agentic-workflow-manager 6.5.2 → 8.1.0

package/dist/tests/core/ledger/scan.test.js

@@ -0,0 +1,217 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const scan_1 = require("../../../src/core/ledger/scan");
+function mkTmp() {
+    return fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-ledger-scan-'));
+}
+function entry(over = {}) {
+    return {
+        ts: '2026-08-14T00:00:00.000Z', branch: 'feat-x', phase: 'qa', source_skill: 'post-implementation-qa',
+        polarity: 'finding', class: 'logica', signature: 'lint-error', severity: 'important', desc: 'private detail',
+        defectClass: 'lint-errors', ...over,
+    };
+}
+function write(root, relative, lines) {
+    const target = path_1.default.join(root, relative);
+    fs_1.default.mkdirSync(path_1.default.dirname(target), { recursive: true });
+    fs_1.default.writeFileSync(target, lines.map(line => typeof line === 'string' ? line : JSON.stringify(line)).join('\n') + '\n');
+}
+describe('scanProjectLedgers', () => {
+    let root;
+    beforeEach(() => { root = mkTmp(); });
+    afterEach(() => { fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    test('reads only direct active and archive files in deterministic path and line order', () => {
+        write(root, '.awm/ledger/z.jsonl', [entry({ signature: 'z' })]);
+        write(root, '.awm/ledger/a.jsonl', [entry({ signature: 'a' })]);
+        write(root, '.awm/ledger/archive/b.jsonl', [entry({ signature: 'b' })]);
+        write(root, '.awm/ledger/archive/nested/ignored.jsonl', [entry({ signature: 'ignored' })]);
+        const scan = (0, scan_1.scanProjectLedgers)(root);
+        expect(scan.entries.map(item => item.source)).toEqual([
+            '.awm/ledger/a.jsonl:1', '.awm/ledger/archive/b.jsonl:1', '.awm/ledger/z.jsonl:1',
+        ]);
+        expect(scan.sources).toMatchObject({ activeFiles: 2, archivedFiles: 1, validFindings: 3, skippedFindings: 0 });
+    });
+    test('orders direct active and archive sources together by their relative path', () => {
+        write(root, '.awm/ledger/b.jsonl', [entry({ signature: 'active-b' })]);
+        write(root, '.awm/ledger/archive/a.jsonl', [entry({ signature: 'archive-a' })]);
+        const scan = (0, scan_1.scanProjectLedgers)(root);
+        expect(scan.entries.map(item => item.source)).toEqual([
+            '.awm/ledger/archive/a.jsonl:1', '.awm/ledger/b.jsonl:1',
+        ]);
+    });
+    test('counts wins as valid but excludes them from findings', () => {
+        write(root, '.awm/ledger/a.jsonl', [entry({ polarity: 'win' }), entry({ signature: 'finding' })]);
+        const scan = (0, scan_1.scanProjectLedgers)(root);
+        expect(scan.entries.map(item => item.entry.signature)).toEqual(['finding']);
+        expect(scan.sources).toMatchObject({ validEntries: 2, validFindings: 1 });
+    });
+    test.each([
+        ['invalid JSON', 'invalid-json', ['{not-json'], {}],
+        ['invalid persisted class', 'invalid-defect-class', [{ ...entry(), defectClass: 'Bad_ID' }], {}],
+        ['oversized line', 'line-too-large', [JSON.stringify(entry()) + 'x'.repeat(100)], { maxLineBytes: 64 }],
+    ])('reports %s as a typed skipped finding', (_name, reason, lines, limits) => {
+        write(root, '.awm/ledger/a.jsonl', lines);
+        const scan = (0, scan_1.scanProjectLedgers)(root, limits);
+        expect(scan.sources.skippedFindings).toBe(1);
+        expect(scan.sources.skippedByReason).toMatchObject({ [reason]: 1 });
+    });
+    test('rejects a symlink without reading its target', () => {
+        const outside = path_1.default.join(root, 'outside.jsonl');
+        fs_1.default.writeFileSync(outside, JSON.stringify(entry()));
+        const ledger = path_1.default.join(root, '.awm', 'ledger');
+        fs_1.default.mkdirSync(ledger, { recursive: true });
+        fs_1.default.symlinkSync(outside, path_1.default.join(ledger, 'linked.jsonl'));
+        const scan = (0, scan_1.scanProjectLedgers)(root);
+        expect(scan.entries).toEqual([]);
+        expect(scan.sources.skippedByReason).toMatchObject({ 'symlink-entry': 1 });
+    });
