agentic-workflow-manager 9.22.0 → 9.22.1

package/dist/tests/core/changes/list.test.js

@@ -15,14 +15,42 @@ const change_1 = require("../../../src/commands/change");
 const types_1 = require("../../../src/core/changes/types");
 let repo;
 let template;
-beforeAll(() => { template = (0, helpers_1.makeRepo)(); });
-afterAll(() => template.cleanup());
+/** The template plus `adoptIn`, and the template plus `historyIn`: prebuilt once, copied per test with no git process. */
+let adopted;
+let historic;
+beforeAll(() => {
+    template = (0, helpers_1.makeRepo)();
+    adopted = (0, helpers_1.cloneRepo)(template);
+    (0, list_fixtures_1.adoptIn)(adopted);
+    historic = (0, helpers_1.cloneRepo)(template);
+    (0, list_fixtures_1.historyIn)(historic);
+});
+afterAll(() => { adopted.cleanup(); historic.cleanup(); template.cleanup(); });
 beforeEach(() => { repo = (0, helpers_1.cloneRepo)(template); });
 afterEach(() => { jest.restoreAllMocks(); repo.cleanup(); });
 const list = (opts = {}) => (0, list_fixtures_1.listIn)(repo, opts);
 const listed = (opts = {}) => (0, list_fixtures_1.ok)(list(opts));
-const adopt = (id) => (0, list_fixtures_1.adoptIn)(repo, id);
-const history = () => (0, list_fixtures_1.historyIn)(repo);
+const startFrom = (state) => { repo.cleanup(); repo = (0, helpers_1.cloneRepo)(state); };
+/** The repository after `adoptIn(repo)` (a copy of the prebuilt one). */
+const adopt = () => startFrom(adopted);
+/** The repository after `historyIn(repo)` (a copy of the prebuilt one). */
+const history = () => startFrom(historic);
+/** The history of `historyIn`, listed once under a git spy for the tests that only read that listing (the state is never changed). */
+let historyListing;
+function listedHistory() {
+    if (historyListing === undefined) {
+        const spy = (0, helpers_1.spyOnGit)();
+        try {
+            historyListing = { result: (0, list_fixtures_1.ok)((0, list_fixtures_1.listIn)(historic)), calls: spy.calls };
+        }
+        finally {
+            spy.restore();
+        }
+    }
+    return historyListing;
+}
+/** The commits `repo.commit(files, message, date)` would make, in order, written by one `git fast-import` (importCommits). */
+const commitMany = (planned) => (0, helpers_1.importCommits)(repo, planned.map(([files, message, date]) => ({ files, message: `${message}\n`, date })));
 describe('listChanges: input and base (R5.1, R3.1, R3.2, R3.5)', () => {
     test('resolves the local main by default and reports it', () => {
         adopt();
@@ -95,11 +123,7 @@ describe('listChanges: input and base (R5.1, R3.1, R3.2, R3.5)', () => {
         expect(r.changes.find((c) => c.subject === 'feat: first (#10)')?.classification).toBe('recorded');
     });
     test('a base that moves during the run cannot change the answer: every git call after the pin uses commit ids', () => {
-        history();
-        const spy = (0, helpers_1.spyOnGit)();
-        listed();
-        spy.restore();
-        const afterPin = spy.calls.filter((a) => a.includes('log') || a.includes('diff') || a.includes('ls-tree') || a.includes('for-each-ref'));
+        const afterPin = listedHistory().calls.filter((a) => a.includes('log') || a.includes('diff') || a.includes('ls-tree') || a.includes('for-each-ref'));
         expect(afterPin.length).toBeGreaterThan(0);
         for (const call of afterPin)
             expect(call).not.toContain('main');
@@ -111,15 +135,16 @@ describe('listChanges: adoption point (R5.4)', () => {
         expect(listed()).toMatchObject({ adopted: false, changes: [], truncated: false, omitted: 0 });
     });
     test('R5.4 a docs/changes/README.md alone does not count: the repo has not adopted Change Records', () => {
-        repo.commit({ 'docs/changes/README.md': 'hello' }, 'docs: readme', '2026-10-16T09:00:00Z');
-        repo.commit({ 'a.ts': '1' }, 'feat: a', '2026-10-16T10:00:00Z');
+        commitMany([[{ 'docs/changes/README.md': 'hello' }, 'docs: readme', '2026-10-16T09:00:00Z'], [{ 'a.ts': '1' }, 'feat: a', '2026-10-16T10:00:00Z']]);
         expect(listed()).toMatchObject({ adopted: false, changes: [], truncated: false, omitted: 0 });
     });
     test('R5.4 a README first and a record later: the adoption is the commit that added the record', () => {
-        repo.commit({ 'docs/changes/README.md': 'hello' }, 'docs: readme', '2026-10-16T09:00:00Z');
-        repo.commit({ 'a.ts': '1' }, 'feat: before the first record', '2026-10-16T10:00:00Z');
-        repo.commit({ [(0, list_fixtures_1.recordPath)(list_fixtures_1.FIRST)]: (0, list_fixtures_1.record)(list_fixtures_1.FIRST) }, 'feat: first record', '2026-10-16T11:00:00Z');
-        repo.commit({ 'b.ts': '1' }, 'fix: after', '2026-10-16T12:00:00Z');
+        commitMany([
