agentic-workflow-manager 9.21.0 → 9.22.1

package/dist/tests/core/changes/receipt.test.js

@@ -75,15 +75,18 @@ let home;
 // Child git processes get an explicit identity and config isolation; the shared makeRepo already points HOME and AWM_HOME at a throwaway home.
 const gitEnv = () => ({ ...process.env, HOME: home, GIT_CONFIG_GLOBAL: path_1.default.join(home, 'gitconfig'), GIT_AUTHOR_NAME: 't', GIT_AUTHOR_EMAIL: 't@t', GIT_COMMITTER_NAME: 't', GIT_COMMITTER_EMAIL: 't@t', GIT_CONFIG_NOSYSTEM: '1' });
 const g = (...args) => repo.git(...args);
-beforeEach(() => {
-    repo = (0, helpers_1.makeRepo)();
-    root = repo.root;
-    home = repo.home;
+// One template repository for the whole file (it also holds HOME and AWM_HOME on a throwaway home); every test gets a copy (no git).
+let template;
+beforeAll(() => {
+    template = (0, helpers_1.makeRepo)();
     // makeRepo's own .gitignore ignores `.awm/`; these tests need a repository that does NOT (R2.2b), so the first commit is replaced.
-    repo.commit({ '.gitignore': 'node_modules\n', 'a.txt': 'a' }, 'feat: a');
+    template.commit({ '.gitignore': 'node_modules\n', 'a.txt': 'a' }, 'feat: a');
 });
+const useRepo = (from) => { repo = (0, helpers_1.cloneRepo)(from); root = repo.root; home = repo.home; };
+beforeEach(() => useRepo(template));
 afterEach(() => repo.cleanup());
 afterAll(() => {
+    template.cleanup(); // restores HOME, AWM_HOME and the git config variables
     for (const k of ENV_KEYS)
         expect(process.env[k]).toBe(ORIGINAL[k]);
     expect(listRuns()).toEqual(RUNS_BEFORE);
@@ -141,7 +144,7 @@ describe('receipt', () => {
     test('R2.3 the receipt carries schema, commit, ranAt, cliVersion and overall from the run', () => {
         const head = g('rev-parse', 'HEAD');
         const r = (0, receipt_1.buildReceipt)({ commit: head, ranAt: '2026-10-17T10:00:00.000Z', cliVersion: '9.20.0', output: { overall: 'fail', sensors: [{ name: 'lint', status: 'fail', errors: [] }] } });
-        expect(r).toMatchObject({ schema: 1, commit: head, ranAt: '2026-10-17T10:00:00.000Z', cliVersion: '9.20.0', overall: 'fail', sensors: { lint: 'fail' } });
+        expect(r).toMatchObject({ schema: 2, commit: head, ranAt: '2026-10-17T10:00:00.000Z', cliVersion: '9.20.0', overall: 'fail', sensors: { lint: 'fail' } });
     });
     (0, helpers_1.posixOnly)('R2.1 a receipt replacing an existing 0666 file ends with mode 0600', () => {
         const head = g('rev-parse', 'HEAD');
@@ -646,7 +649,7 @@ describe('receipt', () => {
         ['unknown sensor status', (r) => { r.sensors.lint = 'ok'; }],
         ['array sensors', (r) => { r.sensors = []; }],
         ['null sensors', (r) => { r.sensors = null; }],
-        ['schema 2', (r) => { r.schema = 2; }],
+        ['schema 3', (r) => { r.schema = 3; }],
         ['non-string cliVersion', (r) => { r.cliVersion = 1; }],
         ['multi-line cliVersion', (r) => { r.cliVersion = '1.0\n2.0'; }],
         ['multi-line sensor name', (r) => { r.sensors['bad\nname'] = 'pass'; }],
@@ -776,9 +779,18 @@ describe('sensors run wiring (R2.2, R2.4)', () => {
         g('commit', '-q', '-m', `chore: manifest in ${path_1.default.basename(dir)}`);
     };
     const receiptNames = () => fs_1.default.readdirSync(receiptsDir()).sort();
+    // The template plus `commitManifest(root)`, built once: each test of this block starts from a copy of it.
