agentic-workflow-manager 9.3.0 → 9.4.0

package/dist/tests/commands/preflight/preflight.test.js

@@ -10,6 +10,7 @@ const child_process_1 = require("child_process");
 const checks_1 = require("../../../src/commands/preflight/checks");
 const preflight_1 = require("../../../src/commands/preflight");
 const run_1 = require("../../../src/commands/sensors/run");
+const check_1 = require("../../../src/core/currentness/check");
 // Only `execSync` (used by `resolveOnPath` to check for `gh`/`glab`) is mocked — `git
 // remote get-url origin` runs for real via `execFileSync` against real tmpdir git repos,
 // same as every other check in this file exercises the real filesystem.
@@ -21,8 +22,12 @@ jest.mock('../../../src/commands/sensors/run', () => ({
     ...jest.requireActual('../../../src/commands/sensors/run'),
     runSensors: jest.fn(),
 }));
+jest.mock('../../../src/core/currentness/check', () => ({
+    checkCurrentness: jest.fn(),
+}));
 const mockExecSync = child_process_1.execSync;
 const mockRunSensors = run_1.runSensors;
+const mockCheckCurrentness = check_1.checkCurrentness;
 /** Turn a tmpdir into a real git repo with (optionally) an `origin` remote. */
 function gitRepo(dir, remoteUrl) {
     (0, child_process_1.execFileSync)('git', ['init'], { cwd: dir, stdio: 'pipe' });
@@ -99,7 +104,22 @@ function writePartialKernel(dir) {
 }
 const check = (r, id) => r.checks.find(c => c.id === id);
 describe('preflight', () => {
-    afterEach(() => mockRunSensors.mockReset());
+    beforeEach(() => {
+        mockCheckCurrentness.mockResolvedValue({
+            checkedAt: '2026-08-26T00:00:00.000Z',
+            compatibility: { status: 'not-checked' },
+            components: [{
+                    component: 'cli', installed: '9.3.0', latest: '9.3.0', channel: 'stable',
+                    source: 'https://registry.npmjs.org/agentic-workflow-manager',
+                    checkedAt: '2026-08-26T00:00:00.000Z', status: 'current',
+                    detail: 'Installed version matches npm dist-tags.latest.', remedy: 'No action required.',
+                }],
+        });
+    });
+    afterEach(() => {
+        mockRunSensors.mockReset();
+        mockCheckCurrentness.mockReset();
+    });
     it('does not add a row when no registry declares the schema', async () => {
         installRegistry({ minCliVersion: '9.2.1' });
         const report = await (0, checks_1.preflight)(make({
@@ -205,10 +225,81 @@ describe('preflight', () => {
         });
         await (0, checks_1.preflight)(dir);
         expect(mockRunSensors).not.toHaveBeenCalled();
+        expect(mockCheckCurrentness).not.toHaveBeenCalled();
+    });
+    it('adds authoritative currentness only when strict mode is explicitly requested', async () => {
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        const report = await (0, checks_1.preflight)(dir, { requireCurrent: true });
+        expect(mockCheckCurrentness).toHaveBeenCalledWith(dir);
+        expect(report).toMatchObject({
+            status: 'ready',
+            currentness: expect.objectContaining({
+                components: [expect.objectContaining({ component: 'cli', status: 'current' })],
+            }),
+        });
+        expect(report.checks).toContainEqual(expect.objectContaining({ id: 'currentness', ok: true }));
+        expect((0, preflight_1.formatReport)(report)).toContain('Currentness: current');
+        expect(JSON.parse(JSON.stringify(report))).toHaveProperty('currentness.components');
+    });
+    it('returns a complete strict report instead of throwing for a malformed local registry inventory', async () => {
+        fs_1.default.writeFileSync(path_1.default.join(process.env.AWM_HOME, 'registries.json'), '{not-json');
+        mockCheckCurrentness.mockResolvedValue({
+            checkedAt: '2026-08-26T00:00:00.000Z', compatibility: { status: 'not-checked' },
+            components: [{
+                    component: 'registry:inventory', installed: null, latest: null, channel: 'stable',
+                    source: '[configured registry inventory]', checkedAt: '2026-08-26T00:00:00.000Z', status: 'unverifiable',
+                    detail: 'Authoritative currentness could not be verified.',
+                    remedy: 'Repair the local registry inventory and rerun strict preflight.',
