agentic-workflow-manager 9.4.1 → 9.6.0

package/dist/tests/commands/sensors/compatibility/pack-source.test.js

@@ -7,7 +7,43 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const pack_source_1 = require("../../../../src/commands/sensors/compatibility/pack-source");
+const safe_file_1 = require("../../../../src/commands/sensors/compatibility/safe-file");
+const itLinux = process.platform === 'linux' ? it : it.skip;
+function resolveWithoutNoFollow(...args) {
+    let resolve;
+    jest.isolateModules(() => {
+        jest.doMock('fs', () => {
+            const actual = jest.requireActual('fs');
+            const constants = { ...actual.constants, O_NOFOLLOW: undefined };
+            return { __esModule: true, default: { ...actual, constants }, ...actual, constants };
+        });
+        require('../../../../src/commands/sensors/compatibility/safe-file').setPortableReadForTests(true);
+        resolve = require('../../../../src/commands/sensors/compatibility/pack-source').resolvePackSource;
+    });
+    jest.dontMock('fs');
+    if (!resolve)
+        throw new Error('portable pack source resolver could not be loaded');
+    return resolve(...args);
+}
+function resolveWithoutNoFollowWithExactStats(...args) {
+    let resolve;
+    jest.isolateModules(() => {
+        jest.doMock('fs', () => {
+            const actual = jest.requireActual('fs');
+            const constants = { ...actual.constants, O_NOFOLLOW: undefined };
+            return { __esModule: true, default: { ...actual, constants }, ...actual, constants };
+        });
+        require('../../../../src/commands/sensors/compatibility/safe-file').setPortableReadForTests(true);
+        resolve = require('../../../../src/commands/sensors/compatibility/pack-source').resolvePackSource;
+    });
+    jest.dontMock('fs');
+    if (!resolve)
+        throw new Error('portable exact-stat pack source resolver could not be loaded');
+    return resolve(...args);
+}
 describe('resolvePackSource', () => {
+    beforeEach(() => (0, safe_file_1.setPortableReadForTests)(true));
+    afterEach(() => (0, safe_file_1.setPortableReadForTests)(false));
     it('uses the first registry containing the exact contained pack file', () => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-'));
         try {
@@ -52,4 +88,217 @@ describe('resolvePackSource', () => {
             fs_1.default.rmSync(root, { recursive: true, force: true });
         }
     });
+    it('rejects a symlinked registry content root', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-root-link-'));
+        const target = path_1.default.join(root, 'target');
+        const linked = path_1.default.join(root, 'linked');
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(target, 'sensor-packs', 'js-ts'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(target, 'sensor-packs', 'js-ts', 'pack.json'), '{}');
+            fs_1.default.symlinkSync(target, linked, 'dir');
+            expect(() => (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'linked', remote: '', contentRoot: linked }] }))
+                .toThrow(/symbolic|symlink/i);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('opens the resolved pack with no-follow semantics before reading it', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-nofollow-'));
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        try {
+            const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');
+            fs_1.default.mkdirSync(path_1.default.dirname(packFile), { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{}');
+            (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] });
+            const flags = open.mock.calls[0]?.[1];
+            expect(typeof flags).toBe('number');
+            if (typeof fs_1.default.constants.O_NOFOLLOW === 'number') {
+                expect(flags & fs_1.default.constants.O_NOFOLLOW).toBe(fs_1.default.constants.O_NOFOLLOW);
+            }
+            else {
+                expect(flags).toBe(fs_1.default.constants.O_RDONLY);
+            }
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('resolves an inspected regular pack when no-follow is unavailable', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-portable-open-'));
+        try {
+            const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');
+            fs_1.default.mkdirSync(path_1.default.dirname(packFile), { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"portable"}');
+            expect(resolveWithoutNoFollow('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }).content)
+                .toBe('{"from":"portable"}');
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('uses exact bigint file identities for the portable safe-open fallback', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-bigint-'));
+        const lstat = jest.spyOn(fs_1.default, 'lstatSync');
+        const fstat = jest.spyOn(fs_1.default, 'fstatSync');
+        try {
+            const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');
