agentic-workflow-manager 9.7.1 → 9.9.0

package/dist/tests/core/secure-fs/native-bridge.test.js

@@ -160,6 +160,28 @@ describe('native secure-fs Windows source contract', () => {
         expect(removal).not.toMatch(/\bDeleteFileW\b/);
     });
 });
+describe('native secure-fs durable publication source contract', () => {
+    const source = () => fs_1.default.readFileSync(path_1.default.resolve(__dirname, '../../../native/secure_fs.cc'), 'utf8').replace(/\r\n/g, '\n');
+    it('turns parent-directory fsync failure after publication into a bounded error', () => {
+        const native = source();
+        const write = native.slice(native.indexOf('napi_value WriteProjectTransaction'), native.indexOf('\n}  // namespace'));
+        expect(native).toMatch(/if \(fsync\(parent\) != 0\)[\s\S]{0,240}Throw\(env, "secure-fs durable directory sync failed"\)/);
+        expect(write).toMatch(/fsync\(parent\) == 0;[\s\S]{0,180}secure-fs durable directory sync failed/);
+        const withoutWriteSync = write.replace('fsync(parent) == 0', 'true');
+        expect(withoutWriteSync).not.toMatch(/fsync\(parent\) == 0;/);
+        expect(withoutWriteSync).not.toMatch(/fsync\(parent\) == 0;[\s\S]{0,180}secure-fs durable directory sync failed/);
+    });
+    it('degrades only the unsupported Windows directory flush and retains all other durable failures', () => {
+        expect(source()).toMatch(/FlushFileBuffers\(parent\.handle\) == 0 && GetLastError\(\) != ERROR_ACCESS_DENIED/);
+        expect(source()).toMatch(/if \(directory_sync_failed\).*secure-fs durable directory sync failed/);
+    });
+    it('does not clean a staging name already consumed by a fenced POSIX rename', () => {
+        const write = source().slice(source().indexOf('napi_value WriteProjectTransaction'), source().indexOf('\n}  // namespace'));
+        expect(write).toContain('const bool cleaned = options.replace || unlinkat(parent, temporary.c_str(), 0) == 0;');
+        const reverted = write.replace('options.replace || ', '');
+        expect(reverted).not.toContain('const bool cleaned = options.replace || unlinkat(parent, temporary.c_str(), 0) == 0;');
+    });
+});
 describe('native secure-fs POSIX source contract', () => {
     const source = () => fs_1.default.readFileSync(path_1.default.resolve(__dirname, '../../../native/secure_fs.cc'), 'utf8');
     it('uses an unpredictable nonce and a bounded retry loop for descriptor-relative staging', () => {
@@ -399,6 +421,38 @@ const nativeFixtureAvailable = ['linux', 'darwin', 'win32'].includes(process.pla
     && ['x64', 'arm64'].includes(process.arch)
     && fs_1.default.existsSync(path_1.default.join(__dirname, '../../../prebuilds', `${process.platform}-${process.arch}`, 'secure_fs.node'));
 const nativeOnly = nativeFixtureAvailable ? describe : describe.skip;
+const testAddonPath = path_1.default.join(__dirname, '../../../native/build/Release/secure_fs_test.node');
+const nativeTestOnly = describe;
+nativeTestOnly('native secure-fs directory-sync fault injection', () => {
+    let root;
+    let testBinding;
+    beforeEach(() => {
+        expect(fs_1.default.existsSync(testAddonPath)).toBe(true);
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-secure-fs-fsync-'));
+        testBinding = require(testAddonPath);
+    });
+    afterEach(() => { testBinding.setDirectoryFsyncFailureForTests(false); fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    it('writes the target then reports the forced post-publication directory-sync failure', () => {
+        testBinding.setDirectoryFsyncFailureForTests(true);
+        expect(() => testBinding.writeProjectTransaction(root, 'durable.txt', Buffer.from('published'), { mode: 'create', createParents: false })).toThrow('secure-fs durable directory sync failed');
+        expect(fs_1.default.readFileSync(path_1.default.join(root, 'durable.txt'), 'utf8')).toBe('published');
+    });
+    it('publishes an exact fenced replacement with fault injection disabled', () => {
