agentic-workflow-manager 9.11.9 → 9.11.11

package/dist/src/core/currentness/check.js

@@ -51,6 +51,18 @@ function authoritativeSource(value) {
 function sanitizeSource(value) {
     return authoritativeSource(value) ?? '[configured remote]';
 }
+function sshUserInfoLabel(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol === 'ssh:')
+            return url.username ? 'SSH userinfo present' : 'no SSH userinfo';
+    }
+    catch {
+        if (/^[A-Za-z0-9._-]+@[A-Za-z0-9.-]+:[A-Za-z0-9._/-]+$/.test(value))
+            return 'SSH userinfo present';
+    }
+    return 'no SSH userinfo';
+}
 function parseVersion(value) {
     const match = STRICT_SEMVER.exec(value.trim());
     if (!match)
@@ -144,33 +156,40 @@ async function registryComponent(registry, git, prefs, checkedAt) {
     const authorizedSource = authoritativeSource(registry.remote);
     const source = authorizedSource ?? '[configured remote]';
     const pin = prefs.pins?.[registry.name];
+    const fail = (detail, remedy, installed = null, latest = null) => ({
+        ...unavailable(`registry:${registry.name}`, source, checkedAt, installed, pin), latest, detail, remedy,
+    });
     if (!authorizedSource)
-        return unavailable(`registry:${registry.name}`, source, checkedAt, null, pin);
-    let origin;
-    let head;
-    let exactTag;
-    let remoteTags;
-    try {
-        [origin, head, exactTag, remoteTags] = await Promise.all([
-            deadline(git(registry.contentRoot, ['remote', 'get-url', 'origin'], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
-            deadline(git(registry.contentRoot, ['rev-parse', 'HEAD'], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
-            deadline(git(registry.contentRoot, ['describe', '--tags', '--exact-match', 'HEAD'], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
-            deadline(git(registry.contentRoot, ['ls-remote', '--tags', registry.remote], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
-        ]);
-    }
-    catch {
-        return unavailable(`registry:${registry.name}`, source, checkedAt, null, pin);
-    }
-    const installed = exactTag.trim();
-    const latest = latestStableTag(remoteTags);
-    const localHead = head.trim();
+        return fail('Configured registry remote is not an authoritative HTTPS or SSH source.', 'Configure an authoritative registry remote and rerun strict preflight.');
+    const [originResult, headResult, tagResult, remoteResult] = await Promise.allSettled([
+        deadline(git(registry.contentRoot, ['remote', 'get-url', 'origin'], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
+        deadline(git(registry.contentRoot, ['rev-parse', 'HEAD'], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
+        deadline(git(registry.contentRoot, ['describe', '--tags', '--exact-match', 'HEAD'], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
+        deadline(git(registry.contentRoot, ['ls-remote', '--tags', registry.remote], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
+    ]);
+    if (originResult.status === 'rejected')
+        return fail('Could not read local registry origin.', 'Inspect the local registry checkout and its origin remote.');
+    if (headResult.status === 'rejected')
+        return fail('Could not read local registry HEAD.', 'Inspect or repair the local registry checkout.');
+    if (tagResult.status === 'rejected')
+        return fail('Could not read an exact tag at local registry HEAD.', 'Check out a stable tag in the local registry and rerun strict preflight.');
+    if (remoteResult.status === 'rejected')
+        return fail('Could not query authoritative remote tags.', 'Restore source access and rerun strict preflight.');
+    const installed = tagResult.value.trim();
+    const latest = latestStableTag(remoteResult.value);
+    const localHead = headResult.value.trim();
     const installedVersion = parseVersion(installed);
-    if (!installedVersion || !latest || !/^[0-9a-fA-F]{40,64}$/.test(localHead) || origin.trim() !== registry.remote) {
-        return unavailable(`registry:${registry.name}`, source, checkedAt, installedVersion ? installed : null, pin);
