agentic-workflow-manager 3.9.1 → 3.10.0

package/dist/src/commands/preflight/checks.js

@@ -4,10 +4,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.preflight = preflight;
+const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const status_1 = require("../sensors/status");
 const init_1 = require("../sensors/init");
+const paths_1 = require("../../core/paths");
 const MANIFEST = path_1.default.join('.awm', 'sensors.json');
 /**
  * The agent needs project context delivered every session. A repo with neither file
@@ -106,6 +108,89 @@ function checkPack(cwd, manifest) {
     }
     return { id: 'pack', ok: true, detail: `${manifest.pack} matches the detected stack` };
 }
+/**
+ * Extract just the hostname portion of a git remote URL — never match against the
+ * full URL string. A bare substring check against the whole remote (`remote.includes
+ * ('gitlab')`) false-positives on an org/repo name that happens to contain the word,
+ * e.g. `git@github.enterprise.internal:kodria/gitlab-migration-tool.git` is a GitHub
+ * Enterprise remote, not GitLab — "gitlab" only appears in the repo name.
+ *
+ * Covers the two common remote URL shapes:
+ *   HTTPS: `https://github.com/org/repo.git`      -> `github.com`
+ *   SSH:   `git@github.com:org/repo.git`          -> `github.com`
+ *
+ * Scheme-prefixed remotes (`https://`, `ssh://`, ...) are parsed with the built-in
+ * `URL` class rather than a hand-rolled regex — `.hostname` is spec-defined to exclude
+ * both userinfo (`user:pass@`/`user@`) and `:port`, so a userinfo or password/token
+ * that happens to contain "github"/"gitlab" (e.g. an SSH username `ssh://gitlab@host/`
+ * or a CI credential-injection URL `https://x-access-token:$TOKEN@host/...`) can never
+ * leak into the matched host, and IPv6 literals in brackets are also handled correctly.
+ *
+ * The SCP-style shorthand (`user@host:path`, no scheme — not a real URI, so `URL`
+ * rejects it) falls back to a regex whose host-capture group excludes `@`, so a second
+ * `@` in the remote (`user@host@evil:path`) can't smuggle a bogus "host" past the colon
+ * check either — it simply fails to match and returns `undefined`.
+ *
+ * Returns `undefined` when neither shape matches, so callers fall through to the same
+ * "unrecognized host" handling as any other unmatched URL.
+ */
+function extractHost(remote) {
+    try {
+        return new URL(remote).hostname;
+    }
+    catch {
+        // Not a valid URL — likely git's SCP-like shorthand (user@host:path, no scheme).
+        // Node's URL class does not parse this form (it's not a real URI).
+    }
+    const scpMatch = remote.match(/^[^@\s]+@([^:\s@]+):/);
+    return scpMatch?.[1];
+}
+/**
+ * Advisory only — `ok` is ALWAYS `true` here, no matter what it finds. The
+ * `finishing-a-development-branch`/`receiving-code-review` skills detect the git host
+ * (GitHub vs GitLab) and shell out to `gh`/`glab` to open a PR/MR, degrading honestly
+ * when neither is on PATH. This check tells the operator, in advance, whether that
+ * downstream step will actually work — but plenty of legitimate workflows never create
+ * a PR/MR at all (merge locally, keep the branch as-is), so gating the whole harness on
+ * missing tooling here would be wrong. It is FYI, never a blocker.
+ */
+function checkHost(cwd) {
+    let remote;
+    try {
+        remote = (0, child_process_1.execFileSync)('git', ['remote', 'get-url', 'origin'], {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'], // no origin / not a repo prints to stderr — keep it off the operator's screen
+        }).trim();
+    }
+    catch {
+        // No `origin`, or not a git repo at all — nothing to advise on.
+        return { id: 'host', ok: true, detail: 'no git remote detected — PR/MR automation not applicable' };
+    }
+    const host = extractHost(remote);
+    if (host?.includes('github.com')) {
+        return (0, paths_1.resolveOnPath)('gh')
+            ? { id: 'host', ok: true, detail: 'github detected, gh available' }
+            : {
+                id: 'host',
+                ok: true,
+                detail: 'github detected, gh not on PATH — PR creation will require manual steps',
+                remedy: 'install the GitHub CLI (gh), or PR creation will need to be done manually',
+            };
+    }
+    if (host?.includes('gitlab')) {
+        return (0, paths_1.resolveOnPath)('glab')
+            ? { id: 'host', ok: true, detail: 'gitlab detected, glab available' }
+            : {
+                id: 'host',
+                ok: true,
+                detail: 'gitlab detected, glab not on PATH — MR creation will require manual steps',
+                remedy: 'install the GitLab CLI (glab), or MR creation will need to be done manually',
+            };
+    }
+    // Bitbucket, Azure DevOps, an internal git server, etc. — don't overclaim support.
+    return { id: 'host', ok: true, detail: 'git host not recognized (github/gitlab) — PR/MR automation not applicable' };
+}
 function preflight(cwd = process.cwd()) {
     const manifest = readManifest(cwd);
     const manifestExists = fs_1.default.existsSync(path_1.default.join(cwd, MANIFEST));
@@ -115,6 +200,9 @@ function preflight(cwd = process.cwd()) {
         // Skipped when there is no manifest: reporting "tools broken" on a repo that was
         // never set up buries the one thing the operator needs to read.
         ...(manifestExists ? [checkTools(cwd), checkPack(cwd, manifest)] : []),
+        // Runs unconditionally — orthogonal to sensor configuration entirely, this is
+        // about PR/MR tooling, not sensors.
+        checkHost(cwd),
     ];
     const status = !manifestExists ? 'not_configured'
         : checks.every(c => c.ok) ? 'ready'