+        const target = path_1.default.join(root, 'replace.json');
+        fs_1.default.writeFileSync(target, 'before');
+        const observed = testBinding.readRegularFile(target, 1024);
+        expect(() => testBinding.writeProjectTransaction(root, 'replace.json', Buffer.from('after'), {
+            mode: 'replace', expected: observed.bytes, expectedIdentity: observed.identity, createParents: false,
+        })).not.toThrow();
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('after');
+    });
+    it('keeps the production prebuild free of the test-only control', () => {
+        if (!nativeFixtureAvailable)
+            return;
+        const production = require(path_1.default.join(__dirname, '../../../prebuilds', `${process.platform}-${process.arch}`, 'secure_fs.node'));
+        expect(production.setDirectoryFsyncFailureForTests).toBeUndefined();
+    });
+});
 nativeOnly('native secure-fs identity fence fixtures', () => {
     let root;
     let binding;
@@ -406,6 +460,11 @@ nativeOnly('native secure-fs identity fence fixtures', () => {
         root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-secure-fs-identity-'));
         binding = require(path_1.default.join(__dirname, '../../../prebuilds', `${process.platform}-${process.arch}`, 'secure_fs.node'));
     });
+    it('performs a real artifact-backed publish when the CI prebuild is available', () => {
+        const target = path_1.default.join(root, 'durable.txt');
+        binding.writeProjectTransaction(root, 'durable.txt', Buffer.from('published'), { mode: 'create', createParents: false });
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('published');
+    });
     afterEach(() => { fs_1.default.rmSync(root, { recursive: true, force: true }); });
     it('returns bytes with a canonical native identity from the same regular-file read', () => {
         const target = path_1.default.join(root, 'sensors.json');
@@ -690,6 +749,7 @@ windowsOnly('native secure-fs Windows handle fixtures', () => {
                     fs.symlinkSync(workerData.outside, workerData.trusted, 'junction');
                     Atomics.add(state, 1, 1);
                     Atomics.notify(state, 1);
+                    parentPort.postMessage('ready');
                     Atomics.wait(state, 0, 0, 1);
                     fs.rmSync(workerData.trusted);
                     fs.renameSync(workerData.parked, workerData.trusted);
@@ -701,13 +761,30 @@ windowsOnly('native secure-fs Windows handle fixtures', () => {
             restore();
             parentPort.postMessage('done');
             `, { eval: true, workerData: { shared, trusted, parked, outside } });
-        const done = new Promise((resolve, reject) => {
-            worker.once('message', () => resolve());
-            worker.once('error', reject);
+        let resolveReady;
+        let rejectReady;
+        let resolveDone;
+        let rejectDone;
+        const ready = new Promise((resolve, reject) => { resolveReady = resolve; rejectReady = reject; });
+        const done = new Promise((resolve, reject) => { resolveDone = resolve; rejectDone = reject; });
+        const readyTimeout = setTimeout(() => rejectReady(new Error('junction swap worker did not become ready')), 5_000);
+        worker.on('message', message => {
+            if (message === 'ready') {
+                clearTimeout(readyTimeout);
+                resolveReady();
+            }
+            if (message === 'done')
+                resolveDone();
+        });
+        worker.once('error', error => {
+            clearTimeout(readyTimeout);
+            const failure = error instanceof Error ? error : new Error('junction swap worker failed');
+            rejectReady(failure);
+            rejectDone(failure);
         });
         let published = 0;
         try {
-            Atomics.wait(state, 1, 0, 5_000);
+            await ready;
             expect(Atomics.load(state, 1)).toBeGreaterThan(0);
             for (let attempt = 0; attempt < 500; attempt += 1) {
                 try {