+    let manifested;
+    afterAll(() => manifested?.cleanup());
     beforeEach(() => {
         process.exitCode = undefined;
-        commitManifest(root);
+        // The shared state is its own copy, never the test's `repo`: a failed copy below must not let afterEach remove it.
+        if (manifested === undefined) {
+            commitManifest(root);
+            manifested = (0, helpers_1.cloneRepo)(repo);
+        }
+        repo.cleanup();
+        useRepo(manifested);
         run_1.findManifestDir.mockReset().mockImplementation((start) => {
             const project = (0, project_1.resolveSensorProject)(start);
             return project.state === 'configured' ? project.projectRoot : null;
@@ -944,4 +956,263 @@ describe('sensors run wiring (R2.2, R2.4)', () => {
             expect(fs_1.default.existsSync(receiptsDir())).toBe(false);
         });
     });
+    test('RF-4.2/4.4: all-cached clean full gate still writes a HEAD receipt (digest is authority)', async () => {
+        run_1.runSensors.mockResolvedValue({
+            overall: 'pass',
+            sensors: [
+                {
+                    name: 'lint',
+                    status: 'pass',
+                    errors: [],
+                    cached: true,
+                    cacheProvenance: {
+                        originCommit: 'c'.repeat(40),
+                        originDirty: false,
+                        inputDigest: `sha256:${'d'.repeat(64)}`,
+                        sensorFingerprint: `sha256:${'e'.repeat(64)}`,
+                    },
+                    measurement: {
+                        inputs: ['src/**/*.ts'],
+                        packageRootRel: '',
+                        inputDigest: `sha256:${'d'.repeat(64)}`,
+                        sensorFingerprint: `sha256:${'e'.repeat(64)}`,
+                        measuredPaths: ['a.txt', '.awm/sensors.json'],
+                    },
+                },
+                {
+                    name: 'a-typecheck',
+                    status: 'pass',
+                    errors: [],
+                    cached: true,
+                    cacheProvenance: {
+                        inputDigest: `sha256:${'f'.repeat(64)}`,
+                        sensorFingerprint: `sha256:${'e'.repeat(64)}`,
+                    },
+                    measurement: {
+                        inputs: ['src/**/*.ts'],
+                        packageRootRel: '',
+                        inputDigest: `sha256:${'f'.repeat(64)}`,
+                        sensorFingerprint: `sha256:${'e'.repeat(64)}`,
+                        measuredPaths: ['a.txt', '.awm/sensors.json'],
+                    },
+                },
+            ],
+            manifestPath: rootManifest(),
+        });
+        await runCli();
+        expect(written(stderr)).toBe('');
+        expect(process.exitCode).toBe(0);
+        const head = g('rev-parse', 'HEAD');
+        const read = (0, receipt_1.readReceipt)(root, head);
+        expect(read.ok).toBe(true);
+        if (!read.ok)
+            return;
+        expect(read.receipt.schema).toBe(2);
+        expect(read.receipt.sensors).toEqual({ 'a-typecheck': 'pass', lint: 'pass' });
+    });
+});
+describe('RF-4.3 receipt schema 2', () => {
+    test('buildReceipt writes schema 2 with measurements and alwaysMeasuredPaths including baseline', () => {
+        const head = g('rev-parse', 'HEAD');
+        const r = (0, receipt_1.buildReceipt)({
+            commit: head,
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '9.21.0',
+            output: {
+                overall: 'pass',
+                sensors: [{
+                        name: 'lint',
+                        status: 'pass',
+                        errors: [],
+                        measurement: {
+                            inputs: ['src/**/*.ts'],
+                            packageRootRel: '',
+                            inputDigest: `sha256:${'1'.repeat(64)}`,
+                            sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                            measuredPaths: ['src/a.ts', '.awm/sensors.json', 'package-lock.json'],
+                        },
+                    }],
+            },
+            alwaysMeasuredPaths: ['.awm/sensors.json', '.awm/sensors.baseline.json', 'package-lock.json'],
+        });
+        expect(r.schema).toBe(2);
+        expect(r.sensors).toEqual({ lint: 'pass' });
+        const v2 = r;
