agentic-workflow-manager 9.5.0 → 9.6.0

package/dist/tests/commands/sensors/compatibility/materialize.test.js

@@ -7,20 +7,37 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const materialize_1 = require("../../../../src/commands/sensors/compatibility/materialize");
+const pack_source_1 = require("../../../../src/commands/sensors/compatibility/pack-source");
+const safe_file_1 = require("../../../../src/commands/sensors/compatibility/safe-file");
+const native_bridge_1 = require("../../../../src/core/secure-fs/native-bridge");
 const evidence = { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-10', toolVersion: '10.0.0', runtimeVersion: '22.0.0', certifiedRange: '>=10 <11', evidence: [] };
 describe('materializeResolvedSensors', () => {
     let projectRoot;
     let packRoot;
+    let portableRegistryRoots;
     beforeEach(() => {
         projectRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-project-'));
         packRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-pack-'));
+        portableRegistryRoots = [];
         fs_1.default.writeFileSync(path_1.default.join(packRoot, 'eslint.config.awm.mjs'), 'export default [];');
         fs_1.default.writeFileSync(path_1.default.join(packRoot, 'tsconfig.awm.json'), '{}');
     });
     afterEach(() => {
+        (0, safe_file_1.setSecureFsForTests)(undefined);
         fs_1.default.rmSync(projectRoot, { recursive: true, force: true });
         fs_1.default.rmSync(packRoot, { recursive: true, force: true });
+        for (const registryRoot of portableRegistryRoots)
+            fs_1.default.rmSync(registryRoot, { recursive: true, force: true });
     });
+    function portableSource() {
+        const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-registry-'));
+        portableRegistryRoots.push(registryRoot);
+        const selectedPackRoot = path_1.default.join(registryRoot, 'sensor-packs', 'js-ts');
+        fs_1.default.mkdirSync(selectedPackRoot, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(selectedPackRoot, 'pack.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(selectedPackRoot, 'eslint.config.awm.mjs'), 'export default [];');
+        return (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'baseline', remote: '', contentRoot: registryRoot }] });
+    }
     it('copies only selected assets and writes a v2 manifest atomically', () => {
         const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
                 lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
@@ -30,6 +47,186 @@ describe('materializeResolvedSensors', () => {
         expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'), 'utf8'))).toMatchObject({ schemaVersion: 2, sensors: { lint: { variantId: 'eslint-10' } } });
         expect(fs_1.default.readdirSync(path_1.default.join(projectRoot, '.awm'))).not.toContain('sensors.json.tmp');
     });
+    it('invokes the secure-fs bridge while applying selected registry content', () => {
+        let leaseHeld = false;
+        const bridge = {
+            readRegularFile: jest.fn((...args) => native_bridge_1.secureFs.readRegularFile(...args)),
+            withProjectLease: jest.fn((_projectRoot, operation) => {
+                expect(leaseHeld).toBe(false);
+                leaseHeld = true;
+                try {
+                    return operation();
+                }
+                finally {
+                    leaseHeld = false;
+                }
+            }),
+            writeProjectTransaction: jest.fn((...args) => {
+                expect(leaseHeld).toBe(true);
+                return native_bridge_1.secureFs.writeProjectTransaction(...args);
+            }),
+        };
+        (0, safe_file_1.setSecureFsForTests)(bridge);
+        (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(bridge.readRegularFile).toHaveBeenCalledWith(path_1.default.join(packRoot, 'eslint.config.awm.mjs'), 1024 * 1024);
+        expect(bridge.withProjectLease).toHaveBeenCalledTimes(1);
+        expect(bridge.withProjectLease).toHaveBeenCalledWith(projectRoot, expect.any(Function));
+        expect(bridge.writeProjectTransaction).toHaveBeenCalledWith(projectRoot, 'eslint.config.awm.mjs', expect.any(Buffer), { mode: 'create', createParents: true });
+        (0, safe_file_1.setSecureFsForTests)(undefined);
+        expect(bridge.writeProjectTransaction).toHaveBeenCalledWith(projectRoot, '.awm/sensors.json', expect.any(Buffer), { mode: 'create', createParents: true });
+    });
+    it('carries the exact native read identity through the existing manifest replacement path', () => {
+        const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
+        fs_1.default.mkdirSync(path_1.default.dirname(manifestPath));
+        fs_1.default.writeFileSync(manifestPath, JSON.stringify({ schemaVersion: 2, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { ...evidence, variantId: 'eslint-9' } },
+            } }));
+        const bridge = {
