agentic-workflow-manager 6.4.1 → 6.4.2

package/dist/src/commands/add.js

@@ -52,13 +52,30 @@ function runAddBundleCore(options, prefs, bundles, deps = {}) {
         console.error(picocolors_1.default.red('No project root found (need a .git/, package.json, or .awm/profile.json here). Run inside a project, or pass --global.'));
         return { code: 1, selectedAgents };
     }
+    // `--method` used to be accepted here and silently discarded — this branch
+    // hardcoded 'symlink' regardless of what was passed. Since D-001 made bundle
+    // names the ONLY thing `add [name]` resolves against, this is the sole live
+    // path for any real invocation; the interactive/`--all` path below still has
+    // its own (correct) method resolution, but a valid bundle name never reaches
+    // it. Found running the issue #55 Windows playbook's WIN-02: `--method copy`
+    // on native Windows still produced a Junction, because 'symlink' was the
+    // only value that ever actually reached the installer. The no-flag default
+    // stays 'symlink' (unchanged) — only the explicit-override case was broken.
+    let methodVal = 'symlink';
+    if (options.method) {
+        if (options.method !== 'symlink' && options.method !== 'copy') {
+            console.error(picocolors_1.default.red(`Invalid method "${options.method}". Use: symlink or copy.`));
+            return { code: 1, selectedAgents };
+        }
+        methodVal = options.method;
+    }
     let result;
     try {
         result = d.addBundle({
             bundleName: matchedBundle.name,
             bundles,
             agents: selectedAgents,
-            method: 'symlink',
+            method: methodVal,
             projectRoot: projectRoot ?? cwd,
             scopeOverride,
         });

package/dist/src/commands/init.js

@@ -128,8 +128,17 @@ async function runInit(opts = {}) {
     // Fires at most once per `awm init` run (native Windows only) — this is
     // the single emission point; `renderReport`/`renderInitOutcome` below do
     // NOT also embed it (that used to triple-fire the same text: once here,
-    // once in the "Initial state" render, once in "Final state").
-    (0, paths_1.noteWindowsCaveat)((m) => console.log(picocolors_1.default.dim(`ℹ ${m}`)));
+    // once in the "Initial state" render, once in "Final state"). In `--json`
+    // mode it goes to stderr instead of stdout: stdout must stay pure JSON for
+    // `awm init --yes --json > init.json` (documented in core-acceptance.md
+    // CORE-03) — a stray banner ahead of the `{` broke that contract on every
+    // native-Windows `--json` run.
+    if (opts.json) {
+        (0, paths_1.noteWindowsCaveat)((m) => process.stderr.write(picocolors_1.default.dim(`ℹ ${m}`) + '\n'));
+    }
+    else {
+        (0, paths_1.noteWindowsCaveat)((m) => console.log(picocolors_1.default.dim(`ℹ ${m}`)));
+    }
     const cwd = opts.cwd ?? process.cwd();
     const agent = opts.agent === undefined ? 'claude-code' : (0, providers_1.requireAgentTarget)(opts.agent);
     // R2: gate BEFORE anything is read or written — an unsupported provider

package/dist/src/core/provider-version.js

@@ -4,6 +4,7 @@ exports.assertProviderSupported = assertProviderSupported;
 const child_process_1 = require("child_process");
 const providers_1 = require("../providers");
 const versioning_1 = require("./versioning");
+const paths_1 = require("./paths");
 function assertProviderSupported(agent, exec = child_process_1.execFileSync) {
     const provider = (0, providers_1.providerFor)(agent);
     if (!provider.versionCommand || !provider.minimumVersion) {
@@ -15,17 +16,40 @@ function assertProviderSupported(agent, exec = child_process_1.execFileSync) {
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: 5000,
+            // Windows can't CreateProcess a `.cmd` shim directly (npm installs
+            // `codex` as `codex.cmd`, not `codex.exe`) — execFileSync needs a
+            // shell to resolve and run it, or it throws ENOENT even though
+            // typing `codex --version` in the same shell works fine. Safe here
+            // (unlike sensors.json's `cmd`, core/paths.ts's resolveOnPath):
+            // `provider.versionCommand.command`/`args` are hardcoded first-party
+            // config (providers/index.ts), never attacker-controlled input.
+            // Found running the issue #55 Windows playbook: `awm init -a codex`
+            // reported "Codex is not installed" on a machine where it plainly
+            // was — `codex --version` worked fine typed directly.
+            shell: (0, paths_1.isWindowsNative)(),
         }).toString();
     }
     catch (error) {
-        const code = error.code;
+        const err = error;
         // `provider.label` y `versionCommand`, no "Codex" literal. Esta funcion es
         // generica sobre AgentTarget desde siempre, pero cada mensaje y el patron de
         // parseo nombraban al unico provider que hoy declara `versionCommand` — el
         // segundo en declararlo habria reportado "Codex no esta instalado" al no
         // encontrar SU binario, y habria fallado a parsear una salida perfectamente
         // valida contra el formato de otro programa.
-        if (code === 'ENOENT') {
+        //
+        // Two distinct "not found" shapes to catch now that Windows goes through
+        // a shell (see `shell: isWindowsNative()` above): without a shell, a
+        // missing binary is a spawn-level ENOENT; through cmd.exe, the shell
+        // itself spawns fine and the missing command instead surfaces as a
+        // non-zero exit with "'codex' is not recognized..." on stderr — no
+        // ENOENT anywhere. Missing this second shape was a real regression:
+        // windows-latest CI (no codex installed at all) started reporting
+        // "version probe failed" instead of "not installed", because the exit
+        // code alone doesn't say WHY the shell failed.
+        const shellCommandNotFound = (0, paths_1.isWindowsNative)()
+            && /is not recognized as an internal or external command/i.test(String(err.stderr ?? ''));
+        if (err.code === 'ENOENT' || shellCommandNotFound) {
             throw new Error(`${provider.label} is not installed or not available on PATH ` +
                 `(tried \`${provider.versionCommand.command}\`). Install it, then re-run.`);
         }

