agentic-workflow-manager 9.4.1 → 9.5.0

package/dist/tests/commands/sensors/compatibility/pack-source.test.js

@@ -7,6 +7,36 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const pack_source_1 = require("../../../../src/commands/sensors/compatibility/pack-source");
+function resolveWithoutNoFollow(...args) {
+    let resolve;
+    jest.isolateModules(() => {
+        jest.doMock('fs', () => {
+            const actual = jest.requireActual('fs');
+            const constants = { ...actual.constants, O_NOFOLLOW: undefined };
+            return { __esModule: true, default: { ...actual, constants }, ...actual, constants };
+        });
+        resolve = require('../../../../src/commands/sensors/compatibility/pack-source').resolvePackSource;
+    });
+    jest.dontMock('fs');
+    if (!resolve)
+        throw new Error('portable pack source resolver could not be loaded');
+    return resolve(...args);
+}
+function resolveWithoutNoFollowWithExactStats(...args) {
+    let resolve;
+    jest.isolateModules(() => {
+        jest.doMock('fs', () => {
+            const actual = jest.requireActual('fs');
+            const constants = { ...actual.constants, O_NOFOLLOW: undefined };
+            return { __esModule: true, default: { ...actual, constants }, ...actual, constants };
+        });
+        resolve = require('../../../../src/commands/sensors/compatibility/pack-source').resolvePackSource;
+    });
+    jest.dontMock('fs');
+    if (!resolve)
+        throw new Error('portable exact-stat pack source resolver could not be loaded');
+    return resolve(...args);
+}
 describe('resolvePackSource', () => {
     it('uses the first registry containing the exact contained pack file', () => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-'));
@@ -52,4 +82,190 @@ describe('resolvePackSource', () => {
             fs_1.default.rmSync(root, { recursive: true, force: true });
         }
     });
+    it('rejects a symlinked registry content root', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-root-link-'));
+        const target = path_1.default.join(root, 'target');
+        const linked = path_1.default.join(root, 'linked');
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(target, 'sensor-packs', 'js-ts'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(target, 'sensor-packs', 'js-ts', 'pack.json'), '{}');
+            fs_1.default.symlinkSync(target, linked, 'dir');
+            expect(() => (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'linked', remote: '', contentRoot: linked }] }))
+                .toThrow(/symbolic|symlink/i);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('opens the resolved pack with no-follow semantics before reading it', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-nofollow-'));
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        try {
+            const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');
+            fs_1.default.mkdirSync(path_1.default.dirname(packFile), { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{}');
+            (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] });
+            const flags = open.mock.calls[0]?.[1];
+            expect(typeof flags).toBe('number');
+            if (typeof fs_1.default.constants.O_NOFOLLOW === 'number') {
+                expect(flags & fs_1.default.constants.O_NOFOLLOW).toBe(fs_1.default.constants.O_NOFOLLOW);
+            }
+            else {
+                expect(flags).toBe(fs_1.default.constants.O_RDONLY);
+            }
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('resolves an inspected regular pack when no-follow is unavailable', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-portable-open-'));
+        try {
+            const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');
+            fs_1.default.mkdirSync(path_1.default.dirname(packFile), { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"portable"}');
+            expect(resolveWithoutNoFollow('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }).content)
+                .toBe('{"from":"portable"}');
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('uses exact bigint file identities for the portable safe-open fallback', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-bigint-'));
+        const lstat = jest.spyOn(fs_1.default, 'lstatSync');
+        const fstat = jest.spyOn(fs_1.default, 'fstatSync');
+        try {
+            const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');
+            fs_1.default.mkdirSync(path_1.default.dirname(packFile), { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"bigint"}');
+            expect(resolveWithoutNoFollowWithExactStats('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }).content)
+                .toBe('{"from":"bigint"}');
