agentic-workflow-manager 9.18.0 → 9.20.0

package/dist/tests/core/changes/worktree.test.js

@@ -0,0 +1,259 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = __importStar(require("child_process"));
+const helpers_1 = require("./helpers");
+const worktree_1 = require("../../../src/core/changes/worktree");
+const ENV_KEYS = ['HOME', 'AWM_HOME', 'GIT_CONFIG_GLOBAL', 'GIT_CONFIG_NOSYSTEM'];
+const ORIGINAL = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+let saved = {};
+let root;
+let home;
+// Jest's sandboxed `process.env` is a copy that children do not see, so the child's environment is passed explicitly.
+const gitEnv = () => ({ ...process.env, HOME: home, GIT_CONFIG_GLOBAL: path_1.default.join(home, 'gitconfig'), GIT_AUTHOR_NAME: 't', GIT_AUTHOR_EMAIL: 't@t', GIT_COMMITTER_NAME: 't', GIT_COMMITTER_EMAIL: 't@t', GIT_CONFIG_NOSYSTEM: '1' });
+const g = (...args) => (0, child_process_1.execFileSync)('git', ['-c', 'commit.gpgsign=false', ...args], { cwd: root, encoding: 'utf8', env: gitEnv() }).trim();
+const real = child_process_1.default.execFileSync;
+let spy;
+beforeEach(() => {
+    saved = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+    home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-home-'));
+    Object.assign(process.env, { HOME: home, AWM_HOME: path_1.default.join(home, '.awm'), GIT_CONFIG_GLOBAL: (0, helpers_1.emptyGitConfig)(home), GIT_CONFIG_NOSYSTEM: '1' });
+    root = fs_1.default.realpathSync.native(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-wt-')));
+    g('init', '-q', '-b', 'main');
+    fs_1.default.writeFileSync(path_1.default.join(root, 'a.txt'), 'a');
+    g('add', '.');
+    g('commit', '-q', '-m', 'feat: a');
+});
+afterEach(() => {
+    spy?.mockRestore();
+    spy = undefined;
+    for (const [k, v] of Object.entries(saved)) {
+        if (v === undefined)
+            delete process.env[k];
+        else
+            process.env[k] = v;
+    }
+    fs_1.default.rmSync(root, { recursive: true, force: true });
+    fs_1.default.rmSync(home, { recursive: true, force: true });
+});
+afterAll(() => {
+    // The environment the suite started with is back, so nothing leaks into the next test file.
+    for (const k of ENV_KEYS)
+        expect(process.env[k]).toBe(ORIGINAL[k]);
+});
+/** Intercepts git invocations whose first argument is `first`; every other call reaches the real git. */
+const intercept = (first, handler) => {
+    spy = jest.spyOn(child_process_1.default, 'execFileSync').mockImplementation(((cmd, args, opts) => {
+        if (cmd === 'git' && args[0] === first)
+            return handler(opts, args);
+        return real(cmd, args, opts);
+    }));
+};
+const fail = (code) => () => { throw Object.assign(new Error(`spawnSync git ${code}`), { code }); };
+describe('worktree state', () => {
+    test('R2.x isolation: HOME and AWM_HOME point at a throwaway directory, never the real ones', () => {
+        expect(process.env.HOME).toBe(home);
+        expect(process.env.HOME).not.toBe(ORIGINAL.HOME);
+        expect(process.env.AWM_HOME).toBe(path_1.default.join(home, '.awm'));
+        expect(process.env.AWM_HOME).not.toBe(ORIGINAL.AWM_HOME);
+        expect(process.env.GIT_CONFIG_GLOBAL).toBe(path_1.default.join(home, 'gitconfig'));
+        expect(fs_1.default.readFileSync(path_1.default.join(home, 'gitconfig'), 'utf8')).toBe('');
+        expect(process.env.GIT_CONFIG_NOSYSTEM).toBe('1');
+    });
+    test('the runtime-state exclusion list is exactly the local state paths', () => {
+        expect([...worktree_1.RUNTIME_STATE_EXCLUDES]).toEqual(['.awm/sensors/runs', '.awm/journal', '.awm/ledger', '.awm/evidence', '.awm/track.json']);
+    });
+    test('a clean repository reports its root, HEAD and a clean tree', () => {
+        const state = (0, worktree_1.gitState)(root, true);
+        expect(state.kind).toBe('ok');
+        if (state.kind === 'ok') {
+            expect(fs_1.default.realpathSync.native(state.root)).toBe(fs_1.default.realpathSync.native(root));
+            expect(state.commit).toBe(g('rev-parse', 'HEAD'));
+            expect(state.dirty).toBe(false);
+        }
+    });
+    test('the root is normalized with native separators', () => {
+        intercept('rev-parse', (opts, args) => (args[1] === '--show-toplevel' ? `${root}${path_1.default.sep}.${path_1.default.sep}\n` : real('git', args, opts)));
