agentic-workflow-manager 9.11.6 → 9.11.8

package/dist/src/commands/hooks/codex.js

@@ -10,6 +10,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.awmCodexEntry = awmCodexEntry;
+exports.isStaleAwmCodexEntry = isStaleAwmCodexEntry;
 exports.installCodexHook = installCodexHook;
 exports.computeCodexHookStatus = computeCodexHookStatus;
 exports.uninstallCodexHook = uninstallCodexHook;
@@ -38,6 +39,44 @@ function awmCodexEntry(scriptsDir) {
             }],
     };
 }
+/**
+ * Una entrada NUESTRA en `SessionStart` de Codex que ya no es la canonica (#184).
+ *
+ * Medido en una Mac real: `hooks.json` con dos entradas de AWM cuyos matchers se
+ * solapan en startup/clear/compact, o sea el hook corre dos veces por sesion y el
+ * contexto se inyecta dos veces. Ninguna de las dos vias existentes la alcanzaba:
+ * `isAwmCodexEntry` exige el matcher ACTUAL, e `isDeadAwmHookEntry` compara el
+ * basename del ejecutable contra 'session-start' cuando aca el ejecutable es
+ * `run-hook.cmd`. Y no es "muerta": el wrapper existe porque Claude Code si lo usa,
+ * asi que ninguna prueba de vivencia puede alcanzarla.
+ *
+ * Se reconoce por PROCEDENCIA y no-canonicidad, en dos formas:
+ *
+ *  - `run-hook.cmd session-start`: el contrato de wrapper que escribe el adapter de
+ *    Claude (claude.ts) y que este adapter declara no usar. En el archivo de Codex
+ *    solo puede ser un resto de una version anterior.
+ *  - nuestro propio script con el matcher viejo: misma ruta exacta que instalamos,
+ *    pero el matcher cambio, asi que el instalador la ignoraba y AGREGABA otra.
+ *
+ * Deliberadamente fuera: una instalacion paralela VIVA de otro AWM_HOME, que usa la
+ * forma nativa con su propia ruta. `isDeadAwmHookEntry` la preserva a proposito y
+ * esta funcion no revierte esa decision.
+ */
+function isStaleAwmCodexEntry(entry, scriptsDir, canonicalMatcher) {
+    const candidate = entry;
+    if (!Array.isArray(candidate?.hooks))
+        return false;
+    const ours = path_1.default.join(scriptsDir, 'session-start');
+    return candidate.hooks.some((hook) => {
+        const command = hook?.command;
+        if (typeof command !== 'string' || command.length === 0)
+            return false;
+        const [executable, ...args] = command.split(' ');
+        if (path_1.default.basename(executable) === 'run-hook.cmd' && args.join(' ') === 'session-start')
+            return true;
+        return executable === ours && candidate.matcher !== canonicalMatcher;
+    });
+}
 function isAwmCodexEntry(entry, scriptsDir) {
     return (entry?.matcher === codexMatcher() &&
         Array.isArray(entry?.hooks) &&
@@ -60,7 +99,8 @@ function installCodexHook(options) {
     // Se podan primero las entradas nuestras que apuntan a un script inexistente: son
     // restos de otro AWM_HOME ya borrado, y el agente las intenta ejecutar cada sesion.
     // Una instalacion paralela VIVA no se toca — su script existe. Ver isDeadAwmHookEntry.
-    const entries = raw.filter((entry) => !(0, shared_1.isDeadAwmHookEntry)(entry, codexMatcher(), 'session-start', config.scriptsDir));
+    const entries = raw.filter((entry) => !(0, shared_1.isDeadAwmHookEntry)(entry, codexMatcher(), 'session-start', config.scriptsDir)
+        && !isStaleAwmCodexEntry(entry, config.scriptsDir, codexMatcher()));
     const matches = entries.filter((entry) => isAwmCodexEntry(entry, config.scriptsDir));
     if (matches.length > 1) {
         throw new Error('multiple AWM SessionStart entries in Codex hooks.json');

