agentic-workflow-manager 6.4.1 → 6.5.0

package/dist/tests/core/provider-version.test.js

@@ -10,6 +10,47 @@ describe('assertProviderSupported', () => {
         });
         expect(exec).toHaveBeenCalledWith('codex', ['--version'], expect.any(Object));
     });
+    // Regression: npm installs `codex` as `codex.cmd` on Windows, and
+    // execFileSync can't CreateProcess a `.cmd` shim without a shell — it threw
+    // ENOENT here even on a machine where `codex --version` worked fine typed
+    // directly. `provider.versionCommand` is hardcoded first-party config
+    // (providers/index.ts), never attacker-controlled, so `shell: true` here
+    // carries none of the injection risk core/paths.ts's resolveOnPath was
+    // built to avoid for sensors.json's user/registry-supplied `cmd`.
+    describe('on native Windows', () => {
+        const realPlatform = process.platform;
+        afterEach(() => {
+            Object.defineProperty(process, 'platform', { value: realPlatform, configurable: true });
+        });
+        it('runs the version probe through a shell so the .cmd shim resolves', () => {
+            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+            const exec = jest.fn(() => Buffer.from('codex-cli 0.145.0\n'));
+            (0, provider_version_1.assertProviderSupported)('codex', exec);
+            expect(exec).toHaveBeenCalledWith('codex', ['--version'], expect.objectContaining({ shell: true }));
+        });
+        it('does not use a shell on non-Windows platforms', () => {
+            Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+            const exec = jest.fn(() => Buffer.from('codex-cli 0.145.0\n'));
+            (0, provider_version_1.assertProviderSupported)('codex', exec);
+            expect(exec).toHaveBeenCalledWith('codex', ['--version'], expect.objectContaining({ shell: false }));
+        });
+        // Regression from the fix above: shipping shell:true changed how a
+        // GENUINELY missing binary fails. Without a shell it's a spawn-level
+        // ENOENT; through cmd.exe the shell itself starts fine and the missing
+        // command surfaces as a non-zero exit with this exact stderr text — no
+        // ENOENT anywhere. windows-latest CI (no codex installed) caught this:
+        // it started reporting "version probe failed" instead of "not
+        // installed" the first time shell:true shipped without this branch.
+        it('still reports "not installed" when the shell itself says the command is unknown', () => {
+            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+            const shellNotFound = Object.assign(new Error('Command failed: codex --version'), {
+                status: 1,
+                stderr: Buffer.from("'codex' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n"),
+            });
+            expect(() => (0, provider_version_1.assertProviderSupported)('codex', () => { throw shellNotFound; }))
+                .toThrow('Codex is not installed or not available on PATH');
+        });
+    });
     it.each(['0.145.1', '0.146.0', '1.0.0'])('accepts stable Codex version %s above the minimum', (version) => {
         expect((0, provider_version_1.assertProviderSupported)('codex', () => Buffer.from(`codex-cli ${version}\n`))).toEqual({ provider: 'codex', version });
     });

package/dist/tests/integration/codex-provider-isolated.test.js

@@ -223,10 +223,24 @@ describe('codex provider — isolated home E2E (Task 9)', () => {
     it('doctor reports the isolated Codex install as supported/healthy, not against the real ~/.awm', () => {
         seedPublicRegistryFixture(path_1.default.join(tmpHome, '.awm/registries/baseline'));
         writePrefs(prefsWith(['claude-code', 'codex']));
+        const childProcess = require('child_process');
+        const realExecFileSync = childProcess.execFileSync;
+        const execSpy = jest.spyOn(childProcess, 'execFileSync').mockImplementation(((command, ...args) => {
+            if (command === 'codex') {
+                throw Object.assign(new Error('spawnSync codex ENOENT'), { code: 'ENOENT' });
+            }
+            return realExecFileSync(command, ...args);
+        }));
+        jest.resetModules();
         const { runDoctor } = require('../../src/commands/doctor');
         // R20: doctor resolves a single explicit provider without needing every
         // enabled agent to be independently initialized first.
-        runDoctor({ cwd: tmpWork, json: true, agent: 'codex' });
+        try {
+            runDoctor({ cwd: tmpWork, json: true, agent: 'codex' });
+        }
+        finally {
+            execSpy.mockRestore();
+        }
         const report = JSON.parse(stdout());
         expect(report.providers.map((p) => p.id)).toEqual(['codex']);
         const codexReport = report.providers[0];

package/dist/tests/integration/copilot-init-isolated.test.js

@@ -49,6 +49,7 @@ describe('copilot provider — isolated home E2E (devCore global-scope guard reg
         originalAwmHome = process.env.AWM_HOME;
         process.env.HOME = tmpHome;
         process.env.AWM_HOME = path_1.default.join(tmpHome, '.awm');
+        fs_1.default.writeFileSync(path_1.default.join(tmpWork, 'package.json'), JSON.stringify({ name: 'copilot-e2e-fixture' }));
         jest.resetModules();
         writeSpy = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
     });