+    test('records direct non-regular entries and never descends into them', () => {
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm', 'ledger', 'directory.jsonl'), { recursive: true });
+        write(root, '.awm/ledger/directory.jsonl/hidden.jsonl', [entry({ signature: 'hidden' })]);
+        const scan = (0, scan_1.scanProjectLedgers)(root);
+        expect(scan.entries).toEqual([]);
+        expect(scan.sources.skippedByReason).toMatchObject({ 'nonregular-entry': 1 });
+    });
+    test('reports file and entry limits once without reading candidates beyond the bound', () => {
+        write(root, '.awm/ledger/a.jsonl', [entry({ signature: 'a' })]);
+        write(root, '.awm/ledger/b.jsonl', [entry({ signature: 'b' })]);
+        const files = (0, scan_1.scanProjectLedgers)(root, { maxFiles: 1 });
+        expect(files.entries.map(item => item.entry.signature)).toEqual(['a']);
+        expect(files.sources.skippedByReason).toMatchObject({ 'file-limit': 1 });
+        write(root, '.awm/ledger/entries.jsonl', [entry({ signature: 'first' }), entry({ signature: 'second' })]);
+        const entries = (0, scan_1.scanProjectLedgers)(root, { maxEntries: 1, maxFiles: 10 });
+        expect(entries.entries).toHaveLength(1);
+        expect(entries.sources.skippedByReason).toMatchObject({ 'entry-limit': 1 });
+    });
+    test('enumerates file candidates with bounded memory and never opens a source after maxFiles', () => {
+        write(root, '.awm/ledger/a.jsonl', [entry({ signature: 'first' })]);
+        write(root, '.awm/ledger/b.jsonl', [entry({ signature: 'must-not-open' })]);
+        write(root, '.awm/ledger/archive/c.jsonl', [entry({ signature: 'also-must-not-open' })]);
+        const readSpy = jest.spyOn(fs_1.default, 'readFileSync');
+        const readdirSpy = jest.spyOn(fs_1.default, 'readdirSync').mockImplementation(() => {
+            throw new Error('unbounded readdir must not be used for ledger candidates');
+        });
+        try {
+            const scan = (0, scan_1.scanProjectLedgers)(root, { maxFiles: 1 });
+            expect(scan.entries.map(item => item.entry.signature)).toEqual(['first']);
+            expect(scan.sources.skippedByReason).toMatchObject({ 'file-limit': 1 });
+            expect(readSpy.mock.calls.map(([candidate]) => String(candidate))).not.toContain(path_1.default.join(root, '.awm', 'ledger', 'b.jsonl'));
+            expect(readSpy.mock.calls.map(([candidate]) => String(candidate))).not.toContain(path_1.default.join(root, '.awm', 'ledger', 'archive', 'c.jsonl'));
+        }
+        finally {
+            readdirSpy.mockRestore();
+            readSpy.mockRestore();
+        }
+    });
+    test('sorts the retained candidate window instead of assuming host directory order', () => {
+        write(root, '.awm/ledger/a.jsonl', [entry({ signature: 'first' })]);
+        write(root, '.awm/ledger/b.jsonl', [entry({ signature: 'witness' })]);
+        write(root, '.awm/ledger/c.jsonl', [entry({ signature: 'must-not-enumerate' })]);
+        const ledgerDirectory = path_1.default.join(root, '.awm', 'ledger');
+        const originalOpen = fs_1.default.opendirSync;
+        let readCalls = 0;
+        const openSpy = jest.spyOn(fs_1.default, 'opendirSync').mockImplementation((directory, options) => {
+            if (String(directory) === ledgerDirectory) {
+                const names = ['b.jsonl', 'a.jsonl', 'c.jsonl'];
+                let index = 0;
+                return {
+                    closeSync: jest.fn(),
+                    readSync: jest.fn(() => {
+                        readCalls += 1;
+                        if (readCalls > 2)
+                            throw new Error('candidate enumeration exceeded bounded window');
+                        const name = names[index++];
+                        return name === undefined ? null : { name };
+                    }),
+                };
+            }
+            const handle = originalOpen(directory, options);
+            const originalRead = handle.readSync.bind(handle);
+            jest.spyOn(handle, 'readSync').mockImplementation(() => {