+            fs_1.default.mkdirSync(path_1.default.dirname(packFile), { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"bigint"}');
+            expect(resolveWithoutNoFollowWithExactStats('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }).content)
+                .toBe('{"from":"bigint"}');
+            expect(lstat).toHaveBeenCalledWith(expect.any(String), { bigint: true });
+            expect(fstat).toHaveBeenCalledWith(expect.any(Number), { bigint: true });
+        }
+        finally {
+            lstat.mockRestore();
+            fstat.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects a parent-directory swap between inspection and no-follow open', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-parent-swap-'));
+        const packDir = path_1.default.join(root, 'sensor-packs', 'js-ts');
+        const movedPackDir = path_1.default.join(root, 'sensor-packs', 'js-ts-original');
+        const packFile = path_1.default.join(packDir, 'pack.json');
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let swapped = false;
+        try {
+            fs_1.default.mkdirSync(packDir, { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"original"}');
+            open.mockImplementation(((file, flags, mode) => {
+                if (!swapped && file === fs_1.default.realpathSync(packFile)) {
+                    swapped = true;
+                    fs_1.default.renameSync(packDir, movedPackDir);
+                    fs_1.default.mkdirSync(packDir, { recursive: true });
+                    fs_1.default.writeFileSync(packFile, '{"from":"replacement"}');
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect(() => (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }))
+                .toThrow(/changed|identity|regular|safe/i);
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    itLinux('accepts a parent symlink replacement when Linux descriptor binding preserves the inspected pack inode', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-same-inode-'));
+        const packDir = path_1.default.join(root, 'sensor-packs', 'js-ts');
+        const movedPackDir = path_1.default.join(root, 'sensor-packs', 'js-ts-original');
+        const packFile = path_1.default.join(packDir, 'pack.json');
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let swapped = false;
+        try {
+            fs_1.default.mkdirSync(packDir, { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"original"}');
+            open.mockImplementation(((file, flags, mode) => {
+                if (!swapped && file === fs_1.default.realpathSync(packFile)) {
+                    swapped = true;
+                    fs_1.default.renameSync(packDir, movedPackDir);
+                    fs_1.default.symlinkSync(movedPackDir, packDir, 'dir');
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect((0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }).content)
+                .toBe('{"from":"original"}');
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects an observable parent symlink replacement in the portable fallback', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-portable-parent-swap-'));
+        const packDir = path_1.default.join(root, 'sensor-packs', 'js-ts');
+        const movedPackDir = path_1.default.join(root, 'sensor-packs', 'js-ts-original');
+        const packFile = path_1.default.join(packDir, 'pack.json');
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let swapped = false;
+        try {
+            fs_1.default.mkdirSync(packDir, { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"original"}');
+            open.mockImplementation(((file, flags, mode) => {
+                if (!swapped && file === fs_1.default.realpathSync(packFile)) {
+                    swapped = true;
+                    fs_1.default.renameSync(packDir, movedPackDir);
+                    fs_1.default.symlinkSync(movedPackDir, packDir, 'dir');
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect(() => resolveWithoutNoFollow('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }))
+                .toThrow(/changed|identity|safe|symlink/i);
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects same-inode content growth between inspection and open', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-size-race-'));
+        const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let changed = false;
+        try {
+            fs_1.default.mkdirSync(path_1.default.dirname(packFile), { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"original"}');
+            open.mockImplementation(((file, flags, mode) => {
+                if (!changed && file === fs_1.default.realpathSync(packFile)) {
+                    changed = true;
+                    fs_1.default.appendFileSync(packFile, 'x');
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect(() => resolveWithoutNoFollow('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }))
+                .toThrow(/changed|size|identity/i);
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects same-inode truncation after safe open before reading', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-truncate-race-'));
