agentic-workflow-manager 3.13.5 → 3.13.7

package/dist/tests/core/path-resolution-no-shell.test.js

@@ -0,0 +1,136 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// SECURITY regression: `resolveOnPath` used to interpolate its argument into a
+// SHELL string (`command -v ${bin}` / `where ${bin}`) and run it through
+// execSync. The argument is the first token of a sensor's `cmd`, which comes
+// from `.awm/sensors.json` — a file that is COMMITTED IN THE REPO and also
+// regenerated from a registry sensor-pack's `defaultCmd`. So both a cloned
+// untrusted repo and a third-party registry could reach it.
+//
+// The token cannot contain whitespace (it is a split token), but that stops
+// nothing: `${IFS}` and `$(...)` sidestep it entirely. Confirmed exploit on the
+// real binary — `awm sensors status` (and `awm preflight`) executed an attacker
+// command and then reported the sensor as HEALTHY, because the injected command
+// exited 0:
+//
+//     {"sensors":{"lint":{"cmd":"foo;touch${IFS}/tmp/PWNED","fast":true}}}
+//     $ awm sensors status      # -> /tmp/PWNED created, status "✔ HEALTHY"
+//
+// `awm sensors status` and `awm preflight` are commands a user reasonably
+// expects to be INERT — read-only inspection. The fix removes the shell
+// entirely: PATH is resolved in-process, so there is no interpreter to inject
+// into, on any platform.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../../src/core/paths");
+describe('resolveOnPath: sin shell, inmune a inyeccion', () => {
+    const realPlatform = process.platform;
+    let binDir;
+    let originalPath;
+    beforeEach(() => {
+        binDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pathres-'));
+        originalPath = process.env.PATH;
+        process.env.PATH = binDir;
+    });
+    afterEach(() => {
+        Object.defineProperty(process, 'platform', { value: realPlatform });
+        if (originalPath === undefined)
+            delete process.env.PATH;
+        else
+            process.env.PATH = originalPath;
+        fs_1.default.rmSync(binDir, { recursive: true, force: true });
+    });
+    function setPlatform(p) {
+        Object.defineProperty(process, 'platform', { value: p });
+    }
+    /** Un binario "real" en el PATH falso. */
+    function putBinary(name, mode = 0o755) {
+        const p = path_1.default.join(binDir, name);
+        fs_1.default.writeFileSync(p, '#!/bin/sh\nexit 0\n');
+        fs_1.default.chmodSync(p, mode);
+        return p;
+    }
+    it('encuentra un binario real presente en PATH', () => {
+        setPlatform('linux');
+        putBinary('mytool');
+        expect((0, paths_1.resolveOnPath)('mytool')).toBe(true);
+    });
+    it('devuelve false para un binario ausente', () => {
+        setPlatform('linux');
+        expect((0, paths_1.resolveOnPath)('definitivamente-no-existe')).toBe(false);
+    });
+    it('NO ejecuta un payload de inyeccion — el efecto lateral jamas ocurre (regresion de seguridad)', () => {
+        setPlatform('linux');
+        const marker = path_1.default.join(binDir, 'PWNED');
+        // El mismo payload confirmado contra el binario real.
+        const payload = `foo;touch\${IFS}${marker}`;
+        expect((0, paths_1.resolveOnPath)(payload)).toBe(false);
+        expect(fs_1.default.existsSync(marker)).toBe(false);
+    });
+    it.each([
+        ['sustitucion de comando', 'foo$(touch MARKER)'],
+        ['backticks', 'foo`touch MARKER`'],