+                readCalls += 1;
+                if (readCalls > 2)
+                    throw new Error('candidate enumeration exceeded bounded window');
+                return originalRead();
+            });
+            return handle;
+        });
+        try {
+            const scan = (0, scan_1.scanProjectLedgers)(root, { maxFiles: 1 });
+            expect(scan.entries.map(item => item.entry.signature)).toEqual(['first']);
+            expect(scan.sources.skippedByReason).toMatchObject({ 'file-limit': 1 });
+            expect(readCalls).toBe(2);
+        }
+        finally {
+            openSpy.mockRestore();
+        }
+    });
+    test('shares the candidate window across active and archive directories', () => {
+        write(root, '.awm/ledger/a.jsonl', [entry({ signature: 'active-first' })]);
+        write(root, '.awm/ledger/b.jsonl', [entry({ signature: 'active-witness' })]);
+        write(root, '.awm/ledger/archive/c.jsonl', [entry({ signature: 'archive-must-not-enumerate' })]);
+        const originalOpen = fs_1.default.opendirSync;
+        let candidateReads = 0;
+        const openSpy = jest.spyOn(fs_1.default, 'opendirSync').mockImplementation((directory, options) => {
+            const handle = originalOpen(directory, options);
+            const originalRead = handle.readSync.bind(handle);
+            jest.spyOn(handle, 'readSync').mockImplementation(() => {
+                const item = originalRead();
+                if (item?.name.endsWith('.jsonl')) {
+                    candidateReads += 1;
+                    if (candidateReads > 2)
+                        throw new Error('candidate enumeration exceeded the global bounded window');
+                }
+                return item;
+            });
+            return handle;
+        });
+        try {
+            const scan = (0, scan_1.scanProjectLedgers)(root, { maxFiles: 1 });
+            expect(scan.entries.map(item => item.entry.signature)).toEqual(['active-first']);
+            expect(scan.sources.skippedByReason).toMatchObject({ 'file-limit': 1 });
+            expect(candidateReads).toBe(2);
+        }
+        finally {
+            openSpy.mockRestore();
+        }
+    });
+    test('reports a too-large file without parsing it', () => {
+        write(root, '.awm/ledger/a.jsonl', [entry()]);
+        const scan = (0, scan_1.scanProjectLedgers)(root, { maxFileBytes: 1 });
+        expect(scan.entries).toEqual([]);
+        expect(scan.sources.skippedByReason).toMatchObject({ 'file-too-large': 1 });
+    });
+    test('reports over-deep JSON before parsing it', () => {
+        write(root, '.awm/ledger/a.jsonl', ['{"x":{"x":{"x":{"x":{"x":1}}}}}']);
+        const scan = (0, scan_1.scanProjectLedgers)(root, { maxJsonDepth: 3 });
+        expect(scan.entries).toEqual([]);
+        expect(scan.sources.skippedByReason).toMatchObject({ 'json-too-deep': 1 });
+    });
+    test('keeps every finding for analysis while bounding renderable references per defect class', () => {
+        write(root, '.awm/ledger/a.jsonl', [
+            entry({ signature: 'first', defectClass: 'lint-errors' }),
+            entry({ signature: 'second', defectClass: 'lint-errors' }),
+            entry({ signature: 'other', defectClass: 'static-type-errors' }),
+        ]);
+        const scan = (0, scan_1.scanProjectLedgers)(root, { maxRefsPerClass: 1 });
+        expect(scan.entries.map(item => item.entry.signature)).toEqual(['first', 'second', 'other']);
+        expect(scan.entries.map(item => item.evidenceRef)).toEqual([
+            '.awm/ledger/a.jsonl:1', null, '.awm/ledger/a.jsonl:3',
+        ]);
+        expect(scan.omittedEvidenceRefs).toBe(1);
+        expect(scan.sources).toMatchObject({
+            validFindings: 3,
+            skippedFindings: 1,
+            skippedByReason: { 'evidence-ref-limit': 1 },
+        });
+    });
+    test('rejects non-object limit overrides instead of accepting an impossible public input', () => {
+        expect(() => (0, scan_1.scanProjectLedgers)(root, null)).toThrow(/limits.*object/i);
+    });
+});

