agentic-workflow-manager 3.13.5 → 3.13.7

package/dist/tests/core/skill-integrity.test.js

@@ -16,7 +16,7 @@ describe('skill-integrity multi-root', () => {
     afterEach(() => {
         fs_1.default.rmSync(tmp, { recursive: true, force: true });
     });
-    it('repairGlobalSkills re-links a dangling symlink to the FIRST root that has the skill', () => {
+    it('repairSkillLinks re-links a dangling symlink to the FIRST root that has the skill', () => {
         const skillsDir = path_1.default.join(tmp, 'installed');
         const rootA = path_1.default.join(tmp, 'base');
         const rootB = path_1.default.join(tmp, 'personal');
@@ -25,16 +25,16 @@ describe('skill-integrity multi-root', () => {
         fs_1.default.writeFileSync(path_1.default.join(rootB, 'skills', 'mine', 'SKILL.md'), '---\nname: mine\n---\n');
         // dangling symlink: points to a deleted target
         fs_1.default.symlinkSync(path_1.default.join(tmp, 'gone', 'mine'), path_1.default.join(skillsDir, 'mine'), 'dir');
-        const { repairGlobalSkills: repair } = require('../../src/core/skill-integrity');
+        const { repairSkillLinks: repair } = require('../../src/core/skill-integrity');
         const r = repair(skillsDir, [rootA, rootB]);
         expect(r.relinked).toEqual(['mine']);
         expect(fs_1.default.realpathSync(path_1.default.join(skillsDir, 'mine'))).toBe(fs_1.default.realpathSync(path_1.default.join(rootB, 'skills', 'mine')));
     });
-    it('classifyGlobalSkills marks dead when NO root has the skill', () => {
+    it('classifySkillLinks marks dead when NO root has the skill', () => {
         const skillsDir = path_1.default.join(tmp, 'installed');
         fs_1.default.mkdirSync(skillsDir, { recursive: true });
         fs_1.default.symlinkSync(path_1.default.join(tmp, 'gone', 'nope'), path_1.default.join(skillsDir, 'nope'), 'dir');
-        const { classifyGlobalSkills: classify } = require('../../src/core/skill-integrity');
+        const { classifySkillLinks: classify } = require('../../src/core/skill-integrity');
         const c = classify(skillsDir, [path_1.default.join(tmp, 'base')]);
         expect(c.dead).toEqual(['nope']);
     });
@@ -53,7 +53,7 @@ function makeRegistrySkill(registryContentDir, name) {
     fs_1.default.writeFileSync(path_1.default.join(dir, 'SKILL.md'), `# ${name}\n`);
     return dir;
 }
-describe('classifyGlobalSkills', () => {
+describe('classifySkillLinks', () => {
     it('classifies valid / repairable / dead', () => {
         const { skillsDir, registryContentDir } = setup();
         // valid: symlink a una skill que existe en el registry
@@ -64,13 +64,13 @@ describe('classifyGlobalSkills', () => {
         fs_1.default.symlinkSync(path_1.default.join('/nonexistent/old-root/beta'), path_1.default.join(skillsDir, 'beta'), 'dir');
         // dead: symlink colgante y la skill NO existe en el registry
         fs_1.default.symlinkSync(path_1.default.join('/nonexistent/old-root/gamma'), path_1.default.join(skillsDir, 'gamma'), 'dir');
-        const result = (0, skill_integrity_1.classifyGlobalSkills)(skillsDir, [registryContentDir]);
+        const result = (0, skill_integrity_1.classifySkillLinks)(skillsDir, [registryContentDir]);
         expect(result.valid).toEqual(['alpha']);
         expect(result.repairable).toEqual(['beta']);
         expect(result.dead).toEqual(['gamma']);
     });
     it('returns empty arrays when the skills dir does not exist', () => {
-        const result = (0, skill_integrity_1.classifyGlobalSkills)('/nonexistent/dir', ['/also/nonexistent']);
+        const result = (0, skill_integrity_1.classifySkillLinks)('/nonexistent/dir', ['/also/nonexistent']);
         expect(result).toEqual({ valid: [], repairable: [], dead: [] });
     });
 });
@@ -117,7 +117,7 @@ describe('reconcileAllSkillLinks (#4 — awm update, all providers)', () => {
         }
     });
 });
-describe('repairGlobalSkills', () => {
+describe('repairSkillLinks', () => {
     it('re-links repairable to registry content dir and prunes dead; valid untouched; idempotent', () => {
         const { skillsDir, registryContentDir } = setup();
         const okTarget = makeRegistrySkill(registryContentDir, 'alpha');
@@ -125,7 +125,7 @@ describe('repairGlobalSkills', () => {
         makeRegistrySkill(registryContentDir, 'beta');
         fs_1.default.symlinkSync(path_1.default.join('/nonexistent/old-root/beta'), path_1.default.join(skillsDir, 'beta'), 'dir');
         fs_1.default.symlinkSync(path_1.default.join('/nonexistent/old-root/gamma'), path_1.default.join(skillsDir, 'gamma'), 'dir');
-        const r1 = (0, skill_integrity_1.repairGlobalSkills)(skillsDir, [registryContentDir]);
+        const r1 = (0, skill_integrity_1.repairSkillLinks)(skillsDir, [registryContentDir]);
         expect(r1.relinked).toEqual(['beta']);
         expect(r1.pruned).toEqual(['gamma']);
         // beta ahora apunta al registry content dir y resuelve
@@ -137,7 +137,7 @@ describe('repairGlobalSkills', () => {
         // alpha intacto
         expect(fs_1.default.existsSync(path_1.default.join(skillsDir, 'alpha'))).toBe(true);
         // idempotente: segunda corrida no cambia nada
-        const r2 = (0, skill_integrity_1.repairGlobalSkills)(skillsDir, [registryContentDir]);
+        const r2 = (0, skill_integrity_1.repairSkillLinks)(skillsDir, [registryContentDir]);
         expect(r2.relinked).toEqual([]);
         expect(r2.pruned).toEqual([]);
     });

