agentic-workflow-manager 9.17.0 → 9.19.0

package/dist/tests/commands/sensors/run-read-only.test.js

@@ -0,0 +1,151 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const mockRunCommand = jest.fn();
+jest.mock('../../../src/commands/sensors/exec', () => ({
+    runCommand: (...args) => mockRunCommand(...args),
+}));
+const { ok } = require('./exec-fixtures');
+describe('runSensors read-only observation (admission)', () => {
+    const ENV_KEYS = ['HOME', 'AWM_HOME', 'GIT_CONFIG_GLOBAL', 'GIT_CONFIG_NOSYSTEM', 'GIT_CEILING_DIRECTORIES'];
+    const saved = {};
+    let root;
+    let project;
+    beforeEach(() => {
+        jest.resetModules();
+        mockRunCommand.mockReset();
+        mockRunCommand.mockResolvedValue(ok(''));
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-run-readonly-'));
+        for (const key of ENV_KEYS)
+            saved[key] = process.env[key];
+        const home = path_1.default.join(root, 'home');
+        fs_1.default.mkdirSync(home, { recursive: true });
+        process.env.HOME = home;
+        process.env.AWM_HOME = path_1.default.join(home, '.awm');
+        const globalConfig = path_1.default.join(home, 'gitconfig');
+        fs_1.default.writeFileSync(globalConfig, '[user]\n\temail = test@example.test\n\tname = test\n');
+        process.env.GIT_CONFIG_GLOBAL = globalConfig;
+        process.env.GIT_CONFIG_NOSYSTEM = '1';
+        process.env.GIT_CEILING_DIRECTORIES = root;
+        project = path_1.default.join(root, 'project');
+        write('.awm/sensors.json', JSON.stringify({ pack: 'js-ts', sensors: { lint: { fast: true, cmd: 'eslint --format json .' } } }));
+    });
+    afterEach(() => {
+        jest.dontMock('../../../src/commands/sensors/read-only-observation');
+        for (const key of ENV_KEYS) {
+            if (saved[key] === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = saved[key];
+        }
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
+    function write(relative, content = 'x') {
+        const file = path_1.default.join(project, ...relative.split('/'));
+        fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+        fs_1.default.writeFileSync(file, content);
+    }
+    const git = (args) => (0, child_process_1.execFileSync)('git', args, { cwd: project, env: { ...process.env }, stdio: 'pipe', encoding: 'utf8' });
+    function commitProject(gitignore) {
+        write('.gitignore', gitignore);
+        git(['init', '-q', '-b', 'main']);
+        git(['add', '.']);
+        git(['commit', '-qm', 'initial']);
+    }
+    const load = () => require('../../../src/commands/sensors/run');
+    it('skips ignored default directories, including one a sensor creates, and reports them', async () => {
+        commitProject('node_modules/\ncoverage/\n');
+        write('node_modules/pkg/index.js', 'installed');
+        mockRunCommand.mockImplementation(async () => {
+            write('coverage/lcov.info', 'sensor output');
+            write('node_modules/pkg/index.js', 'rebuilt');
+            return ok('');
+        });
+        const out = await load().runSensors({ cwd: project, readOnly: true });
+        expect(out.reason).not.toBe('read-only-mutation-detected');
+        expect(out.reason).not.toBe('read-only-observation-unavailable');
+        expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: ['coverage', 'node_modules'], rejected: [] });
+    });
+    it('still detects a mutation inside a matching directory that is not ignored', async () => {
+        commitProject('');
+        write('node_modules/pkg/index.js', 'installed');
+        mockRunCommand.mockImplementation(async () => {
+            write('node_modules/pkg/index.js', 'rebuilt');
+            return ok('');
+        });
+        const out = await load().runSensors({ cwd: project, readOnly: true });
+        expect(out).toMatchObject({ overall: 'not_certified', reason: 'read-only-mutation-detected' });
+        expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: [], rejected: [{ path: 'node_modules', reason: 'not-ignored' }] });
+    });
+    it('observes everything and says so when the project is not a git worktree', async () => {
+        write('node_modules/pkg/index.js', 'installed');
+        const out = await load().runSensors({ cwd: project, readOnly: true });
+        expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: [], rejected: [{ path: 'node_modules', reason: 'git-unavailable' }] });
+    });
+    it('blocks a read-only run on an invalid admission file before running sensors', async () => {
+        write('.awm/admission.json', JSON.stringify({ schemaVersion: 2 }));