package/dist/tests/integration/pack-e2e.test.js

@@ -38,7 +38,10 @@ it('el tarball empaquetado corre awm update sin el monorepo', () => {
         const awmHome = path_1.default.join(home, '.awm');
         fs_1.default.mkdirSync(awmHome, { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify([{ name: 'baseline', remote: source }]));
-        (0, child_process_1.execSync)(`node "${path_1.default.join(pkgDir, 'dist/src/index.js')}" update`, {
+        // El artefacto se debe ejecutar con el mismo runtime que corre la prueba:
+        // usar `node` desde PATH podría probar accidentalmente otra versión. En
+        // particular, esto cubre Node 22, declarado como compatible por package.json.
+        (0, child_process_1.execSync)(`"${process.execPath}" "${path_1.default.join(pkgDir, 'dist/src/index.js')}" update`, {
             env: { ...process.env, HOME: home, AWM_HOME: awmHome, AWM_NO_UPDATE_CHECK: '1' },
             stdio: 'pipe',
         });

package/dist/tests/integration/preflight-json-pipe.e2e.test.js

@@ -105,13 +105,17 @@ test('verify-sensors degrades parseably for a v2 sensor that exits 2 without fin
         writeJson(path_1.default.join(project, 'package.json'), { name: 'preflight-verify-fixture', private: true });
         writeJson(path_1.default.join(project, 'node_modules', 'fixture-sensor', 'package.json'), { name: 'fixture-sensor', version: '1.0.0' });
         fs_1.default.writeFileSync(path_1.default.join(project, 'fixture-sensor.config.mjs'), 'export default {};\n');
-        fs_1.default.writeFileSync(path_1.default.join(project, 'fixture-sensor.mjs'), 'process.exit(2);\n');
+        const fixtureArgs = ['-e', 'process.exit(2);', '--', '--fixture'];
+        const fixtureBin = path_1.default.join(project, 'node_modules', '.bin', process.platform === 'win32' ? 'fixture-sensor.exe' : 'fixture-sensor');
+        fs_1.default.mkdirSync(path_1.default.dirname(fixtureBin), { recursive: true });
+        fs_1.default.copyFileSync(process.execPath, fixtureBin);
+        fs_1.default.chmodSync(fixtureBin, 0o755);
         writeJson(path_1.default.join(registry, 'sensor-packs', 'fixture', 'pack.json'), {
             schemaVersion: 2, name: 'fixture', description: 'preflight exit-2 fixture', detects: ['package.json'],
             sensors: { lint: { applicability: { allFiles: ['package.json'] }, variants: [{
                             id: 'fixture-v1', priority: 100,
                             requirements: { tool: 'fixture-sensor', toolRange: '>=1 <2', runtime: 'node', runtimeRange: '>=20', configFiles: ['fixture-sensor.config.mjs'] },
-                            certifiedRange: '>=1 <2', command: { executable: 'node', resolution: 'path', args: ['fixture-sensor.mjs'] },
+                            certifiedRange: '>=1 <2', command: { executable: 'fixture-sensor', resolution: 'node-modules-bin', args: fixtureArgs },
                             assets: ['fixture-sensor.config.mjs'], formatter: 'generic', probe: { kind: 'config-present' },
                         }] } },
             coverage: { schemaVersion: 1, classes: {
@@ -124,7 +128,7 @@ test('verify-sensors degrades parseably for a v2 sensor that exits 2 without fin
         writeJson(path_1.default.join(awmHome, 'registries.json'), [{ name: 'baseline', remote: 'fixture' }]);
         writeJson(path_1.default.join(project, '.awm', 'sensors.json'), {
             schemaVersion: 2, pack: 'fixture', packSelection: 'explicit', sensors: { lint: {
-                    enabled: true, fast: true, variantId: 'fixture-v1', command: { executable: 'node', resolution: 'path', args: ['fixture-sensor.mjs'] }, assets: ['fixture-sensor.config.mjs'],
+                    enabled: true, fast: true, variantId: 'fixture-v1', command: { executable: 'fixture-sensor', resolution: 'node-modules-bin', args: fixtureArgs }, assets: ['fixture-sensor.config.mjs'],
                     initializedCompatibility: { state: 'certified', reason: 'fixture', variantId: 'fixture-v1', toolVersion: '1.0.0', runtimeVersion: process.versions.node, certifiedRange: '>=1 <2', evidence: [] },
                 } },
         });