+            [{ 'docs/changes/README.md': 'hello' }, 'docs: readme', '2026-10-16T09:00:00Z'],
+            [{ 'a.ts': '1' }, 'feat: before the first record', '2026-10-16T10:00:00Z'],
+            [{ [(0, list_fixtures_1.recordPath)(list_fixtures_1.FIRST)]: (0, list_fixtures_1.record)(list_fixtures_1.FIRST) }, 'feat: first record', '2026-10-16T11:00:00Z'],
+            [{ 'b.ts': '1' }, 'fix: after', '2026-10-16T12:00:00Z'],
+        ]);
         const r = listed();
         expect(r.adopted).toBe(true);
         expect((0, list_fixtures_1.subjects)(r)).toEqual(['fix: after', 'feat: first record']);
@@ -130,8 +155,7 @@ describe('listChanges: adoption point (R5.4)', () => {
         ['a non-markdown file', 'docs/changes/2026-10-10-x.txt'],
         ['a record-shaped name outside docs/changes', 'docs/other/2026-10-10-x.md'],
     ])('R5.4 %s does not mark the adoption', (_label, file) => {
-        repo.commit({ [file]: 'x' }, 'docs: not a record', '2026-10-16T09:00:00Z');
-        repo.commit({ 'a.ts': '1' }, 'feat: a', '2026-10-16T10:00:00Z');
+        commitMany([[{ [file]: 'x' }, 'docs: not a record', '2026-10-16T09:00:00Z'], [{ 'a.ts': '1' }, 'feat: a', '2026-10-16T10:00:00Z']]);
         expect(listed()).toMatchObject({ adopted: false, changes: [] });
     });
     test('a record that was added and later deleted still marks the adoption', () => {
@@ -141,15 +165,17 @@ describe('listChanges: adoption point (R5.4)', () => {
         expect(listed().adopted).toBe(true);
     });
     test('commits older than the first one that added a file under docs/changes are omitted; the adopting commit itself is kept', () => {
-        history();
-        expect((0, list_fixtures_1.subjects)(listed())).not.toContain('feat: before adoption');
-        expect((0, list_fixtures_1.subjects)(listed())).not.toContain('chore: init');
-        expect((0, list_fixtures_1.subjects)(listed())).toContain('feat: first (#10)');
+        const { result } = listedHistory();
+        expect((0, list_fixtures_1.subjects)(result)).not.toContain('feat: before adoption');
+        expect((0, list_fixtures_1.subjects)(result)).not.toContain('chore: init');
+        expect((0, list_fixtures_1.subjects)(result)).toContain('feat: first (#10)');
     });
     test('modifying a file under docs/changes is not an adoption: only the commit that added the first file is', () => {
-        repo.commit({ 'a.ts': '1' }, 'feat: before', '2026-10-16T09:00:00Z');
-        repo.commit({ [(0, list_fixtures_1.recordPath)(list_fixtures_1.FIRST)]: (0, list_fixtures_1.record)(list_fixtures_1.FIRST) }, 'docs: first file', '2026-10-16T10:00:00Z');
-        repo.commit({ [(0, list_fixtures_1.recordPath)(list_fixtures_1.FIRST)]: (0, list_fixtures_1.record)(list_fixtures_1.FIRST, { summary: 'Edit.' }) }, 'docs: edit', '2026-10-16T11:00:00Z');
+        commitMany([
+            [{ 'a.ts': '1' }, 'feat: before', '2026-10-16T09:00:00Z'],
+            [{ [(0, list_fixtures_1.recordPath)(list_fixtures_1.FIRST)]: (0, list_fixtures_1.record)(list_fixtures_1.FIRST) }, 'docs: first file', '2026-10-16T10:00:00Z'],
+            [{ [(0, list_fixtures_1.recordPath)(list_fixtures_1.FIRST)]: (0, list_fixtures_1.record)(list_fixtures_1.FIRST, { summary: 'Edit.' }) }, 'docs: edit', '2026-10-16T11:00:00Z'],
+        ]);
         expect((0, list_fixtures_1.subjects)(listed())).toEqual(['docs: edit', 'docs: first file']);
     });
     test('an adopted repo whose window holds no commit lists nothing', () => {
@@ -180,24 +206,20 @@ describe('listChanges: adoption point (R5.4)', () => {
 });
 describe('listChanges: classification (R5.3)', () => {
     test('recorded, missing, exempt and invalid-record', () => {
-        history();
-        expect((0, list_fixtures_1.byClass)(listed())).toEqual({ 'feat: first (#10)': 'recorded', 'fix: no record': 'missing', 'chore(release): v1.0.0 [skip ci]': 'exempt', 'feat: bad record': 'invalid-record' });
+        expect((0, list_fixtures_1.byClass)(listedHistory().result)).toEqual({ 'feat: first (#10)': 'recorded', 'fix: no record': 'missing', 'chore(release): v1.0.0 [skip ci]': 'exempt', 'feat: bad record': 'invalid-record' });
     });
     test('entries come newest first, in first-parent order', () => {
-        history();
-        expect((0, list_fixtures_1.subjects)(listed())).toEqual(['feat: bad record', 'chore(release): v1.0.0 [skip ci]', 'fix: no record', 'feat: first (#10)']);
+        expect((0, list_fixtures_1.subjects)(listedHistory().result)).toEqual(['feat: bad record', 'chore(release): v1.0.0 [skip ci]', 'fix: no record', 'feat: first (#10)']);
     });
     test('a recorded entry holds the path and the full frontmatter, nothing else', () => {
-        history();
-        const first = listed().changes.find((c) => c.subject === 'feat: first (#10)');