+                }],
+        });
+        const report = await (0, checks_1.preflight)(make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } }), { requireCurrent: true });
+        expect(report.status).toBe('degraded');
+        expect(report.currentness?.components).toEqual(expect.arrayContaining([
+            expect.objectContaining({ component: 'registry:inventory', status: 'unverifiable', remedy: expect.stringMatching(/Repair the local registry inventory/) }),
+        ]));
+        expect(JSON.parse(JSON.stringify(report))).toHaveProperty('currentness.components');
+    });
+    it.each(['stale', 'pinned-behind', 'unverifiable'])('fails strict preflight for a %s component with its exact remedy', async (status) => {
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        mockCheckCurrentness.mockResolvedValue({
+            checkedAt: '2026-08-26T00:00:00.000Z', compatibility: { status: 'not-checked' },
+            components: [{
+                    component: 'registry:baseline', installed: 'v1.0.0', latest: 'v1.1.0', channel: 'stable',
+                    source: 'https://example.test/baseline.git', checkedAt: '2026-08-26T00:00:00.000Z', status,
+                    detail: 'Authoritative currentness failed.',
+                    remedy: status === 'pinned-behind' ? 'awm unpin baseline && awm update --yes' : 'awm update --yes',
+                }],
+        });
+        const report = await (0, checks_1.preflight)(dir, { requireCurrent: true });
+        expect(report.status).toBe('degraded');
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+        expect(report.checks).toContainEqual(expect.objectContaining({ id: 'currentness', ok: false }));
+        expect((0, preflight_1.formatReport)(report)).toContain(status === 'pinned-behind' ? 'awm unpin baseline && awm update --yes' : 'awm update --yes');
+    });
+    it('keeps compatibility failure distinct when authoritative currentness is current', async () => {
+        installRegistry({ minCliVersion: '999.0.0' }, 'requires-new-cli');
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        const report = await (0, checks_1.preflight)(dir, { requireCurrent: true });
+        expect(report.status).toBe('degraded');
+        expect(report.checks).toEqual(expect.arrayContaining([
+            expect.objectContaining({ id: 'compatibility', ok: false, detail: expect.stringContaining('requires-new-cli requires CLI >= 999.0.0') }),
+            expect.objectContaining({ id: 'currentness', ok: true }),
+        ]));
+    });
+    it('retains both empirical sensor and currentness verdicts when both gates are requested', async () => {
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        mockRunSensors.mockResolvedValue({ overall: 'pass', sensors: [] });
+        const report = await (0, checks_1.preflight)(dir, { verifySensors: true, requireCurrent: true });
+        expect(mockRunSensors).toHaveBeenCalledWith({ cwd: dir, all: true });
+        expect(mockCheckCurrentness).toHaveBeenCalledWith(dir);
+        expect(report.checks).toEqual(expect.arrayContaining([
+            expect.objectContaining({ id: 'sensors-execution', ok: true }),
+            expect.objectContaining({ id: 'currentness', ok: true }),
+        ]));
     });
     it('rejects an array passed as public preflight options before filesystem work', async () => {
         await expect((0, checks_1.preflight)(process.cwd(), []))
-            .rejects.toThrow('preflight options must contain an optional boolean verifySensors');
+            .rejects.toThrow('preflight options must contain optional boolean verifySensors and requireCurrent');
     });
     it('requires an empirical sensor pass when verification is requested', async () => {
         const dir = make({

package/dist/tests/core/currentness/check.test.js

@@ -0,0 +1,293 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+describe('checkCurrentness', () => {
+    let root;
+    beforeEach(() => {
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-currentness-'));
+        jest.resetModules();
+    });
+    afterEach(() => {
+        jest.useRealTimers();
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
+    function deps(overrides = {}) {
+        return {
+            cliVersion: () => '1.2.3',