package/dist/tests/core/skill-repair-safety.test.js

@@ -0,0 +1,92 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Regresion: `repairSkillLinks` hacia `rmSync` del link colgante y RECIEN
+// DESPUES intentaba recrearlo con `symlinkSync(..., 'dir')`. En Windows un
+// symlink de directorio exige SeCreateSymbolicLinkPrivilege, denegado por
+// defecto en cuentas sin privilegios — asi que el link se borraba y la
+// recreacion tiraba EPERM: el usuario quedaba PEOR que antes, y con la entrada
+// ya ausente el siguiente `awm init` ni siquiera podia verla como reparable.
+//
+// `executor.ts` documenta en extenso que en win32 hay que usar `'junction'`
+// (que cualquier cuenta puede crear, y que libuv reporta igual que un symlink);
+// este sitio nunca recibio ese fix.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const skill_integrity_1 = require("../../src/core/skill-integrity");
+describe('repairSkillLinks: un fallo nunca deja al usuario peor que antes', () => {
+    let skillsDir;
+    let registry;
+    beforeEach(() => {
+        const base = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-repair-'));
+        skillsDir = path_1.default.join(base, 'skills-installed');
+        registry = path_1.default.join(base, 'registry');
+        fs_1.default.mkdirSync(skillsDir, { recursive: true });
+        fs_1.default.mkdirSync(path_1.default.join(registry, 'skills', 'alpha'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(registry, 'skills', 'alpha', 'SKILL.md'), '---\nname: alpha\ndescription: d\n---\nb');
+    });
+    /** Un symlink colgante: apunta a algo que no existe, pero el registry SI
+     *  tiene la skill — o sea, reparable. */
+    function danglingLink(name) {
+        fs_1.default.symlinkSync(path_1.default.join(skillsDir, '__no_existe__'), path_1.default.join(skillsDir, name), 'dir');
+    }
+    it('repara un link colgante apuntandolo al registry', () => {
+        danglingLink('alpha');
+        const result = (0, skill_integrity_1.repairSkillLinks)(skillsDir, [registry]);
+        expect(result.relinked).toContain('alpha');
+        expect(fs_1.default.existsSync(path_1.default.join(skillsDir, 'alpha'))).toBe(true);
+        expect(fs_1.default.realpathSync(path_1.default.join(skillsDir, 'alpha')))
+            .toBe(fs_1.default.realpathSync(path_1.default.join(registry, 'skills', 'alpha')));
+    });
+    it('si la creacion del link falla, el estado original NO se destruye', () => {
+        danglingLink('alpha');
+        const before = fs_1.default.readlinkSync(path_1.default.join(skillsDir, 'alpha'));
+        // Simula la denegacion de privilegio de Windows.
+        const spy = jest.spyOn(fs_1.default, 'symlinkSync').mockImplementation(() => {
+            const err = new Error('operation not permitted');
+            err.code = 'EPERM';
+            throw err;
+        });
+        try {
+            const result = (0, skill_integrity_1.repairSkillLinks)(skillsDir, [registry]);
+            expect(result.failed).toContain('alpha');
+            expect(result.relinked).not.toContain('alpha');
+            // Lo que importa: la entrada sigue existiendo, con su target
+            // original. Antes quedaba borrada — invisible incluso para el
+            // proximo intento de reparacion.
+            expect(fs_1.default.lstatSync(path_1.default.join(skillsDir, 'alpha')).isSymbolicLink()).toBe(true);
+            expect(fs_1.default.readlinkSync(path_1.default.join(skillsDir, 'alpha'))).toBe(before);
+        }
+        finally {
+            spy.mockRestore();
+        }
+    });
+    it('no deja archivos de staging tirados tras una reparacion exitosa', () => {
+        danglingLink('alpha');
+        (0, skill_integrity_1.repairSkillLinks)(skillsDir, [registry]);
+        expect(fs_1.default.readdirSync(skillsDir).filter((e) => e.includes('.relink'))).toEqual([]);
+    });
+    it('no deja archivos de staging tirados tras un fallo', () => {
+        danglingLink('alpha');
+        const spy = jest.spyOn(fs_1.default, 'renameSync').mockImplementation(() => { throw new Error('boom'); });
+        try {
+            (0, skill_integrity_1.repairSkillLinks)(skillsDir, [registry]);
+        }
+        finally {
+            spy.mockRestore();
+        }
+        // El staging puede sobrevivir a un crash duro, pero se limpia en el
+        // siguiente intento — se verifica que una segunda pasada converge.
+        (0, skill_integrity_1.repairSkillLinks)(skillsDir, [registry]);
+        expect(fs_1.default.readdirSync(skillsDir).filter((e) => e.includes('.relink'))).toEqual([]);
+    });
+    it('poda un link muerto (sin contraparte en el registry)', () => {
+        danglingLink('fantasma');
+        const result = (0, skill_integrity_1.repairSkillLinks)(skillsDir, [registry]);
+        expect(result.pruned).toContain('fantasma');
+        expect(fs_1.default.existsSync(path_1.default.join(skillsDir, 'fantasma'))).toBe(false);
+    });
+});