package/dist/tests/core/ledger/store.test.js

@@ -7,6 +7,7 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const store_1 = require("../../../src/core/ledger/store");
+const types_1 = require("../../../src/core/ledger/types");
 function mkTmp() {
     return fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-ledger-'));
 }
@@ -32,6 +33,14 @@ describe('ledger store — add/list', () => {
     test('ledgerPath sanitizes branch slashes into the filename', () => {
         expect((0, store_1.ledgerPath)(cwd, 'feature/foo')).toBe(path_1.default.join(cwd, '.awm', 'ledger', 'feature__foo.jsonl'));
     });
+    test.each(['..\\outside', 'feature\\..\\outside'])('rejects a Windows path-traversal branch %p before it can escape the ledger directory', (branch) => {
+        // On Windows, a backslash is a separator even when this test suite runs on POSIX.
+        // Keep the regression explicit so future path changes cannot reintroduce the escape.
+        expect(branch.split(path_1.default.win32.sep)).toContain('..');
+        expect(() => (0, store_1.ledgerPath)(cwd, branch)).toThrow(/invalid ledger branch/i);
+        expect(() => (0, store_1.addEntry)(cwd, entry({ branch }))).toThrow(/invalid ledger branch/i);
+        expect(fs_1.default.existsSync(path_1.default.join(cwd, '.awm', 'ledger'))).toBe(false);
+    });
     test('addEntry creates .awm/ledger/ and appends one jsonl line', () => {
         (0, store_1.addEntry)(cwd, entry());
         const raw = fs_1.default.readFileSync((0, store_1.ledgerPath)(cwd, 'feat-x'), 'utf-8');
@@ -43,6 +52,25 @@ describe('ledger store — add/list', () => {
         (0, store_1.addEntry)(cwd, entry({ signature: 'second', desc: 'another' }));
         expect((0, store_1.listEntries)(cwd, 'feat-x')).toHaveLength(2);
     });
+    test('persists an optional reusable defect class', () => {
+        (0, store_1.addEntry)(cwd, entry({ defectClass: 'lint-errors' }));
+        expect(JSON.parse(fs_1.default.readFileSync((0, store_1.ledgerPath)(cwd, 'feat-x'), 'utf-8'))).toMatchObject({ defectClass: 'lint-errors' });
+    });
+    test('rejects an invalid direct entry before it can cross the durable boundary', () => {
+        expect(() => (0, store_1.addEntry)(cwd, { ...entry(), defectClass: 'Bad_ID' })).toThrow(/invalid-defect-class/i);
+        expect(fs_1.default.existsSync((0, store_1.ledgerPath)(cwd, 'feat-x'))).toBe(false);
+    });
+    test('keeps a legacy entry without defectClass valid and unclassified', () => {
+        const parsed = (0, types_1.parseLedgerEntry)(entry(), 'line 1');
+        expect(parsed).toMatchObject({ ok: true, entry: { defectClass: undefined } });
+    });
+    test.each(['', 'Bad_ID', '../escape', 'a b', '-leading', 'trailing-'])('skips a persisted invalid defect class %p', (defectClass) => {
+        const parsed = (0, types_1.parseLedgerEntry)({ ...entry(), defectClass }, 'line 1');
+        expect(parsed).toMatchObject({ ok: false, reason: 'invalid-defect-class' });
+    });
+    test('rejects a non-string durable source instead of returning an unsafe parse result', () => {
+        expect(() => (0, types_1.parseLedgerEntry)(entry(), null)).toThrow(/source.*string/i);
+    });
     test('listEntries on a branch with no ledger returns []', () => {
         expect((0, store_1.listEntries)(cwd, 'never-touched')).toEqual([]);
     });
@@ -154,4 +182,84 @@ describe('ledger store — archive', () => {
     test('archiving a non-existent ledger is a no-op returning false', () => {
         expect((0, store_1.archiveLedger)(cwd, 'feat-x', '20260606T000000')).toBe(false);
     });
+    test('refuses to overwrite an existing archive and preserves both ledger files', () => {
+        (0, store_1.addEntry)(cwd, entry({ signature: 'active-evidence' }));
+        const archivePath = path_1.default.join(cwd, '.awm', 'ledger', 'archive', 'feat-x-20260606T000000.jsonl');
+        fs_1.default.mkdirSync(path_1.default.dirname(archivePath), { recursive: true });
+        fs_1.default.writeFileSync(archivePath, JSON.stringify(entry({ signature: 'archived-evidence' })) + '\n');
+        expect(() => (0, store_1.archiveLedger)(cwd, 'feat-x', '20260606T000000')).toThrow(/archive.*already exists/i);
+        expect((0, store_1.listEntries)(cwd, 'feat-x')).toEqual([expect.objectContaining({ signature: 'active-evidence' })]);
+        expect(fs_1.default.readFileSync(archivePath, 'utf-8')).toContain('archived-evidence');
+    });
+    test('refuses a dangling symlink archive destination and preserves the active ledger', () => {