+            now: () => 1_700_000_000_000,
+            fetch: jest.fn().mockResolvedValue({
+                ok: true,
+                text: async () => JSON.stringify({ 'dist-tags': { latest: '1.2.3' } }),
+            }),
+            readPreferences: () => ({ pins: {} }),
+            listRegistries: () => [{ name: 'baseline', remote: 'https://example.test/team/repo.git', contentRoot: '/registry' }],
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+                if (args[0] === 'remote')
+                    return 'https://example.test/team/repo.git\n';
+                if (args[0] === 'rev-parse')
+                    return `${'a'.repeat(40)}\n`;
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                throw new Error(`unexpected git invocation: ${args.join(' ')}`);
+            }),
+            ...overrides,
+        };
+    }
+    it('reports authoritative current CLI and registry without exposing URL credentials', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps());
+        expect(result.components).toEqual([
+            expect.objectContaining({ component: 'cli', installed: '1.2.3', latest: '1.2.3', status: 'current', channel: 'stable' }),
+            expect.objectContaining({ component: 'registry:baseline', installed: 'v1.2.3', latest: 'v1.2.3', status: 'current', channel: 'stable' }),
+        ]);
+        expect(JSON.stringify(result)).not.toContain('secret');
+        expect(result.components[1].source).toBe('https://example.test/team/repo.git');
+    });
+    it('marks an older pinned registry as pinned-behind with the unpin remedy', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            readPreferences: () => ({ pins: { baseline: '1.0.0' } }),
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'ls-remote')
+                    return `${'b'.repeat(40)}\trefs/tags/v1.1.0\n${'a'.repeat(40)}\trefs/tags/v1.0.0\n`;
+                if (args[0] === 'remote')
+                    return 'https://example.test/team/repo.git\n';
+                if (args[0] === 'rev-parse')
+                    return `${'a'.repeat(40)}\n`;
+                if (args[0] === 'describe')
+                    return 'v1.0.0\n';
+                throw new Error('unexpected');
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            status: 'pinned-behind',
+            pin: '1.0.0',
+            remedy: 'awm unpin baseline && awm update --yes',
+        }));
+    });
+    it('marks an npm latest version above the max-safe numeric boundary as stale', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            cliVersion: () => '1.9007199254740992.0',
+            fetch: jest.fn().mockResolvedValue({
+                ok: true,
+                text: async () => JSON.stringify({ 'dist-tags': { latest: '1.9007199254740993.0' } }),
+            }),
+        }));
+        expect(result.components[0]).toEqual(expect.objectContaining({
+            installed: '1.9007199254740992.0',
+            latest: '1.9007199254740993.0',
+            status: 'stale',
+        }));
+    });
+    it('marks a registry tag above the max-safe numeric boundary as stale', async () => {
+        const installed = 'v1.9007199254740992.0';
+        const latest = 'v1.9007199254740993.0';
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'ls-remote')
+                    return `${'b'.repeat(40)}\trefs/tags/${latest}\n${'a'.repeat(40)}\trefs/tags/${installed}\n`;
+                if (args[0] === 'remote')
+                    return 'https://example.test/team/repo.git\n';
+                if (args[0] === 'rev-parse')
+                    return `${'a'.repeat(40)}\n`;
+                if (args[0] === 'describe')
+                    return `${installed}\n`;
+                throw new Error('unexpected');
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({ installed, latest, status: 'stale' }));
+    });
+    it('discovers an unprefixed stable SemVer tag while ignoring prereleases', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/1.2.4\n${'b'.repeat(40)}\trefs/tags/1.2.5-rc.1\n`;
+                if (args[0] === 'remote')
+                    return 'https://example.test/team/repo.git\n';
+                if (args[0] === 'rev-parse')
+                    return `${'a'.repeat(40)}\n`;
+                if (args[0] === 'describe')
