agentic-workflow-manager 9.4.1 → 9.6.0

package/dist/tests/commands/sensors/compatibility/materialize.test.js

@@ -7,20 +7,37 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const materialize_1 = require("../../../../src/commands/sensors/compatibility/materialize");
+const pack_source_1 = require("../../../../src/commands/sensors/compatibility/pack-source");
+const safe_file_1 = require("../../../../src/commands/sensors/compatibility/safe-file");
+const native_bridge_1 = require("../../../../src/core/secure-fs/native-bridge");
 const evidence = { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-10', toolVersion: '10.0.0', runtimeVersion: '22.0.0', certifiedRange: '>=10 <11', evidence: [] };
 describe('materializeResolvedSensors', () => {
     let projectRoot;
     let packRoot;
+    let portableRegistryRoots;
     beforeEach(() => {
         projectRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-project-'));
         packRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-pack-'));
+        portableRegistryRoots = [];
         fs_1.default.writeFileSync(path_1.default.join(packRoot, 'eslint.config.awm.mjs'), 'export default [];');
         fs_1.default.writeFileSync(path_1.default.join(packRoot, 'tsconfig.awm.json'), '{}');
     });
     afterEach(() => {
+        (0, safe_file_1.setSecureFsForTests)(undefined);
         fs_1.default.rmSync(projectRoot, { recursive: true, force: true });
         fs_1.default.rmSync(packRoot, { recursive: true, force: true });
+        for (const registryRoot of portableRegistryRoots)
+            fs_1.default.rmSync(registryRoot, { recursive: true, force: true });
     });
+    function portableSource() {
+        const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-registry-'));
+        portableRegistryRoots.push(registryRoot);
+        const selectedPackRoot = path_1.default.join(registryRoot, 'sensor-packs', 'js-ts');
+        fs_1.default.mkdirSync(selectedPackRoot, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(selectedPackRoot, 'pack.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(selectedPackRoot, 'eslint.config.awm.mjs'), 'export default [];');
+        return (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'baseline', remote: '', contentRoot: registryRoot }] });
+    }
     it('copies only selected assets and writes a v2 manifest atomically', () => {
         const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
                 lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
@@ -30,6 +47,186 @@ describe('materializeResolvedSensors', () => {
         expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'), 'utf8'))).toMatchObject({ schemaVersion: 2, sensors: { lint: { variantId: 'eslint-10' } } });
         expect(fs_1.default.readdirSync(path_1.default.join(projectRoot, '.awm'))).not.toContain('sensors.json.tmp');
     });
+    it('invokes the secure-fs bridge while applying selected registry content', () => {
+        let leaseHeld = false;
+        const bridge = {
+            readRegularFile: jest.fn((...args) => native_bridge_1.secureFs.readRegularFile(...args)),
+            withProjectLease: jest.fn((_projectRoot, operation) => {
+                expect(leaseHeld).toBe(false);
+                leaseHeld = true;
+                try {
+                    return operation();
+                }
+                finally {
+                    leaseHeld = false;
+                }
+            }),
+            writeProjectTransaction: jest.fn((...args) => {
+                expect(leaseHeld).toBe(true);
+                return native_bridge_1.secureFs.writeProjectTransaction(...args);
+            }),
+        };
+        (0, safe_file_1.setSecureFsForTests)(bridge);
+        (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(bridge.readRegularFile).toHaveBeenCalledWith(path_1.default.join(packRoot, 'eslint.config.awm.mjs'), 1024 * 1024);
+        expect(bridge.withProjectLease).toHaveBeenCalledTimes(1);
+        expect(bridge.withProjectLease).toHaveBeenCalledWith(projectRoot, expect.any(Function));
+        expect(bridge.writeProjectTransaction).toHaveBeenCalledWith(projectRoot, 'eslint.config.awm.mjs', expect.any(Buffer), { mode: 'create', createParents: true });
+        (0, safe_file_1.setSecureFsForTests)(undefined);
+        expect(bridge.writeProjectTransaction).toHaveBeenCalledWith(projectRoot, '.awm/sensors.json', expect.any(Buffer), { mode: 'create', createParents: true });
+    });
+    it('carries the exact native read identity through the existing manifest replacement path', () => {
+        const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
+        fs_1.default.mkdirSync(path_1.default.dirname(manifestPath));
+        fs_1.default.writeFileSync(manifestPath, JSON.stringify({ schemaVersion: 2, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { ...evidence, variantId: 'eslint-9' } },
