agentic-workflow-manager 3.13.0 → 3.13.2

package/dist/tests/core/journal/adapter.test.js

@@ -16,6 +16,60 @@ describe('ControllerAdapter', () => {
         expect(a.safeToReplace(ref)).toBe('indeterminate'); // vivo: codex no observa llamadas en vuelo => custodia
         child.kill('SIGKILL');
     });
+    /** Regresion (CI windows-latest): reproduce el bug real via mock de
+     *  process.platform, ya que no hay windows real disponible en este
+     *  entorno. Antes del fix, refIsAlive en win32 caia en la rama POSIX
+     *  (ps/pgrep), y ps/pgrep alli — cuando resuelven en el PATH — son el
+     *  ps/pgrep EMULADO de MSYS/Cygwin, ciego a pids nativos: para el hijo
+     *  real y vivo que spawnStructured produce, devolvian exit 1 ("no such
+     *  process" segun su vista emulada), que el codigo interpretaba como
+     *  "el SO confirmo la muerte" -> refIsAlive(ref) daba `false` -> este
+     *  mismo test daba `safeToReplace(ref) === 'safe'` para un proceso
+     *  VIVO, violando "JAMAS safe sin evidencia" (R4.2b). Tras el fix,
+     *  refIsAlive en win32 usa process.kill(pid,0) (respaldado por el
+     *  kernel via libuv) y nunca ps/pgrep. */
+    test('safeToReplace en win32 (mockeado): muerto probado (ESRCH real) => safe; vivo => indeterminate, JAMAS safe por ceguera de ps/pgrep emulado (R4.2b)', async () => {
+        const originalPlatform = process.platform;
+        try {
+            const a = (0, adapter_1.adapterFor)('codex');
+            const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 3000)'], process.cwd(), 'nWin32');
+            Object.defineProperty(process, 'platform', { value: 'win32' });
+            // El pid vive de verdad: nunca 'safe' sin evidencia real de muerte.
+            expect(a.safeToReplace(ref)).toBe('indeterminate');
+            // Un ps/pgrep emulado y ciego (exit 1 para un pid nativo real) ya
+            // NO puede empujar el veredicto hacia 'safe': refIsAlive en win32
+            // nunca invoca ps/pgrep — SI invoca powershell.exe (win32ProcessInfo,
+            // R6 ronda 2) para la verificacion de identidad completa cuando el
+            // ref no esta degradado, que es un mecanismo distinto y legitimo
+            // (WMI, no la capa emulada MSYS/Cygwin) — no se afirma "cero
+            // llamadas", se afirma "ps/pgrep especificamente, nunca".
+            const cp = require('child_process');
+            const execSpy = jest.spyOn(cp, 'execFileSync').mockImplementation(() => {
+                const err = new Error('no matches found');
+                err.status = 1;
+                throw err;
+            });
+            expect(a.safeToReplace(ref)).toBe('indeterminate');
+            const calledBinaries = execSpy.mock.calls.map((call) => call[0]);
+            expect(calledBinaries).not.toContain('ps');
+            expect(calledBinaries).not.toContain('pgrep');
+            execSpy.mockRestore();
+            child.kill('SIGKILL');
+            // Muerte PROBADA por el SO (ESRCH real de process.kill(pid,0)):
+            // recien ahi es legitimo declarar 'safe'.
