agentic-workflow-manager 3.2.0 → 3.2.2

package/dist/src/core/init/orchestrator.js

@@ -42,7 +42,26 @@ async function runInitSteps(deps) {
         steps.push(await wrapStep('project.constitutionInjection', 'project', () => (0, steps_1.stepConstitutionInjection)(deps)));
         steps.push(await wrapStep('project.context', 'project', () => (0, steps_1.stepContext)(deps)));
     }
+    // Re-gather fresh so the report reflects whatever the steps above just
+    // installed. `results` deliberately keeps every check — including project
+    // ones — so the render still shows real project state (e.g. "run awm sync")
+    // when one exists; only `overall`, the exit-code verdict, needs scoping.
+    //
+    // If this run started with project scope nulled — `--machine-only`
+    // (init.ts's effectiveCtx), or genuinely no project at this cwd — `overall`
+    // must reflect only what THIS run attempted. `runChecks` otherwise mixes
+    // machine + project results into one flat `overall` (checks.ts), so a
+    // `--machine-only` bootstrap into an already-initialized project with
+    // unrelated unsynced bundles reports "degraded" and callers gating on it
+    // (`runInit`'s exit code) fail a run that fully succeeded at everything it
+    // was asked to do — the exact shape of a real Codex Cloud bootstrap script
+    // aborting under `set -euo pipefail` right after `awm init`.
     const after = (0, checks_1.runChecks)((0, context_1.gatherContext)({ cwd: deps.cwd, bundles: deps.bundles, agent: deps.agent }));
+    if (deps.ctx.project === null) {
+        after.overall = after.results
+            .filter((r) => r.level === 'machine')
+            .some((r) => r.status === 'missing') ? 'degraded' : 'healthy';
+    }
     return {
         steps,
         applied: steps.filter((s) => s.action === 'applied').length,

package/dist/src/core/init/provider-facts.js

@@ -85,19 +85,34 @@ function hashDirectoryTree(dir, exclude) {
     });
     return parts.join('|');
 }
+/** Canonical digest for "this agent owns nothing here" — see hashPath. */
+const NO_CONTENT = 'absent';
 function hashPath(target, exclude) {
     let stat;
     try {
         stat = fs_1.default.lstatSync(target);
     }
     catch {
-        return 'absent';
+        return NO_CONTENT;
     }
     if (stat.isSymbolicLink()) {
         return `symlink:${fs_1.default.readlinkSync(target)}`;
     }
     if (stat.isDirectory()) {
-        return `dir:${hashDirectoryTree(target, exclude)}`;
+        const tree = hashDirectoryTree(target, exclude);
+        // A managed directory that exists but holds nothing this agent owns is
+        // indistinguishable, for R19's purposes, from one that doesn't exist:
+        // either way Claude has no hook, no skill and no agent installed there.
+        // Collapsing both to one digest is what makes a Codex-only bootstrap
+        // possible — Codex's scriptsDir (~/.awm/hooks/codex) is nested inside
+        // Claude's (~/.awm/hooks), so installing the Codex hook necessarily
+        // creates Claude's directory via `mkdirSync(..., {recursive: true})`
+        // (commands/hooks/shared.ts). On a machine that never ran a Claude
+        // init, that flipped Claude's digest from absent to `dir:` and aborted
+        // every `awm init --agent codex` — the exact fresh-cloud-box scenario
+        // Codex Cloud boots into. Genuine changes still register: content
+        // appearing here, or being emptied out, both move the digest.
+        return tree === '' ? NO_CONTENT : `dir:${tree}`;
     }
     return `file:${hashFileContent(target)}`;
 }