package/dist/tests/integration/sensor-coverage-provider-evidence.test.js

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const evidenceDir = path_1.default.resolve(__dirname, '../../../docs/research/r2/evidence');
+const runner = path_1.default.resolve(__dirname, '../../../docs/research/r2/provider-run.mjs');
+const providers = ['claude-code', 'codex'];
+function read(provider) {
+    const file = path_1.default.join(evidenceDir, `${provider}.json`);
+    return fs_1.default.existsSync(file) ? JSON.parse(fs_1.default.readFileSync(file, 'utf8')) : null;
+}
+function expectEvidenceIntegrity(provider, value) {
+    expect(value).toMatchObject({ schema: 1, provider });
+    expect(['pass', 'partial', 'fail']).toContain(value.result);
+    // This identifies the evidence's source without assuming CI has fetched that object.
+    expect(value.sourceHead).toMatch(/^[0-9a-f]{40}$/);
+    expect(value.command).toBe('node cli/dist/src/index.js sensors coverage --json');
+    expect(value.providerVersion).toMatch(/^\S[^\r\n]*$/);
+    expect(value.providerIdentity).toEqual({
+        requestedProvider: provider,
+        executable: provider === 'claude-code' ? 'claude' : 'codex',
+        attestedBy: 'executable--version',
+    });
+    const serialized = JSON.stringify(value);
+    expect(serialized).not.toMatch(/\/home\/[^/"\s]+|\/Users\/[^/"\s]+|\b(?:token|secret|password|api[-_]?key)\b"?\s*[:=]/i);
+    if (value.result === 'pass') {
+        expect(value.reportSha256).toMatch(/^[0-9a-f]{64}$/);
+        expect(value.semanticContract).toBeDefined();
+        expect(value.report).toBeDefined();
+        expect(crypto_1.default.createHash('sha256').update(`${JSON.stringify(value.report)}\n`).digest('hex'))
+            .toBe(value.reportSha256);
+    }
+}
+describe('R2 provider evidence integrity', () => {
+    it('locates the repository root from docs/research/r2 before invoking the compiled CLI', () => {
+        expect(fs_1.default.readFileSync(runner, 'utf8')).toContain("fileURLToPath(import.meta.url)), '../../..')");
+    });
+    it.each(providers)('%s evidence, when recorded, is a sanitized attested partial (RNF-T.2)', (provider) => {
+        const value = read(provider);
+        if (value === null) {
+            expect({ certification: 'partial', missingProviders: [provider] }).toEqual({
+                certification: 'partial',
+                missingProviders: ['claude-code'],
+            });
+            return;
+        }
+        expectEvidenceIntegrity(provider, value);
+    });
+    it('accepts a valid but locally unavailable source SHA and rejects malformed source SHAs', () => {
+        const value = read('codex');
+        if (value === null)
+            throw new Error('Codex evidence fixture is required for integrity validation');
+        expectEvidenceIntegrity('codex', { ...value, sourceHead: 'f'.repeat(40) });
+        expect(() => expectEvidenceIntegrity('codex', { ...value, sourceHead: 'not-a-commit' }))
+            .toThrow();
+    });
+    it('reports RNF-T.2 as partial until two real pass envelopes can be compared', () => {
+        const claude = read('claude-code');
+        const codex = read('codex');
+        const missingPassEvidence = providers.filter((provider) => read(provider)?.result !== 'pass');
+        if (missingPassEvidence.length > 0) {
+            expect({ certification: 'partial', missingPassEvidence }).toEqual({
+                certification: 'partial',
+                missingPassEvidence: ['claude-code'],
+            });
+            return;
+        }
+        if (claude === null || codex === null)
+            throw new Error('pass evidence must be present before certification');
+        expect(claude.sourceHead).toBe(codex.sourceHead);
+        expect(claude.semanticContract).toEqual(codex.semanticContract);
+    });
+    it('does not write Claude evidence when its required executable is unavailable', () => {
+        const output = path_1.default.join(evidenceDir, 'claude-code.json');
+        expect(fs_1.default.existsSync(output)).toBe(false);
+        const result = (0, child_process_1.spawnSync)(process.execPath, [runner, 'claude-code', path_1.default.resolve(__dirname, '../..')], {
+            cwd: path_1.default.resolve(__dirname, '../../..'), encoding: 'utf8',
+        });
+        expect(result.status).not.toBe(0);
+        expect(`${result.stdout}${result.stderr}`).toContain('claude');
+        expect(fs_1.default.existsSync(output)).toBe(false);
+    });
+});