+            const deadRef = { ...ref };
+            const killSpy = jest.spyOn(process, 'kill').mockImplementation(() => {
+                const err = new Error('no such process');
+                err.code = 'ESRCH';
+                throw err;
+            });
+            expect(a.safeToReplace(deadRef)).toBe('safe');
+            killSpy.mockRestore();
+        }
+        finally {
+            Object.defineProperty(process, 'platform', { value: originalPlatform });
+        }
+    });
     test('launchArgv construye el comando de reanudacion journal-first (R4.8)', () => {
         const argv = (0, adapter_1.adapterFor)('codex').launchArgv('retoma desde next_action');
         expect(argv[0]).toBe('codex');

package/dist/tests/core/journal/fingerprint.test.js

@@ -111,7 +111,15 @@ describe('computeFingerprint', () => {
  *  de un git real) — sin el fix, esto tumba al hijo; con el fix, sobrevive. */
 describe('fingerprint.ts git(): stdio explicito evita inheritStderr hacia un pipe roto', () => {
     const DIST_ENTRY = path_1.default.resolve(__dirname, '..', '..', '..', 'dist', 'src', 'core', 'journal', 'fingerprint.js');
-    const REAL_GIT = (0, child_process_1.execFileSync)('which', ['git'], { encoding: 'utf8' }).trim();
+    // `which` is POSIX-only and not reliably on PATH in a pwsh-shell windows-latest
+    // runner even though Git for Windows is installed (Windows uses `where`). `where`
+    // can print one match per line when git is reachable via more than one PATH
+    // entry, so only the FIRST line is a valid single path to spawn directly — the
+    // rest would make execFileSync try to exec a multi-line string as one path.
+    const REAL_GIT = (0, child_process_1.execFileSync)(process.platform === 'win32' ? 'where' : 'which', ['git'], { encoding: 'utf8' })
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .find((line) => line.length > 0);
     beforeAll(() => {
         if (!fs_1.default.existsSync(DIST_ENTRY)) {
             throw new Error('dist ausente: corre `cd cli && npm run build` antes de este test (verifica el dist compilado real, no el source transpilado por ts-jest)');
@@ -143,7 +151,7 @@ describe('fingerprint.ts git(): stdio explicito evita inheritStderr hacia un pip
         `);
         const child = (0, child_process_1.spawn)(process.execPath, [childScript], {
             cwd: workDir,
-            env: { ...process.env, PATH: `${workDir}:${process.env.PATH}` },
+            env: { ...process.env, PATH: `${workDir}${path_1.default.delimiter}${process.env.PATH}` },
             stdio: ['ignore', 'pipe', 'pipe'],
             detached: true,
         });

package/dist/tests/core/journal/process.test.js

@@ -8,6 +8,7 @@ const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const process_1 = require("../../../src/core/journal/process");
+const paths_1 = require("../../../src/core/paths");
 describe('process identity', () => {
     test('spawnStructured produce ProcessRef con tupla completa (R2.1, R4.7)', async () => {
         const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 5000)'], process.cwd(), 'nonce-abc');
@@ -15,24 +16,52 @@ describe('process identity', () => {
         expect(ref.spawnNonce).toBe('nonce-abc');
         expect(typeof ref.startTime).toBe('string');
         expect(ref.processGroup).toBeGreaterThan(0);
-        expect(ref.psArgsDigest).toMatch(/^[0-9a-f]{16}$/);
+        // hex real cuando `ps` pudo observar el proceso (caso normal en
+        // POSIX); sentinel 'unknown' documentado (ver captureRefFor) cuando
+        // no pudo — en win32 esto es la ruta NORMAL, no un error: `ps`/`pgrep`
+        // ahi (si resuelven en el PATH) son el ps/pgrep emulado de
+        // MSYS/Cygwin, ciego a procesos nativos (ver pidExistsNative en
+        // src/core/journal/process.ts). El formato exacto de este campo
+        // nunca es la fuente de verdad de vida/muerte — solo lo es refIsAlive
+        // (ver los tests de la seccion 'process identity (win32, mockeado)').