package/dist/tests/integration/sensor-bootstrap.e2e.test.js

@@ -14,6 +14,7 @@ const safe_file_1 = require("../../src/commands/sensors/compatibility/safe-file"
 const native_bridge_1 = require("../../src/core/secure-fs/native-bridge");
 const cliRoot = path_1.default.resolve(__dirname, '../..');
 const bin = path_1.default.join(cliRoot, 'dist/src/index.js');
+const nativeArtifact = path_1.default.join(cliRoot, 'prebuilds', `${process.platform}-${process.arch}`, 'secure_fs.node');
 const fixtureRoot = path_1.default.join(cliRoot, 'tests/fixtures/sensor-compatibility');
 function hashTree(root) {
     const hash = crypto_1.default.createHash('sha256');
@@ -70,6 +71,8 @@ function v2Manifest() {
 beforeAll(() => {
     if (!fs_1.default.existsSync(bin))
         throw new Error(`Sensor bootstrap E2E requires the compiled CLI at ${bin}; run npm run build before this test.`);
+    if (!fs_1.default.existsSync(nativeArtifact))
+        throw new Error(`Sensor bootstrap E2E requires the host secure-fs artifact at ${nativeArtifact}; run npm run native:build before this test.`);
 });
 test('compiled bootstrap creates once and the exact second invocation is a byte-stable no-op', () => {
     const subject = fixture();
@@ -163,3 +166,37 @@ test('compiled bootstrap migrates v2 once, preserves all non-manifest project by
         fs_1.default.rmSync(subject.root, { recursive: true, force: true });
     }
 });
+test('compiled bootstrap requires explicit project-sensors mode before replacing a legacy manifest', () => {
+    const subject = fixture();
+    try {
+        const manifest = path_1.default.join(subject.project, '.awm', 'sensors.json');
+        const legacy = {
+            pack: 'js-ts',
+            sensors: { lint: { cmd: 'npx eslint .' } },
+        };
+        fs_1.default.writeFileSync(manifest, JSON.stringify(legacy, null, 2) + '\n');
+        const before = fs_1.default.readFileSync(manifest);
+        const machineBefore = hashTree(subject.awmHome);
+        const blocked = run(subject, '--dry-run');
+        expect(blocked.status).toBe(1);
+        expect(`${blocked.stdout}${blocked.stderr}`).toContain('legacy-replacement-requires-project-sensors-mode');
+        expect(fs_1.default.readFileSync(manifest)).toEqual(before);
+        const dryRun = run(subject, '--mode', 'project-sensors', '--dry-run');
+        expect(dryRun.status).toBe(0);
+        expect(fs_1.default.readFileSync(manifest)).toEqual(before);
+        const migrated = run(subject, '--mode', 'project-sensors');
+        expect(migrated.status).toBe(0);
+        expect(`${migrated.stdout}${migrated.stderr}`).toContain('migrated');
+        expect(`${migrated.stdout}${migrated.stderr}`).not.toContain('legacy-v1-preserved');
+        expect(JSON.parse(fs_1.default.readFileSync(manifest, 'utf8'))).toMatchObject({
+            schemaVersion: 3,
+            mode: 'project-sensors',
+            pack: 'js-ts',
+            source: { registry: 'baseline' },
+        });
+        expect(hashTree(subject.awmHome)).toBe(machineBefore);
+    }
+    finally {
+        fs_1.default.rmSync(subject.root, { recursive: true, force: true });
+    }
+});