-    }
+    if (!installedVersion)
+        return fail('Local registry HEAD does not have an exact stable tag.', 'Check out a stable tag in the local registry and rerun strict preflight.');
+    if (!latest)
+        return fail('No stable version tag was found on the authoritative remote.', 'Publish a stable tag or correct the configured registry remote.', installed);
+    if (!/^[0-9a-fA-F]{40,64}$/.test(localHead))
+        return fail('Local registry HEAD is not a valid commit SHA.', 'Inspect or repair the local registry checkout.', installed, latest.tag);
+    if (originResult.value.trim() !== registry.remote)
+        return fail(`Local origin does not match configured remote (origin: ${sanitizeSource(originResult.value.trim())} [${sshUserInfoLabel(originResult.value.trim())}]; configured: ${source} [${sshUserInfoLabel(registry.remote)}]).`, 'Align the local origin with the configured registry remote and rerun strict preflight.', installed, latest.tag);
     const relation = compareStrict(installed, latest.tag);
     if (relation === null)
-        return unavailable(`registry:${registry.name}`, source, checkedAt, installed, pin);
+        return fail('Stable registry tags could not be compared.', 'Inspect local and remote stable tags.', installed, latest.tag);
     if (relation === 0 && localHead === latest.sha) {
         return { component: `registry:${registry.name}`, installed, latest: latest.tag, channel: 'stable', source, ...(pin ? { pin } : {}), checkedAt, status: 'current', detail: 'Exact stable tag and configured origin match the authoritative remote.', remedy: 'No action required.' };
     }
@@ -181,7 +200,7 @@ async function registryComponent(registry, git, prefs, checkedAt) {
             remedy: pin ? `awm unpin ${registry.name} && awm update --yes` : 'awm update --yes',
         };
     }
-    return unavailable(`registry:${registry.name}`, source, checkedAt, installed, pin);
+    return fail('Installed stable tag is ahead of the authoritative remote or does not match its commit.', 'Inspect the local tag and authoritative remote before updating.', installed, latest.tag);
 }
 /** Strict, read-only remote currentness check. It intentionally never reads/writes update cache. */
 async function checkCurrentness(cwd, deps = {}) {
@@ -195,11 +214,14 @@ async function checkCurrentness(cwd, deps = {}) {
     const preferences = (deps.readPreferences ?? config_1.readPreferences)();
     const installedCli = getCliVersion();
     const latest = await latestCli(fetchImpl);
-    const cli = !parseVersion(installedCli) || !latest || compareStrict(installedCli, latest) === null
+    const relation = latest ? compareStrict(installedCli, latest) : null;
+    const cli = relation === null
         ? unavailable('cli', NPM_SOURCE, checkedAt, parseVersion(installedCli) ? installedCli : null)
-        : compareStrict(installedCli, latest) === 0
+        : relation === 0
             ? { component: 'cli', installed: installedCli, latest, channel: 'stable', source: NPM_SOURCE, checkedAt, status: 'current', detail: 'Installed version equals the npm latest release.', remedy: 'No action required.' }
-            : { component: 'cli', installed: installedCli, latest, channel: 'stable', source: NPM_SOURCE, checkedAt, status: 'stale', detail: 'Installed version is behind the npm latest release.', remedy: `npm i -g ${cli_version_1.CLI_PACKAGE_NAME}@latest && rerun in a fresh process` };
+            : relation < 0
+                ? { component: 'cli', installed: installedCli, latest, channel: 'stable', source: NPM_SOURCE, checkedAt, status: 'stale', detail: 'Installed version is behind the npm latest release.', remedy: `npm i -g ${cli_version_1.CLI_PACKAGE_NAME}@latest && rerun in a fresh process` }
+                : { component: 'cli', installed: installedCli, latest, channel: 'stable', source: NPM_SOURCE, checkedAt, status: 'unverifiable', detail: 'Installed version is ahead of the npm latest release; remote currentness cannot be established.', remedy: 'Check the installed CLI version and npm latest metadata, then rerun strict preflight.' };