+        expect(ref.psArgsDigest).toMatch(/^([0-9a-f]{16}|unknown)$/);
         expect((0, process_1.refIsAlive)(ref)).toBe(true);
         const dead = await (0, process_1.terminateGroupConfirmed)(ref, { termGraceMs: 300, killGraceMs: 300 });
         expect(dead).toBe(true);
         expect((0, process_1.refIsAlive)(ref)).toBe(false);
     });
-    test('refIsAlive rechaza cualquier campo distinto de la tupla completa (R2.1)', () => {
+    test('refIsAlive rechaza cualquier campo distinto de la tupla completa (R2.1) — en win32 nativo, solo identidad reducida (ronda 3, ver src/core/journal/process.ts)', () => {
         const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 3000)'], process.cwd(), 'n2');
-        expect((0, process_1.refIsAlive)({ ...ref, startTime: 'otro-momento' })).toBe(false);
-        expect((0, process_1.refIsAlive)({ ...ref, spawnNonce: 'otro-nonce' })).toBe(false);
-        expect((0, process_1.refIsAlive)({ ...ref, argvDigest: 'ffffffffffffffff' })).toBe(false);
-        expect((0, process_1.refIsAlive)({ ...ref, psArgsDigest: 'ffffffffffffffff' })).toBe(false);
-        expect((0, process_1.refIsAlive)({ ...ref, processGroup: ref.processGroup + 1 })).toBe(false);
+        if ((0, paths_1.isWindowsNative)()) {
+            // win32 real (ronda 3): refIsAlive solo valida pid existente +
+            // processGroup === pid; el resto de la tupla es informativo
+            // (via WMI, captureRefFor) pero NO gatea el veredicto — gap
+            // aceptado y documentado (ver refIsAlive en process.ts).
+            expect((0, process_1.refIsAlive)({ ...ref, startTime: 'otro-momento' })).toBe(true);
+            expect((0, process_1.refIsAlive)({ ...ref, spawnNonce: 'otro-nonce' })).toBe(true);
+            expect((0, process_1.refIsAlive)({ ...ref, argvDigest: 'ffffffffffffffff' })).toBe(true);
+            expect((0, process_1.refIsAlive)({ ...ref, psArgsDigest: 'ffffffffffffffff' })).toBe(true);
+            expect((0, process_1.refIsAlive)({ ...ref, processGroup: ref.processGroup + 1 })).toBe(false);
+        }
+        else {
+            expect((0, process_1.refIsAlive)({ ...ref, startTime: 'otro-momento' })).toBe(false);
+            expect((0, process_1.refIsAlive)({ ...ref, spawnNonce: 'otro-nonce' })).toBe(false);
+            expect((0, process_1.refIsAlive)({ ...ref, argvDigest: 'ffffffffffffffff' })).toBe(false);
+            expect((0, process_1.refIsAlive)({ ...ref, psArgsDigest: 'ffffffffffffffff' })).toBe(false);
+            expect((0, process_1.refIsAlive)({ ...ref, processGroup: ref.processGroup + 1 })).toBe(false);
+        }
         child.kill('SIGKILL');
     });
     test('terminateGroupConfirmed no senializa un PGID si la identidad del lider no coincide', async () => {
         const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 5000)'], process.cwd(), 'n-no-kill');
-        const mismatched = { ...ref, startTime: 'identidad-de-otro-proceso' };
+        // win32 (ronda 3): un mismatch de SOLO startTime ya no lo detecta
+        // refIsAlive ahi (gap de reciclado de PID aceptado, ver process.ts) —
+        // se usa un mismatch de processGroup, que SI se valida en ambas
+        // plataformas, para que este test siga siendo significativo en
+        // cualquier host.