+        const first = listedHistory().result.changes.find((c) => c.subject === 'feat: first (#10)');
         expect(first?.records).toHaveLength(1);
         expect(first?.records[0]).toMatchObject({ path: (0, list_fixtures_1.recordPath)(list_fixtures_1.FIRST), schema: 'awm.change-record/v1', id: list_fixtures_1.FIRST, title: `T ${list_fixtures_1.FIRST}`, summary_short: 'Primer cambio.', type: 'feat', modules: ['cli'] });
         expect(first?.records[0]).not.toHaveProperty('diagnostics');
         expect(first?.records[0]).toHaveProperty('verification.overall', 'pass');
     });
     test('an invalid-record entry holds the path and its diagnostics, no frontmatter', () => {
-        history();
-        const bad = listed().changes.find((c) => c.subject === 'feat: bad record');
+        const bad = listedHistory().result.changes.find((c) => c.subject === 'feat: bad record');
         expect(bad?.records).toHaveLength(1);
         expect(bad?.records[0]).toMatchObject({ path: (0, list_fixtures_1.recordPath)('2026-10-17-bad') });
         expect(bad?.records[0]).not.toHaveProperty('schema');
@@ -258,8 +280,7 @@ describe('listChanges: classification (R5.3)', () => {
         expect(entry.records[0].diagnostics[0].message).toMatch(/not a regular file/);
     });
     test('exempt and missing entries have no records', () => {
-        history();
-        const r = listed();
+        const r = listedHistory().result;
         expect(r.changes.find((c) => c.classification === 'exempt')?.records).toEqual([]);
         expect(r.changes.find((c) => c.classification === 'missing')?.records).toEqual([]);
     });
@@ -275,8 +296,7 @@ describe('listChanges: classification (R5.3)', () => {
     });
     test('the opt-out must be a trailer of the final paragraph: a mention in the subject or the body does not exempt', () => {
         adopt();
-        repo.commit({ 'a.ts': '1' }, 'feat: Change-Record: none', '2026-10-16T20:00:00Z');
-        repo.commit({ 'b.ts': '1' }, 'feat: b\n\nChange-Record: none\n\nand more text', '2026-10-16T21:00:00Z');
+        commitMany([[{ 'a.ts': '1' }, 'feat: Change-Record: none', '2026-10-16T20:00:00Z'], [{ 'b.ts': '1' }, 'feat: b\n\nChange-Record: none\n\nand more text', '2026-10-16T21:00:00Z']]);
         expect((0, list_fixtures_1.byClass)(listed())).toEqual({ 'feat: Change-Record: none': 'missing', 'feat: b': 'missing' });
     });
     test('a commit adding two records, one of them invalid, is invalid-record and lists both', () => {
@@ -444,8 +464,7 @@ describe('listChanges: size and paths of what git prints (R5.7, R1.8)', () => {
     });
     test('a failing ls-tree makes the entry invalid-record with git-failed, and the others are still read', () => {
         adopt();
-        repo.commit({ [(0, list_fixtures_1.recordPath)('2026-10-16-a')]: (0, list_fixtures_1.record)('2026-10-16-a') }, 'feat: a', '2026-10-16T10:00:00Z');
-        repo.commit({ [(0, list_fixtures_1.recordPath)('2026-10-16-b')]: (0, list_fixtures_1.record)('2026-10-16-b') }, 'feat: b', '2026-10-16T11:00:00Z');
+        commitMany([[{ [(0, list_fixtures_1.recordPath)('2026-10-16-a')]: (0, list_fixtures_1.record)('2026-10-16-a') }, 'feat: a', '2026-10-16T10:00:00Z'], [{ [(0, list_fixtures_1.recordPath)('2026-10-16-b')]: (0, list_fixtures_1.record)('2026-10-16-b') }, 'feat: b', '2026-10-16T11:00:00Z']]);
         let fails = 1;
         const spy = (0, helpers_1.spyOnGit)((args) => { if (args.includes('ls-tree') && fails-- > 0)
             throw new Error('boom'); });
@@ -456,8 +475,7 @@ describe('listChanges: size and paths of what git prints (R5.7, R1.8)', () => {
     });
     test('a failing read of one blob makes that record git-failed only', () => {
         adopt();
-        repo.commit({ [(0, list_fixtures_1.recordPath)('2026-10-16-a')]: (0, list_fixtures_1.record)('2026-10-16-a') }, 'feat: a', '2026-10-16T10:00:00Z');
-        repo.commit({ [(0, list_fixtures_1.recordPath)('2026-10-16-b')]: (0, list_fixtures_1.record)('2026-10-16-b') }, 'feat: b', '2026-10-16T11:00:00Z');
+        commitMany([[{ [(0, list_fixtures_1.recordPath)('2026-10-16-a')]: (0, list_fixtures_1.record)('2026-10-16-a') }, 'feat: a', '2026-10-16T10:00:00Z'], [{ [(0, list_fixtures_1.recordPath)('2026-10-16-b')]: (0, list_fixtures_1.record)('2026-10-16-b') }, 'feat: b', '2026-10-16T11:00:00Z']]);
         let fails = 1;
         const spy = (0, helpers_1.spyOnGit)((args) => { if (args.includes('show') && fails-- > 0)
             throw new Error('boom'); });
@@ -510,8 +528,7 @@ describe('listChanges: derived fields (R5.5)', () => {
     });
     test('a tag on a later commit contains the earlier ones', () => {
         adopt();
-        repo.commit({ 'a.ts': '1' }, 'fix: a', '2026-10-16T10:00:00Z');