package/dist/tests/integration/sensor-structured-run.e2e.test.js

@@ -26,6 +26,7 @@ function createFixture() {
     const awmHome = path_1.default.join(root, 'awm-home');
     const registryRoot = path_1.default.join(awmHome, 'registries', 'baseline');
     const literal = shellSensitiveLiteral;
+    const args = ['-e', "require('fs').writeFileSync('structured-argv.json', JSON.stringify(process.argv.slice(1)));", '--', literal];
     writeJson(path_1.default.join(project, 'package.json'), { name: 'structured-run-fixture', private: true });
     // Local metadata is the compatibility evidence. It is not a tool found in a
     // global installation, so init and run must keep resolving this fixture's pack.
@@ -33,10 +34,12 @@ function createFixture() {
         name: 'fixture-sensor', version: '1.0.0',
     });
     fs_1.default.writeFileSync(path_1.default.join(project, 'fixture-sensor.config.mjs'), 'export default {};\n');
-    fs_1.default.writeFileSync(path_1.default.join(project, 'fixture-sensor.mjs'), [
-        "import fs from 'fs';",
-        "fs.writeFileSync('structured-argv.json', JSON.stringify(process.argv.slice(2)));",
-    ].join('\n'));
+    const fixtureBin = path_1.default.join(project, 'node_modules', '.bin', process.platform === 'win32' ? 'fixture-sensor.exe' : 'fixture-sensor');
+    fs_1.default.mkdirSync(path_1.default.dirname(fixtureBin), { recursive: true });
+    // A real local native executable works on Windows too; shebang scripts do
+    // not. The controlled program and adversarial literal remain separate argv.
+    fs_1.default.copyFileSync(process.execPath, fixtureBin);
+    fs_1.default.chmodSync(fixtureBin, 0o755);
     writeJson(path_1.default.join(registryRoot, 'sensor-packs', 'fixture', 'pack.json'), {
         schemaVersion: 2,
         name: 'fixture',
@@ -53,10 +56,9 @@ function createFixture() {
                             runtime: 'node', runtimeRange: '>=20', configFiles: ['fixture-sensor.config.mjs'],
                         },
                         certifiedRange: '>=1 <2',
-                        // `node` is resolved from the process environment, but the actual
-                        // executable payload is the fixture-local script. Keeping the
-                        // literal as one argv element proves no shell parses it.
-                        command: { executable: 'node', resolution: 'path', args: ['fixture-sensor.mjs', literal] },
+                        // The fixture executable is project-local. Keeping the literal
+                        // as one argv element proves no shell parses it.
+                        command: { executable: 'fixture-sensor', resolution: 'node-modules-bin', args },
                         assets: ['fixture-sensor.config.mjs'], formatter: 'generic', probe: { kind: 'config-present' },
                     }],
             },
@@ -72,7 +74,7 @@ function createFixture() {
         },
     });
     writeJson(path_1.default.join(awmHome, 'registries.json'), [{ name: 'baseline', remote: 'fixture' }]);
-    return { root, project, awmHome, registryRoot, literal };
+    return { root, project, awmHome, registryRoot, literal, args };
 }
 function runCli(fixture, ...args) {
     return (0, child_process_1.spawnSync)(process.execPath, [bin, 'sensors', ...args], {
@@ -111,7 +113,7 @@ test('compiled sensors run materializes a v2 registry command and passes its lit
             mode: 'project-sensors',
             pack: 'fixture',
             source: { registry: 'baseline' },
-            sensors: { structured: { variantId: 'fixture-v1', command: { executable: 'node', resolution: 'path', args: ['fixture-sensor.mjs', fixture.literal] } } },
+            sensors: { structured: { variantId: 'fixture-v1', command: { executable: 'fixture-sensor', resolution: 'node-modules-bin', args: fixture.args } } },
         });
         const result = runCli(fixture, 'run', '--fast');
         assertSuccessfulCli(result, 'run --fast', true);

package/dist/tests/providers/injection-config.test.js

@@ -6,18 +6,26 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const providers_1 = require("../../src/providers");
+const paths_1 = require("../../src/core/paths");
 describe('getInjection', () => {
     it('returns cc-settings-merge for claude-code', () => {
         const inj = (0, providers_1.getInjection)('claude-code');
         expect(inj?.type).toBe('cc-settings-merge');
     });
     it('returns config-instructions for opencode pointing at the global opencode.json', () => {
-        const inj = (0, providers_1.getInjection)('opencode');
-        expect(inj).toEqual({
-            type: 'config-instructions',
-            configPath: path_1.default.join(os_1.default.homedir(), '.config/opencode/opencode.json'),
-            field: 'instructions',
-        });
+        // Windows os.homedir() uses USERPROFILE while the CLI honors HOME.
+        const systemHome = jest.spyOn(os_1.default, 'homedir').mockReturnValue(path_1.default.resolve('different-system-profile'));
+        try {
+            const inj = (0, providers_1.getInjection)('opencode');
+            expect(inj).toEqual({
+                type: 'config-instructions',
+                configPath: path_1.default.join((0, paths_1.homeDir)(), '.config/opencode/opencode.json'),
+                field: 'instructions',
+            });
+        }
+        finally {
+            systemHome.mockRestore();
+        }
     });
     it('returns undefined for antigravity (no injection mechanism wired yet)', () => {
         expect((0, providers_1.getInjection)('antigravity')).toBeUndefined();