package/dist/tests/core/sync-profile-atomicity.test.js

@@ -0,0 +1,122 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// `awm sync` over a profile with N extensions ran N independent transactions —
+// one `planInstall` + `applyInstallPlan` per extension, in a loop. Each is atomic on
+// its own, none is atomic with the others, so a failure on extension 3 left 1 and 2
+// installed and the tree in a state that matched neither before nor after:
+//
+//     extensions: [a, b, c]
+//     a → tx-1  committed
+//     b → tx-2  committed
+//     c → throws           ← a and b stay installed, sync exits non-zero
+//
+// And the transaction IDs — the only handle `awm backup restore` accepts — were
+// collected into `transactionIds` and then never printed by any caller, so even the
+// committed halves could not be named to undo them by hand.
+//
+// One plan for the whole sync. `planInstall` already dedups by physical target across
+// artifacts, so combining the extensions loses nothing; and `applyInstallPlan` already
+// rolls its own plan back on any failure, so combining is what makes the sync atomic.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const bundle_install_1 = require("../../src/core/bundle-install");
+function bundle(name, skills, contentRoot) {
+    return {
+        name, description: '', version: '1.0.0', scope: 'project', visibility: 'public',
+        dependsOn: [], skills: skills.map(n => ({ name: n })), workflows: [], agents: [],
+        source: `bundles/${name}`, contentRoot,
+    };
+}
+describe('awm sync is one transaction, not one per extension', () => {
+    let projectRoot;
+    let contentDir;
+    let home;
+    let saved;
+    let bundles;
+    beforeEach(() => {
+        home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-atomic-home-'));
+        saved = { HOME: process.env.HOME, AWM_HOME: process.env.AWM_HOME };
+        process.env.HOME = home;
+        process.env.AWM_HOME = path_1.default.join(home, '.awm');
+        fs_1.default.mkdirSync(path_1.default.join(home, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(home, '.awm', 'preferences.json'), JSON.stringify({
+            enabledAgents: ['claude-code'], defaultAgent: 'claude-code',
+            installMethod: 'symlink', defaultScope: 'global',
+        }));
+        contentDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-atomic-content-'));
+        for (const s of ['skill-a', 'skill-b', 'skill-c']) {
+            fs_1.default.mkdirSync(path_1.default.join(contentDir, 'skills', s), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(contentDir, 'skills', s, 'SKILL.md'), `---\nname: ${s}\ndescription: d\n---\n`);
+        }
+        bundles = [
+            bundle('ext-a', ['skill-a'], contentDir),
+            bundle('ext-b', ['skill-b'], contentDir),
+            bundle('ext-c', ['skill-c'], contentDir),
+        ];
+        projectRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-atomic-proj-'));
+        fs_1.default.mkdirSync(path_1.default.join(projectRoot, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, '.awm', 'profile.json'), JSON.stringify({ extensions: ['ext-a', 'ext-b', 'ext-c'] }));
+    });
+    afterEach(() => {
+        if (saved.HOME === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = saved.HOME;
+        if (saved.AWM_HOME === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = saved.AWM_HOME;
+        for (const d of [home, contentDir, projectRoot])
+            fs_1.default.rmSync(d, { recursive: true, force: true });
+    });
+    const run = (applyPlan) => (0, bundle_install_1.syncProfile)({ projectRoot, bundles, agents: ['claude-code'], method: 'symlink', contentDir, applyPlan });
+    it('applies a single plan covering every extension', () => {
+        const plans = [];
+        const result = run((plan) => {
+            plans.push(plan);
