agentic-workflow-manager 3.2.0 → 3.2.1

package/dist/src/core/init/provider-facts.js

@@ -85,19 +85,34 @@ function hashDirectoryTree(dir, exclude) {
     });
     return parts.join('|');
 }
+/** Canonical digest for "this agent owns nothing here" — see hashPath. */
+const NO_CONTENT = 'absent';
 function hashPath(target, exclude) {
     let stat;
     try {
         stat = fs_1.default.lstatSync(target);
     }
     catch {
-        return 'absent';
+        return NO_CONTENT;
     }
     if (stat.isSymbolicLink()) {
         return `symlink:${fs_1.default.readlinkSync(target)}`;
     }
     if (stat.isDirectory()) {
-        return `dir:${hashDirectoryTree(target, exclude)}`;
+        const tree = hashDirectoryTree(target, exclude);
+        // A managed directory that exists but holds nothing this agent owns is
+        // indistinguishable, for R19's purposes, from one that doesn't exist:
+        // either way Claude has no hook, no skill and no agent installed there.
+        // Collapsing both to one digest is what makes a Codex-only bootstrap
+        // possible — Codex's scriptsDir (~/.awm/hooks/codex) is nested inside
+        // Claude's (~/.awm/hooks), so installing the Codex hook necessarily
+        // creates Claude's directory via `mkdirSync(..., {recursive: true})`
+        // (commands/hooks/shared.ts). On a machine that never ran a Claude
+        // init, that flipped Claude's digest from absent to `dir:` and aborted
+        // every `awm init --agent codex` — the exact fresh-cloud-box scenario
+        // Codex Cloud boots into. Genuine changes still register: content
+        // appearing here, or being emptied out, both move the digest.
+        return tree === '' ? NO_CONTENT : `dir:${tree}`;
     }
     return `file:${hashFileContent(target)}`;
 }

package/dist/tests/core/init/provider-facts.test.js

@@ -111,6 +111,54 @@ describe('gatherProviderFacts / assertClaudeBaselinePreserved', () => {
         expect(afterModify.hash).toBe(before.hash);
         expect(() => assertClaudeBaselinePreserved(before, afterModify)).not.toThrow();
     });
+    // -----------------------------------------------------------------------
+    // Codex-only bootstrap: Claude's scriptsDir has NEVER existed.
+    //
+    // Every nested-exclusion test above seeds ~/.awm/hooks first, so they only
+    // ever exercise the present→present transition. On a fresh Codex-only
+    // machine (a cloud box, the actual rollout target) that directory does not
+    // exist, and installing the Codex hook creates it as a side effect of
+    // `mkdirSync(dirname, {recursive:true})` in syncExecutable — flipping
+    // Claude's own scriptsDir from absent to present-but-empty. That is not a
+    // change to anything Claude owns, but it moved the hash and aborted init.
+    // -----------------------------------------------------------------------
+    it('does NOT flag Codex creating its nested scriptsDir when Claude\'s has never existed', () => {
+        const { gatherProviderFacts, assertClaudeBaselinePreserved } = require('../../../src/core/init/provider-facts');
+        const claudeScripts = path_1.default.join(tmpHome, '.awm', 'hooks');
+        expect(fs_1.default.existsSync(claudeScripts)).toBe(false);
+        const before = gatherProviderFacts('claude-code');
+        // Exactly what syncExecutable does for the Codex hook: one recursive
+        // mkdir that necessarily materializes Claude's hooks/ as the parent.
+        const codexScripts = path_1.default.join(claudeScripts, 'codex');
+        fs_1.default.mkdirSync(codexScripts, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(codexScripts, 'session-start'), '#!/bin/sh\necho codex\n');
+        const after = gatherProviderFacts('claude-code');
+        expect(after.hash).toBe(before.hash);
+        expect(() => assertClaudeBaselinePreserved(before, after)).not.toThrow();
+    });
+    it('still flags real Claude content appearing where the directory did not exist', () => {
+        const { gatherProviderFacts, assertClaudeBaselinePreserved } = require('../../../src/core/init/provider-facts');
+        const before = gatherProviderFacts('claude-code');
+        // The guard must not be relaxed into blindness: an absent directory
+        // gaining Claude-owned content is still a genuine baseline change.
+        const claudeScripts = path_1.default.join(tmpHome, '.awm', 'hooks');
+        fs_1.default.mkdirSync(claudeScripts, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(claudeScripts, 'session-start'), '#!/bin/sh\n');
+        const after = gatherProviderFacts('claude-code');
+        expect(after.hash).not.toBe(before.hash);
+        expect(() => assertClaudeBaselinePreserved(before, after)).toThrow(/must never happen \(R19\)/);
+    });
+    it('still flags Claude content being emptied out of an existing directory', () => {
+        const { gatherProviderFacts, assertClaudeBaselinePreserved } = require('../../../src/core/init/provider-facts');
+        const claudeScripts = path_1.default.join(tmpHome, '.awm', 'hooks');
+        fs_1.default.mkdirSync(claudeScripts, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(claudeScripts, 'session-start'), '#!/bin/sh\n');
+        const before = gatherProviderFacts('claude-code');
+        fs_1.default.rmSync(path_1.default.join(claudeScripts, 'session-start'));
+        const after = gatherProviderFacts('claude-code');
+        expect(after.hash).not.toBe(before.hash);
+        expect(() => assertClaudeBaselinePreserved(before, after)).toThrow(/must never happen \(R19\)/);
+    });
     it('still flags a genuinely Claude-owned change alongside an untouched Codex nested dir', () => {
         const { gatherProviderFacts, assertClaudeBaselinePreserved } = require('../../../src/core/init/provider-facts');
         const claudeScripts = path_1.default.join(tmpHome, '.awm', 'hooks');