+        (0, store_1.addEntry)(cwd, entry({ signature: 'active-evidence' }));
+        const archivePath = path_1.default.join(cwd, '.awm', 'ledger', 'archive', 'feat-x-20260606T000000.jsonl');
+        fs_1.default.mkdirSync(path_1.default.dirname(archivePath), { recursive: true });
+        try {
+            fs_1.default.symlinkSync(path_1.default.join(cwd, 'missing-target.jsonl'), archivePath);
+        }
+        catch (error) {
+            if (process.platform === 'win32')
+                return;
+            throw error;
+        }
+        expect(() => (0, store_1.archiveLedger)(cwd, 'feat-x', '20260606T000000')).toThrow(/archive.*already exists/i);
+        expect(fs_1.default.lstatSync(archivePath).isSymbolicLink()).toBe(true);
+        expect((0, store_1.listEntries)(cwd, 'feat-x')).toEqual([expect.objectContaining({ signature: 'active-evidence' })]);
+    });
+    test('rejects a symlinked archive directory without moving the active ledger outside the project', () => {
+        (0, store_1.addEntry)(cwd, entry({ signature: 'active-evidence' }));
+        const archive = path_1.default.join(cwd, '.awm', 'ledger', 'archive');
+        const outside = path_1.default.join(cwd, 'outside');
+        fs_1.default.mkdirSync(outside, { recursive: true });
+        try {
+            fs_1.default.symlinkSync(outside, archive, 'dir');
+        }
+        catch (error) {
+            if (error.code === 'EPERM')
+                return;
+            throw error;
+        }
+        expect(() => (0, store_1.archiveLedger)(cwd, 'feat-x', '20260606T000000')).toThrow(/unsafe|escape|symlink/i);
+        expect((0, store_1.listEntries)(cwd, 'feat-x')).toEqual([expect.objectContaining({ signature: 'active-evidence' })]);
+        expect(fs_1.default.readdirSync(outside)).toEqual([]);
+    });
+    test('rejects a symlinked source ledger and preserves the link target', () => {
+        const outside = path_1.default.join(cwd, 'outside.jsonl');
+        fs_1.default.writeFileSync(outside, JSON.stringify(entry({ signature: 'outside-evidence' })) + '\n');
+        const source = (0, store_1.ledgerPath)(cwd, 'feat-x');
+        fs_1.default.mkdirSync(path_1.default.dirname(source), { recursive: true });
+        try {
+            fs_1.default.symlinkSync(outside, source);
+        }
+        catch (error) {
+            if (error.code === 'EPERM')
+                return;
+            throw error;
+        }
+        expect(() => (0, store_1.archiveLedger)(cwd, 'feat-x', '20260606T000000')).toThrow(/unsafe|escape|symlink/i);
+        expect(fs_1.default.lstatSync(source).isSymbolicLink()).toBe(true);
+        expect(fs_1.default.readFileSync(outside, 'utf-8')).toContain('outside-evidence');
+        expect(fs_1.default.existsSync(path_1.default.join(cwd, '.awm', 'ledger', 'archive', 'feat-x-20260606T000000.jsonl'))).toBe(false);
+    });
+    test.each(['', '.', '..', '../outside', '/tmp/outside', 'C:\\temp\\outside'])('rejects an unsafe archive label %p before touching a ledger', (label) => {
+        expect(() => (0, store_1.archiveLedger)(cwd, 'feat-x', label)).toThrow(/invalid ledger label/i);
+        expect(fs_1.default.existsSync(path_1.default.join(cwd, '.awm', 'ledger'))).toBe(false);
+    });
+    test.each(['safe/child', 'safe\\child'])('rejects an archive label with a separator %p before it can create ledger files', (label) => {
+        expect(() => (0, store_1.archiveLedger)(cwd, 'feat-x', label)).toThrow(/invalid ledger label/i);
+        expect(fs_1.default.existsSync(path_1.default.join(cwd, '.awm', 'ledger'))).toBe(false);
+        expect(fs_1.default.existsSync((0, store_1.ledgerPath)(cwd, 'feat-x'))).toBe(false);
+    });
+    test('rejects a Windows traversal archive label before it can create an escaped file', () => {
+        const label = '..\\outside';
+        const archiveRoot = path_1.default.win32.join('C:\\project', '.awm', 'ledger', 'archive');
+        const escaped = path_1.default.win32.resolve(archiveRoot, label);
+        (0, store_1.addEntry)(cwd, entry());
+        expect(escaped.startsWith(`${archiveRoot}\\`)).toBe(false);
+        expect(() => (0, store_1.archiveLedger)(cwd, 'feat-x', label)).toThrow(/invalid ledger label/i);
+        expect(fs_1.default.existsSync(path_1.default.join(cwd, '.awm', 'ledger', 'archive'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(cwd, 'outside.jsonl'))).toBe(false);
+        expect(fs_1.default.existsSync((0, store_1.ledgerPath)(cwd, 'feat-x'))).toBe(true);
+    });
 });

