agentic-workflow-manager 9.19.0 → 9.20.0

package/dist/tests/core/changes/worktree.test.js

@@ -0,0 +1,259 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = __importStar(require("child_process"));
+const helpers_1 = require("./helpers");
+const worktree_1 = require("../../../src/core/changes/worktree");
+const ENV_KEYS = ['HOME', 'AWM_HOME', 'GIT_CONFIG_GLOBAL', 'GIT_CONFIG_NOSYSTEM'];
+const ORIGINAL = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+let saved = {};
+let root;
+let home;
+// Jest's sandboxed `process.env` is a copy that children do not see, so the child's environment is passed explicitly.
+const gitEnv = () => ({ ...process.env, HOME: home, GIT_CONFIG_GLOBAL: path_1.default.join(home, 'gitconfig'), GIT_AUTHOR_NAME: 't', GIT_AUTHOR_EMAIL: 't@t', GIT_COMMITTER_NAME: 't', GIT_COMMITTER_EMAIL: 't@t', GIT_CONFIG_NOSYSTEM: '1' });
+const g = (...args) => (0, child_process_1.execFileSync)('git', ['-c', 'commit.gpgsign=false', ...args], { cwd: root, encoding: 'utf8', env: gitEnv() }).trim();
+const real = child_process_1.default.execFileSync;
+let spy;
+beforeEach(() => {
+    saved = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+    home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-home-'));
+    Object.assign(process.env, { HOME: home, AWM_HOME: path_1.default.join(home, '.awm'), GIT_CONFIG_GLOBAL: (0, helpers_1.emptyGitConfig)(home), GIT_CONFIG_NOSYSTEM: '1' });
+    root = fs_1.default.realpathSync.native(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-wt-')));
+    g('init', '-q', '-b', 'main');
+    fs_1.default.writeFileSync(path_1.default.join(root, 'a.txt'), 'a');
+    g('add', '.');
+    g('commit', '-q', '-m', 'feat: a');
+});
+afterEach(() => {
+    spy?.mockRestore();
+    spy = undefined;
+    for (const [k, v] of Object.entries(saved)) {
+        if (v === undefined)
+            delete process.env[k];
+        else
+            process.env[k] = v;
+    }
+    fs_1.default.rmSync(root, { recursive: true, force: true });
+    fs_1.default.rmSync(home, { recursive: true, force: true });
+});
+afterAll(() => {
+    // The environment the suite started with is back, so nothing leaks into the next test file.
+    for (const k of ENV_KEYS)
+        expect(process.env[k]).toBe(ORIGINAL[k]);
+});
+/** Intercepts git invocations whose first argument is `first`; every other call reaches the real git. */
+const intercept = (first, handler) => {
+    spy = jest.spyOn(child_process_1.default, 'execFileSync').mockImplementation(((cmd, args, opts) => {
+        if (cmd === 'git' && args[0] === first)
+            return handler(opts, args);
+        return real(cmd, args, opts);
+    }));
+};
+const fail = (code) => () => { throw Object.assign(new Error(`spawnSync git ${code}`), { code }); };
+describe('worktree state', () => {
+    test('R2.x isolation: HOME and AWM_HOME point at a throwaway directory, never the real ones', () => {
+        expect(process.env.HOME).toBe(home);
+        expect(process.env.HOME).not.toBe(ORIGINAL.HOME);
+        expect(process.env.AWM_HOME).toBe(path_1.default.join(home, '.awm'));
+        expect(process.env.AWM_HOME).not.toBe(ORIGINAL.AWM_HOME);
+        expect(process.env.GIT_CONFIG_GLOBAL).toBe(path_1.default.join(home, 'gitconfig'));
+        expect(fs_1.default.readFileSync(path_1.default.join(home, 'gitconfig'), 'utf8')).toBe('');
+        expect(process.env.GIT_CONFIG_NOSYSTEM).toBe('1');
+    });
+    test('the runtime-state exclusion list is exactly the local state paths', () => {
+        expect([...worktree_1.RUNTIME_STATE_EXCLUDES]).toEqual(['.awm/sensors/runs', '.awm/journal', '.awm/ledger', '.awm/evidence', '.awm/track.json']);
+    });
+    test('a clean repository reports its root, HEAD and a clean tree', () => {
+        const state = (0, worktree_1.gitState)(root, true);
+        expect(state.kind).toBe('ok');
+        if (state.kind === 'ok') {
+            expect(fs_1.default.realpathSync.native(state.root)).toBe(fs_1.default.realpathSync.native(root));
+            expect(state.commit).toBe(g('rev-parse', 'HEAD'));
+            expect(state.dirty).toBe(false);
+        }
+    });
+    test('the root is normalized with native separators', () => {
+        intercept('rev-parse', (opts, args) => (args[1] === '--show-toplevel' ? `${root}${path_1.default.sep}.${path_1.default.sep}\n` : real('git', args, opts)));