+        const state = (0, worktree_1.gitState)(root, true);
+        expect(state.kind === 'ok' && state.root).toBe(path_1.default.resolve(root));
+    });
+    test('an untracked file is dirty for the pre-run measure and clean for the post-run recheck', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'new.ts'), 'x');
+        const pre = (0, worktree_1.gitState)(root, true);
+        const post = (0, worktree_1.gitState)(root, false);
+        expect(pre.kind === 'ok' && pre.dirty).toBe(true);
+        expect(post.kind === 'ok' && post.dirty).toBe(false);
+    });
+    test('the pre-run measure sees untracked files even when status.showUntrackedFiles is no', () => {
+        g('config', 'status.showUntrackedFiles', 'no');
+        fs_1.default.writeFileSync(path_1.default.join(root, 'new.ts'), 'x');
+        const pre = (0, worktree_1.gitState)(root, true);
+        expect(pre.kind === 'ok' && pre.dirty).toBe(true);
+    });
+    test('a tracked change is dirty for both measures', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'a.txt'), 'changed');
+        const pre = (0, worktree_1.gitState)(root, true);
+        const post = (0, worktree_1.gitState)(root, false);
+        expect(pre.kind === 'ok' && pre.dirty).toBe(true);
+        expect(post.kind === 'ok' && post.dirty).toBe(true);
+    });
+    test.each(worktree_1.RUNTIME_STATE_EXCLUDES.map((p) => [p]))('an untracked file at %s is not a change', (rel) => {
+        fs_1.default.mkdirSync(path_1.default.dirname(path_1.default.join(root, rel)), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, rel), 'x');
+        const pre = (0, worktree_1.gitState)(root, true);
+        expect(pre.kind === 'ok' && pre.dirty).toBe(false);
+    });
+    test('extra exclusions hide changes under them, on top of the runtime-state ones', () => {
+        fs_1.default.mkdirSync(path_1.default.join(root, 'docs/changes'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'docs/changes/r.md'), 'r');
+        const without = (0, worktree_1.gitState)(root, true);
+        const withExtra = (0, worktree_1.gitState)(root, true, ['docs/changes']);
+        expect(without.kind === 'ok' && without.dirty).toBe(true);
+        expect(withExtra.kind === 'ok' && withExtra.dirty).toBe(false);
+        fs_1.default.writeFileSync(path_1.default.join(root, 'other.ts'), 'x');
+        const stillDirty = (0, worktree_1.gitState)(root, true, ['docs/changes']);
+        expect(stillDirty.kind === 'ok' && stillDirty.dirty).toBe(true);
+    });
+    test('extra exclusions keep the runtime-state exclusions', () => {
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm/journal'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm/journal/j.json'), 'x');
+        const state = (0, worktree_1.gitState)(root, true, ['docs/changes']);
+        expect(state.kind === 'ok' && state.dirty).toBe(false);
+    });
+    test.each([['docs/changes'], [[7]], [['../out']], [['a\nb']], [['/abs']], [[' pad']], [Array.from({ length: 65 }, (_, i) => `d${i}`)]])('unsafe extra exclusions %j are a failure, never a throw', (extra) => {
+        expect((0, worktree_1.gitState)(root, true, extra)).toEqual({ kind: 'failed' });
+    });
+    test('GIT_*_PATHSPECS variables in the environment do not change the exclusions', () => {
+        fs_1.default.mkdirSync(path_1.default.join(root, 'docs/changes'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'docs/changes/r.md'), 'r');
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm/journal'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm/journal/j.json'), 'x');
+        const saved = process.env.GIT_LITERAL_PATHSPECS;
+        process.env.GIT_LITERAL_PATHSPECS = '1';
+        try {
+            const state = (0, worktree_1.gitState)(root, true, ['docs/changes']);
+            expect(state.kind === 'ok' && state.dirty).toBe(false);
+        }
+        finally {
+            if (saved === undefined)
+                delete process.env.GIT_LITERAL_PATHSPECS;
+            else
+                process.env.GIT_LITERAL_PATHSPECS = saved;
+        }
+    });
+    describe('a submodule change is a change whatever the configuration says', () => {
+        // Offline: vendor/sm is a nested repository registered as a gitlink, hidden by .gitmodules `ignore = all` and diff.ignoreSubmodules=all.