package/dist/tests/core/profile-pins.test.js

@@ -11,7 +11,8 @@ const child_process_1 = require("child_process");
 const GIT = (cwd, cmd) => (0, child_process_1.execSync)(`git -c user.email=t@t.t -c user.name=t -c tag.gpgSign=false ${cmd}`, { cwd, stdio: 'pipe' });
 function makeTaggedRepo(base, name, versions) {
     const dir = path_1.default.join(base, name);
-    fs_1.default.mkdirSync(dir, { recursive: true });
+    fs_1.default.mkdirSync(path_1.default.join(dir, 'skills'), { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'skills', '.keep'), 'fixture');
     GIT(dir, 'init -q -b main');
     fs_1.default.writeFileSync(path_1.default.join(dir, 'VERSION'), 'init');
     GIT(dir, 'add -A');

package/dist/tests/core/project-skill-links.test.js

@@ -156,4 +156,26 @@ describe('awm sync reaches the project-scope reconciliation', () => {
         expect(out.code).toBe(0);
         expect(spy).toHaveBeenCalledTimes(1);
     });
+    it('fails before project reconciliation when registry sync leaves unsafe content', async () => {
+        writeProfile(['demo']);
+        const registry = path_1.default.join(process.env.AWM_HOME, 'registries', 'baseline');
+        const outside = path_1.default.join(home, 'outside-skill');
+        fs_1.default.writeFileSync(outside, 'outside');
+        fs_1.default.mkdirSync(path_1.default.join(registry, 'skills'), { recursive: true });
+        fs_1.default.symlinkSync(outside, path_1.default.join(registry, 'skills', 'artifact'));
+        fs_1.default.writeFileSync(path_1.default.join(process.env.AWM_HOME, 'registries.json'), JSON.stringify([{ name: 'baseline', remote: 'r' }]));
+        const reconcile = jest.fn(() => []);
+        const syncProfile = jest.fn(() => ({ installed: [], skipped: [], extensions: [], transactionIds: [], modifiedFiles: [] }));
+        const { runSyncCore } = require('../../src/commands/sync');
+        const out = await runSyncCore({ cwd: projectRoot }, {
+            syncRegistries: async () => [{ name: 'baseline', action: 'error', error: 'unsafe layout' }],
+            verifyMinCliVersions: () => [],
+            verifyProjectPins: async () => [],
+            syncProfile,
+            reconcileProjectSkillLinks: reconcile,
+        });
+        expect(out.code).toBe(1);
+        expect(reconcile).not.toHaveBeenCalled();
+        expect(syncProfile).not.toHaveBeenCalled();
+    });
 });

package/dist/tests/core/registries-capability.test.js

@@ -49,4 +49,14 @@ describe('capabilityRoot', () => {
         m.writeRegistriesConfig([]);
         expect(m.capabilityRoot('hooks')).toBeNull();
     });
+    it('ignora una capability que no es un directorio y selecciona la primera regular', () => {
+        const m = require('../../src/core/registries');
+        const aRoot = path_1.default.join(tmpHome, '.awm', 'registries', 'a');
+        const bRoot = path_1.default.join(tmpHome, '.awm', 'registries', 'b');
+        fs_1.default.mkdirSync(aRoot, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(aRoot, 'hooks'), 'not a directory');
+        fs_1.default.mkdirSync(path_1.default.join(bRoot, 'hooks'), { recursive: true });
+        m.writeRegistriesConfig([{ name: 'a', remote: 'x' }, { name: 'b', remote: 'y' }]);
+        expect(m.capabilityRoot('hooks')).toBe(bRoot);
+    });
 });

package/dist/tests/core/registries-sync.test.js

@@ -101,6 +101,22 @@ describe('syncRegistries (git fixtures locales)', () => {
         const synced = fs_1.default.readFileSync(path_1.default.join(tmpHome, '.awm/registries/personal/skills/alpha/SKILL.md'), 'utf-8');
         expect(synced).toContain('v2');
     });
+    it('reports an unsafe symlink introduced by an update instead of a successful pull', async () => {
+        const m = require('../../src/core/registries');
+        const source = makeSourceRepo(tmpWork, 'alpha');
+        m.writeRegistriesConfig([{ name: 'personal', remote: source }]);
+        await m.syncRegistries();
+        const outside = path_1.default.join(tmpWork, 'outside-skill.md');
+        fs_1.default.writeFileSync(outside, 'outside');
+        fs_1.default.rmSync(path_1.default.join(source, 'skills', 'alpha', 'SKILL.md'));
+        fs_1.default.symlinkSync(outside, path_1.default.join(source, 'skills', 'alpha', 'SKILL.md'));
+        GIT(source, 'add -A');
+        GIT(source, 'commit -qm unsafe-link');
+        const results = await m.syncRegistries();
+        expect(results[0].action).toBe('error');
+        expect(results[0].error).toMatch(/unsafe|layout/i);
+        expect(m.contentRoots()).toEqual([]);
+    });
     it('registry con tags queda en el último tag y reporta la versión', async () => {
         const m = require('../../src/core/registries');
         const source = makeSourceRepo(tmpWork, 'alpha');