package/dist/tests/structural/directory-fsync-is-single-source.test.js

@@ -0,0 +1,97 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Structural guard, same family as symlink-type-is-explicit.test.ts.
+//
+// fsync-ing a DIRECTORY file descriptor is a POSIX-only capability. On Windows
+// `fs.openSync(dir, 'r')` succeeds and the following `fs.fsyncSync(fd)` always
+// fails with EPERM — libuv's mapping of `FlushFileBuffers` on a directory
+// handle, which Win32 rejects categorically. That is not a durability failure
+// (NTFS journals the rename itself); the mechanism simply does not exist there.
+//
+// `atomic-file.fsyncDirSync` is where that decision lives, and it is deliberately
+// narrow: degrade ONLY on win32 + EPERM at the fsync, keep throwing everywhere
+// else. Re-implementing the open/fsync/close sequence inline re-creates the gap
+// without the exception, and it fails on Windows and nowhere else — invisible to
+// every local run, and behind CI's `--bail` it costs one full matrix round to
+// surface. That is exactly how `tests/core/model-policy/store.test.ts` broke the
+// Windows legs of the matrix while all four POSIX legs stayed green.
+//
+// So the rule is about the CALL, not about any one call site: a directory fd may
+// be flushed only through `fsyncDirSync`. This scans `tests` as well as `src` —
+// the regression that motivated it lived in a test double, and a guard that only
+// watched `src` would have reported a clean bill of health.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const CLI = path_1.default.join(__dirname, '..', '..');
+const ROOTS = ['src', 'tests'];
+/** The single source of the policy: the one file allowed to flush a directory fd. */
+const SINGLE_SOURCE = path_1.default.join('src', 'core', 'atomic-file.ts');
+/** This guard itself, which must quote the forbidden shape to describe and test it. */
+const THIS_GUARD = path_1.default.join('tests', 'structural', 'directory-fsync-is-single-source.test.ts');
+function sourceFiles(dir) {
+    const out = [];
+    for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+        const full = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...sourceFiles(full));
+        else if (entry.name.endsWith('.ts'))
+            out.push(full);
+    }
+    return out;
+}
+/** True when `lines[i]` opens something that reads as a directory. Deliberately
+ *  shallow — it recognises the shapes this codebase actually writes. Something
+ *  cleverer that defeats it should be calling `fsyncDirSync` instead. */
+function opensADirectory(line) {
+    const open = /\bfs\.openSync\s*\(\s*([^,]+),/.exec(line);
+    if (!open)
+        return false;
+    const target = open[1];
+    return /\bpath\.dirname\s*\(|\bdirname\s*\(/.test(target) || /\b(dir|Dir|root|Root)\b|Dir\b/.test(target);
+}
+/** True when the fd opened at `lines[i]` is flushed within the next few lines. */
+function flushedNearby(lines, i) {
+    return /\bfsyncSync\s*\(/.test(lines.slice(i, i + 4).join('\n'));
+}
+describe('directory fsync has exactly one implementation', () => {
+    it('no file outside atomic-file.ts opens a directory and flushes it inline', () => {
+        const offenders = [];
+        for (const root of ROOTS) {
+            for (const file of sourceFiles(path_1.default.join(CLI, root))) {
+                const relative = path_1.default.relative(CLI, file);
+                if (relative === SINGLE_SOURCE || relative === THIS_GUARD)
+                    continue;
+                const lines = fs_1.default.readFileSync(file, 'utf-8').split('\n');
+                lines.forEach((line, i) => {
+                    if (!opensADirectory(line) || !flushedNearby(lines, i))
+                        return;
+                    offenders.push(`${relative}:${i + 1}: ${line.trim()}`);
+                });
+            }
+        }
+        expect(offenders).toEqual([]);
+    });
+    it('the guard actually rejects the shape that broke the Windows matrix', () => {
+        // Without this, a guard whose regex silently stopped matching would read as
+        // a clean bill of health forever — the failure mode of every structural test.
+        const rejects = (lines, i) => opensADirectory(lines[i]) && flushedNearby(lines, i);
+        // Verbatim shape of the store.test.ts regression this guard exists to stop.
+        const regression = [
+            'fs.renameSync(temporary, file);',
+            "const parent = fs.openSync(path.dirname(file), 'r');",
+            'try { fs.fsyncSync(parent); } finally { fs.closeSync(parent); }',
+        ];
+        expect(rejects(regression, 1)).toBe(true);
+        // The sanctioned replacement carries no directory open at all.
+        expect(regression.map((_, i) => i).some(i => rejects(['fsyncDirSync(path.dirname(file));'], 0))).toBe(false);
+        // Flushing a FILE descriptor stays legal — that is a real, portable fsync.
+        const fileFlush = ["const fd = fs.openSync(temporary, 'wx', 0o600);", 'fs.fsyncSync(fd);'];
+        expect(rejects(fileFlush, 0)).toBe(false);
+        // Opening a directory without flushing it (readdir-style handles) stays legal.
+        const openOnly = ["const parent = fs.openSync(path.dirname(file), 'r');", 'fs.closeSync(parent);'];
+        expect(rejects(openOnly, 0)).toBe(false);
+    });
+});