-        repo.commit({ 'b.ts': '1' }, 'fix: b', '2026-10-16T11:00:00Z');
+        commitMany([[{ 'a.ts': '1' }, 'fix: a', '2026-10-16T10:00:00Z'], [{ 'b.ts': '1' }, 'fix: b', '2026-10-16T11:00:00Z']]);
         repo.gitAt('2026-10-16T12:00:00Z', 'tag', '-a', 'v2.0.0', '-m', 'v2.0.0');
         expect(listed().changes.map((c) => c.release)).toEqual(['v2.0.0', 'v2.0.0']);
     });
@@ -558,26 +575,41 @@ describe('listChanges: derived fields (R5.5)', () => {
     });
     describe('R5.5 the tag lookup is bounded: only the 500 earliest-dated containing tags are examined per entry', () => {
         /** Lightweight tags pointing at `sha`, created with one fast-import process. */
-        const lightTags = (sha, names) => {
-            repo.gitInput(names.map((n) => `reset refs/tags/${n}\nfrom ${sha}\n`).join('\n'), 'fast-import', '--quiet');
+        const lightTags = (sha, names, into = repo) => {
+            into.gitInput(names.map((n) => `reset refs/tags/${n}\nfrom ${sha}\n`).join('\n'), 'fast-import', '--quiet');
         };
         const NAMES = Array.from({ length: 600 }, (_, i) => `t${String(i).padStart(4, '0')}`);
+        // One fix commit carrying the 600 lightweight tags, listed once under a git spy: the next two tests only read that listing.
+        let shared;
+        afterAll(() => shared?.state.cleanup());
+        function sharedTags() {
+            if (shared === undefined) {
+                const state = (0, helpers_1.cloneRepo)(adopted);
+                try {
+                    state.commit({ 'a.ts': '1' }, 'fix: a', '2026-10-16T10:00:00Z');
+                    lightTags(state.git('rev-parse', 'HEAD'), NAMES, state);
+                    const spy = (0, helpers_1.spyOnGit)();
+                    try {
+                        shared = { state, result: (0, list_fixtures_1.ok)((0, list_fixtures_1.listIn)(state)), calls: spy.calls };
+                    }
+                    finally {
+                        spy.restore();
+                    }
+                }
+                catch (error) {
+                    state.cleanup();
+                    throw error;
+                }
+            }
+            return shared;
+        }
         test('the for-each-ref call asks for at most 500 tags', () => {
-            adopt();
-            repo.commit({ 'a.ts': '1' }, 'fix: a', '2026-10-16T10:00:00Z');
-            lightTags(repo.git('rev-parse', 'HEAD'), NAMES);
-            const spy = (0, helpers_1.spyOnGit)();
-            listed();
-            spy.restore();
-            const lookups = spy.calls.filter((a) => a.includes('for-each-ref') && a.includes('refs/tags/')); // the tag lookup, not the base's
+            const lookups = sharedTags().calls.filter((a) => a.includes('for-each-ref') && a.includes('refs/tags/')); // the tag lookup, not the base's
             expect(lookups).toHaveLength(1);
             expect(lookups[0]).toContain('--count=500');
         });
         test('600 lightweight tags on the commit: the earliest by date then name is the release', () => {
-            adopt();
-            repo.commit({ 'a.ts': '1' }, 'fix: a', '2026-10-16T10:00:00Z');
-            lightTags(repo.git('rev-parse', 'HEAD'), NAMES);
-            expect(listed().changes[0].release).toBe('t0000');
+            expect(sharedTags().result.changes[0].release).toBe('t0000');
         });
         test('the earliest annotated tag among the first 500 still wins over 600 lightweight tags', () => {
             adopt();
@@ -711,8 +743,7 @@ describe('listChanges: shallow clones and the default base (R5.1)', () => {
     }
     test('a shallow clone fails with shallow-history and the remedy', () => {
         adopt();
-        repo.commit({ 'a.ts': '1' }, 'fix: a', '2026-10-16T10:00:00Z');
-        repo.commit({ 'b.ts': '1' }, 'fix: b', '2026-10-16T11:00:00Z');
+        commitMany([[{ 'a.ts': '1' }, 'fix: a', '2026-10-16T10:00:00Z'], [{ 'b.ts': '1' }, 'fix: b', '2026-10-16T11:00:00Z']]);
         const dest = clone(1);
         expect(repo.git('-C', dest, 'rev-parse', '--is-shallow-repository')).toBe('true');
         expect((0, list_1.listChanges)(dest, { since: list_fixtures_1.SINCE_48H })).toMatchObject({ ok: false, failure: { code: 'shallow-history', remedy: 'git fetch --unshallow' } });
@@ -751,46 +782,66 @@ describe('listChanges: shallow clones and the default base (R5.1)', () => {
     });
 });
 describe('listChanges: hostile text from git is escaped and clipped', () => {
+    // The subjects of the next six tests are commits of ONE history after the adoption point, listed once (each entry is found by its
+    // own commit date); that state is never changed. The commits are made as each test made its own: repo.commit, or git commit -m.