+            readRegularFile: jest.fn((...args) => native_bridge_1.secureFs.readRegularFile(...args)),
+            withProjectLease: jest.fn((_projectRoot, operation) => operation()),
+            writeProjectTransaction: jest.fn((...args) => native_bridge_1.secureFs.writeProjectTransaction(...args)),
+        };
+        (0, safe_file_1.setSecureFsForTests)(bridge);
+        (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', configure: false, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: evidence },
+            } });
+        let readCall = -1;
+        bridge.readRegularFile.mock.calls.forEach(([file], index) => {
+            if (file === manifestPath)
+                readCall = index;
+        });
+        const replaceCall = bridge.writeProjectTransaction.mock.calls.find(([, destination, , options]) => destination === '.awm/sensors.json' && options.mode === 'replace');
+        expect(readCall).toBeGreaterThanOrEqual(0);
+        expect(replaceCall).toBeDefined();
+        expect(replaceCall[3]).toMatchObject({ mode: 'replace', expected: expect.any(Buffer), expectedIdentity: expect.any(Object), createParents: false });
+        expect(replaceCall[3].expectedIdentity).toBe(bridge.readRegularFile.mock.results[readCall].value.identity);
+    });
+    it('writes a validated portable v3 manifest using the exact logical registry', () => {
+        const source = portableSource();
+        const result = (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(result.manifest).toMatchObject({ schemaVersion: 3, mode: 'project-sensors', source: { registry: 'baseline' } });
+        const text = fs_1.default.readFileSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'), 'utf8');
+        expect(text.endsWith('\n')).toBe(true);
+        expect(text).not.toContain(path_1.default.dirname(source.path));
+        expect(JSON.parse(text)).toMatchObject({ source: { registry: 'baseline' } });
+    });
+    it('returns a bounded lease conflict before writing an asset or manifest, then succeeds after release', () => {
+        const leasedSecureFs = native_bridge_1.secureFs;
+        const input = { projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } };
+        leasedSecureFs.withProjectLease(projectRoot, () => {
+            expect(() => (0, materialize_1.materializeResolvedSensors)(input)).toThrow(/project lease conflict/i);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+        });
+        expect((0, materialize_1.materializeResolvedSensors)(input).configured).toEqual(['eslint.config.awm.mjs']);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(true);
+    });
+    it('materializes a canonical pack source from a configured root with a symlinked ancestor', () => {
+        const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-registry-'));
+        const linkedRegistryRoot = path_1.default.join(path_1.default.dirname(registryRoot), `${path_1.default.basename(registryRoot)}-linked`);
+        const contentRoot = path_1.default.join(registryRoot, 'content');
+        const linkedContentRoot = path_1.default.join(linkedRegistryRoot, 'content');
+        portableRegistryRoots.push(registryRoot);
+        try {
+            const selectedPackRoot = path_1.default.join(contentRoot, 'sensor-packs', 'js-ts');
+            fs_1.default.mkdirSync(selectedPackRoot, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(selectedPackRoot, 'pack.json'), '{}');
+            fs_1.default.writeFileSync(path_1.default.join(selectedPackRoot, 'eslint.config.awm.mjs'), 'export default [];');
+            fs_1.default.symlinkSync(registryRoot, linkedRegistryRoot);
+            const source = (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'baseline', remote: '', contentRoot: linkedContentRoot }] });
+            const result = (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } });
+            expect(result.configured).toEqual(['eslint.config.awm.mjs']);
+            expect(fs_1.default.readFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'), 'utf8')).toBe('export default [];');
+        }
+        finally {
+            fs_1.default.rmSync(linkedRegistryRoot, { force: true });
+        }
+    });
+    it('rejects a portable source whose selected pack path belongs to another registry', () => {
+        const source = portableSource();
+        const otherRegistry = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-other-registry-'));
+        try {
+            expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source: { ...source, registry: { ...source.registry, contentRoot: otherRegistry } }, sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow(/source|registry|pack/i);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(otherRegistry, { recursive: true, force: true });
+        }
+    });
+    it('rejects a pack whose authoritative bytes changed after planning', () => {
+        const source = portableSource();
+        fs_1.default.writeFileSync(source.path, '{"changed":true}');