package/dist/tests/integration/sensor-coverage.e2e.test.js

@@ -0,0 +1,113 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const cliDir = path_1.default.resolve(__dirname, '../..');
+const bin = path_1.default.join(cliDir, 'dist/src/index.js');
+const fixture = path_1.default.join(cliDir, 'tests/fixtures/sensor-coverage/js-ts-gap');
+const registryFixture = path_1.default.join(cliDir, 'tests/fixtures/sensor-coverage/registry');
+const noFollowUnavailableOnNativeWindows = process.platform === 'win32'
+    && typeof fs_1.default.constants.O_NOFOLLOW !== 'number';
+const hashTree = (root) => {
+    const hash = crypto_1.default.createHash('sha256');
+    const walk = (directory) => {
+        for (const entry of fs_1.default.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const file = path_1.default.join(directory, entry.name);
+            hash.update(path_1.default.relative(root, file));
+            if (entry.isDirectory())
+                walk(file);
+            else if (entry.isFile())
+                hash.update(fs_1.default.readFileSync(file));
+            else
+                hash.update(`link:${fs_1.default.readlinkSync(file)}`);
+        }
+    };
+    walk(root);
+    return hash.digest('hex');
+};
+beforeAll(() => {
+    if (!fs_1.default.existsSync(bin)) {
+        throw new Error(`Coverage E2E requires the compiled CLI at ${bin}; run npm run build before this test.`);
+    }
+});
+test('js-ts gap fixture tracks the manifest copied into the coverage project', () => {
+    const manifest = path_1.default.join(fixture, '.awm', 'sensors.json');
+    expect(fs_1.default.existsSync(manifest)).toBe(true);
+    expect(JSON.parse(fs_1.default.readFileSync(manifest, 'utf8'))).toMatchObject({
+        sensors: expect.any(Object),
+    });
+    expect((0, child_process_1.execFileSync)('git', ['ls-files', '--error-unmatch', 'tests/fixtures/sensor-coverage/js-ts-gap/.awm/sensors.json'], {
+        cwd: cliDir, encoding: 'utf8',
+    }).trim()).toBe('tests/fixtures/sensor-coverage/js-ts-gap/.awm/sensors.json');
+});
+function runWithFixture(mutatePack) {
+    const tmp = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-coverage-e2e-'));
+    const project = path_1.default.join(tmp, 'project');
+    const awmHome = path_1.default.join(tmp, 'awm-home');
+    const registry = path_1.default.join(awmHome, 'registries', 'baseline');
+    fs_1.default.cpSync(fixture, project, { recursive: true });
+    fs_1.default.mkdirSync(path_1.default.dirname(registry), { recursive: true });
+    fs_1.default.cpSync(registryFixture, registry, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify([{ name: 'baseline', remote: 'fixture' }]));
+    if (mutatePack) {
+        const packPath = path_1.default.join(registry, 'sensor-packs/js-ts/pack.json');
+        const pack = JSON.parse(fs_1.default.readFileSync(packPath, 'utf8'));
+        mutatePack(pack);
+        fs_1.default.writeFileSync(packPath, JSON.stringify(pack));
+    }
+    return { tmp, project, awmHome };
+}
+test('compiled CLI reports gaps or fails closed when no-follow safety is unavailable (RF-1.1, RF-1.4)', () => {
+    const { tmp, project, awmHome } = runWithFixture();
+    try {
+        const before = [hashTree(project), hashTree(awmHome)];
+        const result = (0, child_process_1.spawnSync)(process.execPath, [bin, 'sensors', 'coverage', '--json'], {
+            cwd: project, encoding: 'utf8', env: { ...process.env, AWM_HOME: awmHome, AWM_NO_UPDATE_CHECK: '1' },
+        });
+        if (noFollowUnavailableOnNativeWindows) {
+            expect(result.status).toBe(1);
+            expect(`${result.stdout ?? ''}${result.stderr ?? ''}`).toContain('platform cannot guarantee no symlink dereference');
+        }
+        else {
+            expect(result.status).toBe(0);
+            const report = JSON.parse(result.stdout ?? '');
+            expect(report.static.classes).toEqual(expect.arrayContaining([
+                expect.objectContaining({ id: 'formatting', status: 'missing' }),
+                expect.objectContaining({ id: 'project-style-conventions', status: 'missing' }),
+            ]));
+        }
+        expect([hashTree(project), hashTree(awmHome)]).toEqual(before);
+    }
+    finally {
+        fs_1.default.rmSync(tmp, { recursive: true, force: true });
+    }
+});
+const testWithNoFollow = noFollowUnavailableOnNativeWindows ? test.skip : test;
+testWithNoFollow('informative states exit zero; malformed contract exits non-zero (R2.7, R2.9)', () => {
+    const run = (mutatePack) => {
+        const { tmp, project, awmHome } = runWithFixture(mutatePack);
+        try {
+            return (0, child_process_1.spawnSync)(process.execPath, [bin, 'sensors', 'coverage', '--json'], {
+                cwd: project, encoding: 'utf8', env: { ...process.env, AWM_HOME: awmHome, AWM_NO_UPDATE_CHECK: '1' },
+            });
+        }
+        finally {
+            fs_1.default.rmSync(tmp, { recursive: true, force: true });
+        }
+    };
+    const gaps = run(() => undefined);
+    const noReference = run((pack) => { delete pack.coverage; });
+    const malformed = run((pack) => { pack.coverage.schemaVersion = 2; });
+    expect(gaps.status).toBe(0);
+    expect(JSON.parse(gaps.stdout ?? '')).toMatchObject({ overall: 'gaps' });
+    expect(noReference.status).toBe(0);
+    expect(JSON.parse(noReference.stdout ?? '')).toMatchObject({ static: { reason: 'no_reference' } });
+    expect(malformed.status).toBe(1);
+    expect(`${malformed.stdout ?? ''}${malformed.stderr ?? ''}`).toContain('schemaVersion must be 1');
+});