+        ['encadenado con &&', 'foo&&touch'],
+        ['pipe', 'foo|touch'],
+        ['redireccion', 'foo>MARKER'],
+        ['newline embebido', 'foo\ntouch MARKER'],
+        ['expansion de variable', '$HOME'],
+    ])('trata %s como un nombre literal, nunca como sintaxis', (_n, payload) => {
+        setPlatform('linux');
+        // No existe un archivo con ese nombre literal => false, y nada se ejecuta.
+        expect((0, paths_1.resolveOnPath)(payload)).toBe(false);
+    });
+    // Solo donde el filesystem PUEDE expresar la premisa. `setPlatform('linux')` cambia
+    // lo que hace el codigo, no lo que hace el disco: en un runner Windows `chmod 0o644`
+    // no quita ningun bit de ejecucion (no existe), asi que `accessSync(X_OK)` aprueba el
+    // archivo y el test fallaba sobre un producto que se comporta bien. La rama win32 —
+    // "no exige bit de ejecucion" — la cubre su propio caso mas abajo, que SI es
+    // observable ahi.
+    const itPosix = realPlatform === 'win32' ? it.skip : it;
+    itPosix('en POSIX exige el bit de ejecucion — un archivo no ejecutable no es un binario resoluble', () => {
+        setPlatform('linux');
+        putBinary('noexec', 0o644);
+        expect((0, paths_1.resolveOnPath)('noexec')).toBe(false);
+    });
+    it('en win32 resuelve por PATHEXT, incluyendo los shims .cmd de npm (regresion: R1, bug publicado en v3.9.0)', () => {
+        setPlatform('win32');
+        // En win32 el usuario escribe `eslint`, y lo que existe en disco es
+        // `eslint.cmd` — no resolverlo fue un bug real que rompia los sensores.
+        fs_1.default.writeFileSync(path_1.default.join(binDir, 'eslint.cmd'), '@echo off\r\n');
+        process.env.PATHEXT = '.COM;.EXE;.BAT;.CMD';
+        expect((0, paths_1.resolveOnPath)('eslint')).toBe(true);
+        expect((0, paths_1.resolveOnPath)('noexiste')).toBe(false);
+    });
+    it('en win32 no exige bit de ejecucion (no existe ese concepto ahi)', () => {
+        setPlatform('win32');
+        fs_1.default.writeFileSync(path_1.default.join(binDir, 'tool.exe'), '');
+        process.env.PATHEXT = '.COM;.EXE;.BAT;.CMD';
+        expect((0, paths_1.resolveOnPath)('tool')).toBe(true);
+    });
+    it('un nombre con separador de ruta se chequea como ruta directa, sin recorrer PATH', () => {
+        // La plataforma REAL, no una simulada: el invariante es "un nombre que trae el
+        // separador de SU plataforma se resuelve como ruta". Fijar 'linux' mientras el
+        // disco entrega `D:\...\directo` mezclaba las dos mitades — el codigo buscaba
+        // '/' y la ruta traia '\\' — y fallaba por la contradiccion del arreglo, no por
+        // el producto. Asi el caso corre de verdad en los dos sistemas operativos.
+        setPlatform(realPlatform);
+        const abs = putBinary('directo');
+        expect((0, paths_1.resolveOnPath)(abs)).toBe(true);
+        expect((0, paths_1.resolveOnPath)(path_1.default.join(binDir, 'no-esta'))).toBe(false);
+    });
+    it('entradas vacias o no-string no resuelven ni crashean', () => {
+        setPlatform('linux');
+        expect((0, paths_1.resolveOnPath)('')).toBe(false);
+        expect((0, paths_1.resolveOnPath)('   ')).toBe(false);
+        expect((0, paths_1.resolveOnPath)(undefined)).toBe(false);
+    });
+    it('un PATH ausente no crashea', () => {
+        setPlatform('linux');
+        delete process.env.PATH;
+        expect((0, paths_1.resolveOnPath)('cualquiera')).toBe(false);
+    });
+});