+        const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');
+        const originalRead = fs_1.default.readSync.bind(fs_1.default);
+        const read = jest.spyOn(fs_1.default, 'readSync');
+        let truncated = false;
+        try {
+            fs_1.default.mkdirSync(path_1.default.dirname(packFile), { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"original"}');
+            read.mockImplementation(((descriptor, buffer, offset, length, position) => {
+                if (!truncated) {
+                    truncated = true;
+                    fs_1.default.truncateSync(packFile, 0);
+                }
+                return originalRead(descriptor, buffer, offset, length, position);
+            }));
+            expect(() => resolveWithoutNoFollow('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }))
+                .toThrow(/changed|size|identity/i);
+        }
+        finally {
+            read.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('bounds diagnostics when a long content root cannot be inspected', () => {
+        const contentRoot = path_1.default.join(os_1.default.tmpdir(), `awm-${'x'.repeat(200_000)}`);
+        let message = '';
+        try {
+            (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'safe', remote: 'https://user:secret@example.invalid/registry', contentRoot }] });
+        }
+        catch (error) {
+            message = error instanceof Error ? error.message : String(error);
+        }
+        expect(message.length).toBeLessThan(4096);
+        expect(message).not.toContain(contentRoot);
+        expect(message).not.toContain('secret');
+        expect(message).toMatch(/inspect|source|registry/i);
+    });
 });

package/dist/tests/commands/sensors/compatibility/safe-file.test.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const safe_file_1 = require("../../../../src/commands/sensors/compatibility/safe-file");
+function projectLeaseRunner() {
+    return require('../../../../src/commands/sensors/compatibility/safe-file').withProjectLease;
+}
+describe('safe-file native replacement observation', () => {
+    let root;
+    beforeEach(() => { root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-safe-file-')); });
+    afterEach(() => { fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    it('carries bytes and the identity from one exact native read into replacement', () => {
+        const target = path_1.default.join(root, 'sensors.json');
+        fs_1.default.writeFileSync(target, 'observed bytes');
+        const inspected = fs_1.default.lstatSync(target, { bigint: true });
+        const observed = (0, safe_file_1.readInspectedBoundedFileWithIdentity)(target, inspected, 1024, reason => new Error(`safe read failed: ${reason}`));
+        (0, safe_file_1.writeProjectFile)(root, 'sensors.json', Buffer.from('new bytes'), {
+            mode: 'replace',
+            expected: observed.content,
+            expectedIdentity: observed.identity,
+            createParents: false,
+        });
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('new bytes');
+    });
+    it('compensates only the exact project file observed after creation', () => {
+        const target = path_1.default.join(root, 'created.json');
+        fs_1.default.writeFileSync(target, 'created bytes');
+        const inspected = fs_1.default.lstatSync(target, { bigint: true });
+        const observed = (0, safe_file_1.readInspectedBoundedFileWithIdentity)(target, inspected, 1024, reason => new Error(`safe read failed: ${reason}`));
+        (0, safe_file_1.removeObservedProjectFile)(root, 'created.json', observed.identity);
+        expect(fs_1.default.existsSync(target)).toBe(false);
+    });
+    it('rejects a nested claimant before callback mutation and releases after a thrown callback', () => {
+        const withProjectLease = projectLeaseRunner();
+        const target = path_1.default.join(root, 'owner.txt');
+        fs_1.default.writeFileSync(target, 'owner bytes');
+        withProjectLease(root, () => {
+            expect(() => withProjectLease(root, () => fs_1.default.writeFileSync(target, 'claimant bytes')))
+                .toThrow(/project lease conflict/i);
+            expect(fs_1.default.readFileSync(target, 'utf8')).toBe('owner bytes');
+        });
+        const callbackFailure = new Error('lease callback failed');
+        expect(() => withProjectLease(root, () => { throw callbackFailure; })).toThrow(callbackFailure);
+        expect(() => withProjectLease(root, () => fs_1.default.writeFileSync(target, 'next claimant bytes'))).not.toThrow();
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('next claimant bytes');
+    });
+});

package/dist/tests/commands/sensors/compatibility/source.test.js

@@ -0,0 +1,121 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const manifest_1 = require("../../../../src/commands/sensors/compatibility/manifest");
+const source_1 = require("../../../../src/commands/sensors/compatibility/source");