package/dist/tests/structural/jest-environment-is-isolated.test.js

@@ -0,0 +1,14 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const os_1 = __importDefault(require("os"));
+describe('Jest environment isolation', () => {
+    it('does not inherit the operator Codex home', () => {
+        expect(process.env.CODEX_HOME).toBeUndefined();
+    });
+    it('uses a suite-owned temporary directory', () => {
+        expect(os_1.default.tmpdir()).toContain('awm-jest-');
+    });
+});

package/dist/tests/structural/sensor-configs-are-present.test.js

@@ -18,6 +18,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const CLI_ROOT = path_1.default.resolve(__dirname, '..', '..');
 const SENSORS = path_1.default.join(CLI_ROOT, '.awm', 'sensors.json');
+const BASELINE = path_1.default.join(CLI_ROOT, '.awm', 'sensors.baseline.json');
 /** Extrae los archivos de config que un comando de sensor referencia. Se buscan por la
  *  convención `*.awm.*` que usan todos los packs, no por una lista de nombres — un pack
  *  nuevo con otro linter queda cubierto igual. */
@@ -46,4 +47,13 @@ describe('configs de sensores: declarados <=> presentes', () => {
         // termina resuelto borrando el sensor, que es la salida equivocada.
         expect(missing.join('\n') || 'todos presentes').toBe('todos presentes');
     });
+    it('cada sensor conservado en el baseline sigue declarado en el manifiesto', () => {
+        const baseline = JSON.parse(fs_1.default.readFileSync(BASELINE, 'utf8'));
+        const missing = Object.keys(baseline).filter((name) => manifest?.sensors?.[name] === undefined);
+        expect(missing).toEqual([]);
+    });
+    it('el sensor de tests cubre la duración observada de la suite con margen de CI', () => {
+        const testSensor = manifest?.sensors?.test;
+        expect(testSensor?.timeout).toBeGreaterThanOrEqual(300_000);
+    });
 });

package/dist/tests/utils/config.test.js

@@ -6,6 +6,27 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const config_1 = require("../../src/utils/config");
+// Regression for the `awm remove <bundle> --yes` gap found running the issue #55
+// Windows playbook (CORE-17): `--yes` skipped the agent prompt but not the scope
+// one, so a supposedly non-interactive removal still hung waiting on a picker.
+// D-006's own stated rule is "`--yes` implica cero prompts" — this closes the one
+// call site that had drifted from it.
+describe('resolveScopeOption', () => {
+    it('falls back to the default when nothing explicit was passed (the --yes path)', () => {
+        expect((0, config_1.resolveScopeOption)(undefined, 'local')).toEqual({ ok: true, scope: 'local' });
+        expect((0, config_1.resolveScopeOption)(undefined, 'global')).toEqual({ ok: true, scope: 'global' });
+    });
+    it('an explicit valid value wins over the default', () => {
+        expect((0, config_1.resolveScopeOption)('global', 'local')).toEqual({ ok: true, scope: 'global' });
+    });
+    it('rejects a value that is neither local nor global', () => {
+        expect((0, config_1.resolveScopeOption)('bogus', 'local')).toEqual({
+            ok: false,
+            error: 'Invalid scope "bogus". Use: local or global.',
+        });
+    });
+});
 describe('Preferences Manager', () => {
     let tmpHome;
     let tmpWork;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "6.4.1",
+  "version": "6.5.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"