+        const state = (0, worktree_1.gitState)(root, true);
+        expect(state.kind === 'ok' && state.root).toBe(path_1.default.resolve(root));
+    });
+    test('an untracked file is dirty for the pre-run measure and clean for the post-run recheck', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'new.ts'), 'x');
+        const pre = (0, worktree_1.gitState)(root, true);
+        const post = (0, worktree_1.gitState)(root, false);
+        expect(pre.kind === 'ok' && pre.dirty).toBe(true);
+        expect(post.kind === 'ok' && post.dirty).toBe(false);
+    });
+    test('the pre-run measure sees untracked files even when status.showUntrackedFiles is no', () => {
+        g('config', 'status.showUntrackedFiles', 'no');
+        fs_1.default.writeFileSync(path_1.default.join(root, 'new.ts'), 'x');
+        const pre = (0, worktree_1.gitState)(root, true);
+        expect(pre.kind === 'ok' && pre.dirty).toBe(true);
+    });
+    test('a tracked change is dirty for both measures', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'a.txt'), 'changed');
+        const pre = (0, worktree_1.gitState)(root, true);
+        const post = (0, worktree_1.gitState)(root, false);
+        expect(pre.kind === 'ok' && pre.dirty).toBe(true);
+        expect(post.kind === 'ok' && post.dirty).toBe(true);
+    });
+    test.each(worktree_1.RUNTIME_STATE_EXCLUDES.map((p) => [p]))('an untracked file at %s is not a change', (rel) => {
+        fs_1.default.mkdirSync(path_1.default.dirname(path_1.default.join(root, rel)), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, rel), 'x');
+        const pre = (0, worktree_1.gitState)(root, true);
+        expect(pre.kind === 'ok' && pre.dirty).toBe(false);
+    });
+    test('extra exclusions hide changes under them, on top of the runtime-state ones', () => {
+        fs_1.default.mkdirSync(path_1.default.join(root, 'docs/changes'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'docs/changes/r.md'), 'r');
+        const without = (0, worktree_1.gitState)(root, true);
+        const withExtra = (0, worktree_1.gitState)(root, true, ['docs/changes']);
+        expect(without.kind === 'ok' && without.dirty).toBe(true);
+        expect(withExtra.kind === 'ok' && withExtra.dirty).toBe(false);
+        fs_1.default.writeFileSync(path_1.default.join(root, 'other.ts'), 'x');
+        const stillDirty = (0, worktree_1.gitState)(root, true, ['docs/changes']);
+        expect(stillDirty.kind === 'ok' && stillDirty.dirty).toBe(true);
+    });
+    test('extra exclusions keep the runtime-state exclusions', () => {
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm/journal'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm/journal/j.json'), 'x');
+        const state = (0, worktree_1.gitState)(root, true, ['docs/changes']);
+        expect(state.kind === 'ok' && state.dirty).toBe(false);
+    });
+    test.each([['docs/changes'], [[7]], [['../out']], [['a\nb']], [['/abs']], [[' pad']], [Array.from({ length: 65 }, (_, i) => `d${i}`)]])('unsafe extra exclusions %j are a failure, never a throw', (extra) => {
+        expect((0, worktree_1.gitState)(root, true, extra)).toEqual({ kind: 'failed' });
+    });
+    test('GIT_*_PATHSPECS variables in the environment do not change the exclusions', () => {
+        fs_1.default.mkdirSync(path_1.default.join(root, 'docs/changes'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, 'docs/changes/r.md'), 'r');
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm/journal'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm/journal/j.json'), 'x');
+        const saved = process.env.GIT_LITERAL_PATHSPECS;
+        process.env.GIT_LITERAL_PATHSPECS = '1';
+        try {
+            const state = (0, worktree_1.gitState)(root, true, ['docs/changes']);
+            expect(state.kind === 'ok' && state.dirty).toBe(false);
+        }
+        finally {
+            if (saved === undefined)
+                delete process.env.GIT_LITERAL_PATHSPECS;
+            else
+                process.env.GIT_LITERAL_PATHSPECS = saved;
+        }
+    });
+    describe('a submodule change is a change whatever the configuration says', () => {
+        // Offline: vendor/sm is a nested repository registered as a gitlink, hidden by .gitmodules `ignore = all` and diff.ignoreSubmodules=all.