+        let sm = '';
+        let commitInSm = () => '';
+        const registerHiddenSubmodule = () => {
+            const hidden = (0, helpers_1.makeHiddenSubmodule)(root, (cwd, ...args) => (0, child_process_1.execFileSync)('git', ['-c', 'commit.gpgsign=false', ...args], { cwd, encoding: 'utf8', env: gitEnv() }).trim());
+            sm = hidden.dir;
+            commitInSm = hidden.commitInSm;
+        };
+        test('a clean tree holding a submodule is clean', () => {
+            registerHiddenSubmodule();
+            const state = (0, worktree_1.gitState)(root, true);
+            expect(state.kind === 'ok' && state.dirty).toBe(false);
+        });
+        test('an untracked file inside a clean submodule: the post-run recheck ignores it, the pre-run measure counts it', () => {
+            registerHiddenSubmodule();
+            fs_1.default.writeFileSync(path_1.default.join(sm, 'coverage.out'), 'x'); // what a sensor leaves behind
+            const post = (0, worktree_1.gitState)(root, false);
+            const pre = (0, worktree_1.gitState)(root, true);
+            expect(post.kind === 'ok' && post.dirty).toBe(false);
+            // git reports the submodule itself as modified (untracked content) in the normal-untracked mode, so the pre-run measure is dirty.
+            expect(pre.kind === 'ok' && pre.dirty).toBe(true);
+        });
+        test.each([[true], [false]])('modified tracked content inside a submodule makes the tree dirty (untracked=%p)', (untracked) => {
+            registerHiddenSubmodule();
+            fs_1.default.writeFileSync(path_1.default.join(sm, 'one'), 'changed');
+            const state = (0, worktree_1.gitState)(root, untracked);
+            expect(state.kind === 'ok' && state.dirty).toBe(true);
+        });
+        test.each([[true], [false]])('a submodule checked out at another commit than the gitlink makes the tree dirty (untracked=%p)', (untracked) => {
+            registerHiddenSubmodule();
+            commitInSm('two');
+            const state = (0, worktree_1.gitState)(root, untracked);
+            expect(state.kind === 'ok' && state.dirty).toBe(true);
+        });
+    });
+    test('a non-string or empty cwd is a failure, never a throw', () => {
+        expect((0, worktree_1.gitState)(undefined, true)).toEqual({ kind: 'failed' });
+        expect((0, worktree_1.gitState)('', true)).toEqual({ kind: 'failed' });
+    });
+    test('a directory outside git is not-repo', () => {
+        const plain = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-plain-'));
+        try {
+            expect((0, worktree_1.gitState)(plain, true)).toEqual({ kind: 'not-repo' });
+        }
+        finally {
+            fs_1.default.rmSync(plain, { recursive: true, force: true });
+        }
+    });
+    test('a repository without a commit is not-repo', () => {
+        const empty = fs_1.default.realpathSync.native(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-empty-')));
+        try {
+            (0, child_process_1.execFileSync)('git', ['init', '-q', '-b', 'main'], { cwd: empty, env: gitEnv() });
+            expect((0, worktree_1.gitState)(empty, true)).toEqual({ kind: 'not-repo' });
+        }
+        finally {
+            fs_1.default.rmSync(empty, { recursive: true, force: true });
+        }
+    });
+    test.each([['ENOBUFS'], ['ETIMEDOUT']])('a %s from git status is a failure, not a missing repository', (code) => {
+        intercept('status', fail(code));
+        expect((0, worktree_1.gitState)(root, true)).toEqual({ kind: 'failed' });
+    });
+    test('git missing from PATH is a failure', () => {
+        intercept('rev-parse', fail('ENOENT'));
+        expect((0, worktree_1.gitState)(root, true)).toEqual({ kind: 'failed' });
+    });
+    test('git status gets a 64 MiB buffer', () => {
+        let seen;
+        intercept('status', (opts) => { seen = opts.maxBuffer; throw Object.assign(new Error('stop'), { code: 'ENOBUFS' }); });
+        (0, worktree_1.gitState)(root, true);
+        expect(seen).toBeGreaterThanOrEqual(64 * 1024 * 1024);
+    });
+    test('the reasons are the stable user-facing strings', () => {
+        expect(worktree_1.REASON_NOT_REPO).toBe('not inside a git repository with a commit');
+        expect(worktree_1.REASON_GIT_FAILED).toBe('git command failed or timed out');
+    });
+});

package/dist/tests/core/currentness/check-insteadof.test.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const url_1 = require("url");
+/**
+ * A-R1 / A-R2 / V-R3(a), real git. AWM's own cloud recipe (D-7) installs a global
+ * `url.<base>.insteadOf` rewrite; `git remote get-url` then reports the rewritten
+ * transport URL while `.git/config` keeps the configured one. The rewrite here points
+ * at a local bare repository so the test stays offline.