+function manifest(registryRoot) {
+    return (0, manifest_1.parseSensorManifest)({
+        schemaVersion: 2, pack: 'js-ts', ...(registryRoot ? { registryRoot } : {}), sensors: {
+            lint: {
+                enabled: false, variantId: 'eslint-9',
+                command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                initializedCompatibility: { state: 'certified', reason: 'fixture', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] },
+            },
+        },
+    }, 'manifest');
+}
+function pack() {
+    return {
+        schemaVersion: 2, name: 'js-ts', description: 'fixture', detects: ['package.json'], sensors: {
+            lint: { applicability: { allFiles: ['package.json'] }, variants: [{
+                        id: 'eslint-9', priority: 1,
+                        requirements: { tool: 'eslint', toolRange: '>=9 <10', runtime: 'node', runtimeRange: '>=20' },
+                        certifiedRange: '>=9 <10', assets: [], formatter: 'generic', probe: { kind: 'eslint-print-config' },
+                        command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                    }] },
+        },
+        coverage: { schemaVersion: 1, classes: { linting: { description: 'fixture', detectors: [{ sensor: 'lint' }], remedy: { summary: 'fixture', command: 'npm test' } } } },
+    };
+}
+function writePack(root) {
+    const directory = path_1.default.join(root, 'sensor-packs', 'js-ts');
+    fs_1.default.mkdirSync(directory, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(directory, 'pack.json'), JSON.stringify(pack()));
+}
+describe('resolveSensorSource', () => {
+    const roots = [];
+    afterEach(() => { for (const root of roots.splice(0))
+        fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    it('preserves an existing v2 provenance path without registry-order rebinding', () => {
+        const bound = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-bound-'));
+        roots.push(bound);
+        const other = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-other-'));
+        roots.push(other);
+        writePack(bound);
+        writePack(other);
+        expect((0, source_1.resolveSensorSource)(manifest(bound), { registries: [{ name: 'other', remote: 'local', contentRoot: other }] }))
+            .toMatchObject({ kind: 'legacy-bound', source: { registry: { name: 'manifest-provenance' } } });
+    });
+    it('rebinds an absent v2 provenance only when exactly one registry matches every sensor identity', () => {
+        const absent = path_1.default.join(os_1.default.tmpdir(), 'does-not-exist-awma');
+        const registry = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-rebound-'));
+        roots.push(registry);
+        writePack(registry);
+        expect((0, source_1.resolveSensorSource)(manifest(absent), { registries: [{ name: 'baseline', remote: 'local', contentRoot: registry }] }))
+            .toMatchObject({ kind: 'legacy-rebound', source: { registry: { name: 'baseline' } } });
+    });
+    it('fails closed for zero or multiple structural candidates without exposing paths or remotes', () => {
+        const absent = path_1.default.join(os_1.default.tmpdir(), 'does-not-exist-awmb');
+        expect((0, source_1.resolveSensorSource)(manifest(absent), { registries: [] })).toMatchObject({ kind: 'source-unavailable', reason: 'no-compatible-registry' });
+        const first = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-first-'));
+        roots.push(first);
+        const second = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-second-'));
+        roots.push(second);
+        writePack(first);
+        writePack(second);
+        const result = (0, source_1.resolveSensorSource)(manifest(absent), { registries: [
+                { name: 'first', remote: 'https://user:secret@example.invalid/first', contentRoot: first },
+                { name: 'second', remote: 'https://user:secret@example.invalid/second', contentRoot: second },
+            ] });
+        expect(result).toMatchObject({ kind: 'source-ambiguous', candidates: ['first', 'second'] });
+        expect(JSON.stringify(result)).not.toContain('secret');
+    });
+    it('rejects a malformed v3 logical registry identity instead of classifying it as unavailable', () => {
+        expect(() => (0, source_1.resolveSensorSource)({
+            kind: 'v3', pack: { mode: 'project-sensors', pack: 'js-ts', source: { registry: '../escape' } },
+        }, { registries: [] })).toThrow(/registry.*stable|invalid.*registry/i);
+    });
+    it('bounds ambiguity diagnostics for extremely long valid registry names', () => {
+        const first = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-long-first-'));
+        roots.push(first);
+        const second = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-long-second-'));
+        roots.push(second);
+        writePack(first);
+        writePack(second);
+        const result = (0, source_1.resolveSensorSource)(manifest(path_1.default.join(os_1.default.tmpdir(), 'awm-source-long-missing')), { registries: [