package/dist/tests/core/paths.test.js

@@ -5,10 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
-const child_process_1 = require("child_process");
 const paths_1 = require("../../src/core/paths");
-jest.mock('child_process', () => ({ execSync: jest.fn() }));
-const mockExecSync = child_process_1.execSync;
 describe('core/paths', () => {
     let origHome;
     let origAwmHome;
@@ -16,7 +13,6 @@ describe('core/paths', () => {
     beforeEach(() => {
         origHome = process.env.HOME;
         origAwmHome = process.env.AWM_HOME;
-        mockExecSync.mockReset();
     });
     afterEach(() => {
         if (origHome === undefined)
@@ -106,34 +102,11 @@ describe('core/paths', () => {
         setPlatform('linux');
         expect(() => (0, paths_1.noteWindowsCaveat)(throwingLog)).not.toThrow();
     });
-    describe('resolveOnPath', () => {
-        it('uses `command -v` on POSIX and returns true when the binary resolves', () => {
-            setPlatform('linux');
-            mockExecSync.mockImplementation(((cmd) => {
-                if (cmd === 'command -v semgrep')
-                    return Buffer.from('/usr/bin/semgrep');
-                throw new Error(`not found: ${cmd}`);
-            }));
-            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(true);
-        });
-        it('returns false on POSIX when `command -v` fails to resolve the binary', () => {
-            setPlatform('linux');
-            mockExecSync.mockImplementation(() => { throw new Error('not found'); });
-            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(false);
-        });
-        it('uses `where` on win32, not `command -v`', () => {
-            setPlatform('win32');
-            mockExecSync.mockImplementation(((cmd) => {
-                if (cmd === 'where semgrep')
-                    return Buffer.from('C:\\tools\\semgrep.exe');
-                throw new Error(`not found: ${cmd}`);
-            }));
-            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(true);
-        });
-        it('returns false on win32 when `where` cannot find the binary', () => {
-            setPlatform('win32');
-            mockExecSync.mockImplementation(() => { throw new Error('not found'); });
-            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(false);
-        });
-    });
+    // `resolveOnPath` ya no invoca un shell (ni ningun subproceso): resuelve PATH
+    // en proceso. Los tests que vivian aca mockeaban `execSync` y verificaban las
+    // strings `command -v X` / `where X`, o sea la implementacion removida — y dos
+    // de ellos ademas pasaban por accidente en cualquier maquina que tuviera el
+    // binario del fixture instalado de verdad. Su reemplazo, con PATH controlado y
+    // el exploit de inyeccion como ancla, esta en
+    // tests/core/path-resolution-no-shell.test.ts.
 });