package/dist/tests/structural/jest-environment-is-isolated.test.js

@@ -6,44 +6,49 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const os_1 = __importDefault(require("os"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+function isWithin(parent, candidate, pathApi = path_1.default) {
+    const relative = pathApi.relative(parent, candidate);
+    return relative === '' || (relative !== '..' && !relative.startsWith(`..${pathApi.sep}`) && !pathApi.isAbsolute(relative));
+}
 describe('Jest environment isolation', () => {
+    it('treats a path on another volume as outside the operator home', () => {
+        expect(isWithin('C:\\operator-home', 'D:\\suite-root', path_1.default.win32)).toBe(false);
+    });
     it('does not inherit the operator Codex home', () => {
         expect(process.env.CODEX_HOME).toBeUndefined();
     });
     it('uses a suite-owned temporary directory', () => {
         expect(os_1.default.tmpdir()).toContain('awm-jest-');
     });
-    it('falls back to the system temp directory when the home cache is read-only', async () => {
+    it('routes every unscoped AWM write into the suite-owned temporary directory', () => {
+        expect(process.env.AWM_HOME).toBe(path_1.default.join(process.env.AWM_JEST_TMPDIR, 'awm-home'));
+    });
+    it('keeps the suite root and both homes outside the operator home', () => {
+        const suiteRoot = process.env.AWM_JEST_TMPDIR;
+        const operatorHome = fs_1.default.realpathSync(os_1.default.userInfo().homedir);
+        expect(isWithin(operatorHome, suiteRoot)).toBe(false);
+        expect(process.env.HOME).toBe(path_1.default.join(suiteRoot, 'home'));
+        expect(process.env.AWM_HOME).toBe(path_1.default.join(suiteRoot, 'awm-home'));
+    });
+    it('creates its physical root below the system temp directory, not the operator home', async () => {
         const originalEnv = { ...process.env };
-        const fallback = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-jest-fallback-'));
+        const systemTemp = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-jest-system-'));
+        const operatorHome = path_1.default.join(systemTemp, 'operator-home');
         try {
+            fs_1.default.mkdirSync(operatorHome);
             jest.resetModules();
             jest.doMock('os', () => ({
                 ...jest.requireActual('os'),
-                homedir: () => '/readonly-home',
-                tmpdir: () => fallback,
-            }));
-            const actualFs = jest.requireActual('fs');
-            jest.doMock('fs', () => ({
-                ...actualFs,
-                mkdirSync: jest.fn((target, ...args) => {
-                    if (String(target).includes('readonly-home')) {
-                        return undefined;
-                    }
-                    return actualFs.mkdirSync(target, ...args);
-                }),
-                mkdtempSync: jest.fn((prefix, ...args) => {
-                    if (prefix.includes('readonly-home')) {
-                        const error = new Error('read-only');
-                        error.code = 'EROFS';
-                        throw error;
-                    }
-                    return actualFs.mkdtempSync(prefix, ...args);
-                }),
+                homedir: () => operatorHome,
+                tmpdir: () => systemTemp,
             }));
             const setup = require('../../jest.global-setup.js');
             await expect(setup()).resolves.toBeUndefined();
-            expect(process.env.AWM_JEST_TMPDIR?.startsWith(path_1.default.join(fallback, 'awm-cache', 'awm-jest-'))).toBe(true);
+            const suiteRoot = process.env.AWM_JEST_TMPDIR;
+            expect(suiteRoot.startsWith(path_1.default.join(fs_1.default.realpathSync(systemTemp), 'awm-jest-'))).toBe(true);
+            expect(isWithin(operatorHome, suiteRoot)).toBe(false);
+            expect(process.env.HOME).toBe(path_1.default.join(suiteRoot, 'home'));
+            expect(process.env.AWM_HOME).toBe(path_1.default.join(suiteRoot, 'awm-home'));
         }
         finally {
             jest.dontMock('fs');
@@ -52,7 +57,7 @@ describe('Jest environment isolation', () => {
             for (const key of Object.keys(process.env))
                 delete process.env[key];
             Object.assign(process.env, originalEnv);
-            fs_1.default.rmSync(fallback, { recursive: true, force: true });
+            fs_1.default.rmSync(systemTemp, { recursive: true, force: true });
         }
     });
 });