+        const out = await load().runSensors({ cwd: project, readOnly: true });
+        expect(out).toMatchObject({
+            overall: 'not_certified', mode: 'invalid', reason: 'admission-config-invalid',
+            remedy: 'repair .awm/admission.json: schemaVersion must be 1',
+        });
+        expect(mockRunCommand).not.toHaveBeenCalled();
+    });
+    it('never reads the admission file outside read-only runs', async () => {
+        write('.awm/admission.json', JSON.stringify({ schemaVersion: 2 }));
+        const out = await load().runSensors({ cwd: project });
+        expect(out.reason).not.toBe('admission-config-invalid');
+        expect(out.readOnlyObservation).toBeUndefined();
+        expect(mockRunCommand).toHaveBeenCalled();
+    });
+    it('returns an actionable remedy with evidence when the snapshot exceeds a limit', async () => {
+        jest.doMock('../../../src/commands/sensors/read-only-observation', () => {
+            const actual = jest.requireActual('../../../src/commands/sensors/read-only-observation');
+            return { ...actual, filesystemSnapshot: () => ({ ok: false, failure: 'limit-bytes' }) };
+        });
+        const out = await load().runSensors({ cwd: project, readOnly: true });
+        expect(out).toMatchObject({ overall: 'not_certified', reason: 'read-only-observation-unavailable' });
+        expect(out.remedy).toMatch(/1 GiB/);
+        expect(out.remedy).toContain('.awm/admission.json');
+        expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: [], rejected: [] });
+        expect(mockRunCommand).not.toHaveBeenCalled();
+    });
+    describe('the post-run snapshot', () => {
+        const DIGEST = 'a'.repeat(64);
+        const stubSnapshot = (second) => {
+            const calls = jest.fn()
+                .mockReturnValueOnce({ ok: true, digest: DIGEST })
+                .mockReturnValueOnce(second);
+            jest.doMock('../../../src/commands/sensors/read-only-observation', () => {
+                const actual = jest.requireActual('../../../src/commands/sensors/read-only-observation');
+                return { ...actual, filesystemSnapshot: (...args) => calls(...args) };
+            });
+            return calls;
+        };
+        it('never certifies a run whose worktree cannot be observed after the sensors ran', async () => {
+            const snapshot = stubSnapshot({ ok: false, failure: 'unreadable' });
+            const out = await load().runSensors({ cwd: project, readOnly: true });
+            expect(out).toMatchObject({
+                overall: 'not_certified', reason: 'read-only-mutation-detected',
+                remedy: 'sensor execution changed the worktree; repair it before using this evidence for admission',
+            });
+            expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: expect.any(Array), rejected: expect.any(Array) });
+            expect(snapshot).toHaveBeenCalledTimes(2);
+            expect(mockRunCommand).toHaveBeenCalledTimes(1);
+        });
+        it('keeps the verdict when the post-run snapshot matches the first one', async () => {
+            const snapshot = stubSnapshot({ ok: true, digest: DIGEST });
+            const out = await load().runSensors({ cwd: project, readOnly: true });
+            expect(out.reason).not.toBe('read-only-mutation-detected');
+            expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: expect.any(Array), rejected: expect.any(Array) });
+            expect(snapshot).toHaveBeenCalledTimes(2);
+            expect(mockRunCommand).toHaveBeenCalledTimes(1);
+        });
+    });
+});

package/dist/tests/commands/watch/reopened-196.test.js

@@ -921,9 +921,16 @@ describe('issue #196 reopened: supervised S1 handoff', () => {
             }
             expect(stdout).toContain('supervisor activo');
             child.kill('SIGINT');
-            const exit = await new Promise(resolve => child.once('close', code => resolve(code)));
-            expect(exit).toBe(130);
+            const exit = await new Promise(resolve => {
+                child.once('exit', (code, signal) => resolve({ code, signal }));
+            });
+            // Contract: truthful interrupt report. Exit status is secondary —
+            // on Darwin, child_process often reports code null + SIGINT when the
+            // signal disposition races process.exitCode=130 (never use process.exit
+            // in watch/index: it kills in-process Jest callers). Either 130 or
+            // null+SIGINT is an interrupted stop; require the detenido line either way.