     const components = [cli];
     let registries;
     try {

package/dist/tests/core/currentness/check.test.js

@@ -97,6 +97,19 @@ describe('checkCurrentness', () => {
             status: 'stale',
         }));
     });
+    it('does not claim a CLI ahead of npm latest is stale or recommend a downgrade', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            cliVersion: () => '1.2.4',
+        }));
+        expect(result.components[0]).toEqual(expect.objectContaining({
+            installed: '1.2.4',
+            latest: '1.2.3',
+            status: 'unverifiable',
+            detail: expect.stringMatching(/ahead.*npm latest/i),
+        }));
+        expect(result.components[0].remedy).not.toContain('npm i -g');
+    });
     it('marks a registry tag above the max-safe numeric boundary as stale', async () => {
         const installed = 'v1.9007199254740992.0';
         const latest = 'v1.9007199254740993.0';
@@ -165,6 +178,106 @@ describe('checkCurrentness', () => {
             : { git }));
         expect(result.components.some((c) => c.status === 'unverifiable')).toBe(true);
     });
+    it('identifies missing exact-tag provenance without blaming source access', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'describe')
+                    throw new Error('fatal: no tag exactly matches HEAD');
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+                if (args[0] === 'remote')
+                    return 'https://example.test/team/repo.git\n';
+                return `${'a'.repeat(40)}\n`;
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable',
+            detail: expect.stringMatching(/exact.*tag.*HEAD/i),
+            remedy: expect.stringMatching(/stable tag/i),
+        }));
+        expect(result.components[1].remedy).not.toContain('Restore source access');
+    });
+    it('identifies origin mismatch while keeping credential-bearing remotes out of diagnostics', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'remote')
+                    return 'https://user:secret@example.test/team/other.git\n';
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                return `${'a'.repeat(40)}\n`;
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable',
+            detail: expect.stringMatching(/origin.*configured remote/i),
+            remedy: expect.stringMatching(/origin/i),
+        }));
+        expect(JSON.stringify(result)).not.toContain('secret');
+        expect(JSON.stringify(result)).not.toContain('user:');
+    });
+    it('makes an SSH-user-only origin mismatch visible after sanitizing both remotes', async () => {
+        const configured = 'ssh://github.example/team/repo.git';
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            listRegistries: () => [{ name: 'baseline', remote: configured, contentRoot: '/registry' }],
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'remote')
+                    return 'ssh://git@github.example/team/repo.git\n';
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                return `${'a'.repeat(40)}\n`;
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable',
+            detail: expect.stringMatching(/origin.*SSH userinfo present.*configured.*no SSH userinfo/i),
+        }));
+        expect(JSON.stringify(result)).not.toContain('git@');
+    });
+    it('distinguishes a remote tag query failure from local registry failures', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'ls-remote')
+                    throw new Error('remote unavailable');
+                if (args[0] === 'remote')
+                    return 'https://example.test/team/repo.git\n';
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                return `${'a'.repeat(40)}\n`;
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable',
+            detail: expect.stringMatching(/remote.*tags/i),
+            remedy: expect.stringMatching(/source access/i),
+        }));
+    });
+    it('reports a remote with no stable tags as a tag problem', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/v1.2.4-rc.1\n`;