+        expect(v2.measurements).toEqual({
+            lint: {
+                inputs: ['src/**/*.ts'],
+                packageRootRel: '',
+                inputDigest: `sha256:${'1'.repeat(64)}`,
+                sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                measuredPaths: ['.awm/sensors.json', 'package-lock.json', 'src/a.ts'],
+            },
+        });
+        expect(v2.alwaysMeasuredPaths).toEqual(['.awm/sensors.baseline.json', '.awm/sensors.json', 'package-lock.json']);
+        expect(v2.digest).toMatch(/^sha256:[0-9a-f]{64}$/);
+        expect((0, receipt_1.readReceipt)(root, (() => { (0, receipt_1.writeReceipt)(root, r); return head; })()).ok).toBe(true);
+    });
+    test('schema 1 receipts remain readable', () => {
+        const head = g('rev-parse', 'HEAD');
+        const body = {
+            schema: 1,
+            commit: head,
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '9.20.0',
+            overall: 'pass',
+            sensors: { lint: 'pass' },
+        };
+        const receipt = { ...body, digest: (0, receipt_1.computeReceiptDigest)(body) };
+        (0, receipt_1.writeReceipt)(root, receipt);
+        const read = (0, receipt_1.readReceipt)(root, head);
+        expect(read).toEqual({ ok: true, receipt });
+    });
+    test('schema 2 digest covers measurements and alwaysMeasuredPaths', () => {
+        const base = {
+            schema: 2,
+            commit: 'a'.repeat(40),
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '1.0.0',
+            overall: 'pass',
+            sensors: { lint: 'pass' },
+            measurements: {
+                lint: {
+                    inputs: ['src/**'],
+                    packageRootRel: '',
+                    inputDigest: `sha256:${'1'.repeat(64)}`,
+                    sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                    measuredPaths: ['src/a.ts'],
+                },
+            },
+            alwaysMeasuredPaths: ['.awm/sensors.baseline.json'],
+        };
+        const d = (0, receipt_1.computeReceiptDigest)(base);
+        const measuredChanged = {
+            ...base,
+            measurements: {
+                lint: { ...base.measurements.lint, measuredPaths: ['src/b.ts'] },
+            },
+        };
+        const alwaysChanged = {
+            ...base,
+            alwaysMeasuredPaths: ['.awm/sensors.json'],
+        };
+        expect((0, receipt_1.computeReceiptDigest)(measuredChanged)).not.toBe(d);
+        expect((0, receipt_1.computeReceiptDigest)(alwaysChanged)).not.toBe(d);
+    });
+    test('RF-4.6 helper: relaxation only when every recorded sensor has authored inputs', () => {
+        expect((0, receipt_1.allowsUnmeasuredRelaxation)({
+            schema: 2,
+            commit: 'a'.repeat(40),
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '1',
+            overall: 'pass',
+            sensors: { lint: 'pass', test: 'pass' },
+            measurements: {
+                lint: {
+                    inputs: ['src/**'],
+                    packageRootRel: '',
+                    inputDigest: `sha256:${'1'.repeat(64)}`,
+                    sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                    measuredPaths: ['src/a.ts'],
+                },
+            },
+            alwaysMeasuredPaths: [],
+            digest: 'sha256:' + '0'.repeat(64),
+        })).toBe(false);
+        expect((0, receipt_1.allowsUnmeasuredRelaxation)({
+            schema: 2,
+            commit: 'a'.repeat(40),
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '1',
+            overall: 'pass',
+            sensors: { lint: 'pass' },
+            measurements: {
+                lint: {
+                    inputs: ['src/**'],
+                    packageRootRel: '',
+                    inputDigest: `sha256:${'1'.repeat(64)}`,
+                    sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                    measuredPaths: ['src/a.ts'],
+                },
+            },
+            alwaysMeasuredPaths: ['.awm/sensors.baseline.json'],
+            digest: 'sha256:' + '0'.repeat(64),
+        })).toBe(true);
+        expect((0, receipt_1.allowsUnmeasuredRelaxation)({
+            schema: 1,
+            commit: 'a'.repeat(40),
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '1',
+            overall: 'pass',
+            sensors: { lint: 'pass' },
+            digest: 'sha256:' + '0'.repeat(64),