+            expect(lstat).toHaveBeenCalledWith(expect.any(String), { bigint: true });
+            expect(fstat).toHaveBeenCalledWith(expect.any(Number), { bigint: true });
+        }
+        finally {
+            lstat.mockRestore();
+            fstat.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects a parent-directory swap between inspection and no-follow open', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-parent-swap-'));
+        const packDir = path_1.default.join(root, 'sensor-packs', 'js-ts');
+        const movedPackDir = path_1.default.join(root, 'sensor-packs', 'js-ts-original');
+        const packFile = path_1.default.join(packDir, 'pack.json');
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let swapped = false;
+        try {
+            fs_1.default.mkdirSync(packDir, { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"original"}');
+            open.mockImplementation(((file, flags, mode) => {
+                if (!swapped && file === fs_1.default.realpathSync(packFile)) {
+                    swapped = true;
+                    fs_1.default.renameSync(packDir, movedPackDir);
+                    fs_1.default.mkdirSync(packDir, { recursive: true });
+                    fs_1.default.writeFileSync(packFile, '{"from":"replacement"}');
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect(() => (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }))
+                .toThrow(/changed|identity|regular|safe/i);
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('accepts a parent symlink replacement when it resolves to the inspected pack inode', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-same-inode-'));
+        const packDir = path_1.default.join(root, 'sensor-packs', 'js-ts');
+        const movedPackDir = path_1.default.join(root, 'sensor-packs', 'js-ts-original');
+        const packFile = path_1.default.join(packDir, 'pack.json');
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let swapped = false;
+        try {
+            fs_1.default.mkdirSync(packDir, { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"original"}');
+            open.mockImplementation(((file, flags, mode) => {
+                if (!swapped && file === fs_1.default.realpathSync(packFile)) {
+                    swapped = true;
+                    fs_1.default.renameSync(packDir, movedPackDir);
+                    fs_1.default.symlinkSync(movedPackDir, packDir, 'dir');
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect((0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }).content)
+                .toBe('{"from":"original"}');
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects same-inode content growth between inspection and open', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-size-race-'));
+        const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let changed = false;
+        try {
+            fs_1.default.mkdirSync(path_1.default.dirname(packFile), { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"original"}');
+            open.mockImplementation(((file, flags, mode) => {
+                if (!changed && file === fs_1.default.realpathSync(packFile)) {
+                    changed = true;
+                    fs_1.default.appendFileSync(packFile, 'x');
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect(() => resolveWithoutNoFollow('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }))
+                .toThrow(/changed|size|identity/i);
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects same-inode truncation after safe open before reading', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-truncate-race-'));
+        const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');
+        const originalRead = fs_1.default.readSync.bind(fs_1.default);
+        const read = jest.spyOn(fs_1.default, 'readSync');
+        let truncated = false;
+        try {
+            fs_1.default.mkdirSync(path_1.default.dirname(packFile), { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"original"}');
+            read.mockImplementation(((descriptor, buffer, offset, length, position) => {
+                if (!truncated) {
+                    truncated = true;
+                    fs_1.default.truncateSync(packFile, 0);
+                }
+                return originalRead(descriptor, buffer, offset, length, position);
+            }));
+            expect(() => resolveWithoutNoFollow('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }))
+                .toThrow(/changed|size|identity/i);
+        }
+        finally {
+            read.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('bounds diagnostics when a long content root cannot be inspected', () => {
+        const contentRoot = path_1.default.join(os_1.default.tmpdir(), `awm-${'x'.repeat(200_000)}`);