+ */
+describe('checkCurrentness under a global insteadOf rewrite (real git)', () => {
+    const CONFIGURED = 'https://example.test/team/repo.git';
+    const ENV_KEYS = ['HOME', 'AWM_HOME', 'GIT_CONFIG_GLOBAL', 'GIT_CONFIG_NOSYSTEM', 'GIT_CEILING_DIRECTORIES'];
+    const saved = {};
+    let root;
+    beforeEach(() => {
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-insteadof-'));
+        for (const key of ENV_KEYS)
+            saved[key] = process.env[key];
+        const home = path_1.default.join(root, 'home');
+        fs_1.default.mkdirSync(home, { recursive: true });
+        process.env.HOME = home;
+        process.env.AWM_HOME = path_1.default.join(home, '.awm');
+        const globalConfig = path_1.default.join(home, 'gitconfig');
+        fs_1.default.writeFileSync(globalConfig, [
+            '[user]',
+            '\temail = test@example.test',
+            '\tname = test',
+            `[url "${(0, url_1.pathToFileURL)(path_1.default.join(root, 'remote')).href}/"]`,
+            '\tinsteadOf = https://example.test/',
+            '',
+        ].join('\n'));
+        process.env.GIT_CONFIG_GLOBAL = globalConfig;
+        process.env.GIT_CONFIG_NOSYSTEM = '1';
+        process.env.GIT_CEILING_DIRECTORIES = root;
+        jest.resetModules();
+    });
+    afterEach(() => {
+        for (const key of ENV_KEYS) {
+            if (saved[key] === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = saved[key];
+        }
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
+    // Jest's sandboxed `process.env` is a copy: assignments never reach a spawned child
+    // by themselves, so every git invocation (setup and the CLI transport) gets it explicitly.
+    const git = (cwd, args) => (0, child_process_1.execFileSync)('git', args, { cwd, env: { ...process.env }, stdio: 'pipe', encoding: 'utf8' });
+    const realGit = async (cwd, args, options) => (await (0, util_1.promisify)(child_process_1.execFile)('git', args, { cwd, env: { ...process.env }, timeout: options.timeoutMs, maxBuffer: options.maxOutputBytes })).stdout;
+    function cloneTaggedRegistry() {
+        const seed = path_1.default.join(root, 'seed');
+        fs_1.default.mkdirSync(seed);
+        git(seed, ['init', '-q', '-b', 'main']);
+        fs_1.default.writeFileSync(path_1.default.join(seed, 'README.md'), 'registry\n');
+        git(seed, ['add', '.']);
+        git(seed, ['commit', '-qm', 'initial']);
+        git(seed, ['tag', 'v1.0.0']);
+        const bare = path_1.default.join(root, 'remote', 'team', 'repo.git');
+        fs_1.default.mkdirSync(path_1.default.dirname(bare), { recursive: true });
+        git(root, ['clone', '-q', '--bare', seed, bare]);
+        const checkout = path_1.default.join(root, 'checkout');
+        git(root, ['clone', '-q', CONFIGURED, checkout]);
+        git(checkout, ['checkout', '-q', 'v1.0.0']);
+        return checkout;
+    }
+    async function check(checkout) {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        return checkCurrentness(root, {
+            cliVersion: () => '1.2.3',
+            now: () => 1_700_000_000_000,
+            fetch: jest.fn().mockResolvedValue({ ok: true, text: async () => JSON.stringify({ version: '1.2.3' }) }),
+            readPreferences: () => ({ pins: {} }),
+            listRegistries: () => [{ name: 'baseline', remote: CONFIGURED, contentRoot: checkout }],
+            git: realGit,
+        });
+    }
+    it('reports the registry current when only the transport URL is rewritten', async () => {
+        const checkout = cloneTaggedRegistry();
+        expect(git(checkout, ['remote', 'get-url', 'origin']).trim()).not.toBe(CONFIGURED);
+        expect(git(checkout, ['config', '--get', 'remote.origin.url']).trim()).toBe(CONFIGURED);
+        const report = await check(checkout);
+        expect(report.components[1]).toEqual(expect.objectContaining({
+            component: 'registry:baseline', status: 'current', installed: 'v1.0.0', latest: 'v1.0.0',
+        }));
+    });
+    it('still reports an origin stored with a different path as unverifiable', async () => {
+        const checkout = cloneTaggedRegistry();
+        git(checkout, ['remote', 'set-url', 'origin', 'https://example.test/team/other.git']);
+        const report = await check(checkout);
+        expect(report.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable', detail: expect.stringMatching(/origin does not match configured remote/i),
+        }));
+    });
+    it('does not let a global remote.origin.url stand in for a checkout without its own origin', async () => {
+        const checkout = cloneTaggedRegistry();