+        })).toBe(false);
+    });
+    test('readReceipt rejects schema-2 measurements with unsorted measuredPaths or malformed measurement shapes', () => {
+        const head = g('rev-parse', 'HEAD');
+        const baseMeasurement = {
+            inputs: ['src/**/*.ts'],
+            packageRootRel: '',
+            inputDigest: `sha256:${'1'.repeat(64)}`,
+            sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+            measuredPaths: ['a.ts', 'b.ts'],
+        };
+        const writeV2 = (measurements, alwaysMeasuredPaths = ['.awm/sensors.baseline.json']) => {
+            const body = {
+                schema: 2,
+                commit: head,
+                ranAt: '2026-10-17T10:00:00.000Z',
+                cliVersion: '9.21.0',
+                overall: 'pass',
+                sensors: { lint: 'pass' },
+                measurements,
+                alwaysMeasuredPaths,
+            };
+            const receipt = { ...body, digest: (0, receipt_1.computeReceiptDigest)(body) };
+            const dir = path_1.default.join(root, '.awm', 'sensors', 'runs');
+            fs_1.default.mkdirSync(dir, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(dir, `${head}.json`), JSON.stringify(receipt) + '\n');
+        };
+        writeV2({ lint: { ...baseMeasurement, measuredPaths: ['b.ts', 'a.ts'] } });
+        expect((0, receipt_1.readReceipt)(root, head)).toEqual({ ok: false, code: 'receipt-invalid' });
+        writeV2({ lint: { ...baseMeasurement, measuredPaths: 'a.ts' } });
+        expect((0, receipt_1.readReceipt)(root, head)).toEqual({ ok: false, code: 'receipt-invalid' });
+        writeV2({ lint: { ...baseMeasurement, inputs: [] } });
+        expect((0, receipt_1.readReceipt)(root, head)).toEqual({ ok: false, code: 'receipt-invalid' });
+        writeV2({ lint: { ...baseMeasurement, packageRootRel: '../escape' } });
+        expect((0, receipt_1.readReceipt)(root, head)).toEqual({ ok: false, code: 'receipt-invalid' });
+    });
+    test('measurement.inputs on schema-2 parse reuse RF-1.5 glob rules (reject .., !, braces, extglobs)', () => {
+        const head = g('rev-parse', 'HEAD');
+        const mk = (inputs) => {
+            const body = {
+                schema: 2,
+                commit: head,
+                ranAt: '2026-10-17T10:00:00.000Z',
+                cliVersion: '9.21.0',
+                overall: 'pass',
+                sensors: { lint: 'pass' },
+                measurements: {
+                    lint: {
+                        inputs,
+                        packageRootRel: '',
+                        inputDigest: `sha256:${'1'.repeat(64)}`,
+                        sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                        measuredPaths: ['src/a.ts'],
+                    },
+                },
+                alwaysMeasuredPaths: ['.awm/sensors.baseline.json'],
+            };
+            const receipt = { ...body, digest: (0, receipt_1.computeReceiptDigest)(body) };
+            const dir = path_1.default.join(root, '.awm', 'sensors', 'runs');
+            fs_1.default.mkdirSync(dir, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(dir, `${head}.json`), JSON.stringify(receipt) + '\n');
+            return (0, receipt_1.readReceipt)(root, head);
+        };
+        expect(mk(['src/**/*.ts'])).toMatchObject({ ok: true });
+        expect(mk(['../secret/**'])).toEqual({ ok: false, code: 'receipt-invalid' });
+        expect(mk(['!src/**'])).toEqual({ ok: false, code: 'receipt-invalid' });
+        expect(mk(['src/{a,b}.ts'])).toEqual({ ok: false, code: 'receipt-invalid' });
+        expect(mk(['src/@(a|b).ts'])).toEqual({ ok: false, code: 'receipt-invalid' });
+    });
 });

package/dist/tests/core/diagnostics/provider-checks.test.js

@@ -29,6 +29,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const commit_seeded_registry_1 = require("../../helpers/commit-seeded-registry");
 describe('gatherProviderChecks — realistic fully-healthy single-provider fixtures', () => {
     let tmpHome;
     let tmpWork;
@@ -86,6 +87,8 @@ describe('gatherProviderChecks — realistic fully-healthy single-provider fixtu
             name: 'dev-core', description: '', version: '1.0.0', scope: 'baseline', visibility: 'public',
             dependsOn: [], skills: ['development-process'], workflows: [], agents,
         }));
+        // Local commit so real `awm init` skips network sync under SG-7 (#238).