+        const mismatched = (0, paths_1.isWindowsNative)()
+            ? { ...ref, processGroup: ref.processGroup + 1 }
+            : { ...ref, startTime: 'identidad-de-otro-proceso' };
         const confirmed = await (0, process_1.terminateGroupConfirmed)(mismatched, { termGraceMs: 20, killGraceMs: 20 });
         expect(confirmed).toBe(false);
         expect((0, process_1.refIsAlive)(ref)).toBe(true);
@@ -148,6 +177,176 @@ describe('process identity', () => {
         }
     });
 });
+/** Regresion (CI windows-latest, primera corrida real de la matriz): ps/pgrep,
+ *  cuando resuelven en el PATH en Windows, son el ps/pgrep EMULADO de
+ *  MSYS/Cygwin (Git for Windows) — una capa con su propia tabla de pids,
+ *  ciega a procesos nativos spawneados via CreateProcess (exactamente lo que
+ *  produce spawnStructured). El codigo viejo interpretaba el exit 1 de ese
+ *  ps/pgrep "ciego" como "el SO confirmo que el pid no existe" — falso, y
+ *  rompia el invariante "JAMAS safe sin evidencia": `safeToReplace` devolvia
+ *  'safe' para un proceso genuinamente vivo (ver adapter.test.ts). No hay
+ *  windows-latest real disponible en este entorno; estos tests mockean
+ *  `process.platform` (mismo patron que
+ *  tests/commands/sensors/exec-windows.test.ts, que ya cubre exactamente
+ *  este problema para sensors/exec.ts::killTree) para ejercitar la rama
+ *  win32 REAL del codigo de produccion contra un pid real y vivo. */
+describe('process identity (win32, mockeado — sin windows real disponible en este entorno)', () => {
+    const originalPlatform = process.platform;
+    afterEach(() => {
+        Object.defineProperty(process, 'platform', { value: originalPlatform });
+        jest.restoreAllMocks();
+    });
+    test('refIsAlive en win32 usa process.kill(pid,0), NUNCA ps/pgrep — reproduce el bug: un ps/pgrep "ciego" que devuelve exit 1 para un pid real y vivo ya no lo declara muerto (R2.1, R4.2b)', () => {
+        // Ronda 3 (ver refIsAlive en process.ts): el veredicto win32 ya NO
+        // depende de si la identidad esta degradada o no ('unknown' vs
+        // datos reales de WMI) — refIsAlive ahi SOLO llama a
+        // pidExistsNative (process.kill) + convencion de processGroup,
+        // incondicionalmente. La precondicion original de este test
+        // ("identidad degradada porque no hay powershell.exe real en este
+        // entorno") ya no es ni necesaria ni confiable: en windows-latest
+        // CI real, powershell.exe SI esta disponible y captureRefFor
+        // devuelve un startTime real via WMI — lo cual esta bien, porque
+        // esta rama de refIsAlive nunca lo consulta de todos modos.
+        Object.defineProperty(process, 'platform', { value: 'win32' });
+        const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 3000)'], process.cwd(), 'n-win32-a');
+        const cp = require('child_process');
+        // Simula EXACTAMENTE el bug real de CI: ps/pgrep "corren" pero
+        // devuelven exit 1 (ceguera de MSYS a pids nativos) para un pid que
+        // esta genuinamente vivo — el codigo viejo confiaba en esto.
+        const execSpy = jest.spyOn(cp, 'execFileSync').mockImplementation(() => {
+            const err = new Error('no matches found');
+            err.status = 1;
+            throw err;
+        });
+        try {
+            expect((0, process_1.refIsAlive)(ref)).toBe(true); // vivo de verdad: nunca declarado muerto
+            expect(execSpy).not.toHaveBeenCalled(); // refIsAlive en win32 ni siquiera intenta ps/pgrep/WMI
+        }
+        finally {
+            child.kill('SIGKILL');
+        }
+    });
+    test('refIsAlive en win32 declara muerte SOLO con ESRCH real de process.kill(pid,0) (R2.1)', () => {
+        Object.defineProperty(process, 'platform', { value: 'win32' });
+        const killSpy = jest.spyOn(process, 'kill').mockImplementation(() => {
+            const err = new Error('no such process');
+            err.code = 'ESRCH';
+            throw err;
+        });
+        const fakeRef = { pid: 999999, startTime: 'x', spawnNonce: 'n', argvDigest: 'd', processGroup: 999999, psArgsDigest: 'x' };
+        expect((0, process_1.refIsAlive)(fakeRef)).toBe(false);
+        expect(killSpy).toHaveBeenCalledWith(999999, 0);
+    });
+    test('refIsAlive en win32 NUNCA declara muerte por un error que no sea ESRCH (ej. EPERM: el pid existe pero sin permiso de senializarlo) (R2.1)', () => {
+        Object.defineProperty(process, 'platform', { value: 'win32' });
+        jest.spyOn(process, 'kill').mockImplementation(() => {
+            const err = new Error('operation not permitted');
+            err.code = 'EPERM';
+            throw err;
+        });
+        // Ronda 3: refIsAlive en win32 ya no consulta WMI/powershell — solo
+        // pidExistsNative + convencion de processGroup. EPERM (el pid existe
+        // pero sin permiso de senializarlo) no es ESRCH => pidExistsNative
+        // dice "vivo"; execFileSync no deberia ni invocarse.