+            return { installed: plan.operations.map(o => o.targetPath), skipped: [], transactionId: 'tx-1', modifiedFiles: [] };
+        });
+        expect(plans).toHaveLength(1);
+        const names = plans[0].operations.map(o => path_1.default.basename(o.targetPath)).sort();
+        expect(names).toEqual(['skill-a', 'skill-b', 'skill-c']);
+        expect(result.transactionIds).toEqual(['tx-1']);
+    });
+    it('installs nothing at all when the apply fails — no half-synced tree', () => {
+        // The failure is on the LAST extension on purpose: with one transaction per
+        // extension, ext-a and ext-b were already committed by the time ext-c blew up.
+        const committed = [];
+        expect(() => run((plan) => {
+            const names = plan.operations.map(o => path_1.default.basename(o.targetPath));
+            if (names.includes('skill-c'))
+                throw new Error('verification failed');
+            committed.push(...names);
+            return { installed: names, skipped: [], transactionId: `tx-${committed.length}`, modifiedFiles: [] };
+        })).toThrow(/verification failed/);
+        expect(committed).toEqual([]);
+    });
+    it('skips unknown extensions without splitting the transaction', () => {
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, '.awm', 'profile.json'), JSON.stringify({ extensions: ['ext-a', 'ghost', 'ext-c'] }));
+        const plans = [];
+        const result = run((plan) => {
+            plans.push(plan);
+            return { installed: [], skipped: [], transactionId: 'tx-1', modifiedFiles: [] };
+        });
+        expect(plans).toHaveLength(1);
+        expect(plans[0].operations.map(o => path_1.default.basename(o.targetPath)).sort()).toEqual(['skill-a', 'skill-c']);
+        expect(result.skipped.some(s => s.includes('ghost'))).toBe(true);
+    });
+    it('does not apply anything when every extension is unknown', () => {
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, '.awm', 'profile.json'), JSON.stringify({ extensions: ['ghost'] }));
+        let applyCalls = 0;
+        const result = run(() => {
+            applyCalls++;
+            return { installed: [], skipped: [], transactionId: 'tx-1', modifiedFiles: [] };
+        });
+        expect(applyCalls).toBe(0);
+        expect(result.transactionIds).toEqual([]);
+    });
+});

package/dist/tests/integration/copilot-init-isolated.test.js

@@ -75,9 +75,9 @@ describe('copilot provider — isolated home E2E (devCore global-scope guard reg
         fs_1.default.writeFileSync(path_1.default.join(root, 'hooks/session-start'), '#!/bin/sh\necho "{}"\n', { mode: 0o755 });
         fs_1.default.writeFileSync(path_1.default.join(root, 'hooks/run-hook.cmd'), '#!/bin/sh\nexec sh "$1"\n', { mode: 0o755 });
         fs_1.default.mkdirSync(path_1.default.join(root, 'skills/using-awm'), { recursive: true });
-        fs_1.default.writeFileSync(path_1.default.join(root, 'skills/using-awm/SKILL.md'), '---\nname: using-awm\n---\nMUST invoke skills.');
+        fs_1.default.writeFileSync(path_1.default.join(root, 'skills/using-awm/SKILL.md'), '---\nname: using-awm\ndescription: Entry point for AWM skills.\n---\nMUST invoke skills.');
         fs_1.default.mkdirSync(path_1.default.join(root, 'skills/development-process'), { recursive: true });
-        fs_1.default.writeFileSync(path_1.default.join(root, 'skills/development-process/SKILL.md'), '---\nname: development-process\n---\nOrchestrates the dev lifecycle.');
+        fs_1.default.writeFileSync(path_1.default.join(root, 'skills/development-process/SKILL.md'), '---\nname: development-process\ndescription: Orchestrates the development lifecycle.\n---\nOrchestrates the dev lifecycle.');
         fs_1.default.writeFileSync(path_1.default.join(root, 'catalog.json'), JSON.stringify({
             version: 1,
             bundles: [{ name: 'dev-core', source: 'bundles/dev-core', version: '1.0.0', scope: 'baseline', visibility: 'public' }],