+                    return '1.2.4\n';
+                throw new Error('unexpected');
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            installed: '1.2.4', latest: '1.2.4', status: 'current',
+        }));
+    });
+    it('marks a lower installed version stale even when it shares the latest tag SHA', async () => {
+        const sharedSha = 'a'.repeat(40);
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'ls-remote')
+                    return `${sharedSha}\trefs/tags/v1.2.4\n`;
+                if (args[0] === 'remote')
+                    return 'https://example.test/team/repo.git\n';
+                if (args[0] === 'rev-parse')
+                    return `${sharedSha}\n`;
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                throw new Error('unexpected');
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            installed: 'v1.2.3', latest: 'v1.2.4', status: 'stale', remedy: 'awm update --yes',
+        }));
+    });
+    it.each([
+        ['branch provenance', async (_cwd, args) => args[0] === 'describe' ? Promise.reject(new Error('not a tag')) : args[0] === 'ls-remote' ? `${'a'.repeat(40)}\trefs/tags/v1.2.3\n` : args[0] === 'remote' ? 'https://example.test/team/repo.git\n' : `${'a'.repeat(40)}\n`],
+        ['malformed npm semver', undefined],
+    ])('fails closed for %s', async (name, git) => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps(name === 'malformed npm semver'
+            ? { fetch: jest.fn().mockResolvedValue({ ok: true, text: async () => JSON.stringify({ 'dist-tags': { latest: 'latest' } }) }) }
+            : { git }));
+        expect(result.components.some((c) => c.status === 'unverifiable')).toBe(true);
+    });
+    it('bypasses passive update controls and makes no writes', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const before = fs_1.default.readdirSync(root);
+        const fetch = jest.fn().mockResolvedValue({ ok: false, text: async () => '' });
+        const result = await checkCurrentness(root, deps({ fetch, env: { AWM_NO_UPDATE_CHECK: '1' } }));
+        expect(fetch).toHaveBeenCalledTimes(1);
+        expect(result.components[0]).toEqual(expect.objectContaining({ status: 'unverifiable' }));
+        expect(fs_1.default.readdirSync(root)).toEqual(before);
+    });
+    it('returns a complete strict report when the local registry inventory is malformed', async () => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            listRegistries: () => { throw new Error('Invalid registries config at /private/registries.json'); },
+        }));
+        expect(result.components).toEqual(expect.arrayContaining([
+            expect.objectContaining({ component: 'cli', status: 'current' }),
+            expect.objectContaining({
+                component: 'registry:inventory', status: 'unverifiable',
+                source: '[configured registry inventory]',
+                remedy: 'Repair the local registry inventory and rerun strict preflight.',
+            }),
+        ]));
+        expect(JSON.stringify(result)).not.toContain('/private/registries.json');
+    });
+    it('settles deterministically when an injected fetch ignores abort and later rejects', async () => {
+        jest.useFakeTimers();
+        let rejectFetch;
+        const fetch = jest.fn(() => new Promise((_resolve, reject) => { rejectFetch = reject; }));
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const pending = checkCurrentness(root, deps({ fetch }));
+        await jest.advanceTimersByTimeAsync(2_000);
+        await expect(pending).resolves.toEqual(expect.objectContaining({
+            components: expect.arrayContaining([expect.objectContaining({ component: 'cli', status: 'unverifiable' })]),
+        }));
+        rejectFetch(new Error('late fetch failure'));
+        await Promise.resolve();
+    });
+    it('settles deterministically when an injected Git transport ignores its timeout and later rejects', async () => {
+        jest.useFakeTimers();
+        let rejectGit;
+        const git = jest.fn().mockImplementation(async (_cwd, args) => {
+            if (args[0] === 'ls-remote')
+                return new Promise((_resolve, reject) => { rejectGit = reject; });
+            if (args[0] === 'remote')