+                if (args[0] === 'remote')
+                    return 'https://example.test/team/repo.git\n';
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                return `${'a'.repeat(40)}\n`;
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable',
+            detail: expect.stringMatching(/no stable.*tag/i),
+            remedy: expect.stringMatching(/stable tag/i),
+        }));
+    });
     it('bypasses passive update controls and makes no writes', async () => {
         const { checkCurrentness } = require('../../../src/core/currentness/check');
         const before = fs_1.default.readdirSync(root);

package/dist/tests/structural/native-release-artifacts.test.js

@@ -8,21 +8,90 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const CLI_ROOT = path_1.default.resolve(__dirname, '..', '..');
 const REPO_ROOT = path_1.default.resolve(CLI_ROOT, '..');
+function readWorkflow(name) {
+    return fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', name), 'utf8').replace(/\r\n/g, '\n');
+}
+function assertArmPartition(source) {
+    const workflow = source.replace(/\r\n/g, '\n');
+    expect(workflow.match(/^  windows-arm-hot:\s*$/gm)).toHaveLength(1);
+    const [matrixJob, rest] = workflow.split(/^  windows-arm-hot:\s*$/m);
+    expect(rest).toBeDefined();
+    const hotJob = rest.split(/^  [a-z][\w-]*:\s*$/m)[0];
+    expect(matrixJob).toMatch(/- name: Tests?\n        if: matrix\.target != 'win32-arm64'\n        working-directory: cli\n        run: npx jest --runInBand --bail\n/);
+    const remainder = matrixJob.match(/- name: Tests? \(Windows ARM remainder\)\n        if: matrix\.target == 'win32-arm64'\n        working-directory: cli\n        run: ([^\n]+)/)?.[1];
+    expect(remainder).toMatch(/^npx jest --runInBand --bail --testPathIgnorePatterns='[^']+'$/);
+    const ignorePattern = remainder?.match(/--testPathIgnorePatterns='([^']+)'/)?.[1];
+    expect(ignorePattern).toBe(String.raw `node_modules|[/\\]cli[/\\]tests[/\\]commands[/\\]watch[/\\]track-(finalize|freeze)\.test\.ts$`);
+    const ignored = new RegExp(ignorePattern);
+    for (const separator of ['/', '\\']) {
+        const root = ['repo', 'cli', 'tests'].join(separator);
+        for (const suite of ['track-finalize', 'track-freeze']) {
+            expect(ignored.test([root, 'commands', 'watch', `${suite}.test.ts`].join(separator))).toBe(true);
+            expect(ignored.test([root, 'other', `${suite}.test.ts`].join(separator))).toBe(false);
+        }
+    }
+    const remainderStep = matrixJob.split(/- name: Tests? \(Windows ARM remainder\)\n/)[1]?.split(/^      - name:/m)[0];
+    expect(remainderStep).toBeDefined();
+    expect(remainderStep).not.toContain('continue-on-error: true');
+    expect(matrixJob.match(/uses: actions\/upload-artifact@v4/g)).toHaveLength(1);
+    expect(hotJob).toContain('runs-on: windows-11-arm');
+    expect(hotJob).toContain('run: npm run native:build');
+    expect(hotJob).toContain('run: npm run native:test-build');
+    expect(hotJob.split('\n')).toContain('        run: npx jest --runTestsByPath tests/commands/watch/track-finalize.test.ts tests/commands/watch/track-freeze.test.ts --runInBand --bail');
+    expect(hotJob).not.toContain('upload-artifact@v4');
+    expect(hotJob).not.toContain('secure-fs-win32-arm64');
+    expect(hotJob).not.toMatch(/^\s*if:/m);
+    expect(hotJob).not.toContain('continue-on-error: true');
+}
 describe('native release artifacts', () => {
     it('runs each platform suite once without weakening publication', () => {
         for (const name of ['ci.yml', 'release.yml']) {
-            const workflow = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', name), 'utf8');
+            const workflow = readWorkflow(name);
             expect(workflow).not.toContain('- name: Windows admission smoke');
             expect(workflow).not.toContain('run: npx jest tests/commands/plan/index.test.ts --runInBand --bail');
             expect(workflow).toContain('run: npx jest --runInBand --bail');
         }
-        const release = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', 'release.yml'), 'utf8');