package/dist/tests/core/init/orchestrator.test.js

@@ -96,6 +96,34 @@ describe('runInitSteps — orchestrator', () => {
             fs_1.default.rmSync(bareCwd, { recursive: true, force: true });
         }
     });
+    it('machine-only inside an already-initialized project with unsynced bundles still reaches overall healthy', async () => {
+        // Reproduces a real Codex Cloud bootstrap: `awm init --agent codex --yes
+        // --machine-only` run with cwd inside an existing, previously-initialized
+        // project (its own `.awm/profile.json` already committed, declaring bundles
+        // this machine-only run was never asked to sync). The bare-cwd test above
+        // can't catch this — there, `ctx.project` is null for two reasons at once
+        // (machineOnly AND no project exists), so it never exercises "machineOnly
+        // nulled a project that actually has real, degraded content."
+        const root = path_1.default.join(tmpHome, 'existing-project');
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), JSON.stringify({ dependencies: { next: '14.0.0' } }));
+        // Declares the "dev" bundle active, but its skills were never symlinked —
+        // exactly `active bundles (N missing)` in the real report the user saw.
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'profile.json'), JSON.stringify({ extensions: ['dev'] }));
+        const deps = buildDeps(root);
+        deps.ctx.project = null; // what init.ts's effectiveCtx does for --machine-only
+        const { runInitSteps } = require('../../../src/core/init/orchestrator');
+        const out = await runInitSteps(deps);
+        // The steps this run actually attempted (machine-only) all succeeded —
+        // that must be reflected in the caller's exit code.
+        expect(out.steps.every((s) => s.action !== 'failed')).toBe(true);
+        expect(out.after.results.find((r) => r.id === 'machine.devCore')?.status).toBe('ok');
+        // Project state exists and IS genuinely degraded, and it must stay visible
+        // in the report (the CLI's own render still shows it) — but it must not
+        // drag down the overall verdict for a run that never touched project scope.
+        expect(out.after.results.some((r) => r.id === 'project.activation' && r.status === 'missing')).toBe(true);
+        expect(out.after.overall).toBe('healthy');
+    });
     it('project repo: applies activation/sensors, flags constitution+context as pending', async () => {
         const root = path_1.default.join(tmpHome, 'repo');
         fs_1.default.mkdirSync(path_1.default.join(root, '.awm'), { recursive: true });

package/dist/tests/core/init/provider-facts.test.js

@@ -111,6 +111,54 @@ describe('gatherProviderFacts / assertClaudeBaselinePreserved', () => {
         expect(afterModify.hash).toBe(before.hash);
         expect(() => assertClaudeBaselinePreserved(before, afterModify)).not.toThrow();
     });
+    // -----------------------------------------------------------------------
+    // Codex-only bootstrap: Claude's scriptsDir has NEVER existed.
+    //
+    // Every nested-exclusion test above seeds ~/.awm/hooks first, so they only
+    // ever exercise the present→present transition. On a fresh Codex-only
+    // machine (a cloud box, the actual rollout target) that directory does not
+    // exist, and installing the Codex hook creates it as a side effect of
+    // `mkdirSync(dirname, {recursive:true})` in syncExecutable — flipping
+    // Claude's own scriptsDir from absent to present-but-empty. That is not a
+    // change to anything Claude owns, but it moved the hash and aborted init.
+    // -----------------------------------------------------------------------
+    it('does NOT flag Codex creating its nested scriptsDir when Claude\'s has never existed', () => {
+        const { gatherProviderFacts, assertClaudeBaselinePreserved } = require('../../../src/core/init/provider-facts');
+        const claudeScripts = path_1.default.join(tmpHome, '.awm', 'hooks');
+        expect(fs_1.default.existsSync(claudeScripts)).toBe(false);
+        const before = gatherProviderFacts('claude-code');
+        // Exactly what syncExecutable does for the Codex hook: one recursive
+        // mkdir that necessarily materializes Claude's hooks/ as the parent.
+        const codexScripts = path_1.default.join(claudeScripts, 'codex');
+        fs_1.default.mkdirSync(codexScripts, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(codexScripts, 'session-start'), '#!/bin/sh\necho codex\n');
+        const after = gatherProviderFacts('claude-code');
+        expect(after.hash).toBe(before.hash);
+        expect(() => assertClaudeBaselinePreserved(before, after)).not.toThrow();
+    });
+    it('still flags real Claude content appearing where the directory did not exist', () => {
+        const { gatherProviderFacts, assertClaudeBaselinePreserved } = require('../../../src/core/init/provider-facts');
+        const before = gatherProviderFacts('claude-code');
+        // The guard must not be relaxed into blindness: an absent directory
+        // gaining Claude-owned content is still a genuine baseline change.
+        const claudeScripts = path_1.default.join(tmpHome, '.awm', 'hooks');
+        fs_1.default.mkdirSync(claudeScripts, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(claudeScripts, 'session-start'), '#!/bin/sh\n');
+        const after = gatherProviderFacts('claude-code');
+        expect(after.hash).not.toBe(before.hash);
+        expect(() => assertClaudeBaselinePreserved(before, after)).toThrow(/must never happen \(R19\)/);
+    });
+    it('still flags Claude content being emptied out of an existing directory', () => {
+        const { gatherProviderFacts, assertClaudeBaselinePreserved } = require('../../../src/core/init/provider-facts');
+        const claudeScripts = path_1.default.join(tmpHome, '.awm', 'hooks');
+        fs_1.default.mkdirSync(claudeScripts, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(claudeScripts, 'session-start'), '#!/bin/sh\n');
+        const before = gatherProviderFacts('claude-code');
+        fs_1.default.rmSync(path_1.default.join(claudeScripts, 'session-start'));
+        const after = gatherProviderFacts('claude-code');
+        expect(after.hash).not.toBe(before.hash);
+        expect(() => assertClaudeBaselinePreserved(before, after)).toThrow(/must never happen \(R19\)/);
+    });
     it('still flags a genuinely Claude-owned change alongside an untouched Codex nested dir', () => {
         const { gatherProviderFacts, assertClaudeBaselinePreserved } = require('../../../src/core/init/provider-facts');
         const claudeScripts = path_1.default.join(tmpHome, '.awm', 'hooks');