package/dist/src/commands/sensors/status.js

@@ -4,7 +4,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.computeSensorStatus = computeSensorStatus;
-const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../../core/paths");
@@ -16,17 +15,6 @@ function npxTool(parts) {
     }
     return undefined;
 }
-/** Resolve a binary on PATH portably: `where` on win32, POSIX `command -v` elsewhere. */
-function resolveOnPath(bin) {
-    const cmd = (0, paths_1.isWindowsNative)() ? `where ${bin}` : `command -v ${bin}`;
-    try {
-        (0, child_process_1.execSync)(cmd, { stdio: 'pipe' });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 /** If the command references `--config <file>`, that file must exist in the repo. */
 function configCheck(parts, cwd) {
     const i = parts.indexOf('--config');
@@ -60,7 +48,7 @@ function checkCmd(cmd, cwd) {
         }
         return configCheck(parts, cwd) ?? { ok: true, detail: `${tool} (node_modules/.bin)` };
     }
-    if (!resolveOnPath(bin)) {
+    if (!(0, paths_1.resolveOnPath)(bin)) {
         return { ok: false, detail: `${bin} not found in PATH` };
     }
     return configCheck(parts, cwd) ?? { ok: true, detail: bin };

package/dist/src/core/paths.js

@@ -10,6 +10,7 @@ exports.platform = platform;
 exports.isWindowsNative = isWindowsNative;
 exports.platformLabel = platformLabel;
 exports.warnIfUnsupportedPlatform = warnIfUnsupportedPlatform;
+exports.resolveOnPath = resolveOnPath;
 // cli/src/core/paths.ts
 //
 // Single source of truth for home / AWM_HOME resolution and platform detection.
@@ -17,6 +18,7 @@ exports.warnIfUnsupportedPlatform = warnIfUnsupportedPlatform;
 // always honored and tests need no jest.resetModules().
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 /** User home directory with a robust fallback. Never returns a raw, possibly-empty process.env.HOME. */
 function homeDir() {
     return process.env.HOME || os_1.default.homedir();
@@ -54,3 +56,14 @@ function warnIfUnsupportedPlatform(log) {
     if (isWindowsNative())
         log(exports.WINDOWS_NATIVE_WARNING);
 }
+/** Resolve a binary on PATH portably: `where` on win32, POSIX `command -v` elsewhere. */
+function resolveOnPath(bin) {
+    const cmd = isWindowsNative() ? `where ${bin}` : `command -v ${bin}`;
+    try {
+        (0, child_process_1.execSync)(cmd, { stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/tests/commands/preflight/preflight.test.js