package/dist/tests/core/project-skill-links.test.js

@@ -0,0 +1,159 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Project-scope skill symlinks had no maintenance path at all.
+//
+// The machinery exists and is exercised every `awm init` / `awm registry sync`:
+// `classifySkillLinks` finds dangling symlinks, `repairSkillLinks` re-links the ones
+// the registry can still serve and prunes the ones it cannot. But every entry point
+// pointed it at `provider.skill.global` only. A dangling link under a PROJECT's
+// `.claude/skills/` (registry re-cloned, skill renamed upstream, bundle removed from
+// `.awm/profile.json`) was:
+//
+//   - never healed — `awm sync` installs what the profile declares and looks at
+//     nothing else, so a link whose bundle was dropped is simply left behind;
+//   - never pruned — it stays in the tree indefinitely, and the agent trips on it
+//     when it tries to read the skill's SKILL.md;
+//   - never reported — `awm doctor`'s `globalSkills` reads the global dir, so nothing
+//     on any surface mentions it.
+//
+// For Copilot the gap is total, not partial: `skill.global` is null, so *every* skill
+// it has is project-scope, and none of them had any integrity path whatsoever.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const skill_integrity_1 = require("../../src/core/skill-integrity");
+const providers_1 = require("../../src/providers");
+const tmp_1 = require("../support/tmp");
+describe('project-scope skill links get the same integrity path as global ones', () => {
+    let registry;
+    let projectRoot;
+    const made = [];
+    beforeEach(() => {
+        registry = (0, tmp_1.mkCanonicalTmpDir)('awm-projlink-reg-');
+        projectRoot = (0, tmp_1.mkCanonicalTmpDir)('awm-projlink-proj-');
+        made.push(registry, projectRoot);
+        fs_1.default.mkdirSync(path_1.default.join(registry, 'skills', 'alive'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(registry, 'skills', 'alive', 'SKILL.md'), '# alive\n');
+    });
+    afterAll(() => { for (const d of made)
+        fs_1.default.rmSync(d, { recursive: true, force: true }); });
+    /** The dir where `agent`'s project-scope skills live, with the links pre-created. */
+    function localSkillsDir(agent, links) {
+        const dir = path_1.default.join(projectRoot, (0, providers_1.providerFor)(agent).skill.local);
+        fs_1.default.mkdirSync(dir, { recursive: true });
+        for (const [name, target] of Object.entries(links))
+            fs_1.default.symlinkSync(target, path_1.default.join(dir, name));
+        return dir;
+    }
+    it('classifies a dangling project link as repairable when the registry still has it', () => {
+        const dir = localSkillsDir('claude-code', { alive: path_1.default.join(registry, 'gone', 'alive') });
+        const out = (0, skill_integrity_1.classifySkillLinks)(dir, [registry]);
+        expect(out.repairable).toEqual(['alive']);
+        expect(out.dead).toEqual([]);
+    });
+    it('classifies a dangling project link as dead when the registry no longer has it', () => {
+        const dir = localSkillsDir('claude-code', { removed: path_1.default.join(registry, 'skills', 'removed') });
+        const out = (0, skill_integrity_1.classifySkillLinks)(dir, [registry]);
+        expect(out.dead).toEqual(['removed']);
+        expect(out.repairable).toEqual([]);
+    });
+    it('awm sync heals a project link the registry can still serve', () => {
+        const dir = localSkillsDir('claude-code', { alive: path_1.default.join(registry, 'moved', 'alive') });
+        const results = (0, skill_integrity_1.reconcileProjectSkillLinks)(projectRoot, ['claude-code'], [registry]);
+        expect(results.find(r => r.agent === 'claude-code').result.relinked).toEqual(['alive']);
+        expect(fs_1.default.existsSync(path_1.default.join(dir, 'alive', 'SKILL.md'))).toBe(true);
+    });
+    it('prunes a project link nothing can serve any more', () => {
+        const dir = localSkillsDir('claude-code', { removed: path_1.default.join(registry, 'skills', 'removed') });
+        const results = (0, skill_integrity_1.reconcileProjectSkillLinks)(projectRoot, ['claude-code'], [registry]);
+        expect(results.find(r => r.agent === 'claude-code').result.pruned).toEqual(['removed']);
+        expect(fs_1.default.existsSync(path_1.default.join(dir, 'removed'))).toBe(false);
+        expect(fs_1.default.lstatSync(dir).isDirectory()).toBe(true);
+    });
+    it('covers Copilot, whose skills are ONLY ever project-scope', () => {
+        expect((0, providers_1.providerFor)('copilot').skill.global).toBeNull(); // premise of this test