+        let sm = '';
+        let commitInSm = () => '';
+        const registerHiddenSubmodule = () => {
+            const hidden = (0, helpers_1.makeHiddenSubmodule)(root, (cwd, ...args) => (0, child_process_1.execFileSync)('git', ['-c', 'commit.gpgsign=false', ...args], { cwd, encoding: 'utf8', env: gitEnv() }).trim());
+            sm = hidden.dir;
+            commitInSm = hidden.commitInSm;
+        };
+        test('a clean tree holding a submodule is clean', () => {
+            registerHiddenSubmodule();
+            const state = (0, worktree_1.gitState)(root, true);
+            expect(state.kind === 'ok' && state.dirty).toBe(false);
+        });
+        test('an untracked file inside a clean submodule: the post-run recheck ignores it, the pre-run measure counts it', () => {
+            registerHiddenSubmodule();
+            fs_1.default.writeFileSync(path_1.default.join(sm, 'coverage.out'), 'x'); // what a sensor leaves behind
+            const post = (0, worktree_1.gitState)(root, false);
+            const pre = (0, worktree_1.gitState)(root, true);
+            expect(post.kind === 'ok' && post.dirty).toBe(false);
+            // git reports the submodule itself as modified (untracked content) in the normal-untracked mode, so the pre-run measure is dirty.
+            expect(pre.kind === 'ok' && pre.dirty).toBe(true);
+        });
+        test.each([[true], [false]])('modified tracked content inside a submodule makes the tree dirty (untracked=%p)', (untracked) => {
+            registerHiddenSubmodule();
+            fs_1.default.writeFileSync(path_1.default.join(sm, 'one'), 'changed');
+            const state = (0, worktree_1.gitState)(root, untracked);
+            expect(state.kind === 'ok' && state.dirty).toBe(true);
+        });
+        test.each([[true], [false]])('a submodule checked out at another commit than the gitlink makes the tree dirty (untracked=%p)', (untracked) => {
+            registerHiddenSubmodule();
+            commitInSm('two');
+            const state = (0, worktree_1.gitState)(root, untracked);
+            expect(state.kind === 'ok' && state.dirty).toBe(true);
+        });
+    });
+    test('a non-string or empty cwd is a failure, never a throw', () => {
+        expect((0, worktree_1.gitState)(undefined, true)).toEqual({ kind: 'failed' });
+        expect((0, worktree_1.gitState)('', true)).toEqual({ kind: 'failed' });
+    });
+    test('a directory outside git is not-repo', () => {
+        const plain = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-plain-'));
+        try {
+            expect((0, worktree_1.gitState)(plain, true)).toEqual({ kind: 'not-repo' });
+        }
+        finally {
+            fs_1.default.rmSync(plain, { recursive: true, force: true });
+        }
+    });
+    test('a repository without a commit is not-repo', () => {
+        const empty = fs_1.default.realpathSync.native(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-empty-')));
+        try {
+            (0, child_process_1.execFileSync)('git', ['init', '-q', '-b', 'main'], { cwd: empty, env: gitEnv() });
+            expect((0, worktree_1.gitState)(empty, true)).toEqual({ kind: 'not-repo' });
+        }
+        finally {
+            fs_1.default.rmSync(empty, { recursive: true, force: true });
+        }
+    });
+    test.each([['ENOBUFS'], ['ETIMEDOUT']])('a %s from git status is a failure, not a missing repository', (code) => {
+        intercept('status', fail(code));
+        expect((0, worktree_1.gitState)(root, true)).toEqual({ kind: 'failed' });
+    });
+    test('git missing from PATH is a failure', () => {
+        intercept('rev-parse', fail('ENOENT'));
+        expect((0, worktree_1.gitState)(root, true)).toEqual({ kind: 'failed' });
+    });
+    test('git status gets a 64 MiB buffer', () => {
+        let seen;
