agentic-workflow-manager 6.5.0 → 6.5.1

package/dist/src/commands/sensors/coverage/contract.js

@@ -5,6 +5,7 @@ exports.parseCoverageContract = parseCoverageContract;
 exports.parseCoverageManifest = parseCoverageManifest;
 exports.COVERAGE_SCHEMA_VERSION = 1;
 exports.MAX_COVERAGE_FILE_BYTES = 1024 * 1024;
+const SAFE_EVIDENCE_DOTFILES = Object.freeze(['.semgrep.awm.yml', '.dep-cruiser.awm.js']);
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -37,6 +38,13 @@ function safeName(value, source, location) {
     }
     return name;
 }
+function safeEvidenceFilename(value, source, location) {
+    const name = nonEmptyString(value, source, location);
+    if (name === '.' || name === '..' || name.includes('..') || /[/\\]/.test(name) || !/^[A-Za-z0-9._-]+$/.test(name) || (name.startsWith('.') && !SAFE_EVIDENCE_DOTFILES.includes(name))) {
+        invalid(source, `${location} must be a safe evidence filename component`);
+    }
+    return name;
+}
 function stringArray(value, source, location, allowEmpty) {
     if (!Array.isArray(value) || (!allowEmpty && value.length === 0)) {
         invalid(source, `${location} must be ${allowEmpty ? 'an array' : 'a nonempty array'}`);
@@ -46,7 +54,7 @@ function stringArray(value, source, location, allowEmpty) {
 function parseFileRequirement(input, source, location) {
     const value = record(input, source, location);
     fields(value, ['path', 'containsAll'], source, location);
-    const path = safeName(value.path, source, `${location}.path`);
+    const path = safeEvidenceFilename(value.path, source, `${location}.path`);
     const containsAll = stringArray(value.containsAll, source, `${location}.containsAll`, true);
     return { path, containsAll };
 }

package/dist/tests/commands/sensors/coverage/contract.test.js

@@ -32,7 +32,7 @@ describe('coverage contract v1', () => {
     ])('rejects malformed contract %j', (input, message) => {
         expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow(message);
     });
-    test.each(['', '.', '..', '../secret', 'a/../../secret', '/etc/passwd', 'C:\\secret', 'a\\..\\secret', ' report.txt', 'report!.txt'])('rejects hostile evidence path %p', (path) => {
+    test.each(['', '.', '..', 'a..b', '../secret', 'a/../../secret', '/etc/passwd', 'C:\\secret', 'a\\..\\secret', ' report.txt', 'report!.txt', 'ñ.txt', '.env', '.gitignore'])('rejects hostile evidence path %p', (path) => {
         const input = {
             schemaVersion: 1,
             classes: {
@@ -45,6 +45,19 @@ describe('coverage contract v1', () => {
         };
         expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow('path');
     });
+    test.each(['.semgrep.awm.yml', '.dep-cruiser.awm.js'])('accepts safe dotfile evidence path %p', (path) => {
+        const input = {
+            schemaVersion: 1,
+            classes: {
+                valid: {
+                    description: 'x',
+                    detectors: [{ sensor: 'test', evidence: { files: [{ path, containsAll: [] }] } }],
+                    remedy: { summary: 'x', command: 'x' },
+                },
+            },
+        };
+        expect((0, contract_1.parseCoverageContract)(input, 'coverage.json')).toEqual(input);
+    });
     it('rejects whitespace-only evidence text', () => {
         const input = {
             schemaVersion: 1,

package/dist/tests/integration/sensor-coverage-provider-evidence.test.js

@@ -76,13 +76,17 @@ describe('R2 provider evidence integrity', () => {
         expect(claude.semanticContract).toEqual(codex.semanticContract);
     });
     it('does not write Claude evidence when its required executable is unavailable', () => {
+        // Certified evidence is now committed at this path (RNF-T.2), so this test cannot
+        // assume the file is absent. Instead, force the attestation to fail by hiding
+        // `claude` from PATH and assert the file is left byte-for-byte untouched.
         const output = path_1.default.join(evidenceDir, 'claude-code.json');
-        expect(fs_1.default.existsSync(output)).toBe(false);
+        const before = fs_1.default.existsSync(output) ? fs_1.default.readFileSync(output, 'utf8') : null;
         const result = (0, child_process_1.spawnSync)(process.execPath, [runner, 'claude-code', path_1.default.resolve(__dirname, '../..')], {
-            cwd: path_1.default.resolve(__dirname, '../../..'), encoding: 'utf8',
+            cwd: path_1.default.resolve(__dirname, '../../..'), encoding: 'utf8', env: { ...process.env, PATH: '' },
         });
         expect(result.status).not.toBe(0);
         expect(`${result.stdout}${result.stderr}`).toContain('claude');
-        expect(fs_1.default.existsSync(output)).toBe(false);
+        const after = fs_1.default.existsSync(output) ? fs_1.default.readFileSync(output, 'utf8') : null;
+        expect(after).toBe(before);
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "6.5.0",
+  "version": "6.5.1",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"