agentic-workflow-manager 8.0.0 → 8.1.0

package/dist/tests/commands/sensors/exec-windows.test.js

@@ -24,6 +24,12 @@ function fakeChild(pid = 4242) {
     child.unref = jest.fn();
     return child;
 }
+function restoreEnvironment(name, value) {
+    if (value === undefined)
+        delete process.env[name];
+    else
+        process.env[name] = value;
+}
 describe('runCommand — win32', () => {
     const originalPlatform = process.platform;
     beforeEach(() => {
@@ -58,11 +64,35 @@ describe('runCommand — win32', () => {
             expect(mockSpawn).toHaveBeenCalledWith(path_1.default.join(dir, 'tool.exe'), ['literal;&'], expect.objectContaining({ shell: false, detached: false }));
             child.emit('close', 0, null);
             await expect(pending).resolves.toMatchObject({ code: 0 });
-            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool.cmd', resolution: 'path', args: [] }, { timeout: 5000, cwd: dir })).toThrow(/wrappers/);
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool.cmd', resolution: 'path', args: ['--version'] }, { timeout: 5000, cwd: dir })).toThrow(/wrappers/);
+        }
+        finally {
+            restoreEnvironment('PATH', savedPath);
+            restoreEnvironment('PATHEXT', savedPathExt);
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    it('spawns the allowlisted flat-config environment for ESLint 8', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-structured-win-env-'));
+        const savedPath = process.env.PATH;
+        const savedPathExt = process.env.PATHEXT;
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(dir, 'tool.exe'), 'fixture');
+            process.env.PATH = dir;
+            process.env.PATHEXT = '.EXE';
+            const child = fakeChild();
+            mockSpawn.mockReturnValue(child);
+            const pending = (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'path', args: ['--version'], environment: { ESLINT_USE_FLAT_CONFIG: 'true' } }, { timeout: 5000, cwd: dir });
+            expect(mockSpawn).toHaveBeenCalledWith(path_1.default.join(dir, 'tool.exe'), ['--version'], expect.objectContaining({
+                shell: false,
+                env: expect.objectContaining({ ESLINT_USE_FLAT_CONFIG: 'true' }),
+            }));
+            child.emit('close', 0, null);
+            await expect(pending).resolves.toMatchObject({ code: 0 });
         }
         finally {
-            process.env.PATH = savedPath;
-            process.env.PATHEXT = savedPathExt;
+            restoreEnvironment('PATH', savedPath);
+            restoreEnvironment('PATHEXT', savedPathExt);
             fs_1.default.rmSync(dir, { recursive: true, force: true });
         }
     });
@@ -80,14 +110,14 @@ describe('runCommand — win32', () => {
             process.env.PATHEXT = '.EXE';
             const child = fakeChild();
             mockSpawn.mockReturnValue(child);
-            const pending = (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir });
-            expect(mockSpawn).toHaveBeenCalledWith(path_1.default.join(localBin, 'tool.exe'), [], expect.objectContaining({ shell: false }));
+            const pending = (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: ['--version'] }, { timeout: 5000, cwd: dir });
+            expect(mockSpawn).toHaveBeenCalledWith(path_1.default.join(localBin, 'tool.exe'), ['--version'], expect.objectContaining({ shell: false }));
             child.emit('close', 0, null);
             await expect(pending).resolves.toMatchObject({ code: 0 });
         }
         finally {
-            process.env.PATH = savedPath;
-            process.env.PATHEXT = savedPathExt;
+            restoreEnvironment('PATH', savedPath);
+            restoreEnvironment('PATHEXT', savedPathExt);
             fs_1.default.rmSync(dir, { recursive: true, force: true });
             fs_1.default.rmSync(global, { recursive: true, force: true });
         }
@@ -100,16 +130,34 @@ describe('runCommand — win32', () => {
             fs_1.default.writeFileSync(path_1.default.join(global, 'tool.exe'), 'global');
             process.env.PATH = global;
             mockSpawn.mockReturnValue(fakeChild());
-            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir }))
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: ['--version'] }, { timeout: 5000, cwd: dir }))
                 .toThrow(/node_modules.*not found locally/i);
             expect(mockSpawn).not.toHaveBeenCalled();
         }
         finally {
-            process.env.PATH = savedPath;
+            restoreEnvironment('PATH', savedPath);
             fs_1.default.rmSync(dir, { recursive: true, force: true });
             fs_1.default.rmSync(global, { recursive: true, force: true });
         }
     });
+    it('fails closed when PATHEXT contains no safe executable extension', () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-structured-win-pathext-'));
+        const savedPath = process.env.PATH;
+        const savedPathExt = process.env.PATHEXT;
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(dir, 'tool.cmd'), 'wrapper');
+            process.env.PATH = dir;
+            process.env.PATHEXT = '.CMD';
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'path', args: ['--version'] }, { timeout: 5000, cwd: dir }))
+                .toThrow(/safe Windows executable|PATHEXT/i);
+            expect(mockSpawn).not.toHaveBeenCalled();
+        }
+        finally {
+            restoreEnvironment('PATH', savedPath);
+            restoreEnvironment('PATHEXT', savedPathExt);
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    });
     it('rejects a missing Python environment executable instead of falling back to a same-named global command', () => {
         const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-missing-win-'));
         const global = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-global-win-'));
@@ -123,7 +171,7 @@ describe('runCommand — win32', () => {
             expect(mockSpawn).not.toHaveBeenCalled();
         }
         finally {
-            process.env.PATH = savedPath;
+            restoreEnvironment('PATH', savedPath);
             fs_1.default.rmSync(dir, { recursive: true, force: true });
             fs_1.default.rmSync(global, { recursive: true, force: true });
         }

