agentic-workflow-manager 3.13.5 → 3.13.6

package/dist/tests/structural/renderer-table-is-single-source.test.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Structural guard, in the vein of exec-invocation-explicit-stdio.test.ts: it does not
+// test behaviour, it forbids the SHAPE that produced a whole family of bugs.
+//
+// "What filename does renderer R produce" existed in four places. Three agreed; the
+// fourth — the one deciding whether a rendered artifact counted as installed — had
+// never heard of `.mdc` or `.instructions.md`, so `awm add` re-installed the same
+// Cursor/Copilot artifacts on every run and `awm doctor` called a healthy install
+// absent. Each instance was individually reasonable; the class is what cost a release.
+//
+// `core/renderers/registry.ts` is now the single table. This test fails the moment a
+// second one appears, whether by a new literal map or by a fresh `switch` over renderer
+// ids somewhere that should have asked the table.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const SRC = path_1.default.join(__dirname, '..', '..', 'src');
+const REGISTRY = path_1.default.join(SRC, 'core', 'renderers', 'registry.ts');
+/** Every .ts file under src/, recursively. */
+function sourceFiles(dir) {
+    const out = [];
+    for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+        const full = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...sourceFiles(full));
+        else if (entry.name.endsWith('.ts'))
+            out.push(full);
+    }
+    return out;
+}
+/** The file's lines with `//` comments and blank lines dropped — a renderer id named in
+ *  prose (a doc comment explaining the bug) is not a second implementation of the table. */
+function codeLines(file) {
+    const raw = fs_1.default.readFileSync(file, 'utf-8').split('\n');
+    const out = [];
+    let inBlockComment = false;
+    raw.forEach((line, i) => {
+        let l = line;
+        if (inBlockComment) {
+            const end = l.indexOf('*/');
+            if (end === -1)
+                return;
+            inBlockComment = false;
+            l = l.slice(end + 2);
+        }
+        const start = l.indexOf('/*');
+        if (start !== -1) {
+            inBlockComment = l.indexOf('*/', start) === -1;
+            l = l.slice(0, start) + (inBlockComment ? '' : l.slice(l.indexOf('*/', start) + 2));
+        }
+        const lineComment = l.indexOf('//');
+        if (lineComment !== -1)
+            l = l.slice(0, lineComment);
+        if (l.trim())
+            out.push({ line: l, n: i + 1 });
+    });
+    return out;
+}
+/** The extensions the renderer table owns. A literal here, outside the table, IS the bug. */
+const RENDERED_EXTENSIONS = ['.toml', '.mdc', '.instructions.md'];
+describe('the renderer table is the only renderer table', () => {
+    const files = sourceFiles(SRC).filter((f) => f !== REGISTRY);
+    it('no other source file maps a renderer id to a file extension', () => {
+        const offenders = [];
+        for (const file of files) {
+            for (const { line, n } of codeLines(file)) {
+                // A renderer-to-extension mapping looks like an id and an extension on
+                // the same line of code. That is exactly the shape of every copy that
+                // drifted, and nothing legitimate needs to write both at once now that
+                // `rendererExtension`/`renderedFilename` exist.
+                const namesRenderer = /'(codex-agent-toml|cursor-mdc|copilot-instructions)'/.test(line);
+                const namesExtension = RENDERED_EXTENSIONS.some((e) => line.includes(`'${e}'`) || line.includes(`"${e}"`));
+                if (namesRenderer && namesExtension) {
+                    offenders.push(`${path_1.default.relative(SRC, file)}:${n}: ${line.trim()}`);
+                }
+            }
+        }
+        expect(offenders).toEqual([]);
+    });
+    it('the table itself still covers every declared renderer', () => {
+        // The guard above is only worth anything if the one surviving table is complete:
+        // a renderer added to `RendererId` but not to the table would make the guard
+        // push every caller toward a lookup that has no answer.
+        const { RENDERER_IDS } = require('../../src/providers');
+        const { rendererExtension } = require('../../src/core/renderers/registry');
+        for (const id of RENDERER_IDS) {
+            // `null` (the `link` renderer, which keeps the name as-is) is an ANSWER;
+            // `undefined` is the table not knowing about the renderer at all.
+            expect(rendererExtension(id)).not.toBeUndefined();
+        }
+    });
+});