+        let message = '';
+        try {
+            (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'safe', remote: 'https://user:secret@example.invalid/registry', contentRoot }] });
+        }
+        catch (error) {
+            message = error instanceof Error ? error.message : String(error);
+        }
+        expect(message.length).toBeLessThan(4096);
+        expect(message).not.toContain(contentRoot);
+        expect(message).not.toContain('secret');
+        expect(message).toMatch(/inspect|source|registry/i);
+    });
 });

package/dist/tests/commands/sensors/compatibility/source.test.js

@@ -0,0 +1,121 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const manifest_1 = require("../../../../src/commands/sensors/compatibility/manifest");
+const source_1 = require("../../../../src/commands/sensors/compatibility/source");
+function manifest(registryRoot) {
+    return (0, manifest_1.parseSensorManifest)({
+        schemaVersion: 2, pack: 'js-ts', ...(registryRoot ? { registryRoot } : {}), sensors: {
+            lint: {
+                enabled: false, variantId: 'eslint-9',
+                command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                initializedCompatibility: { state: 'certified', reason: 'fixture', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] },
+            },
+        },
+    }, 'manifest');
+}
+function pack() {
+    return {
+        schemaVersion: 2, name: 'js-ts', description: 'fixture', detects: ['package.json'], sensors: {
+            lint: { applicability: { allFiles: ['package.json'] }, variants: [{
+                        id: 'eslint-9', priority: 1,
+                        requirements: { tool: 'eslint', toolRange: '>=9 <10', runtime: 'node', runtimeRange: '>=20' },
+                        certifiedRange: '>=9 <10', assets: [], formatter: 'generic', probe: { kind: 'eslint-print-config' },
+                        command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                    }] },
+        },
+        coverage: { schemaVersion: 1, classes: { linting: { description: 'fixture', detectors: [{ sensor: 'lint' }], remedy: { summary: 'fixture', command: 'npm test' } } } },
+    };
+}
+function writePack(root) {
+    const directory = path_1.default.join(root, 'sensor-packs', 'js-ts');
+    fs_1.default.mkdirSync(directory, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(directory, 'pack.json'), JSON.stringify(pack()));
+}
+describe('resolveSensorSource', () => {
+    const roots = [];
+    afterEach(() => { for (const root of roots.splice(0))
+        fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    it('preserves an existing v2 provenance path without registry-order rebinding', () => {
+        const bound = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-bound-'));
+        roots.push(bound);
+        const other = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-other-'));
+        roots.push(other);
+        writePack(bound);
+        writePack(other);
+        expect((0, source_1.resolveSensorSource)(manifest(bound), { registries: [{ name: 'other', remote: 'local', contentRoot: other }] }))
+            .toMatchObject({ kind: 'legacy-bound', source: { registry: { name: 'manifest-provenance' } } });
+    });
+    it('rebinds an absent v2 provenance only when exactly one registry matches every sensor identity', () => {
+        const absent = path_1.default.join(os_1.default.tmpdir(), 'does-not-exist-awma');
+        const registry = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-rebound-'));
+        roots.push(registry);
+        writePack(registry);
+        expect((0, source_1.resolveSensorSource)(manifest(absent), { registries: [{ name: 'baseline', remote: 'local', contentRoot: registry }] }))
+            .toMatchObject({ kind: 'legacy-rebound', source: { registry: { name: 'baseline' } } });
+    });
+    it('fails closed for zero or multiple structural candidates without exposing paths or remotes', () => {
+        const absent = path_1.default.join(os_1.default.tmpdir(), 'does-not-exist-awmb');
+        expect((0, source_1.resolveSensorSource)(manifest(absent), { registries: [] })).toMatchObject({ kind: 'source-unavailable', reason: 'no-compatible-registry' });
+        const first = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-first-'));
+        roots.push(first);
+        const second = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-second-'));
+        roots.push(second);
+        writePack(first);
+        writePack(second);
+        const result = (0, source_1.resolveSensorSource)(manifest(absent), { registries: [
+                { name: 'first', remote: 'https://user:secret@example.invalid/first', contentRoot: first },
+                { name: 'second', remote: 'https://user:secret@example.invalid/second', contentRoot: second },