@@ -6,8 +6,23 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 const checks_1 = require("../../../src/commands/preflight/checks");
 const preflight_1 = require("../../../src/commands/preflight");
+// Only `execSync` (used by `resolveOnPath` to check for `gh`/`glab`) is mocked — `git
+// remote get-url origin` runs for real via `execFileSync` against real tmpdir git repos,
+// same as every other check in this file exercises the real filesystem.
+jest.mock('child_process', () => ({
+    ...jest.requireActual('child_process'),
+    execSync: jest.fn(),
+}));
+const mockExecSync = child_process_1.execSync;
+/** Turn a tmpdir into a real git repo with (optionally) an `origin` remote. */
+function gitRepo(dir, remoteUrl) {
+    (0, child_process_1.execFileSync)('git', ['init'], { cwd: dir, stdio: 'pipe' });
+    if (remoteUrl)
+        (0, child_process_1.execFileSync)('git', ['remote', 'add', 'origin', remoteUrl], { cwd: dir, stdio: 'pipe' });
+}
 /** CLAUDE.md: no test may reach the real ~/.awm. Everything here is a tmpdir. */
 function project(opts = {}) {
     const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-'));
@@ -112,6 +127,156 @@ describe('preflight', () => {
         expect((0, preflight_1.exitCodeFor)({ status: 'degraded', checks: [] })).toBe(1);
         expect((0, preflight_1.exitCodeFor)({ status: 'ready', checks: [] })).toBe(0);
     });
+    describe('host check (advisory — never changes the exit code)', () => {
+        beforeEach(() => { mockExecSync.mockReset(); });
+        it('reports github + gh available, and does not affect status', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'git@github.com:kodria/agentic-workflow.git');
+            mockExecSync.mockImplementation(((cmd) => {
+                if (cmd === 'command -v gh')
+                    return Buffer.from('/usr/bin/gh');
+                throw new Error(`not found: ${cmd}`);
+            }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toBe('github detected, gh available');
+            expect(report.status).toBe('ready');
+        });
+        it('is still ok:true (advisory only) when gitlab is detected but glab is not on PATH, and status stays ready', () => {
+            // The only thing "wrong" in this fixture is the missing `glab` — proving the
+            // advisory contract: it must not drag an otherwise-clean repo to `degraded`.
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'https://gitlab.com/kodria/agentic-workflow.git');
+            mockExecSync.mockImplementation((() => {
+                throw new Error('not found');
+            }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('glab not on PATH');
+            expect(check(report, 'host').remedy).toContain('glab');
+            expect(report.status).toBe('ready');
+        });
+        it('handles no origin remote gracefully — no throw, ok:true, minimal detail', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            // Not a git repo at all — the common case for `execFileSync` failing here.
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toBe('no git remote detected — PR/MR automation not applicable');
+            expect(check(report, 'host').remedy).toBeUndefined();
+            expect(report.status).toBe('ready');
+        });
+        it('handles a git repo with no origin remote configured gracefully', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir); // git init, no remote
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('no git remote detected');
+        });
+        it('does not overclaim support for an unrecognized host', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'git@bitbucket.org:kodria/agentic-workflow.git');
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('not recognized');
+            expect(report.status).toBe('ready');
+        });
+        it('does not misclassify a GitHub Enterprise host whose repo NAME contains "gitlab"', () => {
+            // The bug: a bare `remote.includes('gitlab')` matches the full remote URL
+            // string, so an org/repo name containing "gitlab" false-positives even though
+            // the actual host is unrelated. Hostname must be extracted first and matched
+            // in isolation.
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'git@github.enterprise.internal:kodria/gitlab-migration-tool.git');
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('not recognized');
+            expect(report.status).toBe('ready');
+        });
+        it('does not misclassify a non-GitHub host whose repo NAME contains "github"', () => {
+            // Same class of bug on the github side: "something-github-tool" is a repo
+            // name, not the host.
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'https://example.com/kodria/something-github-tool.git');
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('not recognized');
+            expect(report.status).toBe('ready');
+        });
+        it('does not misclassify a GitHub Enterprise host whose SSH USERNAME is "gitlab"', () => {
+            // The related bug: the scheme-based regex captured everything between
+            // `scheme://` and the first `/`, including `userinfo@` — so an SSH username
+            // of "gitlab" leaked into the matched "host" string and false-positived the
+            // `.includes('gitlab')` check even though the real host is GitHub
+            // Enterprise. `new URL(...).hostname` must exclude userinfo entirely.
+            //
+            // Note: `github.company-internal.com` legitimately contains the substring
+            // "github.com" (from "company"), so — with the userinfo bug fixed — this
+            // correctly classifies as github (checkHost's own substring matching is a
+            // separate, pre-existing design, not part of this fix). The regression this
+            // test guards is that it must never again read as gitlab.
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'ssh://gitlab@github.company-internal.com:22/team/repo.git');
+            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('github detected');
+            expect(check(report, 'host').detail).not.toContain('gitlab');
+            expect(report.status).toBe('ready');
+        });
+        it('does not misclassify a host whose injected credential/token contains "gitlab"', () => {
+            // A realistic CI credential-injection remote:
+            // `git remote set-url origin https://x-access-token:$TOKEN@host/...`. If the
+            // token or password happens to contain "gitlab", it must not leak into the
+            // matched host either.
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'https://user:gitlab@example-host.com/org/repo.git');
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('not recognized');
+            expect(report.status).toBe('ready');
+        });
+        it('does not misclassify an SCP-style remote with a second "@" in it', () => {
+            // `user@host:path` shorthand has no scheme for `URL` to parse, so it falls
+            // back to a regex. A second "@" (e.g. a malformed/adversarial remote) must
+            // not let a bogus "host@evil"-shaped capture slip past the colon check —
+            // the host-capture group excludes "@", so this fails to match at all and
+            // falls through to "unrecognized" rather than misclassifying as gitlab.
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'user@github.com@gitlab.evil:org/repo.git');
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').ok).toBe(true);
+            expect(check(report, 'host').detail).toContain('not recognized');
+            expect(report.status).toBe('ready');
+        });
+        it('still detects github.com over HTTPS', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'https://github.com/org/repo.git');
+            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').detail).toContain('github detected');
+        });
+        it('still detects github.com over SSH shorthand', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'git@github.com:org/repo.git');
+            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').detail).toContain('github detected');
+        });
+        it('still detects gitlab over HTTPS', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'https://gitlab.example.com/org/repo.git');
+            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').detail).toContain('gitlab detected');
+        });
+        it('still detects gitlab over SSH shorthand', () => {
+            const dir = make({ manifest: { pack: 'generic', sensors: {} } });
+            gitRepo(dir, 'git@gitlab.example.com:org/repo.git');
+            mockExecSync.mockImplementation((() => { throw new Error('not found'); }));
+            const report = (0, checks_1.preflight)(dir);
+            expect(check(report, 'host').detail).toContain('gitlab detected');
+        });
+    });
     it('tells the operator not to hand a broken harness to an unattended run', () => {
         const out = (0, preflight_1.formatReport)({
             status: 'not_configured',