package/dist/tests/providers/index.test.js

@@ -56,7 +56,7 @@ describe('Providers Routing', () => {
         expect((0, providers_1.providerFor)('codex')).toEqual({
             label: 'Codex',
             minimumVersion: '0.145.0',
-            versionCommand: { command: 'codex', args: ['--version'] },
+            versionCommand: { command: 'codex', args: ['--version'], versionPattern: /^codex-cli (\d+\.\d+\.\d+)$/ },
             skill: {
                 global: path_1.default.join(tmpHome, '.agents/skills'),
                 local: '.agents/skills',

package/dist/tests/structural/renderer-table-is-single-source.test.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Structural guard, in the vein of exec-invocation-explicit-stdio.test.ts: it does not
+// test behaviour, it forbids the SHAPE that produced a whole family of bugs.
+//
+// "What filename does renderer R produce" existed in four places. Three agreed; the
+// fourth — the one deciding whether a rendered artifact counted as installed — had
+// never heard of `.mdc` or `.instructions.md`, so `awm add` re-installed the same
+// Cursor/Copilot artifacts on every run and `awm doctor` called a healthy install
+// absent. Each instance was individually reasonable; the class is what cost a release.
+//
+// `core/renderers/registry.ts` is now the single table. This test fails the moment a
+// second one appears, whether by a new literal map or by a fresh `switch` over renderer
+// ids somewhere that should have asked the table.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const SRC = path_1.default.join(__dirname, '..', '..', 'src');
+const REGISTRY = path_1.default.join(SRC, 'core', 'renderers', 'registry.ts');
+/** Every .ts file under src/, recursively. */
+function sourceFiles(dir) {
+    const out = [];
+    for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+        const full = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...sourceFiles(full));
+        else if (entry.name.endsWith('.ts'))
+            out.push(full);
+    }
+    return out;
+}
+/** The file's lines with `//` comments and blank lines dropped — a renderer id named in
+ *  prose (a doc comment explaining the bug) is not a second implementation of the table. */
+function codeLines(file) {
+    const raw = fs_1.default.readFileSync(file, 'utf-8').split('\n');
+    const out = [];
+    let inBlockComment = false;
+    raw.forEach((line, i) => {
+        let l = line;
+        if (inBlockComment) {
+            const end = l.indexOf('*/');
+            if (end === -1)
+                return;
+            inBlockComment = false;
+            l = l.slice(end + 2);
+        }
+        const start = l.indexOf('/*');
+        if (start !== -1) {
+            inBlockComment = l.indexOf('*/', start) === -1;
+            l = l.slice(0, start) + (inBlockComment ? '' : l.slice(l.indexOf('*/', start) + 2));
+        }
+        const lineComment = l.indexOf('//');
+        if (lineComment !== -1)
+            l = l.slice(0, lineComment);
+        if (l.trim())
+            out.push({ line: l, n: i + 1 });
+    });
+    return out;
+}
+/** The extensions the renderer table owns. A literal here, outside the table, IS the bug. */
+const RENDERED_EXTENSIONS = ['.toml', '.mdc', '.instructions.md'];
+describe('the renderer table is the only renderer table', () => {
+    const files = sourceFiles(SRC).filter((f) => f !== REGISTRY);
+    it('no other source file maps a renderer id to a file extension', () => {
+        const offenders = [];
+        for (const file of files) {
+            for (const { line, n } of codeLines(file)) {
+                // A renderer-to-extension mapping looks like an id and an extension on
+                // the same line of code. That is exactly the shape of every copy that
+                // drifted, and nothing legitimate needs to write both at once now that
+                // `rendererExtension`/`renderedFilename` exist.
+                const namesRenderer = /'(codex-agent-toml|cursor-mdc|copilot-instructions)'/.test(line);
+                const namesExtension = RENDERED_EXTENSIONS.some((e) => line.includes(`'${e}'`) || line.includes(`"${e}"`));
+                if (namesRenderer && namesExtension) {
+                    offenders.push(`${path_1.default.relative(SRC, file)}:${n}: ${line.trim()}`);
+                }
+            }
+        }
+        expect(offenders).toEqual([]);
+    });
+    it('the table itself still covers every declared renderer', () => {
+        // The guard above is only worth anything if the one surviving table is complete:
+        // a renderer added to `RendererId` but not to the table would make the guard
+        // push every caller toward a lookup that has no answer.
+        const { RENDERER_IDS } = require('../../src/providers');
+        const { rendererExtension } = require('../../src/core/renderers/registry');
+        for (const id of RENDERER_IDS) {
+            // `null` (the `link` renderer, which keeps the name as-is) is an ANSWER;
+            // `undefined` is the table not knowing about the renderer at all.
+            expect(rendererExtension(id)).not.toBeUndefined();
+        }
+    });
+});