+        intercept('status', (opts) => { seen = opts.maxBuffer; throw Object.assign(new Error('stop'), { code: 'ENOBUFS' }); });
+        (0, worktree_1.gitState)(root, true);
+        expect(seen).toBeGreaterThanOrEqual(64 * 1024 * 1024);
+    });
+    test('the reasons are the stable user-facing strings', () => {
+        expect(worktree_1.REASON_NOT_REPO).toBe('not inside a git repository with a commit');
+        expect(worktree_1.REASON_GIT_FAILED).toBe('git command failed or timed out');
+    });
+});

package/dist/tests/release/orchestrator-trailer.test.js

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// cli/tests/release/orchestrator-trailer.test.ts
+//
+// R6.1 (#217): the bump commit must be read as a Change Record opt-out by the code that reads it
+// (`hasOptOut`), not just contain the right text in a mocked argv. The orchestrator runs against a
+// real tmp git repo: `git add` and `git commit` execute for real with the argv the orchestrator
+// passes (never retyped here); every other command is faked.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const orchestrator_1 = require("../../src/release/orchestrator");
+const core_1 = require("../../src/release/core");
+const trailers_1 = require("../../src/core/changes/trailers");
+const helpers_1 = require("../core/changes/helpers");
+describe('release — the bump commit opts out of the Change Record (R6.1)', () => {
+    let repo;
+    beforeEach(() => { repo = (0, helpers_1.makeRepo)(); });
+    afterEach(() => repo.cleanup());
+    it('the commit the orchestrator creates is read as an opt-out and keeps its subject byte-identical', () => {
+        // Explicit environment for the child git: identity and config isolation never come from process.env alone.
+        const gitEnv = {
+            ...process.env, HOME: repo.home, GIT_CONFIG_GLOBAL: path_1.default.join(repo.home, 'gitconfig'), GIT_CONFIG_NOSYSTEM: '1',
+            GIT_AUTHOR_NAME: 't', GIT_AUTHOR_EMAIL: 't@t', GIT_COMMITTER_NAME: 't', GIT_COMMITTER_EMAIL: 't@t',
+        };
+        repo.commit({
+            'cli/package.json': '{"version":"2.1.1"}\n',
+            'cli/package-lock.json': '{"version":"2.1.1"}\n',
+            'CHANGELOG.md': '# Changelog\n',
+        }, 'chore: seed release files');
+        repo.git('config', 'commit.gpgsign', 'false');
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(false);
+        let pkgVersion = '2.1.1';
+        let changelog = '# Changelog\n';
+        const write = (rel, content) => fs_1.default.writeFileSync(path_1.default.join(repo.root, rel), content);
+        const commitArgv = [];
+        const io = {
+            run(cmd, args) {
+                if (cmd === 'git' && (args[0] === 'add' || args[0] === 'commit')) {
+                    if (args[0] === 'commit')
+                        commitArgv.push(args);
+                    return (0, child_process_1.execFileSync)('git', args, { cwd: repo.root, encoding: 'utf8', env: gitEnv });
+                }
+                if (cmd === 'git' && args[0] === 'rev-parse')
+                    return 'main';
+                if (cmd === 'git' && args[0] === 'log')
+                    return `feat: nueva${core_1.US}${core_1.RS}`;
+                return ''; // status, tag, npm view/publish: nothing there, nothing dirty
+            },
+            readPackageVersion: () => pkgVersion,
+            writePackageVersion: (v) => { pkgVersion = v; write('cli/package.json', `{"version":"${v}"}\n`); },
+            writeLockVersion: (v) => write('cli/package-lock.json', `{"version":"${v}"}\n`),
+            readChangelog: () => changelog,
+            writeChangelog: (c) => { changelog = c; write('CHANGELOG.md', c); },
+            writeNpmrc: () => { },
+            removeNpmrc: () => { },
+            today: () => '2026-06-25',
+            log: () => { },