+        const cp = require('child_process');
+        const execSpy = jest.spyOn(cp, 'execFileSync').mockImplementation((...args) => {
+            throw new Error('llamada inesperada a execFileSync en este test: ' + args[0]);
+        });
+        try {
+            const fakeRef = { pid: 4242, startTime: 'x', spawnNonce: 'n', argvDigest: 'd', processGroup: 4242, psArgsDigest: 'x' };
+            expect((0, process_1.refIsAlive)(fakeRef)).toBe(true);
+            expect(execSpy).not.toHaveBeenCalled();
+        }
+        finally {
+            execSpy.mockRestore();
+        }
+    });
+    test('terminateGroupConfirmed en win32 usa `taskkill /pid <pid> /T /F`, NUNCA process.kill(-pgid) (mismo patron probado en sensors/exec.ts::killTree, ver tests/commands/sensors/exec-windows.test.ts)', async () => {
+        // Spawnea en modo POSIX real (platform sin mockear todavia) para que
+        // ref.processGroup sea un pgid real de ps (detached:true en esta
+        // plataforma) — evita que el pgid observado sea el del test runner.
+        const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 5000)'], process.cwd(), 'n-win32-taskkill');
+        Object.defineProperty(process, 'platform', { value: 'win32' });
+        const cp = require('child_process');
+        // Ronda 3: refIsAlive en win32 ya no consulta WMI/powershell — solo
+        // pidExistsNative (process.kill) + convencion de processGroup, asi
+        // que el unico execFileSync que este camino dispara es taskkill.
+        const execSpy = jest.spyOn(cp, 'execFileSync').mockImplementation((...args) => {
+            const [cmd] = args;
+            if (cmd === 'taskkill') {
+                child.kill('SIGKILL'); // simula taskkill matando de verdad al pid real
+                return '';
+            }
+            throw new Error('llamada inesperada a execFileSync en este test: ' + cmd);
+        });
+        const posixKillSpy = jest.spyOn(process, 'kill');
+        const dead = await (0, process_1.terminateGroupConfirmed)(ref, { termGraceMs: 2000, killGraceMs: 500 });
+        expect(execSpy).toHaveBeenCalledWith('taskkill', ['/pid', String(ref.pid), '/T', '/F'], expect.anything());
+        expect(dead).toBe(true);
+        // Nunca la convencion POSIX de pid negativo (grupo) en esta plataforma.