package/dist/tests/structural/support-matrix-is-current.test.js

@@ -0,0 +1,100 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Guarda estructural: `docs/support-matrix.md` no puede desalinearse de
+// `src/providers/index.ts`.
+//
+// La tabla escrita a mano ya mintio. Decia que Antigravity instalaba en
+// `~/.agents/skills` y `.agents/skills`; el codigo dice `~/.gemini/antigravity/skills` y
+// `.agent/skills` — singular — y ademas es el unico provider con `global_workflows`, cosa
+// que la tabla ni mencionaba. Nadie lo noto porque nada obligaba a mirarlo: la tabla se
+// escribio una vez, el codigo siguio cambiando, y el documento se cita en presentaciones y
+// se planifica encima.
+//
+// Este test hace que ese desvio sea imposible de mergear. No verifica que la tabla sea
+// "linda": verifica que sea LA MISMA que produce el codigo hoy.
+const fs_1 = __importDefault(require("fs"));
+const support_matrix_1 = require("../../scripts/support-matrix");
+describe('docs/support-matrix.md refleja el codigo', () => {
+    it('el bloque generado esta al dia', () => {
+        const doc = fs_1.default.readFileSync(support_matrix_1.DOC_PATH, 'utf-8');
+        const expected = (0, support_matrix_1.spliceGenerated)(doc, (0, support_matrix_1.renderProviderTables)());
+        // Mensaje accionable: el que rompe esto casi siempre acaba de tocar
+        // providers/index.ts y no sabe que este documento existe.
+        expect(doc).toBe(expected);
+    });
+    it('el documento conserva sus marcadores', () => {
+        const doc = fs_1.default.readFileSync(support_matrix_1.DOC_PATH, 'utf-8');
+        expect(doc).toContain(support_matrix_1.BEGIN_MARKER);
+        expect(doc).toContain(support_matrix_1.END_MARKER);
+    });
+    it('la tabla nombra a los seis providers declarados', () => {
+        // Que el bloque este "al dia" no sirve si el generador se olvidara de un provider:
+        // doc y generador coincidirian, los dos incompletos.
+        const { AGENT_TARGETS } = require('../../src/providers');
+        const generated = (0, support_matrix_1.renderProviderTables)();
+        for (const agent of AGENT_TARGETS) {
+            expect(generated).toContain(`\`${agent}\``);
+        }
+    });
+    it('abrevia el home y usa separadores POSIX, para no depender de la maquina', () => {
+        // Con un HOME inventado: si la tabla dependiera de la maquina que la genera, este
+        // home apareceria literal en la salida y el doc comiteado cambiaria segun quien
+        // corriera el generador — el test de arriba se volveria ruido permanente.
+        const saved = process.env.HOME;
+        process.env.HOME = '/home/inventado';
+        try {
+            jest.resetModules();
+            const { renderProviderTables: fresh } = require('../../scripts/support-matrix');
+            const generated = fresh();
+            expect(generated).toContain('`~/.claude/skills`');
+            expect(generated).not.toContain('/home/inventado');
+            expect(generated).not.toContain('\\');
+        }
+        finally {
+            if (saved === undefined)
+                delete process.env.HOME;
+            else
+                process.env.HOME = saved;
+            jest.resetModules();
+        }
+    });
+    // La abreviacion a `~` se probaba solo end-to-end, y en Linux eso no distingue entre
+    // "normaliza bien" y "los separadores ya coincidian". La CI de Windows encontro que no
+    // normalizaba: comparaba el prefijo ANTES de convertir separadores, asi que alla no
+    // abreviaba nada y la tabla regenerada no era la comiteada. Probar la unidad con las
+    // dos formas de ruta lo detecta en cualquier sistema, sin fingir la plataforma.
+    describe('homeRelative normaliza antes de comparar', () => {
+        it.each([
+            ['posix', '/home/x', '/home/x/.claude/skills', '~/.claude/skills'],
+            ['win32', 'C:\\Users\\x', 'C:\\Users\\x\\.claude\\skills', '~/.claude/skills'],
+            ['mixto', '/home/x', '\\home\\x\\.claude\\skills', '~/.claude/skills'],
+            ['sin prefijo', '/home/x', '/opt/otro/skills', '/opt/otro/skills'],
+        ])('%s', (_n, home, input, expected) => {
+            expect((0, support_matrix_1.homeRelative)(input, home)).toBe(expected);
+        });
+        it('nunca deja un separador de Windows en la salida', () => {
+            expect((0, support_matrix_1.homeRelative)('C:\\Users\\x\\.codex\\agents', 'C:\\Users\\x')).not.toContain('\\');
+        });
+    });
+    it('respeta el fin de linea del documento (un checkout de Windows entrega CRLF)', () => {
+        // Sin esto, regenerar en Windows dejaba el archivo con finales mezclados y el test
+        // de arriba fallaba por bytes ajenos al contenido. Es el mismo error de fondo que
+        // el de los separadores: asumir la forma de POSIX para un dato que la plataforma
+        // decide.
+        const crlfDoc = `intro\r\n${support_matrix_1.BEGIN_MARKER}\r\nviejo\r\n${support_matrix_1.END_MARKER}\r\nfin\r\n`;
+        const out = (0, support_matrix_1.spliceGenerated)(crlfDoc, 'linea uno\nlinea dos');
+        expect(out).toContain('linea uno\r\nlinea dos');
+        expect(out.split('\r\n').length - 1).toBe(out.split('\n').length - 1); // ni un LF suelto
+    });
+    it('marca como no soportado, no como ausente, el scope que un provider no tiene', () => {
+        // La diferencia entre "no soportado" y una celda vacia es exactamente lo que el
+        // documento existe para no dejar ambiguo: Copilot no tiene scope global por
+        // decision del producto que integramos, no porque falte implementarlo.
+        const generated = (0, support_matrix_1.renderProviderTables)();
+        const copilotRow = generated.split('\n').find((l) => l.startsWith('| `copilot` |'));
+        expect(copilotRow).toContain('**no soportado**');
+    });
+});