+    const SUBJECTS = {
+        hostile: 'feat: \u001b[31mred\u001b[0m \u202eevil\u202c \u2028 \u0085 \u007f end (#5)',
+        long: `feat: ${'x'.repeat(5000)}`,
+        atCap: `feat: ${'x'.repeat(list_1.MAX_SUBJECT - 6)}`,
+        surrogates: `feat: ${'x'.repeat(list_1.MAX_SUBJECT - 7)}\u{1F600}\u{1F600}`,
+    };
+    const ORDER = ['hostile', 'long', 'atCap', 'surrogates', 'controls', 'empty'];
+    const dateOf = (key) => new Date(Date.UTC(2026, 9, 16, 10, 0, 0) + ORDER.indexOf(key) * 60_000).toISOString();
+    let shared;
+    afterAll(() => shared?.state.cleanup());
+    function entry(key) {
+        if (shared === undefined) {
+            const state = (0, helpers_1.cloneRepo)(adopted);
+            try {
+                for (const k of ['hostile', 'long', 'atCap', 'surrogates'])
+                    state.commit({ [`${k}.ts`]: '1' }, SUBJECTS[k], dateOf(k));
+                state.gitAt(dateOf('controls'), 'commit', '--allow-empty', '-q', '--allow-empty-message', '-m', '\u001b\u001b');
+                state.gitAt(dateOf('empty'), 'commit', '--allow-empty', '-q', '--allow-empty-message', '-m', '');
+                shared = { state, result: (0, list_fixtures_1.ok)((0, list_fixtures_1.listIn)(state)) };
+            }
+            catch (error) {
+                state.cleanup();
+                throw error;
+            }
+        }
+        expect(shared.result.changes).toHaveLength(ORDER.length);
+        const found = shared.result.changes.find((c) => c.merged_at === dateOf(key));
+        if (found === undefined)
+            throw new Error(`no entry for ${key}`);
+        return found;
+    }
     test('control characters, line separators and bidi marks in a subject are escaped', () => {
-        adopt();
-        repo.commit({ 'a.ts': '1' }, 'feat: \u001b[31mred\u001b[0m \u202eevil\u202c \u2028 \u0085 \u007f end (#5)', '2026-10-16T10:00:00Z');
-        const entry = listed().changes[0];
-        expect(entry.subject).not.toMatch(list_fixtures_1.UNSAFE);
-        expect(entry.subject).toContain('\\u001b[31mred');
-        expect(entry.subject).toContain('\\u202e');
-        expect(entry.pr).toBe(5);
+        const e = entry('hostile');
+        expect(e.subject).not.toMatch(list_fixtures_1.UNSAFE);
+        expect(e.subject).toContain('\\u001b[31mred');
+        expect(e.subject).toContain('\\u202e');
+        expect(e.pr).toBe(5);
     });
     test('a subject is clipped to the subject cap with an ellipsis', () => {
-        adopt();
-        repo.commit({ 'a.ts': '1' }, `feat: ${'x'.repeat(5000)}`, '2026-10-16T10:00:00Z');
-        const subject = listed().changes[0].subject;
+        const subject = entry('long').subject;
         expect(list_1.MAX_SUBJECT).toBe(1024);
         expect(subject.length).toBe(list_1.MAX_SUBJECT);
         expect(subject.endsWith('…')).toBe(true);
     });
     test('a subject exactly at the cap is not clipped', () => {
-        adopt();
-        const subject = `feat: ${'x'.repeat(list_1.MAX_SUBJECT - 6)}`;
-        repo.commit({ 'a.ts': '1' }, subject, '2026-10-16T10:00:00Z');
-        expect(listed().changes[0].subject).toBe(subject);
+        expect(entry('atCap').subject).toBe(SUBJECTS.atCap);
     });
     test('the cut never splits a surrogate pair', () => {
-        adopt();
-        repo.commit({ 'a.ts': '1' }, `feat: ${'x'.repeat(list_1.MAX_SUBJECT - 7)}\u{1F600}\u{1F600}`, '2026-10-16T10:00:00Z');
-        const subject = listed().changes[0].subject;
+        const subject = entry('surrogates').subject;
         expect(Buffer.from(subject, 'utf8').toString('utf8')).toBe(subject);
         expect(subject.length).toBeLessThanOrEqual(list_1.MAX_SUBJECT);
     });
     test('a subject made only of controls is still one clean line', () => {
-        adopt();
-        repo.gitAt('2026-10-16T10:00:00Z', 'commit', '--allow-empty', '-q', '--allow-empty-message', '-m', '\u001b\u001b');
-        const subject = listed().changes[0].subject;
+        const subject = entry('controls').subject;
         expect(subject).not.toMatch(list_fixtures_1.UNSAFE);
     });
     test('a commit with an empty message has an empty subject', () => {
-        adopt();
-        repo.gitAt('2026-10-16T10:00:00Z', 'commit', '--allow-empty', '-q', '--allow-empty-message', '-m', '');
-        expect(listed().changes[0].subject).toBe('');
+        expect(entry('empty').subject).toBe('');
     });
     test('bidi marks inside a valid record are escaped in what list returns', () => {
         adopt();
@@ -815,8 +866,7 @@ describe('listChanges: hostile text from git is escaped and clipped', () => {
         expect(r.changes[0].sha).toMatch(/^[0-9a-f]{40}$/);
     });
     test('GIT_LITERAL_PATHSPECS and GIT_GLOB_PATHSPECS in the environment do not change the answer', () => {
-        history();
-        const plain = (0, list_fixtures_1.byClass)(listed());
-        expect((0, helpers_1.withEnv)({ GIT_LITERAL_PATHSPECS: '1', GIT_GLOB_PATHSPECS: '1' }, () => (0, list_fixtures_1.byClass)(listed()))).toEqual(plain);
+        const plain = (0, list_fixtures_1.byClass)(listedHistory().result);
+        expect((0, helpers_1.withEnv)({ GIT_LITERAL_PATHSPECS: '1', GIT_GLOB_PATHSPECS: '1' }, () => (0, list_fixtures_1.byClass)((0, list_fixtures_1.ok)((0, list_fixtures_1.listIn)(historic))))).toEqual(plain);
     });
 });

package/dist/tests/core/changes/receipt.test.js

@@ -75,15 +75,18 @@ let home;
 // Child git processes get an explicit identity and config isolation; the shared makeRepo already points HOME and AWM_HOME at a throwaway home.