-        expect(release).toMatch(/release:\s*\n\s*needs: test/);
+        const release = readWorkflow('release.yml');
+        expect(release).toMatch(/release:\s*\n\s*needs: \[test, windows-arm-hot\]/);
         for (const target of ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64', 'win32-x64', 'win32-arm64']) {
             expect(release).toContain(`target: ${target}`);
         }
         expect(release).toContain('cancel-in-progress: false');
     });
+    it('partitions the two hot ARM suites without duplicating the native artifact', () => {
+        for (const name of ['ci.yml', 'release.yml']) {
+            const workflow = readWorkflow(name);
+            assertArmPartition(workflow);
+        }
+    });
+    it('checks the same partition after a Windows CRLF checkout', () => {
+        for (const name of ['ci.yml', 'release.yml']) {
+            const workflow = readWorkflow(name);
+            assertArmPartition(workflow.replace(/\n/g, '\r\n'));
+        }
+    });
+    it('rejects swapped matrix guards, non-gating hot tests and duplicate artifacts', () => {
+        for (const name of ['ci.yml', 'release.yml']) {
+            const workflow = readWorkflow(name);
+            const swapped = workflow.replace(/if: matrix\.target (?:!=|==) 'win32-arm64'/g, (guard) => guard.includes('!=') ? "if: matrix.target == 'win32-arm64'" : "if: matrix.target != 'win32-arm64'");
+            const nonGating = workflow.replace('  windows-arm-hot:\n', '  windows-arm-hot:\n    continue-on-error: true\n');
+            const duplicateArtifact = workflow.replace('uses: actions/upload-artifact@v4', 'uses: actions/upload-artifact@v4\n      - uses: actions/upload-artifact@v4');
+            const broadIgnore = workflow.replace(/(--testPathIgnorePatterns='[^']+)(?=')/, '$1|runner\\.test\\.ts$');
+            const skippedHot = workflow.replace('      - name: Test hot Windows ARM suites\n', '      - name: Test hot Windows ARM suites\n        if: false\n');
+            const nonGatingRemainder = workflow.replace(/(run: npx jest --runInBand --bail --testPathIgnorePatterns='[^']+'\n)/, '$1        continue-on-error: true\n');
+            const maskedHot = workflow.replace(/(run: npx jest --runTestsByPath [^\n]+ --runInBand --bail)(?=\n)/, '$1; exit 0');
+            for (const mutated of [swapped, nonGating, duplicateArtifact, broadIgnore, skippedHot, nonGatingRemainder, maskedHot]) {
+                expect(mutated).not.toBe(workflow);
+            }
+            expect(() => assertArmPartition(swapped)).toThrow();
+            expect(() => assertArmPartition(nonGating)).toThrow();
+            expect(() => assertArmPartition(duplicateArtifact)).toThrow();
+            expect(() => assertArmPartition(broadIgnore)).toThrow();
+            expect(() => assertArmPartition(skippedHot)).toThrow();
+            expect(() => assertArmPartition(nonGatingRemainder)).toThrow();
+            expect(() => assertArmPartition(maskedHot)).toThrow();
+        }
+    });
     it('keeps native prebuilds generated instead of versioned source', () => {
         const gitignore = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.gitignore'), 'utf8');
         const tracked = (0, child_process_1.execFileSync)('git', ['ls-files', '--', 'cli/prebuilds'], {
@@ -37,7 +106,7 @@ describe('native release artifacts', () => {
         const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(CLI_ROOT, 'package.json'), 'utf8'));
         expect(pkg.scripts['native:test-build']).toContain('secure_fs_test');
         for (const name of ['ci.yml', 'release.yml']) {
-            const workflow = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', name), 'utf8');
+            const workflow = readWorkflow(name);
             const testBuild = workflow.indexOf('run: npm run native:test-build');
             const jest = workflow.indexOf('run: npx jest --runInBand --bail');
             expect(testBuild).toBeGreaterThanOrEqual(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.11.9",
+  "version": "9.11.11",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"