package/dist/tests/structural/symlink-type-is-explicit.test.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Structural guard, same family as exec-invocation-explicit-stdio.test.ts.
+//
+// `fs.symlinkSync(target, dest)` with no third argument creates a DIRECTORY symlink on
+// Windows when the target is a directory, and that needs SeCreateSymbolicLinkPrivilege
+// — denied by default on unprivileged accounts, including GitHub Actions'
+// windows-latest runner. The same omission has been fixed one site at a time, more
+// than once, each fix landing where the bug was reported and nowhere else:
+// `executor.ts` learned `'junction'`, and `skill-integrity.ts` did not, for a whole
+// release — its comment still says "este sitio nunca recibio el fix".
+//
+// So the rule is about the CALL, not about any one call site: every `fs.symlinkSync`
+// either passes an explicit type argument, or is wrapped in a `try` whose `catch`
+// falls back to a copy. Those are the only two ways this survives Windows, and one of
+// them has to be visible at the call.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const SRC = path_1.default.join(__dirname, '..', '..', 'src');
+function sourceFiles(dir) {
+    const out = [];
+    for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+        const full = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...sourceFiles(full));
+        else if (entry.name.endsWith('.ts'))
+            out.push(full);
+    }
+    return out;
+}
+/** True when `lines[i]` sits inside a try block whose catch copies instead. Deliberately
+ *  shallow — it looks a few lines ahead for the catch, which is what every real fallback
+ *  in this codebase looks like. A cleverer arrangement that defeats it should be written
+ *  with an explicit type argument instead. */
+function hasCopyFallback(lines, i) {
+    const window = lines.slice(Math.max(0, i - 3), i + 8).join('\n');
+    return /\btry\b/.test(window) && /catch\b/.test(window) && /copyFileSync|cpSync/.test(window);
+}
+describe('every symlink creation survives Windows on purpose', () => {
+    it('passes an explicit type argument or falls back to a copy', () => {
+        const offenders = [];
+        for (const file of sourceFiles(SRC)) {
+            const lines = fs_1.default.readFileSync(file, 'utf-8').split('\n');
+            lines.forEach((line, i) => {
+                if (!/\bfs\.symlinkSync\s*\(/.test(line))
+                    return;
+                // Three arguments — the third is the type ('junction' | 'dir' | 'file').
+                const explicitType = /symlinkSync\s*\([^)]*,[^)]*,\s*[^)]+\)/.test(line) ||
+                    /'junction'|'dir'|'file'/.test(lines.slice(i, i + 3).join('\n'));
+                if (explicitType || hasCopyFallback(lines, i))
+                    return;
+                offenders.push(`${path_1.default.relative(SRC, file)}:${i + 1}: ${line.trim()}`);
+            });
+        }
+        expect(offenders).toEqual([]);
+    });
+    it('the guard actually rejects a bare two-argument call', () => {
+        // Without this, a guard whose regex silently stopped matching would read as a
+        // clean bill of health forever — the failure mode of every structural test.
+        const bare = ['fs.symlinkSync(source, dest);'];
+        const explicit = ["fs.symlinkSync(source, dest, 'junction');"];
+        const wrapped = ['try {', 'fs.symlinkSync(source, dest);', '} catch {', 'fs.copyFileSync(source, dest);', '}'];
+        const rejects = (lines, i) => !/symlinkSync\s*\([^)]*,[^)]*,\s*[^)]+\)/.test(lines[i]) &&
+            !/'junction'|'dir'|'file'/.test(lines.slice(i, i + 3).join('\n')) &&
+            !hasCopyFallback(lines, i);
+        expect(rejects(bare, 0)).toBe(true);
+        expect(rejects(explicit, 0)).toBe(false);
+        expect(rejects(wrapped, 1)).toBe(false);
+    });
+});

