agentic-workflow-manager 9.18.0 → 9.20.0

package/dist/tests/commands/sensors/run-read-only.test.js

@@ -0,0 +1,151 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const mockRunCommand = jest.fn();
+jest.mock('../../../src/commands/sensors/exec', () => ({
+    runCommand: (...args) => mockRunCommand(...args),
+}));
+const { ok } = require('./exec-fixtures');
+describe('runSensors read-only observation (admission)', () => {
+    const ENV_KEYS = ['HOME', 'AWM_HOME', 'GIT_CONFIG_GLOBAL', 'GIT_CONFIG_NOSYSTEM', 'GIT_CEILING_DIRECTORIES'];
+    const saved = {};
+    let root;
+    let project;
+    beforeEach(() => {
+        jest.resetModules();
+        mockRunCommand.mockReset();
+        mockRunCommand.mockResolvedValue(ok(''));
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-run-readonly-'));
+        for (const key of ENV_KEYS)
+            saved[key] = process.env[key];
+        const home = path_1.default.join(root, 'home');
+        fs_1.default.mkdirSync(home, { recursive: true });
+        process.env.HOME = home;
+        process.env.AWM_HOME = path_1.default.join(home, '.awm');
+        const globalConfig = path_1.default.join(home, 'gitconfig');
+        fs_1.default.writeFileSync(globalConfig, '[user]\n\temail = test@example.test\n\tname = test\n');
+        process.env.GIT_CONFIG_GLOBAL = globalConfig;
+        process.env.GIT_CONFIG_NOSYSTEM = '1';
+        process.env.GIT_CEILING_DIRECTORIES = root;
+        project = path_1.default.join(root, 'project');
+        write('.awm/sensors.json', JSON.stringify({ pack: 'js-ts', sensors: { lint: { fast: true, cmd: 'eslint --format json .' } } }));
+    });
+    afterEach(() => {
+        jest.dontMock('../../../src/commands/sensors/read-only-observation');
+        for (const key of ENV_KEYS) {
+            if (saved[key] === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = saved[key];
+        }
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
+    function write(relative, content = 'x') {
+        const file = path_1.default.join(project, ...relative.split('/'));
+        fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+        fs_1.default.writeFileSync(file, content);
+    }
+    const git = (args) => (0, child_process_1.execFileSync)('git', args, { cwd: project, env: { ...process.env }, stdio: 'pipe', encoding: 'utf8' });
+    function commitProject(gitignore) {
+        write('.gitignore', gitignore);
+        git(['init', '-q', '-b', 'main']);
+        git(['add', '.']);
+        git(['commit', '-qm', 'initial']);
+    }
+    const load = () => require('../../../src/commands/sensors/run');
+    it('skips ignored default directories, including one a sensor creates, and reports them', async () => {
+        commitProject('node_modules/\ncoverage/\n');
+        write('node_modules/pkg/index.js', 'installed');
+        mockRunCommand.mockImplementation(async () => {
+            write('coverage/lcov.info', 'sensor output');
+            write('node_modules/pkg/index.js', 'rebuilt');
+            return ok('');
+        });
+        const out = await load().runSensors({ cwd: project, readOnly: true });
+        expect(out.reason).not.toBe('read-only-mutation-detected');
+        expect(out.reason).not.toBe('read-only-observation-unavailable');
+        expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: ['coverage', 'node_modules'], rejected: [] });
+    });
+    it('still detects a mutation inside a matching directory that is not ignored', async () => {
+        commitProject('');
+        write('node_modules/pkg/index.js', 'installed');
+        mockRunCommand.mockImplementation(async () => {
+            write('node_modules/pkg/index.js', 'rebuilt');
+            return ok('');
+        });
+        const out = await load().runSensors({ cwd: project, readOnly: true });
+        expect(out).toMatchObject({ overall: 'not_certified', reason: 'read-only-mutation-detected' });
+        expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: [], rejected: [{ path: 'node_modules', reason: 'not-ignored' }] });
+    });
+    it('observes everything and says so when the project is not a git worktree', async () => {
+        write('node_modules/pkg/index.js', 'installed');
+        const out = await load().runSensors({ cwd: project, readOnly: true });
+        expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: [], rejected: [{ path: 'node_modules', reason: 'git-unavailable' }] });
+    });