package/dist/tests/structural/native-release-artifacts.test.js

@@ -9,6 +9,22 @@ const path_1 = __importDefault(require("path"));
 const CLI_ROOT = path_1.default.resolve(__dirname, '..', '..');
 const REPO_ROOT = path_1.default.resolve(CLI_ROOT, '..');
 describe('native release artifacts', () => {
+    it('checks Windows admission before full suites and stops a failed suite without weakening publication', () => {
+        for (const name of ['ci.yml', 'release.yml']) {
+            const workflow = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', name), 'utf8');
+            expect(workflow).toContain('- name: Windows admission smoke');
+            expect(workflow).toContain("if: runner.os == 'Windows'");
+            expect(workflow).toContain('run: npx jest tests/commands/plan/index.test.ts --runInBand --bail');
+            expect(workflow).toContain('run: npx jest --runInBand --bail');
+            expect(workflow.indexOf('- name: Windows admission smoke')).toBeLessThan(workflow.indexOf('run: npx jest --runInBand --bail'));
+        }
+        const release = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', 'release.yml'), 'utf8');
+        expect(release).toMatch(/release:\s*\n\s*needs: test/);
+        for (const target of ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64', 'win32-x64', 'win32-arm64']) {
+            expect(release).toContain(`target: ${target}`);
+        }
+        expect(release).toContain('cancel-in-progress: false');
+    });
     it('keeps native prebuilds generated instead of versioned source', () => {
         const gitignore = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.gitignore'), 'utf8');
         const tracked = (0, child_process_1.execFileSync)('git', ['ls-files', '--', 'cli/prebuilds'], {
@@ -19,4 +35,18 @@ describe('native release artifacts', () => {
         expect(gitignore).toContain('cli/native-artifacts/');
         expect(tracked).toBe('');
     });
+    it('builds the fault-injection addon before every Jest suite without publishing it', () => {
+        const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(CLI_ROOT, 'package.json'), 'utf8'));
+        expect(pkg.scripts['native:test-build']).toContain('secure_fs_test');
+        for (const name of ['ci.yml', 'release.yml']) {
+            const workflow = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', name), 'utf8');
+            const testBuild = workflow.indexOf('run: npm run native:test-build');
+            const jest = workflow.indexOf('run: npx jest --runInBand --bail');
+            expect(testBuild).toBeGreaterThanOrEqual(0);
+            expect(testBuild).toBeLessThan(jest);
+            expect(workflow).toContain("'native/build/Release', 'secure_fs_test.node'");
+            expect(workflow).not.toContain('path: cli/prebuilds/${{ matrix.target }}/secure_fs_test.node');
+            expect(workflow).not.toContain('secure_fs_test.node\n');
+        }
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.7.1",
+  "version": "9.9.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -18,7 +18,8 @@
     "doc": "docs"
   },
   "scripts": {
-    "native:build": "node-gyp rebuild --directory native && node scripts/package-native.js",
+    "native:build": "node-gyp configure --directory native && node-gyp build --directory native -- secure_fs && node scripts/package-native.js",
+    "native:test-build": "node-gyp configure --directory native && node-gyp build --directory native -- secure_fs_test",
     "native:package-check": "node scripts/assert-native-package.js",
     "build": "tsc && chmod +x dist/src/index.js",
     "typecheck": "tsc --noEmit",
@@ -47,7 +48,7 @@
   },
   "description": "CLI to manage Agentic Workflows - install skills, workflows, and processes for AI agents",
   "dependencies": {
-    "@clack/prompts": "^1.0.1",
+    "@clack/prompts": "^0.11.0",
     "commander": "^14.0.3",
     "picocolors": "^1.1.1",
     "semver": "^7.7.4",