+        const dir = localSkillsDir('copilot', { alive: path_1.default.join(registry, 'moved', 'alive') });
+        const results = (0, skill_integrity_1.reconcileProjectSkillLinks)(projectRoot, ['copilot'], [registry]);
+        expect(results.find(r => r.agent === 'copilot').result.relinked).toEqual(['alive']);
+        expect(fs_1.default.existsSync(path_1.default.join(dir, 'alive', 'SKILL.md'))).toBe(true);
+    });
+    it('leaves the user\'s own files alone — only dangling symlinks are touched', () => {
+        const dir = localSkillsDir('claude-code', { alive: path_1.default.join(registry, 'skills', 'alive') });
+        fs_1.default.mkdirSync(path_1.default.join(dir, 'hand-written'));
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'hand-written', 'SKILL.md'), '# mine\n');
+        const results = (0, skill_integrity_1.reconcileProjectSkillLinks)(projectRoot, ['claude-code'], [registry]);
+        const r = results.find(x => x.agent === 'claude-code').result;
+        expect(r.relinked).toEqual([]);
+        expect(r.pruned).toEqual([]);
+        expect(fs_1.default.readFileSync(path_1.default.join(dir, 'hand-written', 'SKILL.md'), 'utf-8')).toBe('# mine\n');
+        expect(fs_1.default.existsSync(path_1.default.join(dir, 'alive'))).toBe(true);
+    });
+    it('skips agents whose project skills dir does not exist', () => {
+        const results = (0, skill_integrity_1.reconcileProjectSkillLinks)(projectRoot, ['claude-code', 'copilot'], [registry]);
+        expect(results).toEqual([]);
+    });
+});
+// Wiring, not just capability: I15's actual defect was that the healing primitive
+// already existed and nothing called it for project scope. A green unit test of the
+// primitive would have looked identical before and after. So assert the call.
+describe('awm sync reaches the project-scope reconciliation', () => {
+    let projectRoot;
+    let home;
+    let saved;
+    beforeEach(() => {
+        jest.resetModules();
+        home = (0, tmp_1.mkCanonicalTmpDir)('awm-syncwire-home-');
+        saved = { HOME: process.env.HOME, AWM_HOME: process.env.AWM_HOME };
+        process.env.HOME = home;
+        process.env.AWM_HOME = path_1.default.join(home, '.awm');
+        fs_1.default.mkdirSync(path_1.default.join(home, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(home, '.awm', 'preferences.json'), JSON.stringify({
+            enabledAgents: ['claude-code'], defaultAgent: 'claude-code',
+            installMethod: 'symlink', defaultScope: 'global',
+        }));
+        projectRoot = (0, tmp_1.mkCanonicalTmpDir)('awm-syncwire-proj-');
+        fs_1.default.mkdirSync(path_1.default.join(projectRoot, '.awm'), { recursive: true });
+    });
+    afterEach(() => {
+        if (saved.HOME === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = saved.HOME;
+        if (saved.AWM_HOME === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = saved.AWM_HOME;
+        fs_1.default.rmSync(home, { recursive: true, force: true });
+        fs_1.default.rmSync(projectRoot, { recursive: true, force: true });
+    });
+    const writeProfile = (extensions) => fs_1.default.writeFileSync(path_1.default.join(projectRoot, '.awm', 'profile.json'), JSON.stringify({ extensions }));
+    async function sync(spy) {
+        const { runSyncCore } = require('../../src/commands/sync');
+        return runSyncCore({ cwd: projectRoot }, {
+            syncRegistries: async () => [],
+            verifyMinCliVersions: () => [],
+            verifyProjectPins: async () => [],
+            syncProfile: () => ({ installed: [], skipped: [], extensions: [], transactionIds: [], modifiedFiles: [] }),
+            reconcileProjectSkillLinks: spy,
+        });
+    }
+    it('reconciles project links on a normal sync', async () => {
+        writeProfile(['demo']);
+        const spy = jest.fn((_root, _agents, _roots) => []);
+        await sync(spy);
+        expect(spy).toHaveBeenCalledTimes(1);
+        expect(spy.mock.calls[0][0]).toBe(projectRoot);
+        expect(spy.mock.calls[0][1]).toEqual(['claude-code']);
+    });
+    it('reconciles project links even when the profile has no extensions left', async () => {
+        // The case that produces orphans in the first place: the extension that owned
+        // them was removed. That path used to return early, touching nothing.
+        writeProfile([]);
+        const spy = jest.fn((_root, _agents, _roots) => []);
+        const out = await sync(spy);
+        expect(out.code).toBe(0);
+        expect(spy).toHaveBeenCalledTimes(1);
+    });
+});