+        (0, commit_seeded_registry_1.commitSeededRegistry)(root);
         fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.awm/registries.json'), JSON.stringify([{ name: 'baseline', remote: 'https://example.invalid/baseline.git' }], null, 2));
     }

package/dist/tests/core/init/steps-registry-sync.test.js

@@ -6,10 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // stepCache vs. syncRegistries()'s RESULT-shaped failures.
 //
 // `syncRegistries()` never throws on a per-registry failure — it returns
-// `{ action: 'error', error }` for that registry and keeps going. stepCache
-// used to `await` it and report a blanket 'applied', so a registry that never
-// landed on disk degraded silently into some later step's failure with its own
-// cause already gone.
+// `{ action: 'error', error }` for that registry. SG-7: stepCache fails closed
+// on ANY sync error (usable on-disk cache is not enough for init).
 //
 // Isolated in its own file (not steps.test.ts) because these assertions reach
 // `listRegistries()`, which resolves AWM_HOME at module require time — the env
@@ -83,12 +81,12 @@ describe('stepCache — registry sync error results', () => {
         expect(r.error).toContain('baseline');
         expect(r.error).toContain('could not clone');
     });
-    it('stays applied but records the error when content is already on disk', async () => {
+    it('fails when sync errors even if content is already on disk (SG-7)', async () => {
         configureRegistries(['baseline'], ['baseline']);
         const r = await run([{ name: 'baseline', action: 'error', error: 'pull timed out' }]);
-        expect(r.action).toBe('applied');
-        expect(r.detail).toContain('baseline');
-        expect(r.detail).toContain('pull timed out');
+        expect(r.action).toBe('failed');
+        expect(r.error).toContain('baseline');
+        expect(r.error).toContain('pull timed out');
     });
     it('fails on a secondary registry that never landed, even when the base one synced', async () => {
         configureRegistries(['baseline', 'documentation'], ['baseline']);

package/dist/tests/core/registry-git.test.js

@@ -0,0 +1,153 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const registry_git_1 = require("../../src/core/registry-git");
+const registry_git_errors_1 = require("../../src/core/registry-git-errors");
+describe('registry-git factory (#238 S1)', () => {
+    it('buildRegistryGitEnv drops guarded GIT_* keys, keeps PATH, forces GIT_TERMINAL_PROMPT=0', () => {
+        const parent = {
+            PATH: '/usr/bin',
+            HOME: '/tmp/home',
+            GIT_ASKPASS: '/secret/askpass',
+            GIT_SSL_CAINFO: '/secret/ca.pem',
+            GIT_TERMINAL_PROMPT: '1',
+            EDITOR: 'vi',
+            VISUAL: 'vim',
+            PAGER: 'less',
+            OTHER: 'ok',
+        };
+        const env = (0, registry_git_1.buildRegistryGitEnv)(parent);
+        expect(env.PATH).toBe('/usr/bin');
+        expect(env.HOME).toBe('/tmp/home');
+        expect(env.OTHER).toBe('ok');
+        expect(env.GIT_ASKPASS).toBeUndefined();
+        expect(env.GIT_SSL_CAINFO).toBeUndefined();
+        expect(env.EDITOR).toBeUndefined();
+        expect(env.VISUAL).toBeUndefined();
+        expect(env.PAGER).toBeUndefined();
+        expect(env.GIT_TERMINAL_PROMPT).toBe('0');
+        expect((0, registry_git_1.listIgnoredGuardedGitEnvNames)(parent)).toEqual(['GIT_ASKPASS', 'GIT_SSL_CAINFO']);
+    });
+    it('createRegistryGit against a bad remote fails quickly without hanging', async () => {