package/dist/tests/commands/sensors/exec.test.js

@@ -27,7 +27,7 @@ describe('runCommand — exit codes and output', () => {
             const literal = `;touch ${marker}`;
             const received = path_1.default.join(dir, 'received');
             const result = await (0, exec_1.runStructuredCommand)({
-                executable: process.execPath,
+                executable: 'node',
                 resolution: 'path',
                 args: ['-e', "require('fs').writeFileSync(process.argv[1], process.argv[2])", received, literal],
             }, { timeout: 5000, cwd: dir });
@@ -130,6 +130,36 @@ describe('runCommand — spawn failure', () => {
         expect(r.code).not.toBe(0);
     });
 });
+describe('runStructuredCommand — public boundary validation', () => {
+    it.each(['sh', 'cmd.exe', '/usr/bin/node', 'nested/tool', 'nested\\tool'])('rejects unsafe executable %j before resolution', executable => {
+        expect(() => (0, exec_1.runStructuredCommand)({ executable, resolution: 'path', args: ['--version'] }, { timeout: 5000, cwd: process.cwd() }))
+            .toThrow(/safe executable name|shell/i);
+    });
+    it('normalizes package-manager spellings while requiring an equivalent explicit selection', () => {
+        expect(() => (0, exec_1.runStructuredCommand)({ executable: 'NPM.exe', resolution: 'path', args: ['--version'] }, { timeout: 5000, cwd: process.cwd() }))
+            .toThrow(/packageManager/);
+        expect(() => (0, exec_1.runStructuredCommand)({ executable: 'NPM.exe', resolution: 'path', args: ['--version'], packageManager: 'pnpm' }, { timeout: 5000, cwd: process.cwd() }))
+            .toThrow(/packageManager/);
+    });
+    it.each([
+        { ESLINT_USE_FLAT_CONFIG: 'invalid' },
+        { ESLINT_USE_FLAT_CONFIG: 'true', OTHER: 'value' },
+    ])('rejects an unknown or expanded environment mapping at the public boundary', environment => {
+        expect(() => (0, exec_1.runStructuredCommand)({ executable: 'node', resolution: 'path', args: ['--version'], environment }, { timeout: 5000, cwd: process.cwd() }))
+            .toThrow(/exact allowlisted/);
+    });
+    it.each([
+        [{ executable: 'node', resolution: 'path', args: [] }, /nonempty array/],
+        [{ executable: 'node', resolution: 'path', args: [''] }, /nonempty single-line/],
+        [{ executable: 'node', resolution: 'path', args: ['one\ntwo'] }, /single-line/],
+        [{ executable: 'node', resolution: 'path', args: ['{files}'] }, /requires fileInput/],
+        [{ executable: 'node', resolution: 'path', args: ['prefix{files}'], fileInput: { placeholder: '{files}', extensions: ['.ts'] } }, /must not embed/],
+        [{ executable: 'node', resolution: 'path', args: ['{files}', '{files}'], fileInput: { placeholder: '{files}', extensions: ['.ts'] } }, /exactly one/],
+        [{ executable: 'node', resolution: 'path', args: ['--check'], fileInput: { placeholder: '{files}', extensions: ['.ts'] } }, /exactly one/],
+    ])('rejects malformed args or file input at the public boundary', (command, message) => {
+        expect(() => (0, exec_1.runStructuredCommand)(command, { timeout: 5000, cwd: process.cwd() })).toThrow(message);
+    });
+});
 onPosix('runStructuredCommand — local node_modules binaries', () => {
     it('follows an npm-style contained shim but rejects one escaping node_modules', async () => {
         const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-local-bin-symlink-'));
@@ -143,11 +173,11 @@ onPosix('runStructuredCommand — local node_modules binaries', () => {
             fs_1.default.writeFileSync(outside, '#!/bin/sh\necho outside\n', { mode: 0o755 });
             fs_1.default.mkdirSync(bin, { recursive: true });
             fs_1.default.symlinkSync('../tool/bin/tool', path_1.default.join(bin, 'tool'));
-            await expect((0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir }))
+            await expect((0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: ['--version'] }, { timeout: 5000, cwd: dir }))
                 .resolves.toMatchObject({ code: 0, stdout: 'contained\n' });
             fs_1.default.unlinkSync(path_1.default.join(bin, 'tool'));
             fs_1.default.symlinkSync(outside, path_1.default.join(bin, 'tool'));
-            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: [] }, { timeout: 5000, cwd: dir }))
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'tool', resolution: 'node-modules-bin', args: ['--version'] }, { timeout: 5000, cwd: dir }))
                 .toThrow(/node_modules.*contain|local/i);
         }
         finally {
@@ -156,6 +186,24 @@ onPosix('runStructuredCommand — local node_modules binaries', () => {
     });
 });
 onPosix('runStructuredCommand — Python environments', () => {
+    it.each(['.venv', 'venv'])('rejects a symlinked %s ancestor instead of executing outside the project', environment => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-ancestor-'));
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-outside-'));
+        const marker = path_1.default.join(dir, 'must-not-exist');
+        try {
+            const executable = path_1.default.join(outside, 'bin', 'semgrep');
+            fs_1.default.mkdirSync(path_1.default.dirname(executable), { recursive: true });
+            fs_1.default.writeFileSync(executable, `#!/bin/sh\ntouch ${marker}\n`, { mode: 0o755 });
+            fs_1.default.symlinkSync(outside, path_1.default.join(dir, environment));
+            expect(() => (0, exec_1.runStructuredCommand)({ executable: 'semgrep', resolution: 'python-environment', pythonEnvironmentRoot: environment, args: ['--validate'] }, { timeout: 5000, cwd: dir }))
+                .toThrow(/python.*environment.*local|contained/i);
+            expect(fs_1.default.existsSync(marker)).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
     it('rejects a missing project Python executable instead of falling back to PATH', () => {
         const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-missing-'));
         const global = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-global-'));