package/dist/tests/support/tmp.js

@@ -0,0 +1,31 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mkCanonicalTmpDir = mkCanonicalTmpDir;
+// Directorios temporales en forma canonica, para tests que comparan rutas.
+//
+// En macOS `os.tmpdir()` devuelve `/var/folders/…`, que es un SYMLINK a
+// `/private/var/folders/…`. El producto resuelve el root del proyecto con `realpathSync`
+// (`findProjectRoot`, `core/profile.ts`), asi que devuelve la forma canonica. Un test que
+// arma su expectativa con el `mkdtemp` crudo compara `/var/…` contra `/private/var/…` y
+// falla sobre un producto que se comporta bien. En Linux y Windows las dos formas
+// coinciden, asi que el problema es invisible hasta que corre en macOS — paso tres veces
+// en la primera corrida de macOS en CI.
+//
+// Usar esto en cualquier test que:
+//   - compare una ruta contra la que devuelve el producto, o
+//   - le pase el tmpdir al producto y despues afirme sobre lo que salio.
+//
+// Un test que solo escribe y lee archivos bajo su tmpdir no lo necesita: las dos formas
+// llegan al mismo inodo. Por eso esto es un helper y no una migracion masiva — envolver
+// los 113 archivos que crean tmpdirs seria ruido, no rigor.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+/** `fs.mkdtempSync` + `realpathSync`: el mismo directorio, en la forma que el producto
+ *  va a usar. El `realpathSync` no puede fallar — el directorio acaba de crearse. */
+function mkCanonicalTmpDir(prefix) {
+    return fs_1.default.realpathSync(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), prefix)));
+}

package/dist/tests/utils/registry-view-overrides.test.js

@@ -25,9 +25,9 @@ describe('registry-view override markers', () => {
         fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
     });
     it('packageDetailLines marks an overridden skill with its registry name', () => {
-        const { REGISTRIES_DIR } = require('../../src/core/registries');
+        const { registriesDir } = require('../../src/core/registries');
         const { buildPackageView, packageDetailLines } = require('../../src/utils/registry-view');
-        const teamSkillPath = path_1.default.join(REGISTRIES_DIR, 'team-acme', 'skills', 'brainstorming');
+        const teamSkillPath = path_1.default.join(registriesDir(), 'team-acme', 'skills', 'brainstorming');
         const view = buildPackageView([{ name: 'brainstorming', path: teamSkillPath, description: 'd', overrode: '/old/path' }], [], [], []);
         const lines = packageDetailLines(view[0]).join('\n');
         expect(lines).toContain('brainstorming');