+            ] });
+        expect(result).toMatchObject({ kind: 'source-ambiguous', candidates: ['first', 'second'] });
+        expect(JSON.stringify(result)).not.toContain('secret');
+    });
+    it('rejects a malformed v3 logical registry identity instead of classifying it as unavailable', () => {
+        expect(() => (0, source_1.resolveSensorSource)({
+            kind: 'v3', pack: { mode: 'project-sensors', pack: 'js-ts', source: { registry: '../escape' } },
+        }, { registries: [] })).toThrow(/registry.*stable|invalid.*registry/i);
+    });
+    it('bounds ambiguity diagnostics for extremely long valid registry names', () => {
+        const first = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-long-first-'));
+        roots.push(first);
+        const second = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-long-second-'));
+        roots.push(second);
+        writePack(first);
+        writePack(second);
+        const result = (0, source_1.resolveSensorSource)(manifest(path_1.default.join(os_1.default.tmpdir(), 'awm-source-long-missing')), { registries: [
+                { name: `a${'x'.repeat(200_000)}`, remote: 'https://user:secret@example.invalid/first', contentRoot: first },
+                { name: `b${'x'.repeat(200_000)}`, remote: 'https://user:secret@example.invalid/second', contentRoot: second },
+            ] });
+        expect(result.kind).toBe('source-ambiguous');
+        if (result.kind === 'source-ambiguous') {
+            expect(result.candidates.every(candidate => candidate.length <= 128)).toBe(true);
+        }
+        expect(JSON.stringify(result).length).toBeLessThan(4096);
+        expect(JSON.stringify(result)).not.toContain('secret');
+    });
+    it('bounds malformed-pack diagnostics for an extremely long valid registry name', () => {
+        const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-malformed-long-'));
+        roots.push(registryRoot);
+        writePack(registryRoot);
+        fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'sensor-packs', 'js-ts', 'pack.json'), '{"schemaVersion":');
+        const name = `a${'x'.repeat(200_000)}`;
+        let message = '';
+        try {
+            (0, source_1.resolveSensorSource)(manifest(path_1.default.join(os_1.default.tmpdir(), 'awm-source-malformed-long-missing')), {
+                registries: [{ name, remote: 'https://user:secret@example.invalid/registry', contentRoot: registryRoot }],
+            });
+        }
+        catch (error) {
+            message = error instanceof Error ? error.message : String(error);
+        }
+        expect(message).toMatch(/invalid sensor pack/);
+        expect(message.length).toBeLessThan(4096);
+        expect(message).not.toContain(name);
+        expect(message).not.toContain('secret');
+    });
+});

package/dist/tests/commands/sensors/coverage/resolve.test.js

@@ -7,6 +7,21 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const tmp_1 = require("../../../support/tmp");
 const resolve_1 = require("../../../../src/commands/sensors/coverage/resolve");
+function resolveCoverageWithoutNoFollow(cwd) {
+    let resolve;
+    jest.isolateModules(() => {
+        jest.doMock('fs', () => {
+            const actual = jest.requireActual('fs');
+            const constants = { ...actual.constants, O_NOFOLLOW: undefined };
+            return { __esModule: true, default: { ...actual, constants }, ...actual, constants };
+        });
+        resolve = require('../../../../src/commands/sensors/coverage/resolve').resolveCoverageInputs;
+    });
+    jest.dontMock('fs');
+    if (!resolve)
+        throw new Error('portable coverage resolver could not be loaded');
+    return resolve(cwd);
+}
 let root;
 let awmHome;
 let project;
@@ -29,9 +44,6 @@ const writeManifest = (body) => fs_1.default.writeFileSync(path_1.default.join(p
 const coverage = { schemaVersion: 1, classes: {
         formatting: { description: 'Formatting', detectors: [{ sensor: 'format' }], remedy: { summary: 'Add formatter', command: 'npm i -D prettier' } },
     } };
-const noFollowUnavailableOnNativeWindows = process.platform === 'win32'
-    && typeof fs_1.default.constants.O_NOFOLLOW !== 'number';
-const safetyError = /platform cannot guarantee no symlink dereference/;
 const writePack = (registry, pack, body) => {
     const dir = path_1.default.join(awmHome, 'registries', registry, 'sensor-packs', pack);
     fs_1.default.mkdirSync(dir, { recursive: true });
@@ -60,62 +72,42 @@ test('selects the first configured registry containing the exact pack', () => {
     configure(['first', 'second']);
     writePack('first', 'generic', { name: 'generic', sensors: {} });
     writePack('second', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
-    }
-    else {