+            } }));
+        const bridge = {
+            readRegularFile: jest.fn((...args) => native_bridge_1.secureFs.readRegularFile(...args)),
+            withProjectLease: jest.fn((_projectRoot, operation) => operation()),
+            writeProjectTransaction: jest.fn((...args) => native_bridge_1.secureFs.writeProjectTransaction(...args)),
+        };
+        (0, safe_file_1.setSecureFsForTests)(bridge);
+        (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', configure: false, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: evidence },
+            } });
+        let readCall = -1;
+        bridge.readRegularFile.mock.calls.forEach(([file], index) => {
+            if (file === manifestPath)
+                readCall = index;
+        });
+        const replaceCall = bridge.writeProjectTransaction.mock.calls.find(([, destination, , options]) => destination === '.awm/sensors.json' && options.mode === 'replace');
+        expect(readCall).toBeGreaterThanOrEqual(0);
+        expect(replaceCall).toBeDefined();
+        expect(replaceCall[3]).toMatchObject({ mode: 'replace', expected: expect.any(Buffer), expectedIdentity: expect.any(Object), createParents: false });
+        expect(replaceCall[3].expectedIdentity).toBe(bridge.readRegularFile.mock.results[readCall].value.identity);
+    });
+    it('writes a validated portable v3 manifest using the exact logical registry', () => {
+        const source = portableSource();
+        const result = (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(result.manifest).toMatchObject({ schemaVersion: 3, mode: 'project-sensors', source: { registry: 'baseline' } });
+        const text = fs_1.default.readFileSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'), 'utf8');
+        expect(text.endsWith('\n')).toBe(true);
+        expect(text).not.toContain(path_1.default.dirname(source.path));
+        expect(JSON.parse(text)).toMatchObject({ source: { registry: 'baseline' } });
+    });
+    it('returns a bounded lease conflict before writing an asset or manifest, then succeeds after release', () => {
+        const leasedSecureFs = native_bridge_1.secureFs;
+        const input = { projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } };
+        leasedSecureFs.withProjectLease(projectRoot, () => {
+            expect(() => (0, materialize_1.materializeResolvedSensors)(input)).toThrow(/project lease conflict/i);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+        });
+        expect((0, materialize_1.materializeResolvedSensors)(input).configured).toEqual(['eslint.config.awm.mjs']);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(true);
+    });
+    it('materializes a canonical pack source from a configured root with a symlinked ancestor', () => {
+        const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-registry-'));
+        const linkedRegistryRoot = path_1.default.join(path_1.default.dirname(registryRoot), `${path_1.default.basename(registryRoot)}-linked`);
+        const contentRoot = path_1.default.join(registryRoot, 'content');
+        const linkedContentRoot = path_1.default.join(linkedRegistryRoot, 'content');
+        portableRegistryRoots.push(registryRoot);
+        try {
+            const selectedPackRoot = path_1.default.join(contentRoot, 'sensor-packs', 'js-ts');
+            fs_1.default.mkdirSync(selectedPackRoot, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(selectedPackRoot, 'pack.json'), '{}');
+            fs_1.default.writeFileSync(path_1.default.join(selectedPackRoot, 'eslint.config.awm.mjs'), 'export default [];');
+            fs_1.default.symlinkSync(registryRoot, linkedRegistryRoot);
+            const source = (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'baseline', remote: '', contentRoot: linkedContentRoot }] });
+            const result = (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } });
+            expect(result.configured).toEqual(['eslint.config.awm.mjs']);
+            expect(fs_1.default.readFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'), 'utf8')).toBe('export default [];');
+        }
+        finally {
+            fs_1.default.rmSync(linkedRegistryRoot, { force: true });
+        }
+    });
+    it('rejects a portable source whose selected pack path belongs to another registry', () => {
+        const source = portableSource();
+        const otherRegistry = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-other-registry-'));
+        try {
+            expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source: { ...source, registry: { ...source.registry, contentRoot: otherRegistry } }, sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow(/source|registry|pack/i);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(otherRegistry, { recursive: true, force: true });