package/dist/tests/commands/hooks/codex.test.js

@@ -282,6 +282,90 @@ describe('installHook / computeHookStatus / uninstallHook — Codex adapter', ()
             const foreign = entryFor('/tmp/someone-elses/my-own-hook');
             expect(isDeadAwmHookEntry(foreign, 'startup|resume|clear|compact', 'session-start', codexScriptsDir)).toBe(false);
         });
+        // #184, medido en una Mac real: `~/.codex/hooks.json` con DOS entradas de AWM,
+        // matchers solapados en startup/clear/compact, o sea el hook corre dos veces por
+        // sesion y el contexto se inyecta dos veces — tokens duplicados en cada arranque.
+        //
+        // La entrada vieja es la forma WRAPPER de Claude (`run-hook.cmd session-start` con
+        // el matcher de Claude), que este adapter declara en su propio encabezado que no
+        // usa. Es invisible para las dos vias que la reconocerian: `isAwmCodexEntry` exige
+        // el matcher actual, e `isDeadAwmHookEntry` compara el basename del EJECUTABLE
+        // contra 'session-start' — y aca el ejecutable es `run-hook.cmd`. Y no es "muerta":
+        // `run-hook.cmd` existe, porque Claude Code si lo usa, asi que ninguna prueba de
+        // vivencia puede alcanzarla.
+        function legacyClaudeWrapperEntry() {
+            return {
+                matcher: 'startup|clear|compact',
+                hooks: [{ type: 'command', command: `${path_1.default.join(tmpHome, '.awm/hooks/run-hook.cmd')} session-start` }],
+            };
+        }
+        it('drops the legacy run-hook.cmd wrapper entry, so the hook stops firing twice', () => {
+            installCodexFixture({ heartbeat: false });
+            // El wrapper EXISTE en disco: es el que usa Claude Code de verdad.
+            fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm/hooks'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.awm/hooks/run-hook.cmd'), '#!/bin/sh\n', { mode: 0o755 });
+            const current = JSON.parse(fs_1.default.readFileSync(hooksJson, 'utf-8'));
+            current.hooks.SessionStart.unshift(legacyClaudeWrapperEntry());
+            fs_1.default.writeFileSync(hooksJson, JSON.stringify(current, null, 2));
+            writeRegistry();
+            const { installHook } = require('../../../src/commands/hooks/install');
+            installHook({ agent: 'codex', registryRoot: tmpRegistry, installMethod: 'copy' });
+            const after = JSON.parse(fs_1.default.readFileSync(hooksJson, 'utf-8')).hooks.SessionStart;
+            expect(after).toHaveLength(1);
+            expect(after[0].matcher).toBe('startup|resume|clear|compact');
+            expect(after[0].hooks[0].command).toBe(path_1.default.join(codexScriptsDir, 'session-start'));
+        });
+        it('drops our own entry when only its matcher drifted, instead of adding a second one', () => {
+            installCodexFixture({ heartbeat: false });
+            const current = JSON.parse(fs_1.default.readFileSync(hooksJson, 'utf-8'));
+            current.hooks.SessionStart.unshift({
+                matcher: 'startup|clear|compact',
+                hooks: [{ type: 'command', command: path_1.default.join(codexScriptsDir, 'session-start') }],
+            });
+            fs_1.default.writeFileSync(hooksJson, JSON.stringify(current, null, 2));
+            writeRegistry();