package/dist/tests/core/registries.test.js

@@ -61,6 +61,16 @@ describe('core/registries', () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.awm', 'registries.json'), JSON.stringify([{ name: '.', remote: 'r' }]));
         expect(() => m.readRegistriesConfig()).toThrow(/path traversal/);
     });
+    it('readRegistriesConfig rejects an empty name that would resolve to the registries parent', () => {
+        const m = load();
+        fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.awm', 'registries.json'), JSON.stringify([{ name: '', remote: 'r' }]));
+        expect(() => m.readRegistriesConfig()).toThrow(/path traversal/);
+        expect(() => m.registryContentRoot('')).toThrow(/Invalid registry name/);
+    });
+    it.each(['.', 'baseline/skills', 'baseline\\skills'])('registryContentRoot rejects unsafe registry component %s', (name) => {
+        expect(() => load().registryContentRoot(name)).toThrow(/Invalid registry name/);
+    });
     it('listRegistries derives contentRoot under ~/.awm/registries/<name>', () => {
         const m = load();
         m.writeRegistriesConfig([{ name: 'personal', remote: 'r' }]);
@@ -72,14 +82,82 @@ describe('core/registries', () => {
         const m = load();
         // 'present' existe en disco, 'ghost' no
         const present = path_1.default.join(tmpHome, '.awm', 'registries', 'present');
-        fs_1.default.mkdirSync(present, { recursive: true });
+        fs_1.default.mkdirSync(path_1.default.join(present, 'skills'), { recursive: true });
         m.writeRegistriesConfig([{ name: 'present', remote: 'r1' }, { name: 'ghost', remote: 'r2' }]);
         expect(m.contentRoots()).toEqual([present]);
     });
+    it('contentRoots preserves an empty configured registry for later synchronization', () => {
+        const m = load();
+        const empty = path_1.default.join(tmpHome, '.awm', 'registries', 'empty');
+        fs_1.default.mkdirSync(empty, { recursive: true });
+        m.writeRegistriesConfig([{ name: 'empty', remote: 'r1' }]);
+        expect(m.contentRoots()).toEqual([empty]);
+    });
+    it('contentRoots omits a configured registry with nested artifact symlinks', () => {
+        const m = load();
+        const present = path_1.default.join(tmpHome, '.awm', 'registries', 'present');
+        const outside = path_1.default.join(tmpHome, 'outside-skill.md');
+        fs_1.default.writeFileSync(outside, 'outside');
+        fs_1.default.mkdirSync(path_1.default.join(present, 'skills', 'linked'), { recursive: true });
+        fs_1.default.symlinkSync(outside, path_1.default.join(present, 'skills', 'linked', 'SKILL.md'));
+        m.writeRegistriesConfig([{ name: 'present', remote: 'r1' }]);
+        expect(m.contentRoots()).toEqual([]);
+    });
+    it('contentRoots omits a configured registry root that is itself a symlink', () => {
+        const m = load();
+        const outside = path_1.default.join(tmpHome, 'outside-registry');
+        const linked = path_1.default.join(tmpHome, '.awm', 'registries', 'linked');
+        fs_1.default.mkdirSync(path_1.default.join(outside, 'skills'), { recursive: true });
+        fs_1.default.mkdirSync(path_1.default.dirname(linked), { recursive: true });
+        fs_1.default.symlinkSync(outside, linked, 'dir');
+        m.writeRegistriesConfig([{ name: 'linked', remote: 'r1' }]);
+        expect(m.contentRoots()).toEqual([]);
+    });
+    it('contentRoots omits a registry with symlinked root metadata', () => {
+        const m = load();
+        for (const metadata of ['awm-registry.json', 'catalog.json']) {
+            const root = path_1.default.join(tmpHome, '.awm', 'registries', metadata);
+            const outside = path_1.default.join(tmpHome, `outside-${metadata}`);
+            fs_1.default.writeFileSync(outside, '{}');
+            fs_1.default.mkdirSync(path_1.default.join(root, 'skills'), { recursive: true });
+            fs_1.default.symlinkSync(outside, path_1.default.join(root, metadata));
+            m.writeRegistriesConfig([{ name: metadata, remote: 'r1' }]);
+            expect(m.contentRoots()).toEqual([]);
+            fs_1.default.rmSync(path_1.default.join(tmpHome, '.awm', 'registries', metadata), { recursive: true, force: true });
+        }
+    });
     it('contentRoots returns [] when no registries are configured', () => {
         const m = load();
         expect(m.contentRoots()).toEqual([]);
     });
+    it('treats an errored registry with an unsafe existing layout as unusable', () => {
+        const m = load();
+        const root = path_1.default.join(tmpHome, '.awm', 'registries', 'baseline');
+        const outside = path_1.default.join(tmpHome, 'outside');
+        fs_1.default.writeFileSync(outside, 'outside');
+        fs_1.default.mkdirSync(path_1.default.join(root, 'skills'), { recursive: true });
+        fs_1.default.symlinkSync(outside, path_1.default.join(root, 'skills', 'artifact'));
+        m.writeRegistriesConfig([{ name: 'baseline', remote: 'r' }]);
+        const results = [{ name: 'baseline', action: 'error', error: 'unsafe layout' }];
+        expect(m.unusableSyncedRegistries(results)).toEqual([{ name: 'baseline', error: 'unsafe layout' }]);