 const gitEnv = () => ({ ...process.env, HOME: home, GIT_CONFIG_GLOBAL: path_1.default.join(home, 'gitconfig'), GIT_AUTHOR_NAME: 't', GIT_AUTHOR_EMAIL: 't@t', GIT_COMMITTER_NAME: 't', GIT_COMMITTER_EMAIL: 't@t', GIT_CONFIG_NOSYSTEM: '1' });
 const g = (...args) => repo.git(...args);
-beforeEach(() => {
-    repo = (0, helpers_1.makeRepo)();
-    root = repo.root;
-    home = repo.home;
+// One template repository for the whole file (it also holds HOME and AWM_HOME on a throwaway home); every test gets a copy (no git).
+let template;
+beforeAll(() => {
+    template = (0, helpers_1.makeRepo)();
     // makeRepo's own .gitignore ignores `.awm/`; these tests need a repository that does NOT (R2.2b), so the first commit is replaced.
-    repo.commit({ '.gitignore': 'node_modules\n', 'a.txt': 'a' }, 'feat: a');
+    template.commit({ '.gitignore': 'node_modules\n', 'a.txt': 'a' }, 'feat: a');
 });
+const useRepo = (from) => { repo = (0, helpers_1.cloneRepo)(from); root = repo.root; home = repo.home; };
+beforeEach(() => useRepo(template));
 afterEach(() => repo.cleanup());
 afterAll(() => {
+    template.cleanup(); // restores HOME, AWM_HOME and the git config variables
     for (const k of ENV_KEYS)
         expect(process.env[k]).toBe(ORIGINAL[k]);
     expect(listRuns()).toEqual(RUNS_BEFORE);
@@ -776,9 +779,18 @@ describe('sensors run wiring (R2.2, R2.4)', () => {
         g('commit', '-q', '-m', `chore: manifest in ${path_1.default.basename(dir)}`);
     };
     const receiptNames = () => fs_1.default.readdirSync(receiptsDir()).sort();
+    // The template plus `commitManifest(root)`, built once: each test of this block starts from a copy of it.
+    let manifested;
+    afterAll(() => manifested?.cleanup());
     beforeEach(() => {
         process.exitCode = undefined;
-        commitManifest(root);
+        // The shared state is its own copy, never the test's `repo`: a failed copy below must not let afterEach remove it.
+        if (manifested === undefined) {
+            commitManifest(root);
+            manifested = (0, helpers_1.cloneRepo)(repo);
+        }
+        repo.cleanup();
+        useRepo(manifested);
         run_1.findManifestDir.mockReset().mockImplementation((start) => {
             const project = (0, project_1.resolveSensorProject)(start);
             return project.state === 'configured' ? project.projectRoot : null;

package/dist/tests/core/diagnostics/provider-checks.test.js

@@ -29,6 +29,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const commit_seeded_registry_1 = require("../../helpers/commit-seeded-registry");
 describe('gatherProviderChecks — realistic fully-healthy single-provider fixtures', () => {
     let tmpHome;
     let tmpWork;
@@ -86,6 +87,8 @@ describe('gatherProviderChecks — realistic fully-healthy single-provider fixtu
             name: 'dev-core', description: '', version: '1.0.0', scope: 'baseline', visibility: 'public',
             dependsOn: [], skills: ['development-process'], workflows: [], agents,
         }));
+        // Local commit so real `awm init` skips network sync under SG-7 (#238).
+        (0, commit_seeded_registry_1.commitSeededRegistry)(root);
         fs_1.default.mkdirSync(path_1.default.join(tmpHome, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpHome, '.awm/registries.json'), JSON.stringify([{ name: 'baseline', remote: 'https://example.invalid/baseline.git' }], null, 2));
     }

package/dist/tests/core/init/steps-registry-sync.test.js

@@ -6,10 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // stepCache vs. syncRegistries()'s RESULT-shaped failures.
 //
 // `syncRegistries()` never throws on a per-registry failure — it returns
-// `{ action: 'error', error }` for that registry and keeps going. stepCache
-// used to `await` it and report a blanket 'applied', so a registry that never
-// landed on disk degraded silently into some later step's failure with its own
-// cause already gone.
+// `{ action: 'error', error }` for that registry. SG-7: stepCache fails closed
+// on ANY sync error (usable on-disk cache is not enough for init).