+        git(checkout, ['remote', 'remove', 'origin']);
+        fs_1.default.appendFileSync(process.env.GIT_CONFIG_GLOBAL, `[remote "origin"]\n\turl = ${CONFIGURED}\n`);
+        expect(git(checkout, ['config', '--get', 'remote.origin.url']).trim()).toBe(CONFIGURED);
+        const report = await check(checkout);
+        expect(report.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable', detail: 'Could not read local registry origin.',
+        }));
+    });
+    it('reports an empty stored origin as an unreadable origin', async () => {
+        const checkout = cloneTaggedRegistry();
+        git(checkout, ['config', 'remote.origin.url', '']);
+        const report = await check(checkout);
+        expect(report.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable', detail: 'Could not read local registry origin.',
+        }));
+    });
+});

package/dist/tests/core/currentness/check.test.js

@@ -29,7 +29,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${'a'.repeat(40)}\n`;
@@ -67,7 +67,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'b'.repeat(40)}\trefs/tags/v1.1.0\n${'a'.repeat(40)}\trefs/tags/v1.0.0\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${'a'.repeat(40)}\n`;
@@ -118,7 +118,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'b'.repeat(40)}\trefs/tags/${latest}\n${'a'.repeat(40)}\trefs/tags/${installed}\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${'a'.repeat(40)}\n`;
@@ -135,7 +135,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/1.2.4\n${'b'.repeat(40)}\trefs/tags/1.2.5-rc.1\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${'a'.repeat(40)}\n`;
@@ -155,7 +155,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${sharedSha}\trefs/tags/v1.2.4\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${sharedSha}\n`;
@@ -169,7 +169,7 @@ describe('checkCurrentness', () => {
         }));
     });
     it.each([
-        ['branch provenance', async (_cwd, args) => args[0] === 'describe' ? Promise.reject(new Error('not a tag')) : args[0] === 'ls-remote' ? `${'a'.repeat(40)}\trefs/tags/v1.2.3\n` : args[0] === 'remote' ? 'https://example.test/team/repo.git\n' : `${'a'.repeat(40)}\n`],
+        ['branch provenance', async (_cwd, args) => args[0] === 'describe' ? Promise.reject(new Error('not a tag')) : args[0] === 'ls-remote' ? `${'a'.repeat(40)}\trefs/tags/v1.2.3\n` : args[0] === 'config' ? 'https://example.test/team/repo.git\n' : `${'a'.repeat(40)}\n`],
         ['malformed npm semver', undefined],
     ])('fails closed for %s', async (name, git) => {
         const { checkCurrentness } = require('../../../src/core/currentness/check');
@@ -186,7 +186,7 @@ describe('checkCurrentness', () => {
                     throw new Error('fatal: no tag exactly matches HEAD');
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 return `${'a'.repeat(40)}\n`;
             }),
@@ -202,7 +202,7 @@ describe('checkCurrentness', () => {
         const { checkCurrentness } = require('../../../src/core/currentness/check');
         const result = await checkCurrentness(root, deps({
             git: jest.fn().mockImplementation(async (_cwd, args) => {
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://user:secret@example.test/team/other.git\n';
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
@@ -225,7 +225,7 @@ describe('checkCurrentness', () => {
         const result = await checkCurrentness(root, deps({
             listRegistries: () => [{ name: 'baseline', remote: configured, contentRoot: '/registry' }],
             git: jest.fn().mockImplementation(async (_cwd, args) => {
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'ssh://git@github.example/team/repo.git\n';
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
@@ -246,7 +246,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     throw new Error('remote unavailable');
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'describe')
                     return 'v1.2.3\n';
@@ -265,7 +265,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.4-rc.1\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'describe')
                     return 'v1.2.3\n';
@@ -321,7 +321,7 @@ describe('checkCurrentness', () => {
         const git = jest.fn().mockImplementation(async (_cwd, args) => {
             if (args[0] === 'ls-remote')
                 return new Promise((_resolve, reject) => { rejectGit = reject; });
-            if (args[0] === 'remote')
+            if (args[0] === 'config')
                 return 'https://example.test/team/repo.git\n';
             if (args[0] === 'rev-parse')
                 return `${'a'.repeat(40)}\n`;