+        expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow('changed after bootstrap planning');
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+    });
+    it('fails lease acquisition before creating an asset when .awm cannot hold the lease', () => {
+        const source = portableSource();
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, '.awm'), 'not a directory');
+        const unlink = jest.spyOn(fs_1.default, 'unlinkSync');
+        try {
+            expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow();
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+            expect(fs_1.default.readFileSync(path_1.default.join(projectRoot, '.awm'), 'utf8')).toBe('not a directory');
+            expect(unlink).not.toHaveBeenCalled();
+        }
+        finally {
+            unlink.mockRestore();
+        }
+    });
+    it('validates portable v3 input before writing assets', () => {
+        const source = portableSource();
+        expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source: { ...source, registry: { ...source.registry, name: 'Baseline' } }, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow('registry');
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+    });
+    it('validates every selected portable asset before publishing the first one', () => {
+        const source = portableSource();
+        expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs', 'missing.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow(/missing/i);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+    });
+    it('compensates only assets it created when manifest publication fails', () => {
+        const source = portableSource();
+        (0, safe_file_1.setSecureFsForTests)({
+            withProjectLease: native_bridge_1.secureFs.withProjectLease,
+            readRegularFile: native_bridge_1.secureFs.readRegularFile,
+            writeProjectTransaction: ((root, destination, content, options) => {
+                if (destination === '.awm/sensors.json')
+                    throw new Error('injected manifest publication failure');
+                native_bridge_1.secureFs.writeProjectTransaction(root, destination, content, options);
+            }),
+            removeObservedProjectFile: native_bridge_1.secureFs.removeObservedProjectFile,
+        });
+        expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source, sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow('injected manifest publication failure');
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json.tmp'))).toBe(false);
+    });
+    it('contains no pathname-based deletion in production materialization', () => {
+        const source = fs_1.default.readFileSync(path_1.default.resolve(__dirname, '../../../../src/commands/sensors/compatibility/materialize.ts'), 'utf8');
+        expect(source).not.toMatch(/\b(?:unlink|rm)Sync\s*\(/);
+    });
     it('preserves a destination that already exists', () => {
         fs_1.default.writeFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'), 'owner content');
         const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
@@ -38,6 +235,202 @@ describe('materializeResolvedSensors', () => {
         expect(result.preserved).toEqual(['eslint.config.awm.mjs']);
         expect(fs_1.default.readFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'), 'utf8')).toBe('owner content');
     });
+    it('throws a non-conflict asset I/O failure and never publishes a manifest reference', () => {
+        const writeProjectTransaction = jest.fn((_root, destination) => {
+            if (destination === 'eslint.config.awm.mjs') {
+                throw new Error('secure-fs target exists or transaction failed');
+            }
+        });
+        (0, safe_file_1.setSecureFsForTests)({
+            withProjectLease: ((_root, operation) => operation()),
+            readRegularFile: jest.fn((...args) => native_bridge_1.secureFs.readRegularFile(...args)),
+            writeProjectTransaction: writeProjectTransaction,
+        });
+        expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow('secure-fs target exists or transaction failed');
+        expect(writeProjectTransaction).toHaveBeenCalledTimes(1);
+        expect(writeProjectTransaction).toHaveBeenCalledWith(projectRoot, 'eslint.config.awm.mjs', expect.any(Buffer), { mode: 'create', createParents: true });
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'))).toBe(false);
+    });
+    it('rejects a symlinked project destination component before writing an asset', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(packRoot, 'configs'));
+            fs_1.default.writeFileSync(path_1.default.join(packRoot, 'configs', 'eslint.config.awm.mjs'), 'registry content');
+            fs_1.default.symlinkSync(outside, path_1.default.join(projectRoot, 'configs'));
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['configs/eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow(/symlink|destination/i);