package/dist/tests/structural/symlink-type-is-explicit.test.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Structural guard, same family as exec-invocation-explicit-stdio.test.ts.
+//
+// `fs.symlinkSync(target, dest)` with no third argument creates a DIRECTORY symlink on
+// Windows when the target is a directory, and that needs SeCreateSymbolicLinkPrivilege
+// — denied by default on unprivileged accounts, including GitHub Actions'
+// windows-latest runner. The same omission has been fixed one site at a time, more
+// than once, each fix landing where the bug was reported and nowhere else:
+// `executor.ts` learned `'junction'`, and `skill-integrity.ts` did not, for a whole
+// release — its comment still says "este sitio nunca recibio el fix".
+//
+// So the rule is about the CALL, not about any one call site: every `fs.symlinkSync`
+// either passes an explicit type argument, or is wrapped in a `try` whose `catch`
+// falls back to a copy. Those are the only two ways this survives Windows, and one of
+// them has to be visible at the call.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const SRC = path_1.default.join(__dirname, '..', '..', 'src');
+function sourceFiles(dir) {
+    const out = [];
+    for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+        const full = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...sourceFiles(full));
+        else if (entry.name.endsWith('.ts'))
+            out.push(full);
+    }
+    return out;
+}
+/** True when `lines[i]` sits inside a try block whose catch copies instead. Deliberately
+ *  shallow — it looks a few lines ahead for the catch, which is what every real fallback
+ *  in this codebase looks like. A cleverer arrangement that defeats it should be written
+ *  with an explicit type argument instead. */
+function hasCopyFallback(lines, i) {
+    const window = lines.slice(Math.max(0, i - 3), i + 8).join('\n');
+    return /\btry\b/.test(window) && /catch\b/.test(window) && /copyFileSync|cpSync/.test(window);
+}
+describe('every symlink creation survives Windows on purpose', () => {
+    it('passes an explicit type argument or falls back to a copy', () => {
+        const offenders = [];
+        for (const file of sourceFiles(SRC)) {
+            const lines = fs_1.default.readFileSync(file, 'utf-8').split('\n');
+            lines.forEach((line, i) => {
+                if (!/\bfs\.symlinkSync\s*\(/.test(line))
+                    return;
+                // Three arguments — the third is the type ('junction' | 'dir' | 'file').
+                const explicitType = /symlinkSync\s*\([^)]*,[^)]*,\s*[^)]+\)/.test(line) ||
+                    /'junction'|'dir'|'file'/.test(lines.slice(i, i + 3).join('\n'));
+                if (explicitType || hasCopyFallback(lines, i))
+                    return;
+                offenders.push(`${path_1.default.relative(SRC, file)}:${i + 1}: ${line.trim()}`);
+            });
+        }
+        expect(offenders).toEqual([]);
+    });
+    it('the guard actually rejects a bare two-argument call', () => {
+        // Without this, a guard whose regex silently stopped matching would read as a
+        // clean bill of health forever — the failure mode of every structural test.
+        const bare = ['fs.symlinkSync(source, dest);'];
+        const explicit = ["fs.symlinkSync(source, dest, 'junction');"];
+        const wrapped = ['try {', 'fs.symlinkSync(source, dest);', '} catch {', 'fs.copyFileSync(source, dest);', '}'];
+        const rejects = (lines, i) => !/symlinkSync\s*\([^)]*,[^)]*,\s*[^)]+\)/.test(lines[i]) &&
+            !/'junction'|'dir'|'file'/.test(lines.slice(i, i + 3).join('\n')) &&
+            !hasCopyFallback(lines, i);
+        expect(rejects(bare, 0)).toBe(true);
+        expect(rejects(explicit, 0)).toBe(false);
+        expect(rejects(wrapped, 1)).toBe(false);
+    });
+});

package/dist/tests/utils/registry-view-overrides.test.js

@@ -25,9 +25,9 @@ describe('registry-view override markers', () => {
         fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
     });
     it('packageDetailLines marks an overridden skill with its registry name', () => {
-        const { REGISTRIES_DIR } = require('../../src/core/registries');
+        const { registriesDir } = require('../../src/core/registries');
         const { buildPackageView, packageDetailLines } = require('../../src/utils/registry-view');
-        const teamSkillPath = path_1.default.join(REGISTRIES_DIR, 'team-acme', 'skills', 'brainstorming');
+        const teamSkillPath = path_1.default.join(registriesDir(), 'team-acme', 'skills', 'brainstorming');
         const view = buildPackageView([{ name: 'brainstorming', path: teamSkillPath, description: 'd', overrode: '/old/path' }], [], [], []);
         const lines = packageDetailLines(view[0]).join('\n');
         expect(lines).toContain('brainstorming');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.13.5",
+  "version": "3.13.6",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -34,6 +34,9 @@
   ],
   "author": "Kodria",
   "license": "ISC",
+  "engines": {
+    "node": ">=22"
+  },
   "description": "CLI to manage Agentic Workflows - install skills, workflows, and processes for AI agents",
   "dependencies": {
     "@clack/prompts": "^1.0.1",