 //
 // Isolated in its own file (not steps.test.ts) because these assertions reach
 // `listRegistries()`, which resolves AWM_HOME at module require time — the env
@@ -83,12 +81,12 @@ describe('stepCache — registry sync error results', () => {
         expect(r.error).toContain('baseline');
         expect(r.error).toContain('could not clone');
     });
-    it('stays applied but records the error when content is already on disk', async () => {
+    it('fails when sync errors even if content is already on disk (SG-7)', async () => {
         configureRegistries(['baseline'], ['baseline']);
         const r = await run([{ name: 'baseline', action: 'error', error: 'pull timed out' }]);
-        expect(r.action).toBe('applied');
-        expect(r.detail).toContain('baseline');
-        expect(r.detail).toContain('pull timed out');
+        expect(r.action).toBe('failed');
+        expect(r.error).toContain('baseline');
+        expect(r.error).toContain('pull timed out');
     });
     it('fails on a secondary registry that never landed, even when the base one synced', async () => {
         configureRegistries(['baseline', 'documentation'], ['baseline']);

package/dist/tests/core/registry-git.test.js

@@ -0,0 +1,153 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const registry_git_1 = require("../../src/core/registry-git");
+const registry_git_errors_1 = require("../../src/core/registry-git-errors");
+describe('registry-git factory (#238 S1)', () => {
+    it('buildRegistryGitEnv drops guarded GIT_* keys, keeps PATH, forces GIT_TERMINAL_PROMPT=0', () => {
+        const parent = {
+            PATH: '/usr/bin',
+            HOME: '/tmp/home',
+            GIT_ASKPASS: '/secret/askpass',
+            GIT_SSL_CAINFO: '/secret/ca.pem',
+            GIT_TERMINAL_PROMPT: '1',
+            EDITOR: 'vi',
+            VISUAL: 'vim',
+            PAGER: 'less',
+            OTHER: 'ok',
+        };
+        const env = (0, registry_git_1.buildRegistryGitEnv)(parent);
+        expect(env.PATH).toBe('/usr/bin');
+        expect(env.HOME).toBe('/tmp/home');
+        expect(env.OTHER).toBe('ok');
+        expect(env.GIT_ASKPASS).toBeUndefined();
+        expect(env.GIT_SSL_CAINFO).toBeUndefined();
+        expect(env.EDITOR).toBeUndefined();
+        expect(env.VISUAL).toBeUndefined();
+        expect(env.PAGER).toBeUndefined();
+        expect(env.GIT_TERMINAL_PROMPT).toBe('0');
+        expect((0, registry_git_1.listIgnoredGuardedGitEnvNames)(parent)).toEqual(['GIT_ASKPASS', 'GIT_SSL_CAINFO']);
+    });
+    it('createRegistryGit against a bad remote fails quickly without hanging', async () => {
+        const dest = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-registry-git-'));
+        const remote = 'https://127.0.0.1:1/awm-no-such-repo.git';
+        const started = Date.now();
+        await expect((0, registry_git_1.createRegistryGit)().clone(remote, path_1.default.join(dest, 'repo'))).rejects.toThrow(/terminal prompts disabled|Failed to connect|Could not resolve|timed out|Authentication|Connection refused|Unable to connect|Network is unreachable/i);
+        expect(Date.now() - started).toBeLessThan(15_000);
+        fs_1.default.rmSync(dest, { recursive: true, force: true });
+    }, 20_000);
+});
+describe('registry-git ignored-env notice (#238 S2 / SG-5)', () => {
+    afterEach(() => {
+        (0, registry_git_1.resetIgnoredGitEnvNoticeForTests)();
+    });
+    it('listIgnoredGuardedGitEnvNames returns GIT_SSL_CAINFO only (never the value)', () => {
+        const parent = {
+            PATH: '/usr/bin',
+            GIT_SSL_CAINFO: '/secret/ca.pem',
+            GIT_TERMINAL_PROMPT: '0',
+        };
+        expect((0, registry_git_1.listIgnoredGuardedGitEnvNames)(parent)).toEqual(['GIT_SSL_CAINFO']);
+        const notice = (0, registry_git_1.formatIgnoredGitEnvNotice)(['GIT_SSL_CAINFO']);
+        expect(notice).toContain('GIT_SSL_CAINFO');
+        expect(notice).not.toContain('/secret/ca.pem');
+        expect(notice).toMatch(/git config|http\.sslCAInfo|file-based|credential\.helper|core\.sshCommand/i);
+    });
+    it('warnIgnoredGitEnvOnce emits once per process and never prints values', () => {
+        const lines = [];
+        const parent = {
+            GIT_ASKPASS: '/secret/askpass',
+            GIT_SSL_CAINFO: '/secret/ca.pem',
+            GIT_TERMINAL_PROMPT: '1',
+        };
+        (0, registry_git_1.warnIgnoredGitEnvOnce)((m) => lines.push(m), parent);
+        (0, registry_git_1.warnIgnoredGitEnvOnce)((m) => lines.push(m), parent);
+        expect(lines).toHaveLength(1);
+        expect(lines[0]).toContain('GIT_ASKPASS');
+        expect(lines[0]).toContain('GIT_SSL_CAINFO');
+        expect(lines[0]).not.toContain('/secret/');
+        expect(lines[0]).not.toMatch(/GIT_TERMINAL_PROMPT/);
+    });
+    it('SG-5 lists only transport/auth names (not GIT_EDITOR) and includes SSH_ASKPASS (M2/B2)', () => {
+        const parent = {
+            GIT_EDITOR: 'vim',
+            GIT_PAGER: 'less',
+            GIT_ASKPASS: '/secret/askpass',
+            SSH_ASKPASS: '/secret/ssh-askpass',
+            GIT_TERMINAL_PROMPT: '0',
+        };
+        expect((0, registry_git_1.listIgnoredGuardedGitEnvNames)(parent)).toEqual(['GIT_ASKPASS', 'SSH_ASKPASS']);