             expect(stdout).toMatch(/detenido; ciclo IN_PROGRESS/);
+            expect(exit.code === 130 || (exit.code === null && exit.signal === 'SIGINT')).toBe(true);
             expect(stdout).not.toContain('COMPLETE');
             expect(stderr).not.toContain('Error');
         }

package/dist/tests/core/admission/index.test.js

@@ -258,6 +258,66 @@ describe('admitPlan', () => {
             expect(() => (0, admission_1.sanitizeAdmissionReport)({ ...report, sensorEvidence: 'opt-out' })).toThrow('invalid report');
         });
     });
+    describe('the sensor-blocked diagnostic', () => {
+        const base = () => ({ plan: valid, provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], verifySensors: true });
+        it('carries the sensor reason and remedy when the verdict is not-certified', async () => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'not_certified', sensors: [], mode: 'invalid', reason: 'read-only-observation-unavailable',
+                    remedy: 'declare heavy directories in .awm/admission.json.', projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            expect(report.diagnostics[0]).toEqual({
+                code: 'ADMISSION_SENSORS_BLOCKED',
+                message: 'Sensor verdict is not-certified (read-only-observation-unavailable): declare heavy directories in .awm/admission.json.',
+            });
+            expect(report.diagnostics[0].message.match(/ADMISSION_[A-Z_]+/g)).toBeNull();
+        });
+        it('keeps the reason alone when the run has no remedy', async () => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'not_certified', sensors: [], mode: 'native-gate', reason: 'native-gate-declared', projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            expect(report.diagnostics[0].message).toBe('Sensor verdict is not-certified (native-gate-declared).');
+        });
+        it.each([
+            ['remedy', { reason: 'admission-config-invalid', remedy: 'repair .awm/admission.json: ADMISSION_FOO is not a known field' }, 'ADMISSION-FOO'],
+            ['reason', { reason: 'ADMISSION_X-unavailable', remedy: 'fix it' }, 'ADMISSION-X'],
+        ])('leaves the diagnostic code as the only ADMISSION_ token when the %s echoes one', async (_name, fields, neutralized) => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'not_certified', sensors: [], mode: 'invalid', ...fields, projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            expect(report.diagnostics[0].code).toBe('ADMISSION_SENSORS_BLOCKED');
+            expect(report.diagnostics[0].message).toContain(neutralized);
+            expect(`${report.diagnostics[0].code} ${report.diagnostics[0].message}`.match(/ADMISSION_[A-Z_]+/g)).toEqual(['ADMISSION_SENSORS_BLOCKED']);
+        });
+        it.each([
+            ['trims a padded reason and remedy', '  read-only-observation-unavailable  ', '  declare it in .awm/admission.json.  ', 'Sensor verdict is not-certified (read-only-observation-unavailable): declare it in .awm/admission.json.'],
+            ['drops a whitespace-only reason', '   ', 'declare it in .awm/admission.json.', 'Sensor verdict is not-certified.'],
+            ['drops a whitespace-only remedy', 'some-reason', '   ', 'Sensor verdict is not-certified (some-reason).'],
+        ])('%s', async (_name, reason, remedy, message) => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'not_certified', sensors: [], mode: 'invalid', reason, remedy, projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            expect(report.diagnostics[0]).toEqual({ code: 'ADMISSION_SENSORS_BLOCKED', message });
+        });