+            expect(fs_1.default.existsSync(path_1.default.join(outside, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('does not stage an asset through a destination ancestor swapped to a symlink', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        const directory = path_1.default.join(projectRoot, 'configs');
+        const originalWrite = fs_1.default.writeFileSync.bind(fs_1.default);
+        const write = jest.spyOn(fs_1.default, 'writeFileSync');
+        let swapped = false;
+        let stagedThroughSwappedAncestor = false;
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(packRoot, 'configs'));
+            fs_1.default.writeFileSync(path_1.default.join(packRoot, 'configs', 'eslint.config.awm.mjs'), 'registry content');
+            write.mockImplementation(((file, data, options) => {
+                if (!swapped && typeof file === 'string' && path_1.default.basename(file).startsWith('.eslint.config.awm.mjs.')) {
+                    swapped = true;
+                    fs_1.default.renameSync(directory, `${directory}.original`);
+                    fs_1.default.symlinkSync(outside, directory);
+                    stagedThroughSwappedAncestor = path_1.default.dirname(file) === directory;
+                }
+                return originalWrite(file, data, options);
+            }));
+            const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['configs/eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } });
+            expect(result.configured).toEqual(['configs/eslint.config.awm.mjs']);
+            expect(stagedThroughSwappedAncestor).toBe(false);
+            expect(fs_1.default.readdirSync(outside)).toEqual([]);
+        }
+        finally {
+            write.mockRestore();
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('rejects a symlinked .awm ancestor before publishing a portable v3 manifest', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        try {
+            fs_1.default.symlinkSync(outside, path_1.default.join(projectRoot, '.awm'));
+            expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source: portableSource(), sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow(/symlink|destination|safe/i);
+            expect(fs_1.default.readdirSync(outside)).toEqual([]);
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('does not overwrite a v3 manifest concurrently published after staging', () => {
+        const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
+        fs_1.default.mkdirSync(path_1.default.dirname(manifestPath));
+        fs_1.default.writeFileSync(manifestPath, 'concurrent manifest');
+        expect(() => (0, materialize_1.materializePortableSensors)({ projectRoot, pack: 'js-ts', source: portableSource(), sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } })).toThrow(/manifest|exist|concurrent|publish|destination/i);
+        expect(fs_1.default.readFileSync(manifestPath, 'utf8')).toBe('concurrent manifest');
+    });
+    it('rejects a symlinked packageRoot before writing an asset', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        try {
+            fs_1.default.symlinkSync(outside, path_1.default.join(projectRoot, 'package'));
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', packageRoot: 'package', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow(/symlink|destination/i);
+            expect(fs_1.default.existsSync(path_1.default.join(outside, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('does not overwrite an asset concurrently published after destination observation', () => {
+        const destination = path_1.default.join(projectRoot, 'eslint.config.awm.mjs');
+        fs_1.default.writeFileSync(destination, 'owner content');
+        const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(result.configured).toEqual([]);
+        expect(result.preserved).toEqual(['eslint.config.awm.mjs']);
+        expect(fs_1.default.readFileSync(destination, 'utf8')).toBe('owner content');
+    });
+    test.each(['C:/sensor-assets/eslint.config.awm.mjs', 'C:sensor-assets/eslint.config.awm.mjs'])('rejects Windows-rooted or drive-qualified asset paths: %s', asset => {
+        expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: [asset], initializedCompatibility: evidence },
+            } })).toThrow(/contained relative asset path/i);
+    });
+    it('rejects a selected asset beneath a symlinked registry directory before copying it', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(packRoot, 'configs'));
+            fs_1.default.writeFileSync(path_1.default.join(outside, 'eslint.config.awm.mjs'), 'outside content');
+            fs_1.default.symlinkSync(outside, path_1.default.join(packRoot, 'configs', 'linked'));
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['configs/linked/eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow('symlink');