+    it('blocks a read-only run on an invalid admission file before running sensors', async () => {
+        write('.awm/admission.json', JSON.stringify({ schemaVersion: 2 }));
+        const out = await load().runSensors({ cwd: project, readOnly: true });
+        expect(out).toMatchObject({
+            overall: 'not_certified', mode: 'invalid', reason: 'admission-config-invalid',
+            remedy: 'repair .awm/admission.json: schemaVersion must be 1',
+        });
+        expect(mockRunCommand).not.toHaveBeenCalled();
+    });
+    it('never reads the admission file outside read-only runs', async () => {
+        write('.awm/admission.json', JSON.stringify({ schemaVersion: 2 }));
+        const out = await load().runSensors({ cwd: project });
+        expect(out.reason).not.toBe('admission-config-invalid');
+        expect(out.readOnlyObservation).toBeUndefined();
+        expect(mockRunCommand).toHaveBeenCalled();
+    });
+    it('returns an actionable remedy with evidence when the snapshot exceeds a limit', async () => {
+        jest.doMock('../../../src/commands/sensors/read-only-observation', () => {
+            const actual = jest.requireActual('../../../src/commands/sensors/read-only-observation');
+            return { ...actual, filesystemSnapshot: () => ({ ok: false, failure: 'limit-bytes' }) };
+        });
+        const out = await load().runSensors({ cwd: project, readOnly: true });
+        expect(out).toMatchObject({ overall: 'not_certified', reason: 'read-only-observation-unavailable' });
+        expect(out.remedy).toMatch(/1 GiB/);
+        expect(out.remedy).toContain('.awm/admission.json');
+        expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: [], rejected: [] });
+        expect(mockRunCommand).not.toHaveBeenCalled();
+    });
+    describe('the post-run snapshot', () => {
+        const DIGEST = 'a'.repeat(64);
+        const stubSnapshot = (second) => {
+            const calls = jest.fn()
+                .mockReturnValueOnce({ ok: true, digest: DIGEST })
+                .mockReturnValueOnce(second);
+            jest.doMock('../../../src/commands/sensors/read-only-observation', () => {
+                const actual = jest.requireActual('../../../src/commands/sensors/read-only-observation');
+                return { ...actual, filesystemSnapshot: (...args) => calls(...args) };
+            });
+            return calls;
+        };
+        it('never certifies a run whose worktree cannot be observed after the sensors ran', async () => {
+            const snapshot = stubSnapshot({ ok: false, failure: 'unreadable' });
+            const out = await load().runSensors({ cwd: project, readOnly: true });
+            expect(out).toMatchObject({
+                overall: 'not_certified', reason: 'read-only-mutation-detected',
+                remedy: 'sensor execution changed the worktree; repair it before using this evidence for admission',
+            });
+            expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: expect.any(Array), rejected: expect.any(Array) });
+            expect(snapshot).toHaveBeenCalledTimes(2);
+            expect(mockRunCommand).toHaveBeenCalledTimes(1);
+        });
+        it('keeps the verdict when the post-run snapshot matches the first one', async () => {
+            const snapshot = stubSnapshot({ ok: true, digest: DIGEST });
+            const out = await load().runSensors({ cwd: project, readOnly: true });
+            expect(out.reason).not.toBe('read-only-mutation-detected');
+            expect(out.readOnlyObservation).toEqual({ defaults: true, excluded: expect.any(Array), rejected: expect.any(Array) });
+            expect(snapshot).toHaveBeenCalledTimes(2);
+            expect(mockRunCommand).toHaveBeenCalledTimes(1);
+        });
+    });
+});

package/dist/tests/core/admission/index.test.js

@@ -258,6 +258,66 @@ describe('admitPlan', () => {
             expect(() => (0, admission_1.sanitizeAdmissionReport)({ ...report, sensorEvidence: 'opt-out' })).toThrow('invalid report');
         });
     });
+    describe('the sensor-blocked diagnostic', () => {
+        const base = () => ({ plan: valid, provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], verifySensors: true });
+        it('carries the sensor reason and remedy when the verdict is not-certified', async () => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'not_certified', sensors: [], mode: 'invalid', reason: 'read-only-observation-unavailable',