package/dist/tests/core/paths.test.js

@@ -5,7 +5,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 const paths_1 = require("../../src/core/paths");
+jest.mock('child_process', () => ({ execSync: jest.fn() }));
+const mockExecSync = child_process_1.execSync;
 describe('core/paths', () => {
     let origHome;
     let origAwmHome;
@@ -13,6 +16,7 @@ describe('core/paths', () => {
     beforeEach(() => {
         origHome = process.env.HOME;
         origAwmHome = process.env.AWM_HOME;
+        mockExecSync.mockReset();
     });
     afterEach(() => {
         if (origHome === undefined)
@@ -75,4 +79,34 @@ describe('core/paths', () => {
         (0, paths_1.warnIfUnsupportedPlatform)(log);
         expect(calls).toEqual([paths_1.WINDOWS_NATIVE_WARNING]);
     });
+    describe('resolveOnPath', () => {
+        it('uses `command -v` on POSIX and returns true when the binary resolves', () => {
+            setPlatform('linux');
+            mockExecSync.mockImplementation(((cmd) => {
+                if (cmd === 'command -v semgrep')
+                    return Buffer.from('/usr/bin/semgrep');
+                throw new Error(`not found: ${cmd}`);
+            }));
+            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(true);
+        });
+        it('returns false on POSIX when `command -v` fails to resolve the binary', () => {
+            setPlatform('linux');
+            mockExecSync.mockImplementation(() => { throw new Error('not found'); });
+            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(false);
+        });
+        it('uses `where` on win32, not `command -v`', () => {
+            setPlatform('win32');
+            mockExecSync.mockImplementation(((cmd) => {
+                if (cmd === 'where semgrep')
+                    return Buffer.from('C:\\tools\\semgrep.exe');
+                throw new Error(`not found: ${cmd}`);
+            }));
+            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(true);
+        });
+        it('returns false on win32 when `where` cannot find the binary', () => {
+            setPlatform('win32');
+            mockExecSync.mockImplementation(() => { throw new Error('not found'); });
+            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(false);
+        });
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.9.1",
+  "version": "3.10.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"