+        }
+    });
+    it('rejects a pack whose authoritative bytes changed after planning', () => {
+        const source = portableSource();
+        fs_1.default.writeFileSync(source.path, '{"changed":true}');
+        expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow('changed after bootstrap planning');
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+    });
+    it('fails lease acquisition before creating an asset when .awm cannot hold the lease', () => {
+        const source = portableSource();
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, '.awm'), 'not a directory');
+        const unlink = jest.spyOn(fs_1.default, 'unlinkSync');
+        try {
+            expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow();
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+            expect(fs_1.default.readFileSync(path_1.default.join(projectRoot, '.awm'), 'utf8')).toBe('not a directory');
+            expect(unlink).not.toHaveBeenCalled();
+        }
+        finally {
+            unlink.mockRestore();
+        }
+    });
+    it('validates portable v3 input before writing assets', () => {
+        const source = portableSource();
+        expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source: { ...source, registry: { ...source.registry, name: 'Baseline' } }, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow('registry');
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+    });
+    it('validates every selected portable asset before publishing the first one', () => {
+        const source = portableSource();
+        expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs', 'missing.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow(/missing/i);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+    });
+    it('compensates only assets it created when manifest publication fails', () => {
+        const source = portableSource();
+        (0, safe_file_1.setSecureFsForTests)({
+            withProjectLease: native_bridge_1.secureFs.withProjectLease,
+            readRegularFile: native_bridge_1.secureFs.readRegularFile,
+            writeProjectTransaction: ((root, destination, content, options) => {
+                if (destination === '.awm/sensors.json')
+                    throw new Error('injected manifest publication failure');
+                native_bridge_1.secureFs.writeProjectTransaction(root, destination, content, options);
+            }),
+            removeObservedProjectFile: native_bridge_1.secureFs.removeObservedProjectFile,
+        });
+        expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow('injected manifest publication failure');
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json.tmp'))).toBe(false);
+    });
+    it('contains no pathname-based deletion in production materialization', () => {
+        const source = fs_1.default.readFileSync(path_1.default.resolve(__dirname, '../../../../src/commands/sensors/compatibility/materialize.ts'), 'utf8');
+        expect(source).not.toMatch(/\b(?:unlink|rm)Sync\s*\(/);
+    });
     it('preserves a destination that already exists', () => {
         fs_1.default.writeFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'), 'owner content');
         const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
@@ -38,6 +235,202 @@ describe('materializeResolvedSensors', () => {
         expect(result.preserved).toEqual(['eslint.config.awm.mjs']);
         expect(fs_1.default.readFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'), 'utf8')).toBe('owner content');
     });
+    it('throws a non-conflict asset I/O failure and never publishes a manifest reference', () => {
+        const writeProjectTransaction = jest.fn((_root, destination) => {
+            if (destination === 'eslint.config.awm.mjs') {
+                throw new Error('secure-fs target exists or transaction failed');
+            }
+        });
+        (0, safe_file_1.setSecureFsForTests)({
+            withProjectLease: ((_root, operation) => operation()),
+            readRegularFile: jest.fn((...args) => native_bridge_1.secureFs.readRegularFile(...args)),
+            writeProjectTransaction: writeProjectTransaction,
+        });
+        expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow('secure-fs target exists or transaction failed');
+        expect(writeProjectTransaction).toHaveBeenCalledTimes(1);
+        expect(writeProjectTransaction).toHaveBeenCalledWith(projectRoot, 'eslint.config.awm.mjs', expect.any(Buffer), { mode: 'create', createParents: true });
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+    });
+    it('rejects a symlinked project destination component before writing an asset', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(packRoot, 'configs'));