package/dist/tests/core/provider-artifacts.test.js

@@ -42,24 +42,76 @@ describe('scanLegacyArtifacts', () => {
             process.env.AWM_HOME = originalAwmHome;
         fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
     });
-    it('never lists Codex TOML agents for legacy removal', () => {
+    /** Registra artefactos como propiedad de AWM, que es lo que ahora habilita
+     *  que `awm remove` los ofrezca. */
+    function own(records) {
+        const file = path_1.default.join(tmpHome, '.awm', 'state', 'artifacts.json');
+        fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+        fs_1.default.writeFileSync(file, JSON.stringify(records.map((r) => ({
+            ...r, scope: 'global', sourcePath: '/tmp/src', owners: ['codex'],
+        }))));
+    }
+    it('lista los artefactos renderizados que AWM instalo, incluidos los .toml de codex', () => {
+        // Este test asertaba lo contrario: que los agents TOML de codex NUNCA
+        // se listaran. Eso codificaba el bug — `scanLegacyArtifacts` se tragaba
+        // `UnsupportedRendererError`, asi que `awm remove` era un no-op
+        // permanente para los skills de cursor/copilot y los agents de codex
+        // ("no hay artefactos instalados", con el directorio lleno).
+        // Un artefacto que AWM instalo tiene que poder desinstalarse.
         const skillPath = path_1.default.join(tmpHome, '.agents/skills/linked-skill');
-        const agentPath = path_1.default.join(tmpHome, '.codex/agents/protected.toml');
+        const agentPath = path_1.default.join(tmpHome, '.codex/agents/rendered.toml');
         fs_1.default.mkdirSync(skillPath, { recursive: true });
         fs_1.default.mkdirSync(path_1.default.dirname(agentPath), { recursive: true });
-        fs_1.default.writeFileSync(agentPath, 'name = "protected"\n');
+        fs_1.default.writeFileSync(agentPath, 'name = "rendered"\n');
+        own([
+            { name: 'linked-skill', type: 'skill', targetPath: skillPath, renderer: 'link' },
+            { name: 'rendered.toml', type: 'agent', targetPath: agentPath, renderer: 'codex-agent-toml' },
+        ]);
         const listed = (0, provider_artifacts_1.scanLegacyArtifacts)(['codex'], 'global');
-        const legacyRemove = jest.fn((target) => fs_1.default.rmSync(target, {
-            recursive: true,
-            force: true,
-        }));
-        for (const artifact of listed) {
-            for (const fullPath of artifact.fullPaths)
-                legacyRemove(fullPath);
-        }
-        expect(listed.map((artifact) => artifact.name)).toEqual(['linked-skill']);
-        expect(legacyRemove).not.toHaveBeenCalledWith(agentPath);
-        expect(fs_1.default.existsSync(agentPath)).toBe(true);
+        expect(listed.map((a) => a.name).sort()).toEqual(['linked-skill', 'rendered.toml']);
+    });
+    it('NO lista archivos que AWM no instalo — el directorio no es suyo para ofrecerlo', () => {
+        // Antes listaba el directorio entero, asi que un skill escrito a mano
+        // por el usuario aparecia en el menu de borrado.
+        const mine = path_1.default.join(tmpHome, '.agents/skills/awm-skill');
+        const theirs = path_1.default.join(tmpHome, '.agents/skills/mi-skill-personal');
+        fs_1.default.mkdirSync(mine, { recursive: true });
+        fs_1.default.mkdirSync(theirs, { recursive: true });
+        own([{ name: 'awm-skill', type: 'skill', targetPath: mine, renderer: 'link' }]);
+        const listed = (0, provider_artifacts_1.scanLegacyArtifacts)(['codex'], 'global');
+        expect(listed.map((a) => a.name)).toEqual(['awm-skill']);
+        expect(listed.flatMap((a) => a.fullPaths)).not.toContain(theirs);
+    });
+    it('no colapsa dos tipos distintos que comparten nombre (borraria el equivocado)', () => {
+        // Antes la clave era solo el nombre, a traves de todos los tipos: un
+        // workflow `deploy.md` y un agent `deploy.md` colapsaban en UNA entrada,
+        // asi que elegir "deploy.md" borraba ambos.
+        const wf = path_1.default.join(tmpHome, '.gemini/antigravity/global_workflows/deploy.md');
+        const ag = path_1.default.join(tmpHome, '.claude/agents/deploy.md');
+        fs_1.default.mkdirSync(path_1.default.dirname(wf), { recursive: true });
+        fs_1.default.mkdirSync(path_1.default.dirname(ag), { recursive: true });
+        fs_1.default.writeFileSync(wf, 'wf');
+        fs_1.default.writeFileSync(ag, 'ag');
+        own([
+            { name: 'deploy.md', type: 'workflow', targetPath: wf, renderer: 'link' },
+            { name: 'deploy.md', type: 'agent', targetPath: ag, renderer: 'link' },
+        ]);
+        const listed = (0, provider_artifacts_1.scanLegacyArtifacts)(['antigravity', 'claude-code'], 'global');
+        expect(listed).toHaveLength(2);
+        for (const a of listed)
+            expect(a.fullPaths).toHaveLength(1);
+    });
+    it('scope local se resuelve contra el projectRoot dado, no contra cwd', () => {
+        const projectRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-proj-'));
+        const local = path_1.default.join(projectRoot, '.claude/skills/local-skill');
+        fs_1.default.mkdirSync(local, { recursive: true });
+        own([{ name: 'local-skill', type: 'skill', targetPath: local, renderer: 'link' }]);
+        const listed = (0, provider_artifacts_1.scanLegacyArtifacts)(['claude-code'], 'local', projectRoot);
+        expect(listed.map((a) => a.name)).toEqual(['local-skill']);
+        // Y la ruta entregada es ABSOLUTA: antes era relativa, y se la pasaba
+        // tal cual a fs.rmSync.
+        expect(path_1.default.isAbsolute(listed[0].fullPaths[0])).toBe(true);
+        fs_1.default.rmSync(projectRoot, { recursive: true, force: true });
     });
     it('Gap C — an agent with a null global skill dir (copilot) at global scope skips cleanly instead of crashing', () => {
         // Copilot's skill.global is null (no user-level skill discovery mechanism —