+                { name: `a${'x'.repeat(200_000)}`, remote: 'https://user:secret@example.invalid/first', contentRoot: first },
+                { name: `b${'x'.repeat(200_000)}`, remote: 'https://user:secret@example.invalid/second', contentRoot: second },
+            ] });
+        expect(result.kind).toBe('source-ambiguous');
+        if (result.kind === 'source-ambiguous') {
+            expect(result.candidates.every(candidate => candidate.length <= 128)).toBe(true);
+        }
+        expect(JSON.stringify(result).length).toBeLessThan(4096);
+        expect(JSON.stringify(result)).not.toContain('secret');
+    });
+    it('bounds malformed-pack diagnostics for an extremely long valid registry name', () => {
+        const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-source-malformed-long-'));
+        roots.push(registryRoot);
+        writePack(registryRoot);
+        fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'sensor-packs', 'js-ts', 'pack.json'), '{"schemaVersion":');
+        const name = `a${'x'.repeat(200_000)}`;
+        let message = '';
+        try {
+            (0, source_1.resolveSensorSource)(manifest(path_1.default.join(os_1.default.tmpdir(), 'awm-source-malformed-long-missing')), {
+                registries: [{ name, remote: 'https://user:secret@example.invalid/registry', contentRoot: registryRoot }],
+            });
+        }
+        catch (error) {
+            message = error instanceof Error ? error.message : String(error);
+        }
+        expect(message).toMatch(/invalid sensor pack/);
+        expect(message.length).toBeLessThan(4096);
+        expect(message).not.toContain(name);
+        expect(message).not.toContain('secret');
+    });
+});

package/dist/tests/commands/sensors/coverage/index.test.js

@@ -36,6 +36,26 @@ test('old pack is no_reference and preserves pack and registry', async () => {
         static: { status: 'inconclusive', reason: 'no_reference', classes: [] },
         empirical: expect.objectContaining({ status: 'evidence', classes: [expect.objectContaining({ outcome: 'coverage-unverifiable' })] }) });
 });
+test('v3 coverage probes the concrete registry selected by logical resolution', async () => {
+    const manifest = { kind: 'v3', pack: {
+            schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'baseline' }, sensors: {
+                lint: {
+                    enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                    initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9', evidence: [] },
+                },
+            },
+        } };
+    const contract = { schemaVersion: 1, classes: {
+            linting: { description: 'Linting', detectors: [{ sensor: 'lint' }], remedy: { summary: 'Add lint', command: 'npm i -D eslint' } },
+        } };
+    const resolveLive = jest.fn().mockResolvedValue({ sensors: {} });
+    await (0, coverage_1.runCoverage)('/fixture', {
+        resolve: () => ({ kind: 'ready', projectRoot: '/fixture', pack: 'js-ts', registry: 'baseline', registryRoot: '/registries/baseline', manifest, contract }),
+        resolveLive,
+        scan: () => ({ entries: [], sources: { activeFiles: 0, archivedFiles: 0, validEntries: 0, validFindings: 0, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0 }),
+    });
+    expect(resolveLive).toHaveBeenCalledWith('/fixture', 'js-ts', '/registries/baseline');
+});
 test('ready input observes every declared detector and evaluates once', async () => {
     const manifest = { kind: 'legacy', pack: { pack: 'js-ts', sensors: { lint: { cmd: 'eslint .' }, format: { cmd: 'prettier --check .' } }, compatibility: {
                 state: 'compatible-unverified', reason: 'legacy', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [],

package/dist/tests/commands/sensors/coverage/resolve.test.js

@@ -7,6 +7,21 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const tmp_1 = require("../../../support/tmp");
 const resolve_1 = require("../../../../src/commands/sensors/coverage/resolve");
+function resolveCoverageWithoutNoFollow(cwd) {
+    let resolve;
+    jest.isolateModules(() => {
+        jest.doMock('fs', () => {
+            const actual = jest.requireActual('fs');
+            const constants = { ...actual.constants, O_NOFOLLOW: undefined };
+            return { __esModule: true, default: { ...actual, constants }, ...actual, constants };
+        });
+        resolve = require('../../../../src/commands/sensors/coverage/resolve').resolveCoverageInputs;
+    });
+    jest.dontMock('fs');
+    if (!resolve)
+        throw new Error('portable coverage resolver could not be loaded');
+    return resolve(cwd);
+}
 let root;
 let awmHome;
 let project;
@@ -29,9 +44,6 @@ const writeManifest = (body) => fs_1.default.writeFileSync(path_1.default.join(p
 const coverage = { schemaVersion: 1, classes: {
         formatting: { description: 'Formatting', detectors: [{ sensor: 'format' }], remedy: { summary: 'Add formatter', command: 'npm i -D prettier' } },
     } };
-const noFollowUnavailableOnNativeWindows = process.platform === 'win32'