+            fs_1.default.writeFileSync(path_1.default.join(packRoot, 'configs', 'eslint.config.awm.mjs'), 'registry content');
+            fs_1.default.symlinkSync(outside, path_1.default.join(projectRoot, 'configs'));
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['configs/eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow(/symlink|destination/i);
+            expect(fs_1.default.existsSync(path_1.default.join(outside, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('does not stage an asset through a destination ancestor swapped to a symlink', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        const directory = path_1.default.join(projectRoot, 'configs');
+        const originalWrite = fs_1.default.writeFileSync.bind(fs_1.default);
+        const write = jest.spyOn(fs_1.default, 'writeFileSync');
+        let swapped = false;
+        let stagedThroughSwappedAncestor = false;
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(packRoot, 'configs'));
+            fs_1.default.writeFileSync(path_1.default.join(packRoot, 'configs', 'eslint.config.awm.mjs'), 'registry content');
+            write.mockImplementation(((file, data, options) => {
+                if (!swapped && typeof file === 'string' && path_1.default.basename(file).startsWith('.eslint.config.awm.mjs.')) {
+                    swapped = true;
+                    fs_1.default.renameSync(directory, `${directory}.original`);
+                    fs_1.default.symlinkSync(outside, directory);
+                    stagedThroughSwappedAncestor = path_1.default.dirname(file) === directory;
+                }
+                return originalWrite(file, data, options);
+            }));
+            const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['configs/eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } });
+            expect(result.configured).toEqual(['configs/eslint.config.awm.mjs']);
+            expect(stagedThroughSwappedAncestor).toBe(false);
+            expect(fs_1.default.readdirSync(outside)).toEqual([]);
+        }
+        finally {
+            write.mockRestore();
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('rejects a symlinked .awm ancestor before publishing a portable v3 manifest', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        try {
+            fs_1.default.symlinkSync(outside, path_1.default.join(projectRoot, '.awm'));
+            expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source: portableSource(), sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow(/symlink|destination|safe/i);
+            expect(fs_1.default.readdirSync(outside)).toEqual([]);
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('does not overwrite a v3 manifest concurrently published after staging', () => {
+        const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
+        fs_1.default.mkdirSync(path_1.default.dirname(manifestPath));
+        fs_1.default.writeFileSync(manifestPath, 'concurrent manifest');
+        expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source: portableSource(), sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow(/manifest|exist|concurrent|publish|destination/i);
+        expect(fs_1.default.readFileSync(manifestPath, 'utf8')).toBe('concurrent manifest');
+    });
+    it('rejects a symlinked packageRoot before writing an asset', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        try {
+            fs_1.default.symlinkSync(outside, path_1.default.join(projectRoot, 'package'));
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', packageRoot: 'package', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow(/symlink|destination/i);
+            expect(fs_1.default.existsSync(path_1.default.join(outside, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('does not overwrite an asset concurrently published after destination observation', () => {
+        const destination = path_1.default.join(projectRoot, 'eslint.config.awm.mjs');
+        fs_1.default.writeFileSync(destination, 'owner content');
+        const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(result.configured).toEqual([]);
+        expect(result.preserved).toEqual(['eslint.config.awm.mjs']);
+        expect(fs_1.default.readFileSync(destination, 'utf8')).toBe('owner content');
+    });
+    test.each(['C:/sensor-assets/eslint.config.awm.mjs', 'C:sensor-assets/eslint.config.awm.mjs'])('rejects Windows-rooted or drive-qualified asset paths: %s', asset => {
+        expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: [asset], initializedCompatibility: evidence },
+            } })).toThrow(/contained relative asset path/i);
+    });
+    it('rejects a selected asset beneath a symlinked registry directory before copying it', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(packRoot, 'configs'));