package/dist/tests/core/provider-capability-guards.test.js

@@ -0,0 +1,92 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Regresion: un provider que estructuralmente NO puede recibir un artefacto en
+// cierto scope (hoy: copilot en global — no tiene descubrimiento de skills a
+// nivel usuario) hacia TIRAR el plan entero, rompiendo el comando para todos
+// los demas agentes de la maquina.
+//
+// Sintoma confirmado contra el binario real:
+//     awm init -a claude-code -y && awm init -a copilot -y && awm update
+//     → Artifact reconciliation failed: skill global scope is not supported by Copilot
+//     exit=1
+// El comando moria ANTES del re-sync de hooks, asi que claude-code dejaba de
+// recibir actualizaciones — y no existe comando para deshabilitar un agente,
+// mientras `awm doctor` seguia diciendo "healthy".
+//
+// La causa era una asimetria de guarda clasica: el `.filter()` interno de
+// `assertCompleteSharedGroup` ya toleraba el caso, pero la linea de arriba
+// —que corre primero— no.
+const path_1 = __importDefault(require("path"));
+const install_planner_1 = require("../../src/core/install-planner");
+const skill = {
+    name: 'using-awm', type: 'skill', installName: 'using-awm', sourcePath: '/tmp/reg/skills/using-awm',
+};
+describe('planInstall: un provider incapaz no puede romper el plan de los demas', () => {
+    it('scope global con copilot habilitado: planifica para los capaces y saltea copilot', () => {
+        const plan = (0, install_planner_1.planInstall)({
+            artifacts: [skill],
+            selectedAgents: ['claude-code', 'copilot'],
+            enabledAgents: ['claude-code', 'copilot'],
+            scope: 'global',
+            projectRoot: '/tmp/proj',
+            method: 'symlink',
+        });
+        const owners = plan.operations.flatMap((op) => op.owners);
+        expect(owners).toContain('claude-code');
+        expect(owners).not.toContain('copilot');
+    });
+    it('no tira aunque copilot este habilitado pero no seleccionado (el caso de awm update)', () => {
+        expect(() => (0, install_planner_1.planInstall)({
+            artifacts: [skill],
+            selectedAgents: ['claude-code'],
+            enabledAgents: ['claude-code', 'copilot'],
+            scope: 'global',
+            projectRoot: '/tmp/proj',
+            method: 'symlink',
+        })).not.toThrow();
+    });
+    it('peticion EXPLICITA de copilot en global: sigue tirando CON la explicacion', () => {
+        // Aca no hay a quien saltear — el usuario pidio justo esa combinacion, y
+        // lo que necesita es leer por que no se puede, no un exito silencioso.
+        expect(() => (0, install_planner_1.planInstall)({
+            artifacts: [skill],
+            selectedAgents: ['copilot'],
+            enabledAgents: ['copilot'],
+            scope: 'global',
+            projectRoot: '/tmp/proj',
+            method: 'symlink',
+        })).toThrow(/per-project|not supported/i);
+    });
+    it('copilot en scope local SI recibe el artefacto (su unico scope valido)', () => {
+        const plan = (0, install_planner_1.planInstall)({
+            artifacts: [skill],
+            selectedAgents: ['copilot'],
+            enabledAgents: ['copilot'],
+            scope: 'local',
+            projectRoot: '/tmp/proj',
+            method: 'symlink',
+        });
+        expect(plan.operations).toHaveLength(1);
+        // `path.join`, no un literal con '/': `physicalTarget` construye la ruta con el
+        // separador de la plataforma, asi que en Windows el destino real es
+        // `.github\instructions` y la asercion POSIX-hardcodeada fallaba sobre un
+        // destino perfectamente correcto.
+        expect(plan.operations[0].targetPath).toContain(path_1.default.join('.github', 'instructions'));
+        expect(plan.operations[0].targetPath).toContain('using-awm.instructions.md');
+    });
+    it('el grupo compartido (opencode + codex) se sigue exigiendo completo', () => {
+        // La guarda no debe aflojar R14: ambos resuelven a ~/.agents/skills, asi
+        // que seleccionar solo uno seguiria siendo un cambio divergente.
+        expect(() => (0, install_planner_1.planInstall)({
+            artifacts: [skill],
+            selectedAgents: ['codex'],
+            enabledAgents: ['codex', 'opencode'],
+            scope: 'global',
+            projectRoot: '/tmp/proj',
+            method: 'symlink',
+        })).toThrow(/shared skill target/i);
+    });
+});

