agentic-workflow-manager 6.5.1 → 6.5.2

package/dist/src/commands/sensors/coverage/contract.js

@@ -5,7 +5,17 @@ exports.parseCoverageContract = parseCoverageContract;
 exports.parseCoverageManifest = parseCoverageManifest;
 exports.COVERAGE_SCHEMA_VERSION = 1;
 exports.MAX_COVERAGE_FILE_BYTES = 1024 * 1024;
-const SAFE_EVIDENCE_DOTFILES = Object.freeze(['.semgrep.awm.yml', '.dep-cruiser.awm.js']);
+const COVERAGE_EVIDENCE_PATHS = new Set([
+    'eslint.config.awm.mjs',
+    'eslint.config.js',
+    'eslint.config.mjs',
+    'eslint.config.cjs',
+    'eslint.config.ts',
+    'eslint.config.mts',
+    'eslint.config.cts',
+    '.semgrep.awm.yml',
+    '.dep-cruiser.awm.js',
+]);
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -40,8 +50,8 @@ function safeName(value, source, location) {
 }
 function safeEvidenceFilename(value, source, location) {
     const name = nonEmptyString(value, source, location);
-    if (name === '.' || name === '..' || name.includes('..') || /[/\\]/.test(name) || !/^[A-Za-z0-9._-]+$/.test(name) || (name.startsWith('.') && !SAFE_EVIDENCE_DOTFILES.includes(name))) {
-        invalid(source, `${location} must be a safe evidence filename component`);
+    if (!COVERAGE_EVIDENCE_PATHS.has(name)) {
+        invalid(source, `${location} must be a supported coverage evidence path`);
     }
     return name;
 }

package/dist/tests/commands/sensors/coverage/contract.test.js

@@ -12,7 +12,7 @@ describe('coverage contract v1', () => {
                             sensor: 'contract-test',
                             evidence: {
                                 commandIncludes: ['coverage'],
-                                files: [{ path: 'contract.ts', containsAll: ['parseCoverageContract'] }],
+                                files: [{ path: 'eslint.config.awm.mjs', containsAll: ['parseCoverageContract'] }],
                             },
                         }],
                     remedy: { summary: 'Add a parser.', command: 'npm test -- contract.test.ts' },
@@ -32,7 +32,7 @@ describe('coverage contract v1', () => {
     ])('rejects malformed contract %j', (input, message) => {
         expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow(message);
     });
-    test.each(['', '.', '..', 'a..b', '../secret', 'a/../../secret', '/etc/passwd', 'C:\\secret', 'a\\..\\secret', ' report.txt', 'report!.txt', 'ñ.txt', '.env', '.gitignore'])('rejects hostile evidence path %p', (path) => {
+    test.each(['', '.', '..', 'a..b', '../secret', 'a/../../secret', '/etc/passwd', 'C:\\secret', 'a\\..\\secret', ' report.txt', 'report!.txt', 'ñ.txt', '.env', '.gitignore', 'secrets.txt', 'id_rsa'])('rejects hostile evidence path %p', (path) => {
         const input = {
             schemaVersion: 1,
             classes: {
@@ -45,7 +45,17 @@ describe('coverage contract v1', () => {
         };
         expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow('path');
     });
-    test.each(['.semgrep.awm.yml', '.dep-cruiser.awm.js'])('accepts safe dotfile evidence path %p', (path) => {
+    test.each([
+        'eslint.config.awm.mjs',
+        'eslint.config.js',
+        'eslint.config.mjs',
+        'eslint.config.cjs',
+        'eslint.config.ts',
+        'eslint.config.mts',
+        'eslint.config.cts',
+        '.semgrep.awm.yml',
+        '.dep-cruiser.awm.js',
+    ])('accepts contractual evidence path %p', (path) => {
         const input = {
             schemaVersion: 1,
             classes: {
@@ -64,7 +74,7 @@ describe('coverage contract v1', () => {
             classes: {
                 valid: {
                     description: 'x',
-                    detectors: [{ sensor: 'test', evidence: { files: [{ path: 'report.txt', containsAll: [' \n'] }] } }],
+                    detectors: [{ sensor: 'test', evidence: { files: [{ path: 'eslint.config.awm.mjs', containsAll: [' \n'] }] } }],
                     remedy: { summary: 'x', command: 'x' },
                 },
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "6.5.1",
+  "version": "6.5.2",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"