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'configs', 'linked', 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it.skip('rejects an asset replaced after inspection and before its safe open', () => {
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let swapped = false;
+        try {
+            open.mockImplementation(((file, flags, mode) => {
+                if (!swapped && file === path_1.default.join(packRoot, 'eslint.config.awm.mjs')) {
+                    swapped = true;
+                    fs_1.default.renameSync(file, path_1.default.join(packRoot, 'eslint.config.awm.original.mjs'));
+                    fs_1.default.writeFileSync(file, 'replacement content');
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow(/changed|identity|safe/i);
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            open.mockRestore();
+        }
+    });
+    it('re-establishes parent containment immediately before safely opening an asset', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-outside-'));
+        const originalLstat = fs_1.default.lstatSync.bind(fs_1.default);
+        const lstat = jest.spyOn(fs_1.default, 'lstatSync');
+        const directory = path_1.default.join(packRoot, 'configs');
+        let inspections = 0;
+        try {
+            fs_1.default.mkdirSync(directory);
+            fs_1.default.writeFileSync(path_1.default.join(directory, 'eslint.config.awm.mjs'), 'registry content');
+            fs_1.default.writeFileSync(path_1.default.join(outside, 'eslint.config.awm.mjs'), 'outside content');
+            lstat.mockImplementation(((candidate, options) => {
+                if (candidate === directory && ++inspections === 2) {
+                    fs_1.default.renameSync(directory, `${directory}.original`);
+                    fs_1.default.symlinkSync(outside, directory);
+                }
+                return originalLstat(candidate, options);
+            }));
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['configs/eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow('symlink');
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'configs', 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            lstat.mockRestore();
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('rejects a pack root reached through a symlinked ancestor before copying registry content', () => {
+        const registry = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-registry-'));
+        const linkedRegistry = path_1.default.join(path_1.default.dirname(registry), `${path_1.default.basename(registry)}-linked`);
+        const linkedPackRoot = path_1.default.join(linkedRegistry, 'sensor-packs', 'js-ts');
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(registry, 'sensor-packs', 'js-ts'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(registry, 'sensor-packs', 'js-ts', 'eslint.config.awm.mjs'), 'outside content');
+            fs_1.default.symlinkSync(registry, linkedRegistry);
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot: linkedPackRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).toThrow('symlink');
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(linkedRegistry, { force: true });
+            fs_1.default.rmSync(registry, { recursive: true, force: true });
+        }
+    });
     it('revalidates a shared Semgrep policy reference without materializing the policy itself', () => {
         const sensorPacks = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-policy-'));
         const semgrepPack = path_1.default.join(sensorPacks, 'python');
@@ -69,4 +462,21 @@ describe('materializeResolvedSensors', () => {
         expect(result.orphaned).toEqual(['eslint.config.awm.cjs']);
         expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.cjs'))).toBe(true);
     });
+    it('does not touch a stale JavaScript-era manifest temporary file', () => {
+        const now = jest.spyOn(Date, 'now').mockReturnValue(12345);
+        const awm = path_1.default.join(projectRoot, '.awm');
+        const temporary = path_1.default.join(awm, `.sensors.json.${process.pid}.12345.tmp`);
+        try {
+            fs_1.default.mkdirSync(awm);
+            fs_1.default.writeFileSync(temporary, 'not ours');
+            expect(() => (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                    lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+                } })).not.toThrow();
+            expect(fs_1.default.readFileSync(temporary, 'utf8')).toBe('not ours');
+            expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'))).toBe(true);
+        }
+        finally {
+            now.mockRestore();
+        }
+    });
 });

package/dist/tests/commands/sensors/compatibility/pack-source.test.js

@@ -7,6 +7,8 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const pack_source_1 = require("../../../../src/commands/sensors/compatibility/pack-source");
+const safe_file_1 = require("../../../../src/commands/sensors/compatibility/safe-file");