-        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', pack: 'js-ts', registry: 'second' });
-    }
+    expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', pack: 'js-ts', registry: 'second' });
 });
 test('registry ordering chooses the earlier exact pack when both registries contain it', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['first', 'second']);
     writePack('first', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
     writePack('second', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
-    }
-    else {
-        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', registry: 'first' });
-    }
+    expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', registry: 'first' });
 });
 test('old pack without coverage is no_reference, not covered', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', { name: 'js-ts', sensors: {} });
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
-    }
-    else {
-        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'no_reference', pack: 'js-ts', registry: 'baseline' });
-    }
+    expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'no_reference', pack: 'js-ts', registry: 'baseline' });
 });
-test('native Windows without no-follow support fails closed before resolving normal coverage inputs', () => {
+test('normal regular coverage inputs resolve regardless of no-follow availability', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
-    }
-    else {
-        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready' });
-    }
+    expect(resolveCoverageWithoutNoFollow(project)).toMatchObject({ kind: 'ready' });
 });
 test.each([
     ['manifest-malformed', '{broken', /Invalid JSON.*sensors\.json/],
     ['manifest-oversize', Buffer.alloc(1024 * 1024 + 1), /sensors\.json.*exceeds 1 MiB/],
 ])('rejects %s', (_name, body, expected) => {
     writeManifest(body);
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows && _name !== 'manifest-oversize' ? safetyError : expected);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(expected);
 });
 test.each([
     ['pack-malformed', '{broken', /Invalid JSON.*pack\.json/],
-    ['pack-oversize', Buffer.alloc(1024 * 1024 + 1), /pack.*pack\.json.*exceeds the 1 MiB limit/],
+    ['pack-oversize', Buffer.alloc(1024 * 1024 + 1), /pack source exceeds the 1 MiB limit/],
 ])('rejects %s', (_name, body, expected) => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', body);
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : expected);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(expected);
 });
 test('rejects a symlinked manifest without dereferencing it', () => {
     const manifest = path_1.default.join(project, '.awm', 'sensors.json');
@@ -133,12 +125,12 @@ test('rejects a JSON object that is not a valid pack', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', { coverage });
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : /Invalid sensor pack.*name/);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(/Invalid sensor pack.*name/);
 });
 test('rejects registry names that are not safe path components', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['']);
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : /malformed entry name|Invalid registry name/);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(/malformed entry name|Invalid registry name/);
 });
 test.each([
     [{ schemaVersion: 3, name: 'js-ts', sensors: {}, coverage: {} }, /supported: legacy, 2/],
@@ -147,5 +139,5 @@ test.each([
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', pack);
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : expected);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(expected);
 });

package/dist/tests/commands/sensors/project.test.js

@@ -0,0 +1,102 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const projectModule = '../../../src/commands/sensors/project';
+function tempDir() {
+    return fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-sensor-project-'));
+}
+function writeJson(file, value) {
+    fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+    fs_1.default.writeFileSync(file, JSON.stringify(value));
+}
+function v3Manifest(packageRoot) {
+    return {
+        schemaVersion: 3,
+        mode: 'project-sensors',
+        pack: 'js-ts',
+        source: { registry: 'baseline' },
+        ...(packageRoot ? { packageRoot } : {}),
+        sensors: {},
+    };
+}
+describe('sensor project authority', () => {
+    const roots = [];
+    afterEach(() => { for (const root of roots.splice(0))
+        fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    function resolve(startCwd) {
+        return require(projectModule).resolveSensorProject(startCwd);
+    }
+    it('selects the nearest regular manifest without crossing the Git boundary', () => {
+        const root = tempDir();