package/dist/src/index.js

@@ -122,7 +122,7 @@ program.command('add [name]')
     if (name) {
         const allBundles = (0, bundles_1.discoverAllBundles)();
         const prefs = (0, config_1.getPreferences)();
-        const outcome = (0, add_1.runAddBundleCore)({ name, agent: options.agent, scope: options.scope }, prefs, allBundles);
+        const outcome = (0, add_1.runAddBundleCore)({ name, agent: options.agent, scope: options.scope, method: options.method }, prefs, allBundles);
         if (outcome.code !== 0)
             process.exit(outcome.code);
         (0, prompts_1.outro)('Done.');
@@ -534,12 +534,17 @@ program.command('remove [name]')
         targetAgents = agentChoice;
     }
     let scopeVal;
-    if (options.scope) {
-        if (options.scope !== 'local' && options.scope !== 'global') {
-            console.error(picocolors_1.default.red(`Invalid scope "${options.scope}". Use: local or global.`));
+    if (options.scope || options.yes) {
+        // Same reasoning as the --agent default just above: `--yes` means ZERO
+        // prompts. Without the `options.yes` half of this condition, `awm remove
+        // <bundle> --yes` still opened the scope picker and hung any
+        // non-interactive caller — the flag promised no-interactive and wasn't.
+        const resolved = (0, config_1.resolveScopeOption)(options.scope, prefs.defaultScope);
+        if (!resolved.ok) {
+            console.error(picocolors_1.default.red(resolved.error));
             process.exit(1);
         }
-        scopeVal = options.scope;
+        scopeVal = resolved.scope;
     }
     else {
         const scopeChoice = await (0, prompts_1.select)({

package/dist/src/utils/config.js

@@ -9,6 +9,7 @@ exports.getPreferences = getPreferences;
 exports.loadPreferences = loadPreferences;
 exports.savePreferences = savePreferences;
 exports.enableAgent = enableAgent;
+exports.resolveScopeOption = resolveScopeOption;
 // src/utils/config.ts
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -158,3 +159,19 @@ function enableAgent(prefs, agent) {
         ? prefs
         : { ...prefs, enabledAgents: [...prefs.enabledAgents, agent] };
 }
+/**
+ * Resolve `--scope` the same way across every non-interactive command path: an
+ * explicit value wins (validated), otherwise fall back to the caller's default
+ * instead of prompting. Pulled out of `remove`'s Commander closure (D-006) after
+ * `--yes` was found to still open the scope picker with no `--scope` given —
+ * `--yes` means zero prompts, and this is the one call site that had drifted
+ * from that rule (the sibling --agent default sits right next to it in index.ts).
+ */
+function resolveScopeOption(explicit, fallback) {
+    if (explicit === undefined)
+        return { ok: true, scope: fallback };
+    if (explicit !== 'local' && explicit !== 'global') {
+        return { ok: false, error: `Invalid scope "${explicit}". Use: local or global.` };
+    }
+    return { ok: true, scope: explicit };
+}