+const itLinux = process.platform === 'linux' ? it : it.skip;
 function resolveWithoutNoFollow(...args) {
     let resolve;
     jest.isolateModules(() => {
@@ -15,6 +17,7 @@ function resolveWithoutNoFollow(...args) {
             const constants = { ...actual.constants, O_NOFOLLOW: undefined };
             return { __esModule: true, default: { ...actual, constants }, ...actual, constants };
         });
+        require('../../../../src/commands/sensors/compatibility/safe-file').setPortableReadForTests(true);
         resolve = require('../../../../src/commands/sensors/compatibility/pack-source').resolvePackSource;
     });
     jest.dontMock('fs');
@@ -30,6 +33,7 @@ function resolveWithoutNoFollowWithExactStats(...args) {
             const constants = { ...actual.constants, O_NOFOLLOW: undefined };
             return { __esModule: true, default: { ...actual, constants }, ...actual, constants };
         });
+        require('../../../../src/commands/sensors/compatibility/safe-file').setPortableReadForTests(true);
         resolve = require('../../../../src/commands/sensors/compatibility/pack-source').resolvePackSource;
     });
     jest.dontMock('fs');
@@ -38,6 +42,8 @@ function resolveWithoutNoFollowWithExactStats(...args) {
     return resolve(...args);
 }
 describe('resolvePackSource', () => {
+    beforeEach(() => (0, safe_file_1.setPortableReadForTests)(true));
+    afterEach(() => (0, safe_file_1.setPortableReadForTests)(false));
     it('uses the first registry containing the exact contained pack file', () => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-'));
         try {
@@ -179,7 +185,7 @@ describe('resolvePackSource', () => {
             fs_1.default.rmSync(root, { recursive: true, force: true });
         }
     });
-    it('accepts a parent symlink replacement when it resolves to the inspected pack inode', () => {
+    itLinux('accepts a parent symlink replacement when Linux descriptor binding preserves the inspected pack inode', () => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-same-inode-'));
         const packDir = path_1.default.join(root, 'sensor-packs', 'js-ts');
         const movedPackDir = path_1.default.join(root, 'sensor-packs', 'js-ts-original');
@@ -206,6 +212,33 @@ describe('resolvePackSource', () => {
             fs_1.default.rmSync(root, { recursive: true, force: true });
         }
     });
+    it('rejects an observable parent symlink replacement in the portable fallback', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-portable-parent-swap-'));
+        const packDir = path_1.default.join(root, 'sensor-packs', 'js-ts');
+        const movedPackDir = path_1.default.join(root, 'sensor-packs', 'js-ts-original');
+        const packFile = path_1.default.join(packDir, 'pack.json');
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let swapped = false;
+        try {
+            fs_1.default.mkdirSync(packDir, { recursive: true });
+            fs_1.default.writeFileSync(packFile, '{"from":"original"}');
+            open.mockImplementation(((file, flags, mode) => {
+                if (!swapped && file === fs_1.default.realpathSync(packFile)) {
+                    swapped = true;
+                    fs_1.default.renameSync(packDir, movedPackDir);
+                    fs_1.default.symlinkSync(movedPackDir, packDir, 'dir');
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect(() => resolveWithoutNoFollow('js-ts', { registries: [{ name: 'safe', remote: '', contentRoot: root }] }))
+                .toThrow(/changed|identity|safe|symlink/i);
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
     it('rejects same-inode content growth between inspection and open', () => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-size-race-'));
         const packFile = path_1.default.join(root, 'sensor-packs', 'js-ts', 'pack.json');

package/dist/tests/commands/sensors/compatibility/safe-file.test.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const safe_file_1 = require("../../../../src/commands/sensors/compatibility/safe-file");
+function projectLeaseRunner() {
+    return require('../../../../src/commands/sensors/compatibility/safe-file').withProjectLease;
+}
+describe('safe-file native replacement observation', () => {
+    let root;
+    beforeEach(() => { root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-safe-file-')); });
+    afterEach(() => { fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    it('carries bytes and the identity from one exact native read into replacement', () => {
+        const target = path_1.default.join(root, 'sensors.json');
+        fs_1.default.writeFileSync(target, 'observed bytes');
+        const inspected = fs_1.default.lstatSync(target, { bigint: true });
+        const observed = (0, safe_file_1.readInspectedBoundedFileWithIdentity)(target, inspected, 1024, reason => new Error(`safe read failed: ${reason}`));