+            const { installHook } = require('../../../src/commands/hooks/install');
+            installHook({ agent: 'codex', registryRoot: tmpRegistry, installMethod: 'copy' });
+            const after = JSON.parse(fs_1.default.readFileSync(hooksJson, 'utf-8')).hooks.SessionStart;
+            expect(after).toHaveLength(1);
+            expect(after[0].matcher).toBe('startup|resume|clear|compact');
+        });
+        it('leaves a live parallel AWM_HOME alone: cleaning our own leftovers is not breaking someone else', () => {
+            installCodexFixture({ heartbeat: false });
+            const other = path_1.default.join(tmpHome, 'other-awm/hooks/codex');
+            fs_1.default.mkdirSync(other, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(other, 'session-start'), '#!/bin/sh\n', { mode: 0o755 });
+            const current = JSON.parse(fs_1.default.readFileSync(hooksJson, 'utf-8'));
+            current.hooks.SessionStart.unshift(entryFor(path_1.default.join(other, 'session-start')));
+            fs_1.default.writeFileSync(hooksJson, JSON.stringify(current, null, 2));
+            writeRegistry();
+            const { installHook } = require('../../../src/commands/hooks/install');
+            installHook({ agent: 'codex', registryRoot: tmpRegistry, installMethod: 'copy' });
+            const after = JSON.parse(fs_1.default.readFileSync(hooksJson, 'utf-8')).hooks.SessionStart;
+            expect(after).toHaveLength(2);
+        });
+        // La guarda real: podar por procedencia tiene que distinguir NUESTRA ruta exacta
+        // de la de otro AWM_HOME. Con matcher canonico la distincion no se ejercita (nada
+        // la poda de todos modos), asi que este caso usa un matcher DERIVADO: si la regla
+        // mirara el basename en vez de la ruta completa, le romperia la instalacion a otro.
+        it('leaves a live parallel AWM_HOME alone even when ITS matcher drifted', () => {
+            installCodexFixture({ heartbeat: false });
+            const other = path_1.default.join(tmpHome, 'other-awm/hooks/codex');
+            fs_1.default.mkdirSync(other, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(other, 'session-start'), '#!/bin/sh\n', { mode: 0o755 });
+            const current = JSON.parse(fs_1.default.readFileSync(hooksJson, 'utf-8'));
+            current.hooks.SessionStart.unshift({
+                matcher: 'startup|clear|compact',
+                hooks: [{ type: 'command', command: path_1.default.join(other, 'session-start') }],
+            });
+            fs_1.default.writeFileSync(hooksJson, JSON.stringify(current, null, 2));
+            writeRegistry();
+            const { installHook } = require('../../../src/commands/hooks/install');
+            installHook({ agent: 'codex', registryRoot: tmpRegistry, installMethod: 'copy' });
+            const after = JSON.parse(fs_1.default.readFileSync(hooksJson, 'utf-8')).hooks.SessionStart;
+            expect(after).toHaveLength(2);
+            expect(after.some((e) => e.hooks[0].command === path_1.default.join(other, 'session-start'))).toBe(true);
+        });
         it('install removes the stale entry instead of accumulating a second one', () => {
             installCodexFixture({ heartbeat: false });
             const hooksJson = path_1.default.join(tmpHome, '.codex', 'hooks.json');