package/dist/tests/commands/sensors/init.test.js

@@ -7,6 +7,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const init_1 = require("../../../src/commands/sensors/init");
+const status_1 = require("../../../src/commands/sensors/status");
 // Build a throwaway registry with a js-ts pack.json (the single source of truth
 // init now reads from). `defaultCmd` uses the {{SOURCE_DIRS}} placeholder for depcheck.
 function makeRegistry() {
@@ -45,9 +46,11 @@ function makeV2Registry() {
     const packDir = path_1.default.join(registryRoot, 'sensor-packs', 'js-ts');
     fs_1.default.mkdirSync(packDir, { recursive: true });
     fs_1.default.writeFileSync(path_1.default.join(packDir, 'eslint.config.awm.mjs'), 'export default []\n');
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'tsconfig.awm.json'), '{ "compilerOptions": { "strict": true } }\n');
     fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
         schemaVersion: 2, name: 'js-ts', description: 'fixture', detects: ['package.json'],
         coverage: { schemaVersion: 1, classes: { lint: { description: 'lint', detectors: [{ sensor: 'lint' }], remedy: { summary: 'fix lint', command: 'awm sensors init --pack js-ts' } } } },
+        hardening: { 'typescript-strict': { assets: ['tsconfig.awm.json'] } },
         sensors: { lint: { applicability: { allFiles: ['package.json'] }, variants: [{
                         id: 'eslint-10', priority: 10, certifiedRange: '>=10.0.0 <11.0.0',
                         requirements: { tool: 'eslint', toolRange: '>=10.0.0 <11.0.0', runtime: 'node', runtimeRange: '>=0.0.0' },
@@ -57,6 +60,23 @@ function makeV2Registry() {
     }));
     return registryRoot;
 }
+function makeGenericV2Registry() {
+    const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-reg-generic-v2-'));
+    const packDir = path_1.default.join(registryRoot, 'sensor-packs', 'generic');
+    fs_1.default.mkdirSync(packDir, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'generic.config'), 'fixture\n');
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
+        schemaVersion: 2, name: 'generic', description: 'fixture', detects: ['README.md'],
+        coverage: { schemaVersion: 1, classes: { security: { description: 'security', detectors: [{ sensor: 'security' }], remedy: { summary: 'run security', command: 'awm sensors init --pack generic' } } } },
+        sensors: { security: { applicability: { kind: 'explicit-or-supported-language' }, variants: [{
+                        id: 'eslint-10', priority: 10, certifiedRange: '>=10.0.0 <11.0.0',
+                        requirements: { tool: 'eslint', toolRange: '>=10.0.0 <11.0.0', runtime: 'node', runtimeRange: '>=0.0.0', configFiles: ['generic.config'] },
+                        assets: ['generic.config'], formatter: 'eslint-llm', probe: { kind: 'config-present' },
+                        command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                    }] } },
+    }));
+    return registryRoot;
+}
 describe('detectStack', () => {
     let tmpDir;
     beforeEach(() => { tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-')); });
@@ -277,6 +297,58 @@ describe('initSensors', () => {
             fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
         }
     });
+    it('persists an explicit generic selection for live revalidation without promoting automatic generic fallback', async () => {
+        const v2Registry = makeGenericV2Registry();
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            const automatic = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, configure: false });