@@ -380,7 +380,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return `${remote}\n`;
                 if (args[0] === 'rev-parse')
                     return `${'a'.repeat(40)}\n`;
@@ -402,7 +402,7 @@ describe('checkCurrentness', () => {
             git: jest.fn().mockImplementation(async (_cwd, args) => {
                 if (args[0] === 'ls-remote')
                     return `${tagObject}\trefs/tags/v1.2.3\n${peeledCommit}\trefs/tags/v1.2.3^{}\n`;
-                if (args[0] === 'remote')
+                if (args[0] === 'config')
                     return 'https://example.test/team/repo.git\n';
                 if (args[0] === 'rev-parse')
                     return `${peeledCommit}\n`;
@@ -413,4 +413,65 @@ describe('checkCurrentness', () => {
         }));
         expect(result.components[1]).toEqual(expect.objectContaining({ status: 'current', latest: 'v1.2.3' }));
     });
+    it('reads the literal origin config value, never the insteadOf-rewritten URL', async () => {
+        const configured = 'https://github.example/team/repo.git';
+        const git = jest.fn().mockImplementation(async (_cwd, args) => {
+            if (args[0] === 'config')
+                return `${configured}\n`;
+            if (args[0] === 'remote')
+                return 'https://x-access-token:ghs_SECRET@github.example/team/repo.git\n';
+            if (args[0] === 'ls-remote')
+                return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+            if (args[0] === 'describe')
+                return 'v1.2.3\n';
+            return `${'a'.repeat(40)}\n`;
+        });
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            listRegistries: () => [{ name: 'baseline', remote: configured, contentRoot: '/registry' }],
+            git,
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({ status: 'current', latest: 'v1.2.3' }));
+        expect(git).toHaveBeenCalledWith('/registry', ['config', '--local', '--get', 'remote.origin.url'], expect.any(Object));
+        expect(git).not.toHaveBeenCalledWith('/registry', ['remote', 'get-url', 'origin'], expect.any(Object));
+        expect(git).toHaveBeenCalledWith('/registry', ['ls-remote', '--tags', configured], expect.any(Object));
+        expect(JSON.stringify(result)).not.toContain('x-access-token');
+        expect(JSON.stringify(result)).not.toContain('SECRET');
+    });
+    it.each([['an empty', ''], ['a whitespace-only', '  \n']])('reports %s origin config value as an unreadable origin', async (_label, output) => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'config')
+                    return output;
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                return `${'a'.repeat(40)}\n`;
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable',
+            detail: 'Could not read local registry origin.',
+        }));
+    });
+    it('reports a missing origin config value as an unreadable origin', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'config')
+                    throw Object.assign(new Error('exit 1'), { code: 1 });
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                return `${'a'.repeat(40)}\n`;
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            status: 'unverifiable',
+            detail: 'Could not read local registry origin.',
+        }));
+    });
 });

package/dist/tests/release/orchestrator-trailer.test.js

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// cli/tests/release/orchestrator-trailer.test.ts
+//
+// R6.1 (#217): the bump commit must be read as a Change Record opt-out by the code that reads it
+// (`hasOptOut`), not just contain the right text in a mocked argv. The orchestrator runs against a
+// real tmp git repo: `git add` and `git commit` execute for real with the argv the orchestrator
+// passes (never retyped here); every other command is faked.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const orchestrator_1 = require("../../src/release/orchestrator");
+const core_1 = require("../../src/release/core");
+const trailers_1 = require("../../src/core/changes/trailers");
+const helpers_1 = require("../core/changes/helpers");
+describe('release — the bump commit opts out of the Change Record (R6.1)', () => {
+    let repo;
+    beforeEach(() => { repo = (0, helpers_1.makeRepo)(); });
+    afterEach(() => repo.cleanup());
+    it('the commit the orchestrator creates is read as an opt-out and keeps its subject byte-identical', () => {
+        // Explicit environment for the child git: identity and config isolation never come from process.env alone.