+        const dest = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-registry-git-'));
+        const remote = 'https://127.0.0.1:1/awm-no-such-repo.git';
+        const started = Date.now();
+        await expect((0, registry_git_1.createRegistryGit)().clone(remote, path_1.default.join(dest, 'repo'))).rejects.toThrow(/terminal prompts disabled|Failed to connect|Could not resolve|timed out|Authentication|Connection refused|Unable to connect|Network is unreachable/i);
+        expect(Date.now() - started).toBeLessThan(15_000);
+        fs_1.default.rmSync(dest, { recursive: true, force: true });
+    }, 20_000);
+});
+describe('registry-git ignored-env notice (#238 S2 / SG-5)', () => {
+    afterEach(() => {
+        (0, registry_git_1.resetIgnoredGitEnvNoticeForTests)();
+    });
+    it('listIgnoredGuardedGitEnvNames returns GIT_SSL_CAINFO only (never the value)', () => {
+        const parent = {
+            PATH: '/usr/bin',
+            GIT_SSL_CAINFO: '/secret/ca.pem',
+            GIT_TERMINAL_PROMPT: '0',
+        };
+        expect((0, registry_git_1.listIgnoredGuardedGitEnvNames)(parent)).toEqual(['GIT_SSL_CAINFO']);
+        const notice = (0, registry_git_1.formatIgnoredGitEnvNotice)(['GIT_SSL_CAINFO']);
+        expect(notice).toContain('GIT_SSL_CAINFO');
+        expect(notice).not.toContain('/secret/ca.pem');
+        expect(notice).toMatch(/git config|http\.sslCAInfo|file-based|credential\.helper|core\.sshCommand/i);
+    });
+    it('warnIgnoredGitEnvOnce emits once per process and never prints values', () => {
+        const lines = [];
+        const parent = {
+            GIT_ASKPASS: '/secret/askpass',
+            GIT_SSL_CAINFO: '/secret/ca.pem',
+            GIT_TERMINAL_PROMPT: '1',
+        };
+        (0, registry_git_1.warnIgnoredGitEnvOnce)((m) => lines.push(m), parent);
+        (0, registry_git_1.warnIgnoredGitEnvOnce)((m) => lines.push(m), parent);
+        expect(lines).toHaveLength(1);
+        expect(lines[0]).toContain('GIT_ASKPASS');
+        expect(lines[0]).toContain('GIT_SSL_CAINFO');
+        expect(lines[0]).not.toContain('/secret/');
+        expect(lines[0]).not.toMatch(/GIT_TERMINAL_PROMPT/);
+    });
+    it('SG-5 lists only transport/auth names (not GIT_EDITOR) and includes SSH_ASKPASS (M2/B2)', () => {
+        const parent = {
+            GIT_EDITOR: 'vim',
+            GIT_PAGER: 'less',
+            GIT_ASKPASS: '/secret/askpass',
+            SSH_ASKPASS: '/secret/ssh-askpass',
+            GIT_TERMINAL_PROMPT: '0',
+        };
+        expect((0, registry_git_1.listIgnoredGuardedGitEnvNames)(parent)).toEqual(['GIT_ASKPASS', 'SSH_ASKPASS']);
+        expect((0, registry_git_1.listIgnoredGuardedGitEnvNames)(parent)).not.toContain('GIT_EDITOR');
+    });
+});
+describe('classifyRegistryGitError (#238 S2 / SG-6)', () => {
+    it('maps terminal prompts disabled → authentication with credential.helper remedy', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('fatal: could not read Username for \'https://example.com\': terminal prompts disabled'));
+        expect(c.class).toBe('authentication');
+        expect(c.fatalLine).toMatch(/terminal prompts disabled/i);
+        expect(c.remedy).toMatch(/credential\.helper/);
+    });
+    it('maps TLS / certificate wording → tls', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('fatal: unable to access \'https://x/\': SSL certificate problem: unable to get local issuer certificate'));
+        expect(c.class).toBe('tls');
+        expect(c.remedy).toMatch(/http\.sslCAInfo|http\.sslCAPath/);
+    });