package/dist/tests/integration/codex-provider-isolated.test.js

@@ -191,6 +191,35 @@ describe('codex provider — isolated home E2E (Task 9)', () => {
         // R19/R19.1/R23: nothing under Claude's baseline moved during the Codex run.
         expect(snapshotTree(path_1.default.join(tmpHome, '.claude'))).toEqual(claudeBefore);
     });
+    it('initializes Codex on a machine that has never run a Claude Code init', async () => {
+        // The E2E above inits claude-code FIRST, so ~/.awm/hooks always exists
+        // by the time Codex runs — which is precisely why it never caught this.
+        // A fresh Codex Cloud box has no Claude install at all, and installing
+        // the Codex hook creates ~/.awm/hooks as a side effect of the recursive
+        // mkdir for its own nested ~/.awm/hooks/codex. That flipped Claude's
+        // R19 baseline digest from absent to present-but-empty and aborted init
+        // with "Claude Code baseline changed during a non-Claude init".
+        seedPublicRegistryFixture(path_1.default.join(tmpHome, '.awm/registries/baseline'));
+        const { runInit } = require('../../src/commands/init');
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.awm/hooks'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.claude'))).toBe(false);
+        const codex = await runInit({
+            cwd: tmpWork,
+            yes: true,
+            agent: 'codex',
+            machineOnly: true,
+            assertProviderSupported: () => ({ provider: 'codex', version: '0.150.0' }),
+        });
+        // Exit 2 is the internal-error path the R19 guard aborts through.
+        expect(codex).toBeLessThanOrEqual(1);
+        expect(readPrefs().enabledAgents).toEqual(['codex']);
+        // The Codex hook really installed, and Claude gained no content of its own.
+        const hooksJson = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpHome, '.codex/hooks.json'), 'utf8'));
+        expect(hooksJson.hooks.SessionStart).toHaveLength(1);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.awm/hooks/codex/session-start'))).toBe(true);
+        expect(fs_1.default.readdirSync(path_1.default.join(tmpHome, '.awm/hooks'))).toEqual(['codex']);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.claude/settings.json'))).toBe(false);
+    });
     it('doctor reports the isolated Codex install as supported/healthy, not against the real ~/.awm', () => {
         seedPublicRegistryFixture(path_1.default.join(tmpHome, '.awm/registries/baseline'));
         writePrefs(prefsWith(['claude-code', 'codex']));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"