+            env: { NPM_TOKEN: 'tok' },
+        };
+        const res = (0, orchestrator_1.release)({ dryRun: false, force: null, push: false, branch: 'main', cliDir: '/cli' }, io);
+        expect(res).toEqual({ released: true, version: '2.2.0' });
+        expect(commitArgv).toHaveLength(1); // the argv under test was really executed, once
+        expect(repo.git('log', '-1', '--format=%s')).toBe('chore(release): v2.2.0 [skip ci]');
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(true);
+        // The opt-out is a trailer paragraph of its own: the full message is subject, blank line, trailer.
+        expect(repo.git('log', '-1', '--format=%B')).toBe('chore(release): v2.2.0 [skip ci]\n\nChange-Record: none');
+    });
+});

package/dist/tests/release/orchestrator.test.js

@@ -51,6 +51,7 @@ describe('release — happy path', () => {
         expect(calls).toContain('WRITE_PKG 2.2.0');
         const joined = calls.join('\n');
         expect(joined).toMatch(/git commit .*chore\(release\): v2.2.0/);
+        expect(joined).toMatch(/git commit .*chore\(release\): v2\.2\.0 \[skip ci\] -m Change-Record: none/);
         expect(joined).toMatch(/git tag -a v2.2.0/);
         expect(joined).toMatch(/npm publish/);
         expect(joined).toMatch(/git push origin main/);

package/dist/tests/structural/change-commands-are-registered.test.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// The Change Record commands are reachable from the real program: `awm change new|validate` and `awm changes list`. Every command
+// module is tested by registering it on a fresh Commander program, which would stay green if src/index.ts forgot the register call.
+const index_1 = require("../../src/index");
+const find = (parent, name) => parent.commands.find((c) => c.name() === name);
+const flags = (command) => (command?.options ?? []).map((o) => o.long ?? o.flags).sort();
+describe('the real awm program registers the Change Record commands', () => {
+    test('`awm change` has `new <slug>` and `validate [path]` with their options', () => {
+        const change = find(index_1.program, 'change');
+        expect(change).toBeDefined();
+        const created = find(change, 'new');
+        const validated = find(change, 'validate');
+        expect(created?.usage()).toContain('<slug>');
+        expect(flags(created)).toEqual(['--base', '--issue', '--model', '--plan', '--refresh', '--session']);
+        expect(validated?.usage()).toContain('[path]');
+        expect(flags(validated)).toEqual(['--base', '--json', '--strict']);
+    });
+    test('`awm changes` has `list` with --since, --base and --format', () => {
+        const changes = find(index_1.program, 'changes');
+        expect(changes).toBeDefined();
+        expect(flags(find(changes, 'list'))).toEqual(['--base', '--format', '--since']);
+    });
+    test('both are in the top-level help', () => {
+        const help = index_1.program.helpInformation();
+        expect(help).toMatch(/^\s+change\b/m);
+        expect(help).toMatch(/^\s+changes\b/m);
+    });
+});

package/dist/tests/structural/change-record-git-and-platform-conventions.test.js

@@ -0,0 +1,77 @@
+"use strict";
+// Structural guards for two defect classes that recurred through the Change Record cycle (#217,
+// harness-retro 2026-10-17; see the branch ledger signatures `s3-cq-dirty-duplicates-gitstate`,
+// `git-dir-env-not-scrubbed` and `silent-return-instead-of-skip`):
+//
+// 1. Every git child of the change-record code runs through `execGit`/`runGit`/`gitState`
+//    (core/changes/git-env.ts), which scrubs inherited GIT_* location/pathspec variables, closes
+//    stdin, bounds time and output and sets GIT_NO_LAZY_FETCH. A bare `execFileSync('git', ...)`
+//    in these directories silently loses all of that, and reviewers found such leaks four times.