package/dist/tests/commands/plan/index.test.js

@@ -17,6 +17,7 @@ const canonical_1 = require("../../../src/core/model-policy/canonical");
 const capabilities_1 = require("../../../src/core/model-policy/capabilities");
 const journal_1 = require("../../../src/core/model-policy/journal");
 const types_1 = require("../../../src/core/journal/types");
+const fixture_cleanup_1 = require("../../helpers/fixture-cleanup");
 const stdoutWrite = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
 const repositoryRoot = path_1.default.resolve(__dirname, '../../../..');
 const approved = (0, validate_1.validatePlanFile)('docs/plans/2026-09-14-compact-only-bootstrap-plan.md', repositoryRoot);
@@ -181,7 +182,7 @@ describe('plan validate Commander wiring', () => {
             expect(fs_1.default.readFileSync(plan).equals(before)).toBe(true);
         }
         finally {
-            fs_1.default.rmSync(fixtureRoot, { recursive: true, force: true });
+            (0, fixture_cleanup_1.removeFixtureTree)(fixtureRoot);
         }
     });
     it.each([

package/dist/tests/helpers/fixture-cleanup.js

@@ -0,0 +1,21 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeFixtureTree = removeFixtureTree;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const REMOVE_OPTIONS = {
+    recursive: true,
+    force: true,
+    maxRetries: 10,
+    retryDelay: 50,
+};
+/** Removes an isolated test fixture while tolerating short-lived Windows locks. */
+function removeFixtureTree(target, remove = fs_1.default.rmSync) {
+    if (typeof target !== 'string' || !path_1.default.isAbsolute(target)) {
+        throw new Error('fixture cleanup requires an absolute path');
+    }
+    remove(target, REMOVE_OPTIONS);
+}

package/dist/tests/helpers/fixture-cleanup.test.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const fixture_cleanup_1 = require("./fixture-cleanup");
+describe('removeFixtureTree', () => {
+    it('uses bounded native retries for transient filesystem locks', () => {
+        const remove = jest.fn();
+        (0, fixture_cleanup_1.removeFixtureTree)('/tmp/fixture', remove);
+        expect(remove).toHaveBeenCalledWith('/tmp/fixture', {
+            recursive: true,
+            force: true,
+            maxRetries: 10,
+            retryDelay: 50,
+        });
+    });
+    it.each(['', 'relative-fixture'])('rejects an unsafe fixture path %j', target => {
+        expect(() => (0, fixture_cleanup_1.removeFixtureTree)(target)).toThrow('fixture cleanup requires an absolute path');
+    });
+});

package/dist/tests/integration/sensor-structured-run.e2e.test.js

@@ -7,6 +7,7 @@ const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const fixture_cleanup_1 = require("../helpers/fixture-cleanup");
 const cliDir = path_1.default.resolve(__dirname, '../..');
 const bin = path_1.default.join(cliDir, 'dist/src/index.js');
 function writeJson(file, value) {
@@ -126,6 +127,6 @@ test('compiled sensors run materializes a v2 registry command and passes its lit
         expect(fs_1.default.existsSync(path_1.default.join(fixture.project, 'structured-shell-injection'))).toBe(false);
     }
     finally {
-        fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+        (0, fixture_cleanup_1.removeFixtureTree)(fixture.root);
     }
 });

package/dist/tests/structural/native-release-artifacts.test.js

@@ -9,14 +9,12 @@ const path_1 = __importDefault(require("path"));
 const CLI_ROOT = path_1.default.resolve(__dirname, '..', '..');
 const REPO_ROOT = path_1.default.resolve(CLI_ROOT, '..');
 describe('native release artifacts', () => {
-    it('checks Windows admission before full suites and stops a failed suite without weakening publication', () => {
+    it('runs each platform suite once without weakening publication', () => {
         for (const name of ['ci.yml', 'release.yml']) {
             const workflow = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', name), 'utf8');
-            expect(workflow).toContain('- name: Windows admission smoke');
-            expect(workflow).toContain("if: runner.os == 'Windows'");
-            expect(workflow).toContain('run: npx jest tests/commands/plan/index.test.ts --runInBand --bail');
+            expect(workflow).not.toContain('- name: Windows admission smoke');
+            expect(workflow).not.toContain('run: npx jest tests/commands/plan/index.test.ts --runInBand --bail');
             expect(workflow).toContain('run: npx jest --runInBand --bail');
-            expect(workflow.indexOf('- name: Windows admission smoke')).toBeLessThan(workflow.indexOf('run: npx jest --runInBand --bail'));
         }
         const release = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', 'release.yml'), 'utf8');
         expect(release).toMatch(/release:\s*\n\s*needs: test/);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.11.6",
+  "version": "9.11.8",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -52,7 +52,7 @@
     "commander": "^14.0.3",
     "picocolors": "^1.1.1",
     "semver": "^7.7.4",
-    "simple-git": "^3.32.2"
+    "simple-git": "3.36.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
@@ -64,7 +64,7 @@
     "dependency-cruiser": "16.10.4",
     "eslint": "10.8.1",
     "jest": "^30.2.0",
-    "js-yaml": "4.1.0",
+    "js-yaml": "4.3.2",
     "node-gyp": "^11.5.0",
     "ts-jest": "^29.4.6",
     "ts-node": "^10.9.2",