+        it('neutralizes every ADMISSION_ token when several are echoed in the reason and the remedy', async () => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'not_certified', sensors: [], mode: 'invalid',
+                    reason: 'admission-config-invalid ADMISSION_BAZ ADMISSION_QUX',
+                    remedy: 'repair .awm/admission.json: ADMISSION_FOO is not allowed, ADMISSION_BAR neither',
+                    projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            const { code, message } = report.diagnostics[0];
+            expect(code).toBe('ADMISSION_SENSORS_BLOCKED');
+            for (const token of ['ADMISSION-FOO', 'ADMISSION-BAR', 'ADMISSION-BAZ', 'ADMISSION-QUX'])
+                expect(message).toContain(token);
+            expect(`${code} ${message}`.match(/ADMISSION_[A-Z_]+/g)).toEqual(['ADMISSION_SENSORS_BLOCKED']);
+        });
+        it('keeps the bare verdict for a failing run', async () => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'fail', sensors: [], mode: 'project-sensors', reason: 'configured-v3', projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            expect(report.diagnostics[0]).toEqual({ code: 'ADMISSION_SENSORS_BLOCKED', message: 'Sensor verdict is fail.' });
+        });
+    });
     it('admits unattended work only with an exact schema-2 plan binding', async () => {
         const unattended = { ...valid, manifest: { ...valid.manifest, executionMode: 'desatendido' } };
         const journal = { ...(0, types_1.emptyState)('main'), schema: 2, planBinding: { path: 'docs/plan.md', digest: 'a'.repeat(64), schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' } };

package/dist/tests/core/currentness/check-insteadof.test.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const url_1 = require("url");
+/**
+ * A-R1 / A-R2 / V-R3(a), real git. AWM's own cloud recipe (D-7) installs a global
+ * `url.<base>.insteadOf` rewrite; `git remote get-url` then reports the rewritten
+ * transport URL while `.git/config` keeps the configured one. The rewrite here points
+ * at a local bare repository so the test stays offline.
+ */
+describe('checkCurrentness under a global insteadOf rewrite (real git)', () => {
+    const CONFIGURED = 'https://example.test/team/repo.git';
+    const ENV_KEYS = ['HOME', 'AWM_HOME', 'GIT_CONFIG_GLOBAL', 'GIT_CONFIG_NOSYSTEM', 'GIT_CEILING_DIRECTORIES'];
+    const saved = {};
+    let root;
+    beforeEach(() => {
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-insteadof-'));
+        for (const key of ENV_KEYS)
+            saved[key] = process.env[key];
+        const home = path_1.default.join(root, 'home');
+        fs_1.default.mkdirSync(home, { recursive: true });
+        process.env.HOME = home;
+        process.env.AWM_HOME = path_1.default.join(home, '.awm');
+        const globalConfig = path_1.default.join(home, 'gitconfig');
+        fs_1.default.writeFileSync(globalConfig, [
+            '[user]',
+            '\temail = test@example.test',
+            '\tname = test',
+            `[url "${(0, url_1.pathToFileURL)(path_1.default.join(root, 'remote')).href}/"]`,
+            '\tinsteadOf = https://example.test/',
+            '',
+        ].join('\n'));
+        process.env.GIT_CONFIG_GLOBAL = globalConfig;
+        process.env.GIT_CONFIG_NOSYSTEM = '1';
+        process.env.GIT_CEILING_DIRECTORIES = root;
+        jest.resetModules();
+    });
+    afterEach(() => {
+        for (const key of ENV_KEYS) {
+            if (saved[key] === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = saved[key];
+        }
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
+    // Jest's sandboxed `process.env` is a copy: assignments never reach a spawned child
+    // by themselves, so every git invocation (setup and the CLI transport) gets it explicitly.