+        expect(() => m.assertSyncedRegistriesUsable(results)).toThrow(/registry sync failed/);
+    });
+    it('treats an errored registry with an empty existing root as unusable', () => {
+        const m = load();
+        const root = path_1.default.join(tmpHome, '.awm', 'registries', 'baseline');
+        fs_1.default.mkdirSync(root, { recursive: true });
+        m.writeRegistriesConfig([{ name: 'baseline', remote: 'r' }]);
+        const results = [{ name: 'baseline', action: 'error', error: 'network unreachable' }];
+        expect(m.unusableSyncedRegistries(results)).toEqual([{ name: 'baseline', error: 'network unreachable' }]);
+        expect(() => m.assertSyncedRegistriesUsable(results)).toThrow(/registry sync failed/);
+    });
+    it('requires synchronization before discovery when a configured root is empty', () => {
+        const m = load();
+        const root = path_1.default.join(tmpHome, '.awm', 'registries', 'baseline');
+        fs_1.default.mkdirSync(root, { recursive: true });
+        m.writeRegistriesConfig([{ name: 'baseline', remote: 'r' }]);
+        expect(m.registriesNeedSync()).toBe(true);
+    });
     it('validateRegistryLayout requires at least one content dir at the root', () => {
         const m = load();
         const root = path_1.default.join(tmpHome, 'somerepo');
@@ -88,4 +166,54 @@ describe('core/registries', () => {
         fs_1.default.mkdirSync(path_1.default.join(root, 'skills'));
         expect(m.validateRegistryLayout(root)).toBe(true);
     });
+    it('validateRegistryLayout accepts a regular capability-only registry', () => {
+        const m = load();
+        for (const directory of ['hooks', 'sensor-packs']) {
+            const root = path_1.default.join(tmpHome, `repo-${directory}`);
+            fs_1.default.mkdirSync(path_1.default.join(root, directory), { recursive: true });
+            expect(m.validateRegistryLayout(root)).toBe(true);
+        }
+    });
+    it('validateRegistryLayout fails closed when a content entry cannot be inspected', () => {
+        const m = load();
+        const root = path_1.default.join(tmpHome, 'somerepo');
+        const inaccessible = path_1.default.join(root, 'bundles');
+        fs_1.default.mkdirSync(path_1.default.join(root, 'skills'), { recursive: true });
+        const original = fs_1.default.lstatSync;
+        const lstat = jest.spyOn(fs_1.default, 'lstatSync').mockImplementation(((candidate) => {
+            if (candidate === inaccessible) {
+                const error = Object.assign(new Error('permission denied'), { code: 'EACCES' });
+                throw error;
+            }
+            return original(candidate);
+        }));
+        try {
+            expect(m.validateRegistryLayout(root)).toBe(false);
+        }
+        finally {
+            lstat.mockRestore();
+        }
+    });
+    it('validateRegistryLayout rejects nested symlinks in every managed registry directory', () => {
+        const m = load();
+        for (const directory of m.REGISTRY_DIR_NAMES) {
+            const root = path_1.default.join(tmpHome, `repo-${directory}`);
+            const outside = path_1.default.join(tmpHome, `outside-${directory}`);
+            fs_1.default.writeFileSync(outside, 'outside');
+            fs_1.default.mkdirSync(path_1.default.join(root, directory, 'nested'), { recursive: true });
+            fs_1.default.symlinkSync(outside, path_1.default.join(root, directory, 'nested', 'artifact'));
+            expect(m.validateRegistryLayout(root)).toBe(false);
+        }
+    });
+    it('validateRegistryLayout rejects symlinked root metadata', () => {
+        const m = load();
+        for (const metadata of ['awm-registry.json', 'catalog.json']) {
+            const root = path_1.default.join(tmpHome, `repo-${metadata}`);
+            const outside = path_1.default.join(tmpHome, `outside-${metadata}`);
+            fs_1.default.writeFileSync(outside, '{}');
+            fs_1.default.mkdirSync(path_1.default.join(root, 'skills'), { recursive: true });
+            fs_1.default.symlinkSync(outside, path_1.default.join(root, metadata));
+            expect(m.validateRegistryLayout(root)).toBe(false);
+        }
+    });
 });

package/dist/tests/core/registry-manifest.test.js

@@ -54,6 +54,13 @@ describe('registry manifest (awm-registry.json)', () => {
         const { readRegistryManifest } = load();
         expect(() => readRegistryManifest(tmpWork)).toThrow(/awm-registry\.json/);
     });
+    it('rejects a manifest symlink instead of reading outside the registry', () => {
+        const outside = path_1.default.join(tmpHome, 'outside-manifest.json');
+        fs_1.default.writeFileSync(outside, JSON.stringify({ overrides: ['outside'] }));
+        fs_1.default.symlinkSync(outside, path_1.default.join(tmpWork, 'awm-registry.json'));
+        const { readRegistryManifest } = load();
+        expect(() => readRegistryManifest(tmpWork)).toThrow(/symbolic link/);
+    });
     it('throws when overrides is not an array of strings', () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpWork, 'awm-registry.json'), JSON.stringify({ overrides: 'brainstorming' }));
         const { readRegistryManifest } = load();