package/dist/tests/integration/codex-provider-isolated.test.js

@@ -191,6 +191,35 @@ describe('codex provider — isolated home E2E (Task 9)', () => {
         // R19/R19.1/R23: nothing under Claude's baseline moved during the Codex run.
         expect(snapshotTree(path_1.default.join(tmpHome, '.claude'))).toEqual(claudeBefore);
     });
+    it('initializes Codex on a machine that has never run a Claude Code init', async () => {
+        // The E2E above inits claude-code FIRST, so ~/.awm/hooks always exists
+        // by the time Codex runs — which is precisely why it never caught this.
+        // A fresh Codex Cloud box has no Claude install at all, and installing
+        // the Codex hook creates ~/.awm/hooks as a side effect of the recursive
+        // mkdir for its own nested ~/.awm/hooks/codex. That flipped Claude's
+        // R19 baseline digest from absent to present-but-empty and aborted init
+        // with "Claude Code baseline changed during a non-Claude init".
+        seedPublicRegistryFixture(path_1.default.join(tmpHome, '.awm/registries/baseline'));
+        const { runInit } = require('../../src/commands/init');
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.awm/hooks'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.claude'))).toBe(false);
+        const codex = await runInit({
+            cwd: tmpWork,
+            yes: true,
+            agent: 'codex',
+            machineOnly: true,
+            assertProviderSupported: () => ({ provider: 'codex', version: '0.150.0' }),
+        });
+        // Exit 2 is the internal-error path the R19 guard aborts through.
+        expect(codex).toBeLessThanOrEqual(1);
+        expect(readPrefs().enabledAgents).toEqual(['codex']);
+        // The Codex hook really installed, and Claude gained no content of its own.
+        const hooksJson = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpHome, '.codex/hooks.json'), 'utf8'));
+        expect(hooksJson.hooks.SessionStart).toHaveLength(1);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.awm/hooks/codex/session-start'))).toBe(true);
+        expect(fs_1.default.readdirSync(path_1.default.join(tmpHome, '.awm/hooks'))).toEqual(['codex']);
+        expect(fs_1.default.existsSync(path_1.default.join(tmpHome, '.claude/settings.json'))).toBe(false);
+    });
     it('doctor reports the isolated Codex install as supported/healthy, not against the real ~/.awm', () => {
         seedPublicRegistryFixture(path_1.default.join(tmpHome, '.awm/registries/baseline'));
         writePrefs(prefsWith(['claude-code', 'codex']));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.2.0",
+  "version": "3.2.2",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"