+    const git = (cwd, args) => (0, child_process_1.execFileSync)('git', args, { cwd, env: { ...process.env }, stdio: 'pipe', encoding: 'utf8' });
+    const realGit = async (cwd, args, options) => (await (0, util_1.promisify)(child_process_1.execFile)('git', args, { cwd, env: { ...process.env }, timeout: options.timeoutMs, maxBuffer: options.maxOutputBytes })).stdout;
+    function cloneTaggedRegistry() {
+        const seed = path_1.default.join(root, 'seed');
+        fs_1.default.mkdirSync(seed);
+        git(seed, ['init', '-q', '-b', 'main']);
+        fs_1.default.writeFileSync(path_1.default.join(seed, 'README.md'), 'registry\n');
+        git(seed, ['add', '.']);
+        git(seed, ['commit', '-qm', 'initial']);
+        git(seed, ['tag', 'v1.0.0']);
+        const bare = path_1.default.join(root, 'remote', 'team', 'repo.git');
+        fs_1.default.mkdirSync(path_1.default.dirname(bare), { recursive: true });
+        git(root, ['clone', '-q', '--bare', seed, bare]);
+        const checkout = path_1.default.join(root, 'checkout');
+        git(root, ['clone', '-q', CONFIGURED, checkout]);
+        git(checkout, ['checkout', '-q', 'v1.0.0']);
+        return checkout;
+    }
+    async function check(checkout) {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        return checkCurrentness(root, {
+            cliVersion: () => '1.2.3',
+            now: () => 1_700_000_000_000,
+            fetch: jest.fn().mockResolvedValue({ ok: true, text: async () => JSON.stringify({ version: '1.2.3' }) }),
+            readPreferences: () => ({ pins: {} }),
+            listRegistries: () => [{ name: 'baseline', remote: CONFIGURED, contentRoot: checkout }],
+            git: realGit,
+        });
+    }
+    it('reports the registry current when only the transport URL is rewritten', async () => {
+        const checkout = cloneTaggedRegistry();
+        expect(git(checkout, ['remote', 'get-url', 'origin']).trim()).not.toBe(CONFIGURED);
+        expect(git(checkout, ['config', '--get', 'remote.origin.url']).trim()).toBe(CONFIGURED);
+        const report = await check(checkout);
+        expect(report.components[1]).toEqual(expect.objectContaining({
+            component: 'registry:baseline', status: 'current', installed: 'v1.0.0', latest: 'v1.0.0',
+        }));
+    });
+    it('still reports an origin stored with a different path as unverifiable', async () => {
+        const checkout = cloneTaggedRegistry();
+        git(checkout, ['remote', 'set-url', 'origin', 'https://example.test/team/other.git']);
+        const report = await check(checkout);
+        expect(report.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable', detail: expect.stringMatching(/origin does not match configured remote/i),
+        }));
+    });
+    it('does not let a global remote.origin.url stand in for a checkout without its own origin', async () => {
+        const checkout = cloneTaggedRegistry();
+        git(checkout, ['remote', 'remove', 'origin']);
+        fs_1.default.appendFileSync(process.env.GIT_CONFIG_GLOBAL, `[remote "origin"]\n\turl = ${CONFIGURED}\n`);
+        expect(git(checkout, ['config', '--get', 'remote.origin.url']).trim()).toBe(CONFIGURED);
+        const report = await check(checkout);
+        expect(report.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable', detail: 'Could not read local registry origin.',
+        }));
+    });
+    it('reports an empty stored origin as an unreadable origin', async () => {
+        const checkout = cloneTaggedRegistry();
+        git(checkout, ['config', 'remote.origin.url', '']);
+        const report = await check(checkout);
+        expect(report.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable', detail: 'Could not read local registry origin.',
+        }));
+    });
+});

package/dist/tests/core/currentness/check.test.js

@@ -29,7 +29,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${'a'.repeat(40)}\n`;
@@ -67,7 +67,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'b'.repeat(40)}\trefs/tags/v1.1.0\n${'a'.repeat(40)}\trefs/tags/v1.0.0\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${'a'.repeat(40)}\n`;
@@ -118,7 +118,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'b'.repeat(40)}\trefs/tags/${latest}\n${'a'.repeat(40)}\trefs/tags/${installed}\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${'a'.repeat(40)}\n`;
@@ -135,7 +135,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/1.2.4\n${'b'.repeat(40)}\trefs/tags/1.2.5-rc.1\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${'a'.repeat(40)}\n`;
@@ -155,7 +155,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${sharedSha}\trefs/tags/v1.2.4\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${sharedSha}\n`;
@@ -169,7 +169,7 @@ describe('checkCurrentness', () => {
         }));
     });
     it.each([
-        ['branch provenance', async (_cwd, args) => args[0] === 'describe' ? Promise.reject(new Error('not a tag')) : args[0] === 'ls-remote' ? `${'a'.repeat(40)}\trefs/tags/v1.2.3\n` : args[0] === 'remote' ? 'https://example.test/team/repo.git\n' : `${'a'.repeat(40)}\n`],
+        ['branch provenance', async (_cwd, args) => args[0] === 'describe' ? Promise.reject(new Error('not a tag')) : args[0] === 'ls-remote' ? `${'a'.repeat(40)}\trefs/tags/v1.2.3\n` : args[0] === 'config' ? 'https://example.test/team/repo.git\n' : `${'a'.repeat(40)}\n`],