+        for (const call of posixKillSpy.mock.calls) {
+            expect(call[0]).toBeGreaterThanOrEqual(0);
+        }
+    }, 15000);
+});
+/** Ronda 2 del fix win32 (R2.1/R6) agrego captura de identidad completa
+ *  (startTime/psArgsDigest reales) via WMI (`Get-CimInstance Win32_Process`,
+ *  ver win32ProcessInfo) para `captureRefFor`. Ronda 3 (ver refIsAlive en
+ *  process.ts) revirtio el USO de esa captura como gate de liveness —
+ *  `refIsAlive` en win32 volvio a pid-existence + convencion de
+ *  processGroup solamente, tras un falso negativo real en CI (WMI
+ *  demostradamente no confiable en su primera corrida real) — pero la
+ *  CAPTURA en si (`captureRefFor`) sigue poblando esos campos como
+ *  informacion persistida en el ProcessRef, asi que estos dos tests de
+ *  captura siguen vigentes. Los tests que ejercitaban `refIsAlive` via el
+ *  camino WMI (ronda 2) fueron removidos: ese camino ya no existe en
+ *  produccion — ver la suite generica de arriba
+ *  ('refIsAlive rechaza cualquier campo...') para la cobertura actual de
+ *  refIsAlive en win32. */
+describe('process identity (win32, mockeado) — captura de identidad via WMI (R2.1/R6, ronda 2)', () => {
+    const originalPlatform = process.platform;
+    afterEach(() => {
+        Object.defineProperty(process, 'platform', { value: originalPlatform });
+        jest.restoreAllMocks();
+    });
+    function mockPowershell(response) {
+        const cp = require('child_process');
+        jest.spyOn(cp, 'execFileSync').mockImplementation((...args) => {
+            const [cmd] = args;
+            if (cmd === 'powershell.exe')
+                return typeof response === 'function' ? response() : response;
+            throw new Error('llamada inesperada a execFileSync en este test: ' + cmd);
+        });
+    }
+    test('captureRefFor en win32 usa WMI para obtener startTime/psArgsDigest REALES cuando powershell responde (R2.1)', () => {
+        Object.defineProperty(process, 'platform', { value: 'win32' });
+        const fakeCreationDate = '2026-08-08T00:00:00.0000000-00:00';
+        mockPowershell(JSON.stringify({ CreationDate: fakeCreationDate, CommandLine: 'C:\\node.exe fake-argv' }));
+        const ref = (0, process_1.captureRefFor)(process.pid, 'nonce-win32-wmi-ok', ['node', 'fake-argv']);
+        expect(ref.startTime).toBe(fakeCreationDate); // ya NO 'unknown': WMI respondio
+        expect(ref.psArgsDigest).toMatch(/^[0-9a-f]{16}$/); // digest real, no sentinel
+        expect(ref.processGroup).toBe(process.pid); // convencion fija win32: sin pgid real jamas
+    });
+    test('captureRefFor en win32 degrada a unknown si WMI/powershell no responde, nunca crashea (R2.1) — mismo contrato que la rama POSIX', () => {
+        Object.defineProperty(process, 'platform', { value: 'win32' });
+        const cp = require('child_process');
+        const execSpy = jest.spyOn(cp, 'execFileSync').mockImplementation(() => {
+            const err = new Error('powershell no encontrado');
+            err.code = 'ENOENT';
+            throw err;
+        });
+        try {
+            expect(() => (0, process_1.captureRefFor)(process.pid, 'nonce-win32-wmi-fail', ['node'])).not.toThrow();
+            const ref = (0, process_1.captureRefFor)(process.pid, 'nonce-win32-wmi-fail', ['node']);
+            expect(ref.startTime).toBe('unknown');
+            expect(ref.psArgsDigest).toBe('unknown');
+            expect(ref.processGroup).toBe(process.pid);
+        }
+        finally {
+            execSpy.mockRestore();
+        }
+    });
+});
 /** Defense-in-depth: los execFileSync internos de este archivo (psField,
  *  sleepSync, groupIsGone, activitySnapshot) deben capturar el stderr del
  *  subproceso INTERNAMENTE, nunca relayearlo al stderr del proceso llamante
@@ -192,7 +391,7 @@ describe('process.ts execFileSync: stdio explicito evita inheritStderr hacia un
         `);
         const child = (0, child_process_1.spawn)(process.execPath, [childScript], {
             cwd: workDir,
-            env: { ...process.env, PATH: `${workDir}:${process.env.PATH}` },
+            env: { ...process.env, PATH: `${workDir}${path_1.default.delimiter}${process.env.PATH}` },
             stdio: ['ignore', 'pipe', 'pipe'],
             detached: true,
         });

package/dist/tests/core/journal/store.test.js

@@ -15,8 +15,14 @@ describe('journal store', () => {
     test('initJournal crea 0700/0600 y estado inicial valido (R1.2)', () => {
         (0, store_1.initJournal)(repo, 'rama');
         const dir = (0, paths_1.journalDir)(repo, 'rama');
-        expect(fs_1.default.statSync(dir).mode & 0o777).toBe(0o700);
-        expect(fs_1.default.statSync((0, paths_1.statePath)(repo, 'rama')).mode & 0o777).toBe(0o600);
+        // Windows fs.chmod can only toggle the read-only attribute, not set granular
+        // POSIX bits -- see tests/core/atomic-file.test.ts (files, confirmed against
+        // real windows-latest CI) and tests/core/install-transaction.test.ts
+        // (directories, same reasoning) for the 0o666/0o777 shapes.