+            fs_1.default.writeFileSync(path_1.default.join(outside, 'eslint.config.awm.mjs'), 'outside content');
+            fs_1.default.symlinkSync(outside, path_1.default.join(packRoot, 'configs', 'linked'));
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['configs/linked/eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow('symlink');
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'configs', 'linked', 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it.skip('rejects an asset replaced after inspection and before its safe open', () => {
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let swapped = false;
+        try {
+            open.mockImplementation(((file, flags, mode) => {
+                if (!swapped && file === path_1.default.join(packRoot, 'eslint.config.awm.mjs')) {
+                    swapped = true;
+                    fs_1.default.renameSync(file, path_1.default.join(packRoot, 'eslint.config.awm.original.mjs'));
+                    fs_1.default.writeFileSync(file, 'replacement content');
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow(/changed|identity|safe/i);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            open.mockRestore();
+        }
+    });
+    it('re-establishes parent containment immediately before safely opening an asset', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        const originalLstat = fs_1.default.lstatSync.bind(fs_1.default);
+        const lstat = jest.spyOn(fs_1.default, 'lstatSync');
+        const directory = path_1.default.join(packRoot, 'configs');
+        let inspections = 0;
+        try {
+            fs_1.default.mkdirSync(directory);
+            fs_1.default.writeFileSync(path_1.default.join(directory, 'eslint.config.awm.mjs'), 'registry content');
+            fs_1.default.writeFileSync(path_1.default.join(outside, 'eslint.config.awm.mjs'), 'outside content');
+            lstat.mockImplementation(((candidate, options) => {
+                if (candidate === directory && ++inspections === 2) {
+                    fs_1.default.renameSync(directory, `${directory}.original`);
+                    fs_1.default.symlinkSync(outside, directory);
+                }
+                return originalLstat(candidate, options);
+            }));
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['configs/eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow('symlink');
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'configs', 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            lstat.mockRestore();
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('rejects a pack root reached through a symlinked ancestor before copying registry content', () => {
+        const registry = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-registry-'));
+        const linkedRegistry = path_1.default.join(path_1.default.dirname(registry), `${path_1.default.basename(registry)}-linked`);
+        const linkedPackRoot = path_1.default.join(linkedRegistry, 'sensor-packs', 'js-ts');
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(registry, 'sensor-packs', 'js-ts'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(registry, 'sensor-packs', 'js-ts', 'eslint.config.awm.mjs'), 'outside content');
+            fs_1.default.symlinkSync(registry, linkedRegistry);
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot: linkedPackRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow('symlink');
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(linkedRegistry, { force: true });
+            fs_1.default.rmSync(registry, { recursive: true, force: true });
+        }
+    });
     it('revalidates a shared Semgrep policy reference without materializing the policy itself', () => {
         const sensorPacks = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-policy-'));
         const semgrepPack = path_1.default.join(sensorPacks, 'python');
@@ -69,4 +462,21 @@ describe('materializeResolvedSensors', () => {
         expect(result.orphaned).toEqual(['eslint.config.awm.cjs']);
         expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.cjs'))).toBe(true);
     });
+    it('does not touch a stale JavaScript-era manifest temporary file', () => {
+        const now = jest.spyOn(Date, 'now').mockReturnValue(12345);
+        const awm = path_1.default.join(projectRoot, '.awm');
+        const temporary = path_1.default.join(awm, `.sensors.json.${process.pid}.12345.tmp`);
+        try {
+            fs_1.default.mkdirSync(awm);
+            fs_1.default.writeFileSync(temporary, 'not ours');
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).not.toThrow();
+            expect(fs_1.default.readFileSync(temporary, 'utf8')).toBe('not ours');
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(true);
+        }
+        finally {
+            now.mockRestore();
+        }
+    });
 });