+        expect((0, registry_git_1.listIgnoredGuardedGitEnvNames)(parent)).not.toContain('GIT_EDITOR');
+    });
+});
+describe('classifyRegistryGitError (#238 S2 / SG-6)', () => {
+    it('maps terminal prompts disabled → authentication with credential.helper remedy', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('fatal: could not read Username for \'https://example.com\': terminal prompts disabled'));
+        expect(c.class).toBe('authentication');
+        expect(c.fatalLine).toMatch(/terminal prompts disabled/i);
+        expect(c.remedy).toMatch(/credential\.helper/);
+    });
+    it('maps TLS / certificate wording → tls', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('fatal: unable to access \'https://x/\': SSL certificate problem: unable to get local issuer certificate'));
+        expect(c.class).toBe('tls');
+        expect(c.remedy).toMatch(/http\.sslCAInfo|http\.sslCAPath/);
+    });
+    it('maps Could not resolve host → network', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('fatal: unable to access \'https://no.such.host/\': Could not resolve host: no.such.host'));
+        expect(c.class).toBe('network');
+    });
+    it('maps timeout plugin message → timeout', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('block timeout reached (60000ms) — killing process'));
+        expect(c.class).toBe('timeout');
+        expect(c.remedy).toMatch(/60s/);
+    });
+    it('maps git/curl Connection timed out → network, not awm idle timeout (M1)', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error("fatal: unable to access 'https://github.com/x/y.git/': Failed to connect to github.com port 443 after 133030 ms: Connection timed out"));
+        expect(c.class).toBe('network');
+        expect(c.remedy).not.toMatch(/killed after 60s/);
+    });
+    it('maps ssh Could not resolve hostname → network, not ssh (M1)', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('ssh: Could not resolve hostname example.invalid: Name or service not known'));
+        expect(c.class).toBe('network');
+    });
+    it('maps SSH host key failures → ssh with core.sshCommand remedy', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('fatal: Host key verification failed.'));
+        expect(c.class).toBe('ssh');
+        expect(c.remedy).toMatch(/core\.sshCommand|~\/\.ssh\/config/);
+    });
+    it('maps repository not found → not-found', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('remote: Repository not found.\nfatal: repository \'https://github.com/x/y.git\' not found'));
+        expect(c.class).toBe('not-found');
+        expect(c.fatalLine).toMatch(/not found/i);
+    });
+    it('prefers not-found over broad SSH wording when remote says Repository not found', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('ERROR: Repository not found.\nfatal: Could not read from remote repository.'));
+        expect(c.class).toBe('not-found');
+        expect(c.class).not.toBe('ssh');
+    });
+    it('maps unknown transport wording → network (default)', () => {
+        const c = (0, registry_git_errors_1.classifyRegistryGitError)(new Error('something unexpected happened in git'));
+        expect(c.class).toBe('network');
+    });
+});
+describe('formatClassifiedRegistryFailure redacts URL credentials (#238 QA B1)', () => {
+    it('strips https userinfo from remote= and fatal lines', () => {
+        const token = 'ghp_SECRETTOKEN1234567890';
+        const remote = `https://${token}@github.com/org/private-reg.git`;
+        const msg = (0, registry_git_errors_1.formatClassifiedRegistryFailure)({
+            name: 'corp',
+            remote,
+            err: new Error(`fatal: repository '${remote}' not found`),
+        });
+        expect(msg).toContain('github.com/org/private-reg.git');
+        expect(msg).not.toContain(token);
+        expect(msg).not.toMatch(/ghp_/);
+        expect(msg).toMatch(/class=not-found/);
+        expect(msg).toMatch(/remedy:/);
+    });
+});

package/dist/tests/helpers/commit-seeded-registry.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commitSeededRegistry = commitSeededRegistry;
+// Local `.git` commit for hand-seeded registry content roots used by real
+// (unstubbed) `awm init` / `stepCache` paths.
+//
+// Under SG-7 (#238), any sync/clone error hard-fails init. Diagnostics treat
+// `registryCache.present` as "`.git` exists" (`context.ts`), so a content-only
+// fixture always triggers sync against the unreachable `example.invalid`
+// remote. Committing locally makes cache present and lets stepCache skip.
+const child_process_1 = require("child_process");
+function commitSeededRegistry(root) {
+    (0, child_process_1.execFileSync)('git', ['init', '-q'], { cwd: root, stdio: 'ignore' });
+    (0, child_process_1.execFileSync)('git', ['config', 'user.email', 'fixture@example.invalid'], { cwd: root, stdio: 'ignore' });
+    (0, child_process_1.execFileSync)('git', ['config', 'user.name', 'fixture'], { cwd: root, stdio: 'ignore' });
+    (0, child_process_1.execFileSync)('git', ['add', '-A'], { cwd: root, stdio: 'ignore' });
+    (0, child_process_1.execFileSync)('git', ['commit', '-qm', 'fixture'], { cwd: root, stdio: 'ignore' });
+}