+        // Confirmed against real windows-latest CI (2026-08-08): directories get the same
+        // 0o666 shape as files there, not 0o777 as first reasoned.
+        expect(fs_1.default.statSync(dir).mode & 0o777).toBe(process.platform === 'win32' ? 0o666 : 0o700);
+        expect(fs_1.default.statSync((0, paths_1.statePath)(repo, 'rama')).mode & 0o777).toBe(process.platform === 'win32' ? 0o666 : 0o600);
         const r = (0, store_1.readJournal)(repo, 'rama');
         expect(r.corrupt).toBe(false);
         expect(r.state.revision).toBe(0);

package/dist/tests/core/no-color.test.js

@@ -0,0 +1,23 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// tests/core/no-color.test.ts
+//
+// Regression for R6 (2026-08-08): picocolors treats being on win32 OR having a `CI`
+// env var set as automatic color support, REGARDLESS of TTY status — GitHub Actions
+// sets `CI=true` on every runner (any OS) and this suite's own tests assert exact/
+// substring CLI text output that silently breaks once ANSI escapes are interleaved
+// into it. jest.setup.js forces `NO_COLOR=1` before any test file loads specifically
+// to make this deterministic everywhere this suite runs, not just where it happens
+// to be colorless by accident (no real TTY, no CI env). This test pins that: if
+// jest.setup.js's NO_COLOR line were ever removed or the wiring in jest.config.js
+// broke, this is the one test that fails on ITS OWN merits, not as a side effect of
+// some other test's substring assertion breaking.
+const picocolors_1 = __importDefault(require("picocolors"));
+test('picocolors never emits ANSI escapes during this test run', () => {
+    expect(picocolors_1.default.isColorSupported).toBe(false);
+    expect(picocolors_1.default.red('x')).toBe('x');
+    expect(picocolors_1.default.green('x')).toBe('x');
+});

package/dist/tests/core/paths.test.js

@@ -67,17 +67,44 @@ describe('core/paths', () => {
         setPlatform('darwin');
         expect((0, paths_1.platformLabel)()).toBe('macOS');
         setPlatform('win32');
-        expect((0, paths_1.platformLabel)()).toContain('WSL');
+        // Windows is a first-class, CI-verified platform since R6 — the label no
+        // longer hedges toward WSL, and must not silently regress back to it.
+        expect((0, paths_1.platformLabel)()).toBe('Windows (native, CI-verified)');
+        expect((0, paths_1.platformLabel)()).not.toContain('WSL');
     });
-    it('warnIfUnsupportedPlatform calls the logger only on win32', () => {
+    it('noteWindowsCaveat calls the logger only on win32, with the narrow watch-supervisor gap', () => {
         const calls = [];
         const log = (m) => calls.push(m);
         setPlatform('linux');
-        (0, paths_1.warnIfUnsupportedPlatform)(log);
+        (0, paths_1.noteWindowsCaveat)(log);
         expect(calls).toHaveLength(0);
         setPlatform('win32');
-        (0, paths_1.warnIfUnsupportedPlatform)(log);
-        expect(calls).toEqual([paths_1.WINDOWS_NATIVE_WARNING]);
+        (0, paths_1.noteWindowsCaveat)(log);
+        expect(calls).toEqual([paths_1.WINDOWS_KNOWN_GAP]);
+        // The message must assert Windows support, not disclaim it, and must name
+        // the one specific gap rather than a blanket "some things may not work"
+        // hedge — pinning both halves so neither regresses independently.