+    it('maps Could not resolve host → network', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('fatal: unable to access \'https://no.such.host/\': Could not resolve host: no.such.host'));
+        expect(c.class).toBe('network');
+    });
+    it('maps timeout plugin message → timeout', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('block timeout reached (60000ms) — killing process'));
+        expect(c.class).toBe('timeout');
+        expect(c.remedy).toMatch(/60s/);
+    });
+    it('maps git/curl Connection timed out → network, not awm idle timeout (M1)', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error("fatal: unable to access 'https://github.com/x/y.git/': Failed to connect to github.com port 443 after 133030 ms: Connection timed out"));
+        expect(c.class).toBe('network');
+        expect(c.remedy).not.toMatch(/killed after 60s/);
+    });
+    it('maps ssh Could not resolve hostname → network, not ssh (M1)', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('ssh: Could not resolve hostname example.invalid: Name or service not known'));
+        expect(c.class).toBe('network');
+    });
+    it('maps SSH host key failures → ssh with core.sshCommand remedy', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('fatal: Host key verification failed.'));
+        expect(c.class).toBe('ssh');
+        expect(c.remedy).toMatch(/core\.sshCommand|~\/\.ssh\/config/);
+    });
+    it('maps repository not found → not-found', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('remote: Repository not found.\nfatal: repository \'https://github.com/x/y.git\' not found'));
+        expect(c.class).toBe('not-found');
+        expect(c.fatalLine).toMatch(/not found/i);
+    });
+    it('prefers not-found over broad SSH wording when remote says Repository not found', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('ERROR: Repository not found.\nfatal: Could not read from remote repository.'));
+        expect(c.class).toBe('not-found');
+        expect(c.class).not.toBe('ssh');
+    });
+    it('maps unknown transport wording → network (default)', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('something unexpected happened in git'));
+        expect(c.class).toBe('network');
+    });
+});
+describe('formatClassifiedRegistryFailure redacts URL credentials (#238 QA B1)', () => {
+    it('strips https userinfo from remote= and fatal lines', () => {
+        const token = 'ghp_SECRETTOKEN1234567890';
+        const remote = `https://${token}@github.com/org/private-reg.git`;
+        const msg = (0, registry_git_errors_1.formatClassifiedRegistryFailure)({
+            name: 'corp',
+            remote,
+            err: new Error(`fatal: repository '${remote}' not found`),
+        });
+        expect(msg).toContain('github.com/org/private-reg.git');
+        expect(msg).not.toContain(token);
+        expect(msg).not.toMatch(/ghp_/);
+        expect(msg).toMatch(/class=not-found/);
+        expect(msg).toMatch(/remedy:/);
+    });
+});

package/dist/tests/helpers/commit-seeded-registry.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commitSeededRegistry = commitSeededRegistry;
+// Local `.git` commit for hand-seeded registry content roots used by real
+// (unstubbed) `awm init` / `stepCache` paths.
+//
+// Under SG-7 (#238), any sync/clone error hard-fails init. Diagnostics treat
+// `registryCache.present` as "`.git` exists" (`context.ts`), so a content-only
+// fixture always triggers sync against the unreachable `example.invalid`
+// remote. Committing locally makes cache present and lets stepCache skip.