package/dist/tests/core/reconciliation.test.js

@@ -138,10 +138,18 @@ describe('planReconciliation (real, unmocked)', () => {
         // points nowhere — resolveBundleClosure just drops the missing dep.
         expect(names).toEqual(['ambient-skill', 'brainstorming', 'dangling-skill']);
     });
-    it('skips a bundle whose closure genuinely fails to resolve, without aborting reconciliation for the rest', () => {
-        // Malformed dependsOn (not an array) makes resolveBundleClosure throw
-        // when it tries to iterate it — a real "unresolvable closure" error,
-        // unlike a plain dangling name reference (see test above).
+    it('un dependsOn malformado ya no rompe nada: el campo invalido se ignora y el bundle instala', () => {
+        // Este test asertaba que un `dependsOn` no-array hacia TIRAR a
+        // `resolveBundleClosure` y que reconciliation lo salteaba. Desde que
+        // `discoverBundles` valida forma sobre el contenido del registry (que es
+        // input no confiable), ese campo se normaliza a `[]` en vez de
+        // propagarse hasta un `for...of` sobre un numero. O sea: la entrada ya
+        // no falla, y el bundle instala normalmente ignorando el campo roto.
+        //
+        // Es una mejora, no una regresion — antes UN archivo malformado en
+        // cualquier registry tumbaba `awm list`/`awm add` con un stack trace
+        // crudo. El `catch` de reconciliation sigue en su lugar como defensa en
+        // profundidad, pero esta entrada ya no lo ejercita.
         writeBundle(contentRoot, 'broken', 'baseline', ['broken-skill'], 5);
         addToCatalog(contentRoot, 'broken', 'baseline');
         const { planReconciliation } = require('../../src/core/reconciliation');
@@ -149,17 +157,9 @@ describe('planReconciliation (real, unmocked)', () => {
         expect(() => {
             plan = planReconciliation({ targets: ['claude-code'], roots: [contentRoot] });
         }).not.toThrow();
-        // The healthy bundles (baseline 'dev' + ambient 'ambient-x') still
-        // reconcile correctly.
         const names = plan.operations.map((op) => op.name).sort();
-        expect(names).toEqual(['ambient-skill', 'brainstorming']);
-        // The broken bundle is cleanly absent — no partial/broken entry for
-        // 'broken-skill' or any operation touching it.
-        expect(names).not.toContain('broken-skill');
-        expect(plan.operations.some((op) => op.sourcePath?.includes('broken'))).toBe(false);
-        // Applying the plan end-to-end still works (no dangling reference to
-        // the broken bundle leaked into the plan).
-        const { applyInstallPlan } = require('../../src/core/install-transaction');
-        expect(() => applyInstallPlan(plan)).not.toThrow();
+        // Los bundles sanos siguen reconciliando, y el que tenia el campo roto
+        // tambien — sin su dependencia invalida.
+        expect(names).toEqual(['ambient-skill', 'brainstorming', 'broken-skill']);
     });
 });

package/dist/tests/core/registry-manifest.test.js

@@ -69,7 +69,7 @@ describe('registry manifest (awm-registry.json)', () => {
     });
     it('registryNameForPath maps configured registries and returns null for unknown paths', () => {
         const m = load();
-        const regPath = path_1.default.join(m.REGISTRIES_DIR, 'team-acme', 'skills', 'x');
+        const regPath = path_1.default.join(m.registriesDir(), 'team-acme', 'skills', 'x');
         expect(m.registryNameForPath(regPath)).toBe('team-acme');
         expect(m.registryNameForPath('/somewhere/else')).toBeNull();
     });

package/dist/tests/core/semver-fails-closed.test.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// Regresion: `compareSemver` devolvia NaN ante una entrada malformada, y como
+// `NaN > 0` y `NaN < 0` son AMBOS false, el gate de version fallaba ABIERTO:
+// `verifyMinCliVersions` dejaba pasar en silencio un CLI por debajo del minimo.
+// Para un gate, la direccion correcta de fallo es la contraria.
+const versioning_1 = require("../../src/core/versioning");
+describe('compareSemver', () => {
+    it.each([
+        ['1.2.3', '1.2.3', 0],
+        ['1.2.4', '1.2.3', 1],
+        ['1.2.3', '1.3.0', -1],
+        ['2.0.0', '1.99.99', 1],
+        ['v1.2.3', '1.2.3', 0],
+    ])('compara %s con %s', (a, b, sign) => {
+        expect(Math.sign((0, versioning_1.compareSemver)(a, b))).toBe(sign);
+    });
+    it.each([
+        ['incompleta', '1.2'],
+        ['no numerica', 'x.y.z'],
+        ['vacia', ''],
+        ['basura', 'latest'],
+    ])('lanza ante una version %s en vez de devolver NaN', (_n, bad) => {
+        expect(() => (0, versioning_1.compareSemver)(bad, '1.0.0')).toThrow(/not a semver/i);
+        expect(() => (0, versioning_1.compareSemver)('1.0.0', bad)).toThrow(/not a semver/i);
+    });
+    it('nunca devuelve NaN — el valor que hacia fallar el gate abierto', () => {
+        expect(Number.isNaN((0, versioning_1.compareSemver)('1.0.0', '2.0.0'))).toBe(false);
+    });
+});