-    && typeof fs_1.default.constants.O_NOFOLLOW !== 'number';
-const safetyError = /platform cannot guarantee no symlink dereference/;
 const writePack = (registry, pack, body) => {
     const dir = path_1.default.join(awmHome, 'registries', registry, 'sensor-packs', pack);
     fs_1.default.mkdirSync(dir, { recursive: true });
@@ -60,62 +72,52 @@ test('selects the first configured registry containing the exact pack', () => {
     configure(['first', 'second']);
     writePack('first', 'generic', { name: 'generic', sensors: {} });
     writePack('second', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
-    }
-    else {
-        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', pack: 'js-ts', registry: 'second' });
-    }
+    expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', pack: 'js-ts', registry: 'second' });
 });
 test('registry ordering chooses the earlier exact pack when both registries contain it', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['first', 'second']);
     writePack('first', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
     writePack('second', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
-    }
-    else {
-        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', registry: 'first' });
-    }
+    expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', registry: 'first' });
+});
+test('v3 project-sensors resolves coverage from its declared logical registry', () => {
+    writeManifest({ schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'second' }, sensors: {} });
+    configure(['first', 'second']);
+    writePack('first', 'js-ts', { name: 'js-ts', sensors: {} });
+    writePack('second', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
+    expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({
+        kind: 'ready', pack: 'js-ts', registry: 'second',
+        registryRoot: path_1.default.join(awmHome, 'registries', 'second'),
+    });
 });
 test('old pack without coverage is no_reference, not covered', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', { name: 'js-ts', sensors: {} });
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
-    }
-    else {
-        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'no_reference', pack: 'js-ts', registry: 'baseline' });
-    }
+    expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'no_reference', pack: 'js-ts', registry: 'baseline' });
 });
-test('native Windows without no-follow support fails closed before resolving normal coverage inputs', () => {
+test('normal regular coverage inputs resolve regardless of no-follow availability', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(safetyError);
-    }
-    else {
-        expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready' });
-    }
+    expect(resolveCoverageWithoutNoFollow(project)).toMatchObject({ kind: 'ready' });
 });
 test.each([
     ['manifest-malformed', '{broken', /Invalid JSON.*sensors\.json/],
     ['manifest-oversize', Buffer.alloc(1024 * 1024 + 1), /sensors\.json.*exceeds 1 MiB/],
 ])('rejects %s', (_name, body, expected) => {
     writeManifest(body);
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows && _name !== 'manifest-oversize' ? safetyError : expected);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(expected);
 });
 test.each([
     ['pack-malformed', '{broken', /Invalid JSON.*pack\.json/],
-    ['pack-oversize', Buffer.alloc(1024 * 1024 + 1), /pack.*pack\.json.*exceeds the 1 MiB limit/],
+    ['pack-oversize', Buffer.alloc(1024 * 1024 + 1), /pack source exceeds the 1 MiB limit/],
 ])('rejects %s', (_name, body, expected) => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', body);
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : expected);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(expected);
 });
 test('rejects a symlinked manifest without dereferencing it', () => {
     const manifest = path_1.default.join(project, '.awm', 'sensors.json');
@@ -133,12 +135,12 @@ test('rejects a JSON object that is not a valid pack', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', { coverage });
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : /Invalid sensor pack.*name/);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(/Invalid sensor pack.*name/);
 });
 test('rejects registry names that are not safe path components', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['']);
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : /malformed entry name|Invalid registry name/);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(/malformed entry name|Invalid registry name/);
 });
 test.each([
     [{ schemaVersion: 3, name: 'js-ts', sensors: {}, coverage: {} }, /supported: legacy, 2/],
@@ -147,5 +149,5 @@ test.each([
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', pack);
-    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(noFollowUnavailableOnNativeWindows ? safetyError : expected);
+    expect(() => (0, resolve_1.resolveCoverageInputs)(project)).toThrow(expected);
 });