+                return 'https://example.test/team/repo.git\n';
+            if (args[0] === 'rev-parse')
+                return `${'a'.repeat(40)}\n`;
+            if (args[0] === 'describe')
+                return 'v1.2.3\n';
+            throw new Error('unexpected');
+        });
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const pending = checkCurrentness(root, deps({ git }));
+        await jest.advanceTimersByTimeAsync(2_000);
+        await expect(pending).resolves.toEqual(expect.objectContaining({
+            components: expect.arrayContaining([expect.objectContaining({ component: 'registry:baseline', status: 'unverifiable' })]),
+        }));
+        rejectGit(new Error('late Git failure'));
+        await Promise.resolve();
+    });
+    it('rejects oversized npm metadata before attempting JSON parsing', async () => {
+        const parse = jest.fn(() => ({ 'dist-tags': { latest: '1.2.3' } }));
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            fetch: jest.fn().mockResolvedValue({
+                ok: true,
+                text: async () => 'x'.repeat(64 * 1024 + 1),
+                json: parse,
+            }),
+        }));
+        expect(result.components[0]).toEqual(expect.objectContaining({ status: 'unverifiable' }));
+        expect(parse).not.toHaveBeenCalled();
+    });
+    it.each([
+        'http://example.test/team/repo.git',
+        'ftp://example.test/team/repo.git',
+        'https://username:password@example.test/team/repo.git',
+        'ssh://git:secret@example.test/team/repo.git',
+        'git@example.test:team/repo.git?token=secret',
+    ])('rejects non-authoritative transport %s before Git invocation', async (remote) => {
+        const git = jest.fn();
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            listRegistries: () => [{ name: 'baseline', remote, contentRoot: '/registry' }],
+            git,
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({
+            source: '[configured remote]',
+            status: 'unverifiable',
+        }));
+        expect(git).not.toHaveBeenCalled();
+    });
+    it.each([
+        ['ssh://username@example.test/team/repo.git', 'ssh://example.test/team/repo.git'],
+        ['username@github.example:team/repo.git', 'github.example:team/repo.git'],
+    ])('accepts auth-free SSH and SCP remotes while rendering a safe source for %s', async (remote, expectedSource) => {
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            listRegistries: () => [{ name: 'baseline', remote, contentRoot: '/registry' }],
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'ls-remote')
+                    return `${'a'.repeat(40)}\trefs/tags/v1.2.3\n`;
+                if (args[0] === 'remote')
+                    return `${remote}\n`;
+                if (args[0] === 'rev-parse')
+                    return `${'a'.repeat(40)}\n`;
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                throw new Error('unexpected');
+            }),
+        }));
+        expect(result.components[1].source).toBe(expectedSource);
+        expect(JSON.stringify(result)).not.toContain('username');
+        expect(JSON.stringify(result)).not.toContain('password');
+        expect(JSON.stringify(result)).not.toContain('secret');
+    });
+    it('treats the peeled commit of an annotated stable tag as authoritative', async () => {
+        const tagObject = 'b'.repeat(40);
+        const peeledCommit = 'a'.repeat(40);
+        const { checkCurrentness } = require('../../../src/core/currentness/check');
+        const result = await checkCurrentness(root, deps({
+            git: jest.fn().mockImplementation(async (_cwd, args) => {
+                if (args[0] === 'ls-remote')
+                    return `${tagObject}\trefs/tags/v1.2.3\n${peeledCommit}\trefs/tags/v1.2.3^{}\n`;
+                if (args[0] === 'remote')
+                    return 'https://example.test/team/repo.git\n';
+                if (args[0] === 'rev-parse')
+                    return `${peeledCommit}\n`;
+                if (args[0] === 'describe')
+                    return 'v1.2.3\n';
+                throw new Error('unexpected');
+            }),
+        }));
+        expect(result.components[1]).toEqual(expect.objectContaining({ status: 'current', latest: 'v1.2.3' }));
+    });
+});