+        expect(paths_1.WINDOWS_KNOWN_GAP).toMatch(/supported and continuously verified/i);
+        expect(paths_1.WINDOWS_KNOWN_GAP).toMatch(/awm watch/i);
+        expect(paths_1.WINDOWS_KNOWN_GAP).not.toMatch(/WSL/i);
+        expect(paths_1.WINDOWS_KNOWN_GAP).not.toMatch(/not supported/i);
+    });
+    it('noteWindowsCaveat propagates a throwing logger instead of swallowing it', () => {
+        // `noteWindowsCaveat` has no try/catch around the logger call — callers
+        // (init.ts/update.ts/sync.ts/doctor.ts) all pass simple `console.log`
+        // wrappers that are not expected to throw, and every caller controls its
+        // own logger, so there is no shared reason for this helper to be
+        // defensive on their behalf. Pin that behavior explicitly: a throwing
+        // logger's error propagates out of `noteWindowsCaveat`, it is not
+        // swallowed.
+        setPlatform('win32');
+        const boom = new Error('logger exploded');
+        const throwingLog = () => { throw boom; };
+        expect(() => (0, paths_1.noteWindowsCaveat)(throwingLog)).toThrow(boom);
+        // And on non-Windows the logger is never even invoked, so a throwing
+        // logger is harmless there.
+        setPlatform('linux');
+        expect(() => (0, paths_1.noteWindowsCaveat)(throwingLog)).not.toThrow();
     });
     describe('resolveOnPath', () => {
         it('uses `command -v` on POSIX and returns true when the binary resolves', () => {

package/dist/tests/core/registries-sync.test.js

@@ -9,6 +9,35 @@ const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const child_process_1 = require("child_process");
 const GIT = (cwd, cmd) => (0, child_process_1.execSync)(`git -c user.email=t@t.t -c user.name=t -c tag.gpgSign=false ${cmd}`, { cwd, stdio: 'pipe' });
+// Real `git clone`/`pull` against local file:// fixtures, several times per
+// test — on windows-latest CI this is measurably slower than on POSIX (NTFS
+// overhead, antivirus scanning of freshly-written objects) and the jest
+// default of 5000ms proved too tight in real CI (regression: real windows-latest
+// run, "Exceeded timeout of 5000 ms"). Matches the pattern already used by
+// other real-subprocess suites in this repo (supervisor-loop.test.ts: 60000,
+// e2e-crash.test.ts: 180000).
+jest.setTimeout(30000);
+/** git en win32 puede mantener un handle abierto sobre `.git/objects` por un
+ *  instante despues de que el proceso `git` retorna (buffering/flush del
+ *  filesystem, o un git-index-lock que el SO tarda en soltar) — rmSync
+ *  inmediato entonces produce EBUSY/ENOTEMPTY (regresion: real windows-latest
+ *  CI). Mismo patron ya aplicado en tests/commands/watch/runner.test.ts para
+ *  un problema de fondo identico (escritura async en vuelo vs cleanup
+ *  inmediato). */
+async function rmSyncRetryingBusy(target, attempts = 10, delayMs = 100) {
+    for (let i = 0; i < attempts; i++) {
+        try {
+            fs_1.default.rmSync(target, { recursive: true, force: true });
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if ((code !== 'EBUSY' && code !== 'ENOTEMPTY') || i === attempts - 1)
+                throw error;
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
+    }
+}
 /** Creates a git source repo with a skill, returns its path (serves as local remote). */
 function makeSourceRepo(base, skillName) {
     const dir = path_1.default.join(base, `src-${skillName}`);
@@ -33,9 +62,9 @@ describe('syncRegistries (git fixtures locales)', () => {
         process.env.AWM_HOME = path_1.default.join(tmpHome, '.awm');
         jest.resetModules();
     });
-    afterEach(() => {
-        fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
-        fs_1.default.rmSync(tmpWork, { recursive: true, force: true });
+    afterEach(async () => {
+        await rmSyncRetryingBusy(tmpHome);
+        await rmSyncRetryingBusy(tmpWork);
         if (originalHome === undefined)
             delete process.env.HOME;
         else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.13.0",
+  "version": "3.13.2",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"