+        const gitEnv = {
+            ...process.env, HOME: repo.home, GIT_CONFIG_GLOBAL: path_1.default.join(repo.home, 'gitconfig'), GIT_CONFIG_NOSYSTEM: '1',
+            GIT_AUTHOR_NAME: 't', GIT_AUTHOR_EMAIL: 't@t', GIT_COMMITTER_NAME: 't', GIT_COMMITTER_EMAIL: 't@t',
+        };
+        repo.commit({
+            'cli/package.json': '{"version":"2.1.1"}\n',
+            'cli/package-lock.json': '{"version":"2.1.1"}\n',
+            'CHANGELOG.md': '# Changelog\n',
+        }, 'chore: seed release files');
+        repo.git('config', 'commit.gpgsign', 'false');
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(false);
+        let pkgVersion = '2.1.1';
+        let changelog = '# Changelog\n';
+        const write = (rel, content) => fs_1.default.writeFileSync(path_1.default.join(repo.root, rel), content);
+        const commitArgv = [];
+        const io = {
+            run(cmd, args) {
+                if (cmd === 'git' && (args[0] === 'add' || args[0] === 'commit')) {
+                    if (args[0] === 'commit')
+                        commitArgv.push(args);
+                    return (0, child_process_1.execFileSync)('git', args, { cwd: repo.root, encoding: 'utf8', env: gitEnv });
+                }
+                if (cmd === 'git' && args[0] === 'rev-parse')
+                    return 'main';
+                if (cmd === 'git' && args[0] === 'log')
+                    return `feat: nueva${core_1.US}${core_1.RS}`;
+                return ''; // status, tag, npm view/publish: nothing there, nothing dirty
+            },
+            readPackageVersion: () => pkgVersion,
+            writePackageVersion: (v) => { pkgVersion = v; write('cli/package.json', `{"version":"${v}"}\n`); },
+            writeLockVersion: (v) => write('cli/package-lock.json', `{"version":"${v}"}\n`),
+            readChangelog: () => changelog,
+            writeChangelog: (c) => { changelog = c; write('CHANGELOG.md', c); },
+            writeNpmrc: () => { },
+            removeNpmrc: () => { },
+            today: () => '2026-06-25',
+            log: () => { },
+            env: { NPM_TOKEN: 'tok' },
+        };
+        const res = (0, orchestrator_1.release)({ dryRun: false, force: null, push: false, branch: 'main', cliDir: '/cli' }, io);
+        expect(res).toEqual({ released: true, version: '2.2.0' });
+        expect(commitArgv).toHaveLength(1); // the argv under test was really executed, once
+        expect(repo.git('log', '-1', '--format=%s')).toBe('chore(release): v2.2.0 [skip ci]');
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(true);
+        // The opt-out is a trailer paragraph of its own: the full message is subject, blank line, trailer.
+        expect(repo.git('log', '-1', '--format=%B')).toBe('chore(release): v2.2.0 [skip ci]\n\nChange-Record: none');
+    });
+});

package/dist/tests/release/orchestrator.test.js

@@ -51,6 +51,7 @@ describe('release — happy path', () => {
         expect(calls).toContain('WRITE_PKG 2.2.0');
         const joined = calls.join('\n');
         expect(joined).toMatch(/git commit .*chore\(release\): v2.2.0/);
+        expect(joined).toMatch(/git commit .*chore\(release\): v2\.2\.0 \[skip ci\] -m Change-Record: none/);
         expect(joined).toMatch(/git tag -a v2.2.0/);
         expect(joined).toMatch(/npm publish/);
         expect(joined).toMatch(/git push origin main/);