGETS).toEqual(['antigravity', 'opencode', 'claude-code', 'codex']);
+        expect(providers_1.AGENT_TARGETS).toEqual(['antigravity', 'opencode', 'claude-code', 'codex', 'cursor', 'copilot']);
         expect(Object.keys((0, providers_1.providers)())).toEqual([...providers_1.AGENT_TARGETS]);
     });
     it('throws on unsupported artifacts', () => {
@@ -160,4 +160,48 @@ describe('Providers Routing', () => {
         expect(() => (0, providers_1.getTargetPath)('skill', 'unknown-agent', 'global'))
             .toThrow('Unknown agent target');
     });
+    describe('Cursor and Copilot (D4)', () => {
+        it('recognizes cursor and copilot as valid agent targets', () => {
+            expect((0, providers_1.isAgentTarget)('cursor')).toBe(true);
+            expect((0, providers_1.isAgentTarget)('copilot')).toBe(true);
+        });
+        it('resolves Cursor skill paths for both scopes', () => {
+            expect((0, providers_1.getTargetPath)('skill', 'cursor', 'local')).toBe('.cursor/rules');
+            expect((0, providers_1.getTargetPath)('skill', 'cursor', 'global'))
+                .toBe(path_1.default.join(process.env.HOME, '.cursor/rules'));
+        });
+        it('resolves the Copilot local skill path', () => {
+            expect((0, providers_1.getTargetPath)('skill', 'copilot', 'local')).toBe('.github/instructions');
+        });
+        it('throws a specific, non-generic reason when Copilot global skills are requested', () => {
+            expect(() => (0, providers_1.getTargetPath)('skill', 'copilot', 'global')).toThrow('skill global scope is not supported by Copilot: GitHub Copilot has no user-level skill discovery mechanism — skills must be installed per-project.');
+        });
+        it('keeps workflow/agent unsupported (null) for both, via the existing generic message', () => {
+            expect(() => (0, providers_1.getTargetPath)('workflow', 'cursor', 'local')).toThrow('workflows are not supported by Cursor.');
+            expect(() => (0, providers_1.getTargetPath)('agent', 'copilot', 'local')).toThrow('agents are not supported by Copilot.');
+        });
+        it('declares no hooks config for cursor or copilot', () => {
+            expect((0, providers_1.providerFor)('cursor').hooks).toBeUndefined();
+            expect((0, providers_1.providerFor)('copilot').hooks).toBeUndefined();
+        });
+        it('assigns the Cursor .mdc and Copilot instructions renderers to their skill artifact config (Task 4.3)', () => {
+            expect((0, providers_1.providerFor)('cursor').skill.renderer).toBe('cursor-mdc');
+            expect((0, providers_1.providerFor)('copilot').skill.renderer).toBe('copilot-instructions');
+        });
+        it('assertLinkRenderer still refuses the Cursor/Copilot skill renderers (Task 4.3 code-quality-review fix)', () => {
+            // Regression: an earlier version of this task widened assertLinkRenderer to
+            // allow these two through, on the theory that a raw unrendered copy is "at
+            // least a plausible degraded install" — wrong. assertLinkRenderer's only
+            // callers (core/provider-artifacts.ts's legacy preflight, src/index.ts's
+            // legacy interactive `awm add`) can only symlink/copy verbatim; they never
+            // render. A raw SKILL.md copy at `.cursor/rules/<name>` or
+            // `.github/instructions/<name>` has no `.mdc`/`.instructions.md` extension
+            // and no frontmatter (`alwaysApply`/`applyTo`) — neither Cursor nor Copilot
+            // would ever read it. This must keep throwing, same as codex-agent-toml
+            // always has, directing users to commands/add.ts's real render pipeline
+            // instead (which never calls assertLinkRenderer at all).
+            expect(() => (0, providers_1.assertLinkRenderer)('skill', 'cursor')).toThrow(/not implemented yet/);
+            expect(() => (0, providers_1.assertLinkRenderer)('skill', 'copilot')).toThrow(/not implemented yet/);
+        });
+    });
 });

package/dist/tests/providers/injection-config.test.js

@@ -22,4 +22,20 @@ describe('getInjection', () => {
     it('returns undefined for antigravity (no injection mechanism wired yet)', () => {
         expect((0, providers_1.getInjection)('antigravity')).toBeUndefined();
     });
+    it('returns managed-agents-md for cursor, with no confirmed global path (D4)', () => {
+        const inj = (0, providers_1.getInjection)('cursor');
+        expect(inj).toEqual({
+            type: 'managed-agents-md',
+            globalPath: null,
+            localFile: 'AGENTS.md',
+        });
+    });
+    it('returns managed-agents-md for copilot, project-root only (D4: no global equivalent)', () => {
+        const inj = (0, providers_1.getInjection)('copilot');
+        expect(inj).toEqual({
+            type: 'managed-agents-md',
+            globalPath: null,
+            localFile: 'AGENTS.md',
+        });
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.10.0",
+  "version": "3.12.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"