+                    remedy: 'declare heavy directories in .awm/admission.json.', projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            expect(report.diagnostics[0]).toEqual({
+                code: 'ADMISSION_SENSORS_BLOCKED',
+                message: 'Sensor verdict is not-certified (read-only-observation-unavailable): declare heavy directories in .awm/admission.json.',
+            });
+            expect(report.diagnostics[0].message.match(/ADMISSION_[A-Z_]+/g)).toBeNull();
+        });
+        it('keeps the reason alone when the run has no remedy', async () => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'not_certified', sensors: [], mode: 'native-gate', reason: 'native-gate-declared', projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            expect(report.diagnostics[0].message).toBe('Sensor verdict is not-certified (native-gate-declared).');
+        });
+        it.each([
+            ['remedy', { reason: 'admission-config-invalid', remedy: 'repair .awm/admission.json: ADMISSION_FOO is not a known field' }, 'ADMISSION-FOO'],
+            ['reason', { reason: 'ADMISSION_X-unavailable', remedy: 'fix it' }, 'ADMISSION-X'],
+        ])('leaves the diagnostic code as the only ADMISSION_ token when the %s echoes one', async (_name, fields, neutralized) => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'not_certified', sensors: [], mode: 'invalid', ...fields, projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            expect(report.diagnostics[0].code).toBe('ADMISSION_SENSORS_BLOCKED');
+            expect(report.diagnostics[0].message).toContain(neutralized);
+            expect(`${report.diagnostics[0].code} ${report.diagnostics[0].message}`.match(/ADMISSION_[A-Z_]+/g)).toEqual(['ADMISSION_SENSORS_BLOCKED']);
+        });
+        it.each([
+            ['trims a padded reason and remedy', '  read-only-observation-unavailable  ', '  declare it in .awm/admission.json.  ', 'Sensor verdict is not-certified (read-only-observation-unavailable): declare it in .awm/admission.json.'],
+            ['drops a whitespace-only reason', '   ', 'declare it in .awm/admission.json.', 'Sensor verdict is not-certified.'],
+            ['drops a whitespace-only remedy', 'some-reason', '   ', 'Sensor verdict is not-certified (some-reason).'],
+        ])('%s', async (_name, reason, remedy, message) => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'not_certified', sensors: [], mode: 'invalid', reason, remedy, projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            expect(report.diagnostics[0]).toEqual({ code: 'ADMISSION_SENSORS_BLOCKED', message });
+        });
+        it('neutralizes every ADMISSION_ token when several are echoed in the reason and the remedy', async () => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'not_certified', sensors: [], mode: 'invalid',
+                    reason: 'admission-config-invalid ADMISSION_BAZ ADMISSION_QUX',
+                    remedy: 'repair .awm/admission.json: ADMISSION_FOO is not allowed, ADMISSION_BAR neither',
+                    projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            const { code, message } = report.diagnostics[0];
+            expect(code).toBe('ADMISSION_SENSORS_BLOCKED');
+            for (const token of ['ADMISSION-FOO', 'ADMISSION-BAR', 'ADMISSION-BAZ', 'ADMISSION-QUX'])
+                expect(message).toContain(token);
+            expect(`${code} ${message}`.match(/ADMISSION_[A-Z_]+/g)).toEqual(['ADMISSION_SENSORS_BLOCKED']);
+        });
+        it('keeps the bare verdict for a failing run', async () => {
+            const report = await (0, admission_1.admitPlan)({ ...base(), sensors: {
+                    overall: 'fail', sensors: [], mode: 'project-sensors', reason: 'configured-v3', projectRoot: '/r', manifestPath: '/r/.awm/sensors.json',
+                } });
+            expect(report.diagnostics[0]).toEqual({ code: 'ADMISSION_SENSORS_BLOCKED', message: 'Sensor verdict is fail.' });
+        });
+    });
     it('admits unattended work only with an exact schema-2 plan binding', async () => {
         const unattended = { ...valid, manifest: { ...valid.manifest, executionMode: 'desatendido' } };
         const journal = { ...(0, types_1.emptyState)('main'), schema: 2, planBinding: { path: 'docs/plan.md', digest: 'a'.repeat(64), schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' } };