package/dist/tests/commands/add.test.js

@@ -94,3 +94,45 @@ it('awm add demo materializes a real Copilot .instructions.md file end-to-end',
     fs_1.default.rmSync(content, { recursive: true, force: true });
     fs_1.default.rmSync(projectRoot, { recursive: true, force: true });
 });
+// Regression for WIN-02 (issue #55 Windows playbook): `--method copy` was
+// silently discarded by this exact function — `runAddBundleCore` hardcoded
+// 'symlink' regardless of what the CLI parsed, so a real Windows machine got
+// a Junction back no matter what `--method` asked for.
+describe('runAddBundleCore --method', () => {
+    const claudeCodePrefs = {
+        defaultAgent: 'claude-code', enabledAgents: ['claude-code'], installMethod: 'symlink', defaultScope: 'local',
+    };
+    it('honours an explicit --method copy: a real directory, not a symlink', () => {
+        const content = makeContentFixture();
+        const projectRoot = makeProjectRoot();
+        const bundles = (0, bundles_1.discoverBundles)(content);
+        const outcome = (0, add_1.runAddBundleCore)({ name: 'demo', agent: 'claude-code', method: 'copy', cwd: projectRoot }, claudeCodePrefs, bundles);
+        expect(outcome.code).toBe(0);
+        const skillPath = path_1.default.join(projectRoot, '.claude/skills/demo-skill');
+        expect(fs_1.default.lstatSync(skillPath).isSymbolicLink()).toBe(false);
+        expect(fs_1.default.readFileSync(path_1.default.join(skillPath, 'SKILL.md'), 'utf8')).toContain('Follow the demo skill body.');
+        fs_1.default.rmSync(content, { recursive: true, force: true });
+        fs_1.default.rmSync(projectRoot, { recursive: true, force: true });
+    });
+    it('still defaults to symlink when --method is omitted (unchanged behavior)', () => {
+        const content = makeContentFixture();
+        const projectRoot = makeProjectRoot();
+        const bundles = (0, bundles_1.discoverBundles)(content);
+        const outcome = (0, add_1.runAddBundleCore)({ name: 'demo', agent: 'claude-code', cwd: projectRoot }, claudeCodePrefs, bundles);
+        expect(outcome.code).toBe(0);
+        const skillPath = path_1.default.join(projectRoot, '.claude/skills/demo-skill');
+        expect(fs_1.default.lstatSync(skillPath).isSymbolicLink()).toBe(true);
+        fs_1.default.rmSync(content, { recursive: true, force: true });
+        fs_1.default.rmSync(projectRoot, { recursive: true, force: true });
+    });
+    it('rejects an invalid --method value without touching the filesystem', () => {
+        const content = makeContentFixture();
+        const projectRoot = makeProjectRoot();
+        const bundles = (0, bundles_1.discoverBundles)(content);
+        const outcome = (0, add_1.runAddBundleCore)({ name: 'demo', agent: 'claude-code', method: 'bogus', cwd: projectRoot }, claudeCodePrefs, bundles);
+        expect(outcome.code).toBe(1);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.claude/skills/demo-skill'))).toBe(false);
+        fs_1.default.rmSync(content, { recursive: true, force: true });
+        fs_1.default.rmSync(projectRoot, { recursive: true, force: true });
+    });
+});

package/dist/tests/commands/init.test.js

@@ -108,6 +108,29 @@ describe('runInit', () => {
             const caveatCalls = logSpy.mock.calls.filter((c) => /awm watch/i.test(String(c[0])));
             expect(caveatCalls).toHaveLength(0);
         });
+        // Regression: `awm init --yes --json > init.json` on native Windows used to
+        // write the caveat to stdout via console.log AHEAD of the JSON payload,
+        // so the documented core-acceptance.md CORE-03 flow produced a file that
+        // wasn't valid JSON (banner text, then `{...}`). The caveat must still
+        // reach the operator — it now goes to stderr instead of vanishing.
+        it('does not pollute --json stdout with the caveat on native Windows', async () => {
+            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+            const errSpy = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+            const { runInit } = require('../../src/commands/init');
+            await runInit({
+                cwd: tmpHome,
+                yes: true,
+                json: true,
+                actions: { syncCache: async () => { }, installHook: () => ({ status: 'installed' }) },
+            });
+            const written = writeSpy.mock.calls.map((c) => c[0]).join('');
+            expect(() => JSON.parse(written)).not.toThrow();
+            const caveatOnStdout = logSpy.mock.calls.filter((c) => /awm watch/i.test(String(c[0])));
+            expect(caveatOnStdout).toHaveLength(0);
+            const caveatOnStderr = errSpy.mock.calls.filter((c) => /awm watch/i.test(String(c[0])));
+            expect(caveatOnStderr).toHaveLength(1);
+            errSpy.mockRestore();
+        });
     });
     it('returns exit 0 on a bare HOME and never prompts with --yes (cache stubbed)', async () => {
         const { runInit } = require('../../src/commands/init');