+            expect(automatic.manifest).toMatchObject({ schemaVersion: 2, pack: 'generic', sensors: {} });
+            expect(automatic.manifest.packSelection).toBeUndefined();
+            const explicit = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, pack: 'generic' });
+            const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8'));
+            expect(explicit.manifest).toMatchObject({ schemaVersion: 2, pack: 'generic', packSelection: 'explicit', sensors: { security: { variantId: 'eslint-10' } } });
+            expect(written.packSelection).toBe('explicit');
+            await expect((0, status_1.computeSensorStatus)(tmpDir)).resolves.toMatchObject({ overall: 'HEALTHY', checks: { security: { ok: true } } });
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('never materializes an opt-in hardening asset during ordinary v2 init', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'))).toBe(true);
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'tsconfig.awm.json'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('initializes a selected v2 variant with an explicitly empty assets list', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            const packPath = path_1.default.join(v2Registry, 'sensor-packs', 'js-ts', 'pack.json');
+            const pack = JSON.parse(fs_1.default.readFileSync(packPath, 'utf8'));
+            pack.sensors.lint.variants[0].assets = [];
+            fs_1.default.writeFileSync(packPath, JSON.stringify(pack));
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await expect((0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry })).resolves.toMatchObject({
+                manifest: { schemaVersion: 2, sensors: { lint: { assets: [] } } },
+                configured: [],
+            });
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
     it('preserves enabled and fast choices when a valid v2 manifest is re-initialized', async () => {
         const v2Registry = makeV2Registry();
         try {

package/dist/tests/structural/r3-cli-major-version.test.js

@@ -8,7 +8,7 @@ const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const CLI_ROOT = path_1.default.resolve(__dirname, '../..');
 const DIST_ENTRYPOINT = path_1.default.join(CLI_ROOT, 'dist', 'src', 'index.js');
-const TARGET_VERSION = '7.0.0';
+const TARGET_VERSION = '8.0.0';
 function readJson(file) {
     return JSON.parse(fs_1.default.readFileSync(path_1.default.join(CLI_ROOT, file), 'utf8'));
 }
@@ -22,7 +22,7 @@ function runCompiledCli(...args) {
     return `${result.stdout}${result.stderr}`;
 }
 describe('R3 public major CLI release contract', () => {
-    it('declares 7.0.0 consistently in package metadata and the lockfile root', () => {
+    it('declares 8.0.0 consistently in package metadata and the lockfile root', () => {
         const pkg = readJson('package.json');
         const lock = readJson('package-lock.json');
         const root = lock.packages[''];
@@ -30,7 +30,7 @@ describe('R3 public major CLI release contract', () => {
         expect(lock.version).toBe(TARGET_VERSION);
         expect(root.version).toBe(TARGET_VERSION);
     });
-    it('exposes 7.0.0 from the compiled CLI while retaining its help banner', () => {
+    it('exposes 8.0.0 from the compiled CLI while retaining its help banner', () => {
         expect(runCompiledCli('--version').trim()).toBe(TARGET_VERSION);
         expect(runCompiledCli('--help')).toContain('Usage: awm');
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"