+const child_process_1 = require("child_process");
+function commitSeededRegistry(root) {
+    (0, child_process_1.execFileSync)('git', ['init', '-q'], { cwd: root, stdio: 'ignore' });
+    (0, child_process_1.execFileSync)('git', ['config', 'user.email', 'fixture@example.invalid'], { cwd: root, stdio: 'ignore' });
+    (0, child_process_1.execFileSync)('git', ['config', 'user.name', 'fixture'], { cwd: root, stdio: 'ignore' });
+    (0, child_process_1.execFileSync)('git', ['add', '-A'], { cwd: root, stdio: 'ignore' });
+    (0, child_process_1.execFileSync)('git', ['commit', '-qm', 'fixture'], { cwd: root, stdio: 'ignore' });
+}

package/dist/tests/integration/codex-provider-isolated.test.js

@@ -42,6 +42,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const commit_seeded_registry_1 = require("../helpers/commit-seeded-registry");
 describe('codex provider — isolated home E2E (Task 9)', () => {
     let tmpHome;
     let tmpWork;
@@ -79,8 +80,10 @@ describe('codex provider — isolated home E2E (Task 9)', () => {
     });
     /** Hand-seeds a registry content root with everything a real `awm init` needs:
      *  hooks (Claude + Codex), the bootstrap skill, one baseline bundle providing
-     *  both a skill and a Codex-native agent artifact. No git repo involved — the
-     *  registry cache is content-root-shaped, exactly what a real clone produces. */
+     *  both a skill and a Codex-native agent artifact. Content-root-shaped like a
+     *  real clone, plus a local `.git` commit so `machine.registryCache.present`
+     *  is true and `stepCache` skips network sync (SG-7 hard-fails any sync error,
+     *  and `https://example.invalid/...` is intentionally unreachable). */
     function seedPublicRegistryFixture(root) {
         fs_1.default.mkdirSync(path_1.default.join(root, 'hooks'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(root, 'hooks/session-start'), '#!/bin/sh\necho "{}"\n', { mode: 0o755 });
@@ -101,6 +104,8 @@ describe('codex provider — isolated home E2E (Task 9)', () => {
             name: 'dev-core', description: '', version: '1.0.0', scope: 'baseline', visibility: 'public',
             dependsOn: [], skills: ['development-process'], workflows: [], agents: ['development-process'],
         }));
+        // Local commit only — no origin. Present+.git makes stepCache skip sync.
+        (0, commit_seeded_registry_1.commitSeededRegistry)(root);
         fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.awm/registries.json'), JSON.stringify([{ name: 'baseline', remote: 'https://example.invalid/baseline.git' }], null, 2));
     }

package/dist/tests/integration/copilot-init-isolated.test.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const commit_seeded_registry_1 = require("../helpers/commit-seeded-registry");
 describe('copilot provider — isolated home E2E (devCore global-scope guard regression)', () => {
     let tmpHome;
     let tmpWork;
@@ -67,10 +68,11 @@ describe('copilot provider — isolated home E2E (devCore global-scope guard reg
             process.env.AWM_HOME = originalAwmHome;
     });
     /** Same fixture shape as codex-provider-isolated.test.ts's seedPublicRegistryFixture:
-     *  a real content-root registry (no git repo needed) with the bootstrap skill and one
-     *  baseline bundle. Copilot needs no hooks (providers/index.ts has no `hooks` config
-     *  for it) and no native agent renderer (`agent: null`), so the fixture is intentionally
-     *  smaller than Codex's. */
+     *  a real content-root registry with the bootstrap skill and one baseline bundle,
+     *  plus a local `.git` commit so SG-7 does not hard-fail init on an unreachable
+     *  example.invalid remote (stepCache skips when registryCache.present). Copilot
+     *  needs no hooks (providers/index.ts has no `hooks` config for it) and no native
+     *  agent renderer (`agent: null`), so the fixture is intentionally smaller than Codex's. */
     function seedPublicRegistryFixture(root) {
         fs_1.default.mkdirSync(path_1.default.join(root, 'hooks'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(root, 'hooks/session-start'), '#!/bin/sh\necho "{}"\n', { mode: 0o755 });
@@ -88,6 +90,7 @@ describe('copilot provider — isolated home E2E (devCore global-scope guard reg
             name: 'dev-core', description: '', version: '1.0.0', scope: 'baseline', visibility: 'public',
             dependsOn: [], skills: ['development-process'], workflows: [], agents: [],
         }));
+        (0, commit_seeded_registry_1.commitSeededRegistry)(root);
         fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.awm/registries.json'), JSON.stringify([{ name: 'baseline', remote: 'https://example.invalid/baseline.git' }], null, 2));
     }