+// 2. A test that returns early on Windows is reported as PASSED by the 3-platform release gate.
+//    These suites use `posixOnly` (test.skip with a visible reason) instead.
+//
+// The detectors are exercised on inline samples below, so each guard demonstrably fires.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bareGitSpawns = bareGitSpawns;
+exports.silentWin32Returns = silentWin32Returns;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const CLI_ROOT = path_1.default.join(__dirname, '../..');
+function tsFiles(dir) {
+    if (!fs_1.default.existsSync(dir))
+        return [];
+    const out = [];
+    for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+        const full = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...tsFiles(full));
+        else if (entry.isFile() && entry.name.endsWith('.ts'))
+            out.push(full);
+    }
+    return out;
+}
+// Naive comment stripping, as in exec-invocation-explicit-stdio.test.ts: a false positive fails loud.
+function stripComments(source) {
+    return source.replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|[^:])\/\/.*$/gm, '$1');
+}
+const BARE_GIT_SPAWN = /\b(?:execFileSync|execFile|spawnSync|spawn)\(\s*['"`]git['"`]/;
+const SILENT_WIN32_RETURN = /\bif\s*\(\s*(?:process\.platform\s*===\s*['"]win32['"]|win32|isWindows)\s*\)\s*(?:\{\s*)?return\b/;
+function bareGitSpawns(source) {
+    return BARE_GIT_SPAWN.test(stripComments(source));
+}
+function silentWin32Returns(source) {
+    return SILENT_WIN32_RETURN.test(stripComments(source));
+}
+describe('change-record conventions (structural)', () => {
+    test('the detectors fire on the offending shapes and not on the sanctioned ones', () => {
+        expect(bareGitSpawns("execFileSync('git', ['status'])")).toBe(true);
+        expect(bareGitSpawns('spawnSync("git", args, opts)')).toBe(true);
+        expect(bareGitSpawns("runGit(root, ['status'])")).toBe(false);
+        expect(bareGitSpawns("// execFileSync('git', [])\nexecGit(root, [])")).toBe(false);
+        expect(silentWin32Returns("if (process.platform === 'win32') return;")).toBe(true);
+        expect(silentWin32Returns('if (win32) { return; }')).toBe(true);
+        expect(silentWin32Returns('posixOnly(() => { /* body */ });')).toBe(false);
+        expect(silentWin32Returns("// if (process.platform === 'win32') return;")).toBe(false);
+    });
+    test('git is spawned only by git-env.ts under core/changes and the change commands', () => {
+        const dirs = ['src/core/changes', 'src/commands/change', 'src/commands/changes'].map(d => path_1.default.join(CLI_ROOT, d));
+        const allowed = path_1.default.join(CLI_ROOT, 'src/core/changes/git-env.ts');
+        const offenders = dirs
+            .flatMap(tsFiles)
+            .filter(file => file !== allowed)
+            .filter(file => bareGitSpawns(fs_1.default.readFileSync(file, 'utf8')))
+            .map(file => path_1.default.relative(CLI_ROOT, file));
+        expect(offenders).toEqual([]);
+    });
+    test('change-record tests skip with posixOnly instead of returning early on Windows', () => {
+        const dirs = ['tests/core/changes', 'tests/commands/change', 'tests/commands/changes'].map(d => path_1.default.join(CLI_ROOT, d));
+        const offenders = dirs
+            .flatMap(tsFiles)
+            .filter(file => silentWin32Returns(fs_1.default.readFileSync(file, 'utf8')))
+            .map(file => path_1.default.relative(CLI_ROOT, file));
+        expect(offenders).toEqual([]);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.19.0",
+  "version": "9.20.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"