+        roots.push(root);
+        fs_1.default.mkdirSync(path_1.default.join(root, '.git'));
+        writeJson(path_1.default.join(root, '.awm/sensors.json'), v3Manifest());
+        writeJson(path_1.default.join(root, 'packages/app/.awm/sensors.json'), v3Manifest());
+        fs_1.default.mkdirSync(path_1.default.join(root, 'packages/app/src'), { recursive: true });
+        const result = resolve(path_1.default.join(root, 'packages/app/src'));
+        expect(result).toMatchObject({ state: 'configured', projectRoot: path_1.default.join(root, 'packages/app'), manifestPath: path_1.default.join(root, 'packages/app/.awm/sensors.json') });
+    });
+    it('treats a .git file as a worktree boundary and rejects an escaping packageRoot', () => {
+        const root = tempDir();
+        roots.push(root);
+        fs_1.default.writeFileSync(path_1.default.join(root, '.git'), 'gitdir: /elsewhere');
+        writeJson(path_1.default.join(root, '.awm/sensors.json'), v3Manifest('../outside'));
+        fs_1.default.mkdirSync(path_1.default.join(root, 'cli/src'), { recursive: true });
+        expect(resolve(path_1.default.join(root, 'cli/src'))).toMatchObject({ state: 'invalid', projectRoot: root });
+    });
+    it('inspects only the exact CWD outside Git and returns missing for absent or malformed manifests', () => {
+        const parent = tempDir();
+        roots.push(parent);
+        writeJson(path_1.default.join(parent, '.awm/sensors.json'), v3Manifest());
+        const cwd = path_1.default.join(parent, 'child');
+        fs_1.default.mkdirSync(cwd);
+        expect(resolve(cwd)).toMatchObject({ state: 'missing', projectRoot: cwd });
+        fs_1.default.mkdirSync(path_1.default.join(cwd, '.awm'));
+        fs_1.default.writeFileSync(path_1.default.join(cwd, '.awm/sensors.json'), '{bad json');
+        expect(resolve(cwd)).toMatchObject({ state: 'invalid', projectRoot: cwd });
+    });
+    it('rejects a symlinked manifest and a packageRoot that is not a directory', () => {
+        const root = tempDir();
+        roots.push(root);
+        fs_1.default.mkdirSync(path_1.default.join(root, '.git'));
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm'), { recursive: true });
+        writeJson(path_1.default.join(root, 'elsewhere.json'), v3Manifest());
+        fs_1.default.symlinkSync(path_1.default.join(root, 'elsewhere.json'), path_1.default.join(root, '.awm/sensors.json'));
+        expect(resolve(root)).toMatchObject({ state: 'invalid', reason: expect.stringMatching(/regular file/) });
+        fs_1.default.unlinkSync(path_1.default.join(root, '.awm/sensors.json'));
+        fs_1.default.symlinkSync(path_1.default.join(root, 'missing.json'), path_1.default.join(root, '.awm/sensors.json'));
+        expect(resolve(root)).toMatchObject({ state: 'invalid', reason: expect.stringMatching(/regular file/) });
+        fs_1.default.unlinkSync(path_1.default.join(root, '.awm/sensors.json'));
+        writeJson(path_1.default.join(root, '.awm/sensors.json'), v3Manifest('not-a-directory'));
+        fs_1.default.writeFileSync(path_1.default.join(root, 'not-a-directory'), 'file');
+        expect(resolve(root)).toMatchObject({ state: 'invalid', reason: expect.stringMatching(/existing directory/) });
+        writeJson(path_1.default.join(root, '.awm/sensors.json'), v3Manifest('missing-directory'));
+        expect(resolve(root)).toMatchObject({ state: 'invalid', reason: expect.stringMatching(/existing directory/) });
+    });
+    it('rejects invalid UTF-8 and packageRoot symlinks escaping the manifest directory', () => {
+        const root = tempDir();
+        roots.push(root);
+        fs_1.default.mkdirSync(path_1.default.join(root, '.git'));
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm'));
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm/sensors.json'), Buffer.from([0xff, 0xfe]));
+        expect(resolve(root)).toMatchObject({ state: 'invalid', reason: expect.stringMatching(/UTF-8/) });
+        writeJson(path_1.default.join(root, '.awm/sensors.json'), v3Manifest('linked-package'));
+        const outside = tempDir();
+        roots.push(outside);
+        fs_1.default.symlinkSync(outside, path_1.default.join(root, 'linked-package'));
+        expect(resolve(root)).toMatchObject({ state: 'invalid', reason: expect.stringMatching(/escapes/) });
+    });
+    it('never selects a parent manifest above the Git boundary', () => {
+        const parent = tempDir();
+        roots.push(parent);
+        writeJson(path_1.default.join(parent, '.awm/sensors.json'), v3Manifest());
+        const root = path_1.default.join(parent, 'repository');
+        fs_1.default.mkdirSync(path_1.default.join(root, '.git'), { recursive: true });
+        expect(resolve(root)).toMatchObject({ state: 'missing', projectRoot: root });
+    });
+});