         ['malformed npm semver', undefined],
     ])('fails closed for %s', async (name, git) => {
         const { checkCurrentness } = require('../../../src/core/currentness/check');
@@ -186,7 +186,7 @@ describe('checkCurrentness', () => {
                     throw new Error('fatal: no tag exactly matches HEAD');
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 return `${'a'.repeat(40)}\n`;
             }),
@@ -202,7 +202,7 @@ describe('checkCurrentness', () => {
         const { checkCurrentness } = require('../../../src/core/currentness/check');
         const result = await checkCurrentness(root, deps({
             git: jest.fn().mockImplementation(async (_cwd, args) => {
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://user:secret@example.test/team/other.git\n';
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
@@ -225,7 +225,7 @@ describe('checkCurrentness', () => {
         const result = await checkCurrentness(root, deps({
             listRegistries: () => [{ name: 'baseline', remote: configured, contentRoot: '/registry' }],
             git: jest.fn().mockImplementation(async (_cwd, args) => {
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'ssh://git@github.example/team/repo.git\n';
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
@@ -246,7 +246,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     throw new Error('remote unavailable');
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'describe')
                     return 'v1.2.3\n';
@@ -265,7 +265,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.4-rc.1\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'describe')
                     return 'v1.2.3\n';
@@ -321,7 +321,7 @@ describe('checkCurrentness', () => {
         const git = jest.fn().mockImplementation(async (_cwd, args) => {
             if (args[0] === 'ls-remote')
                 return new Promise((_resolve, reject) => { rejectGit = reject; });
-            if (args[0] === 'remote')
+            if (args[0] === 'config')
                 return 'https://example.test/team/repo.git\n';
             if (args[0] === 'rev-parse')
                 return `${'a'.repeat(40)}\n`;
@@ -380,7 +380,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return `${remote}\n`;
                 if (args[0] === 'rev-parse')
                     return `${'a'.repeat(40)}\n`;
@@ -402,7 +402,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${tagObject}\trefs/tags/v1.2.3\n${peeledCommit}\trefs/tags/v1.2.3^{}\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${peeledCommit}\n`;
@@ -413,4 +413,65 @@ describe('checkCurrentness', () => {
         }));
         expect(result.components[1]).toEqual(expect.objectContaining({ status: 'current', latest: 'v1.2.3' }));
     });
+    it('reads the literal origin config value, never the insteadOf-rewritten URL', async () => {
+        const configured = 'https://github.example/team/repo.git';
+        const git = jest.fn().mockImplementation(async (_cwd, args) => {
+            if (args[0] === 'config')
+                return `${configured}\n`;
+            if (args[0] === 'remote')
+                return 'https://x-access-token:ghs_SECRET@github.example/team/repo.git\n';
+            if (args[0] === 'ls-remote')
+                return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+            if (args[0] === 'describe')
+                return 'v1.2.3\n';
+            return `${'a'.repeat(40)}\n`;
+        });
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            listRegistries: () => [{ name: 'baseline', remote: configured, contentRoot: '/registry' }],
+            git,
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({ status: 'current', latest: 'v1.2.3' }));
+        expect(git).toHaveBeenCalledWith('/registry', ['config', '--local', '--get', 'remote.origin.url'], expect.any(Object));
+        expect(git).not.toHaveBeenCalledWith('/registry', ['remote', 'get-url', 'origin'], expect.any(Object));
+        expect(git).toHaveBeenCalledWith('/registry', ['ls-remote', '--tags', configured], expect.any(Object));
+        expect(JSON.stringify(result)).not.toContain('x-access-token');
+        expect(JSON.stringify(result)).not.toContain('SECRET');
+    });
+    it.each([['an empty', ''], ['a whitespace-only', '  \n']])('reports %s origin config value as an unreadable origin', async (_label, output) => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'config')
+                    return output;
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                return `${'a'.repeat(40)}\n`;
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable',
+            detail: 'Could not read local registry origin.',
+        }));
+    });
+    it('reports a missing origin config value as an unreadable origin', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'config')
+                    throw Object.assign(new Error('exit 1'), { code: 1 });
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                return `${'a'.repeat(40)}\n`;
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable',
+            detail: 'Could not read local registry origin.',
+        }));
+    });
 });