+        (0, safe_file_1.writeProjectFile)(root, 'sensors.json', Buffer.from('new bytes'), {
+            mode: 'replace',
+            expected: observed.content,
+            expectedIdentity: observed.identity,
+            createParents: false,
+        });
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('new bytes');
+    });
+    it('compensates only the exact project file observed after creation', () => {
+        const target = path_1.default.join(root, 'created.json');
+        fs_1.default.writeFileSync(target, 'created bytes');
+        const inspected = fs_1.default.lstatSync(target, { bigint: true });
+        const observed = (0, safe_file_1.readInspectedBoundedFileWithIdentity)(target, inspected, 1024, reason => new Error(`safe read failed: ${reason}`));
+        (0, safe_file_1.removeObservedProjectFile)(root, 'created.json', observed.identity);
+        expect(fs_1.default.existsSync(target)).toBe(false);
+    });
+    it('rejects a nested claimant before callback mutation and releases after a thrown callback', () => {
+        const withProjectLease = projectLeaseRunner();
+        const target = path_1.default.join(root, 'owner.txt');
+        fs_1.default.writeFileSync(target, 'owner bytes');
+        withProjectLease(root, () => {
+            expect(() => withProjectLease(root, () => fs_1.default.writeFileSync(target, 'claimant bytes')))
+                .toThrow(/project lease conflict/i);
+            expect(fs_1.default.readFileSync(target, 'utf8')).toBe('owner bytes');
+        });
+        const callbackFailure = new Error('lease callback failed');
+        expect(() => withProjectLease(root, () => { throw callbackFailure; })).toThrow(callbackFailure);
+        expect(() => withProjectLease(root, () => fs_1.default.writeFileSync(target, 'next claimant bytes'))).not.toThrow();
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('next claimant bytes');
+    });
+});

package/dist/tests/commands/sensors/coverage/index.test.js

@@ -36,6 +36,26 @@ test('old pack is no_reference and preserves pack and registry', async () => {
         static: { status: 'inconclusive', reason: 'no_reference', classes: [] },
         empirical: expect.objectContaining({ status: 'evidence', classes: [expect.objectContaining({ outcome: 'coverage-unverifiable' })] }) });
 });
+test('v3 coverage probes the concrete registry selected by logical resolution', async () => {
+    const manifest = { kind: 'v3', pack: {
+            schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'baseline' }, sensors: {
+                lint: {
+                    enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                    initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9', evidence: [] },
+                },
+            },
+        } };
+    const contract = { schemaVersion: 1, classes: {
+            linting: { description: 'Linting', detectors: [{ sensor: 'lint' }], remedy: { summary: 'Add lint', command: 'npm i -D eslint' } },
+        } };
+    const resolveLive = jest.fn().mockResolvedValue({ sensors: {} });
+    await (0, coverage_1.runCoverage)('/fixture', {
+        resolve: () => ({ kind: 'ready', projectRoot: '/fixture', pack: 'js-ts', registry: 'baseline', registryRoot: '/registries/baseline', manifest, contract }),
+        resolveLive,
+        scan: () => ({ entries: [], sources: { activeFiles: 0, archivedFiles: 0, validEntries: 0, validFindings: 0, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0 }),
+    });
+    expect(resolveLive).toHaveBeenCalledWith('/fixture', 'js-ts', '/registries/baseline');
+});
 test('ready input observes every declared detector and evaluates once', async () => {
     const manifest = { kind: 'legacy', pack: { pack: 'js-ts', sensors: { lint: { cmd: 'eslint .' }, format: { cmd: 'prettier --check .' } }, compatibility: {
                 state: 'compatible-unverified', reason: 'legacy', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [],

package/dist/tests/commands/sensors/coverage/resolve.test.js

@@ -81,6 +81,16 @@ test('registry ordering chooses the earlier exact pack when both registries cont
     writePack('second', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
     expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'ready', registry: 'first' });
 });
+test('v3 project-sensors resolves coverage from its declared logical registry', () => {
+    writeManifest({ schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'second' }, sensors: {} });
+    configure(['first', 'second']);
+    writePack('first', 'js-ts', { name: 'js-ts', sensors: {} });
+    writePack('second', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
+    expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({
+        kind: 'ready', pack: 'js-ts', registry: 'second',
+        registryRoot: path_1.default.join(awmHome, 'registries', 'second'),
+    });
+});
 test('old pack without coverage is no_reference, not covered', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);