package/dist/tests/core/provider-version.test.js

@@ -10,6 +10,47 @@ describe('assertProviderSupported', () => {
         });
         expect(exec).toHaveBeenCalledWith('codex', ['--version'], expect.any(Object));
     });
+    // Regression: npm installs `codex` as `codex.cmd` on Windows, and
+    // execFileSync can't CreateProcess a `.cmd` shim without a shell — it threw
+    // ENOENT here even on a machine where `codex --version` worked fine typed
+    // directly. `provider.versionCommand` is hardcoded first-party config
+    // (providers/index.ts), never attacker-controlled, so `shell: true` here
+    // carries none of the injection risk core/paths.ts's resolveOnPath was
+    // built to avoid for sensors.json's user/registry-supplied `cmd`.
+    describe('on native Windows', () => {
+        const realPlatform = process.platform;
+        afterEach(() => {
+            Object.defineProperty(process, 'platform', { value: realPlatform, configurable: true });
+        });
+        it('runs the version probe through a shell so the .cmd shim resolves', () => {
+            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+            const exec = jest.fn(() => Buffer.from('codex-cli 0.145.0\n'));
+            (0, provider_version_1.assertProviderSupported)('codex', exec);
+            expect(exec).toHaveBeenCalledWith('codex', ['--version'], expect.objectContaining({ shell: true }));
+        });
+        it('does not use a shell on non-Windows platforms', () => {
+            Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+            const exec = jest.fn(() => Buffer.from('codex-cli 0.145.0\n'));
+            (0, provider_version_1.assertProviderSupported)('codex', exec);
+            expect(exec).toHaveBeenCalledWith('codex', ['--version'], expect.objectContaining({ shell: false }));
+        });
+        // Regression from the fix above: shipping shell:true changed how a
+        // GENUINELY missing binary fails. Without a shell it's a spawn-level
+        // ENOENT; through cmd.exe the shell itself starts fine and the missing
+        // command surfaces as a non-zero exit with this exact stderr text — no
+        // ENOENT anywhere. windows-latest CI (no codex installed) caught this:
+        // it started reporting "version probe failed" instead of "not
+        // installed" the first time shell:true shipped without this branch.
+        it('still reports "not installed" when the shell itself says the command is unknown', () => {
+            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+            const shellNotFound = Object.assign(new Error('Command failed: codex --version'), {
+                status: 1,
+                stderr: Buffer.from("'codex' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n"),
+            });
+            expect(() => (0, provider_version_1.assertProviderSupported)('codex', () => { throw shellNotFound; }))
+                .toThrow('Codex is not installed or not available on PATH');
+        });
+    });
     it.each(['0.145.1', '0.146.0', '1.0.0'])('accepts stable Codex version %s above the minimum', (version) => {
         expect((0, provider_version_1.assertProviderSupported)('codex', () => Buffer.from(`codex-cli ${version}\n`))).toEqual({ provider: 'codex', version });
     });

package/dist/tests/utils/config.test.js

@@ -6,6 +6,27 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const config_1 = require("../../src/utils/config");
+// Regression for the `awm remove <bundle> --yes` gap found running the issue #55
+// Windows playbook (CORE-17): `--yes` skipped the agent prompt but not the scope
+// one, so a supposedly non-interactive removal still hung waiting on a picker.
+// D-006's own stated rule is "`--yes` implica cero prompts" — this closes the one
+// call site that had drifted from it.
+describe('resolveScopeOption', () => {
+    it('falls back to the default when nothing explicit was passed (the --yes path)', () => {
+        expect((0, config_1.resolveScopeOption)(undefined, 'local')).toEqual({ ok: true, scope: 'local' });
+        expect((0, config_1.resolveScopeOption)(undefined, 'global')).toEqual({ ok: true, scope: 'global' });
+    });
+    it('an explicit valid value wins over the default', () => {
+        expect((0, config_1.resolveScopeOption)('global', 'local')).toEqual({ ok: true, scope: 'global' });
+    });
+    it('rejects a value that is neither local nor global', () => {
+        expect((0, config_1.resolveScopeOption)('bogus', 'local')).toEqual({
+            ok: false,
+            error: 'Invalid scope "bogus". Use: local or global.',
+        });
+    });
+});
 describe('Preferences Manager', () => {
     let tmpHome;
     let tmpWork;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "6.4.1",
+  "version": "6.4.2",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"