@ashlr/stack-core 0.1.1 → 0.2.2

package/src/__tests__/github-provider.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import github from "../providers/github.ts";
 import type { ProviderContext } from "../providers/_base.ts";
+import github from "../providers/github.ts";
 import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
 
 describe("github provider (mocked fetch)", () => {
@@ -8,7 +8,8 @@ describe("github provider (mocked fetch)", () => {
   let realFetch: typeof fetch;
 
   beforeEach(() => {
-    h = setupFakePhantom();
+    // Provider logic after a token is read; real Phantom 0.7.9 refuses headless reveal.
+    h = setupFakePhantom({}, { legacyHeadlessReveal: true });
     realFetch = globalThis.fetch;
   });
 

package/src/__tests__/helpers.test.ts

@@ -1,6 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { addSecret } from "../phantom.ts";
-import { bearerJsonHeaders, tryRevealSecret } from "../providers/_helpers.ts";
+import { bearerJsonHeaders, takeRevealRefusals, tryRevealSecret } from "../providers/_helpers.ts";
 import { type Harness, setupFakePhantom } from "./_harness.ts";
 
 /**
@@ -11,7 +10,12 @@ import { type Harness, setupFakePhantom } from "./_harness.ts";
 describe("provider helpers", () => {
   let h: Harness;
   beforeEach(() => {
-    h = setupFakePhantom({ PRESENT_KEY: "hello-world" });
+    // Legacy headless reveal exercises the helper's own logic; the last test
+    // below covers what Phantom Secrets 0.7.9 actually does.
+    h = setupFakePhantom(
+      { PRESENT_KEY: "hello-world", EMPTY_KEY: "" },
+      { legacyHeadlessReveal: true },
+    );
   });
   afterEach(() => h.cleanup());
 
@@ -20,7 +24,6 @@ describe("provider helpers", () => {
   });
 
   test("tryRevealSecret returns undefined for an empty value", async () => {
-    await addSecret("EMPTY_KEY", "");
     expect(await tryRevealSecret("EMPTY_KEY")).toBeUndefined();
   });
 
@@ -29,6 +32,23 @@ describe("provider helpers", () => {
     expect(await tryRevealSecret("NEVER_STORED_KEY")).toBeUndefined();
   });
 
+  test("tryRevealSecret returns undefined when Phantom refuses headless reveal", async () => {
+    h.cleanup();
+    h = setupFakePhantom({ PRESENT_KEY: "hello-world" });
+    takeRevealRefusals();
+    expect(await tryRevealSecret("PRESENT_KEY")).toBeUndefined();
+    // The refusal is recorded by name so doctor can say "stored, unverified".
+    expect(takeRevealRefusals()).toEqual(["PRESENT_KEY"]);
+    expect(takeRevealRefusals()).toEqual([]);
+  });
+
+  test("a readable or absent value records no refusal", async () => {
+    takeRevealRefusals();
+    await tryRevealSecret("PRESENT_KEY");
+    await tryRevealSecret("NEVER_STORED_KEY");
+    expect(takeRevealRefusals()).toEqual([]);
+  });
+
   test("bearerJsonHeaders returns the canonical shape", () => {
     const headers = bearerJsonHeaders("my-token") as Record<string, string>;
     expect(headers.Authorization).toBe("Bearer my-token");

package/src/__tests__/http.test.ts

@@ -220,8 +220,8 @@ describe("parseRetryAfter", () => {
     const parsed = parseRetryAfter(future);
     expect(parsed).toBeDefined();
     // Allow drift from test overhead; we just need it to be in the right ballpark.
-    expect(parsed!).toBeGreaterThan(5_000);
-    expect(parsed!).toBeLessThanOrEqual(12_000);
+    expect(parsed as number).toBeGreaterThan(5_000);
+    expect(parsed as number).toBeLessThanOrEqual(12_000);
   });
 
   test("HTTP-date in the past clamps to 0", () => {

package/src/__tests__/inference.test.ts

@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { CostTracker } from "../ai/cost-tracker.ts";
 import {
   ClaudeMCPBackend,
   LocalSLMBackend,
@@ -6,7 +7,6 @@ import {
   getInferenceBackend,
   parseRecipeDraft,
 } from "../ai/inference.ts";
-import { CostTracker } from "../ai/cost-tracker.ts";
 
 /**
  * Inference backend tests. The local backend talks to an OpenAI-compatible
@@ -15,7 +15,10 @@ import { CostTracker } from "../ai/cost-tracker.ts";
  */
 
 // Minimal valid chat-completion response.
-function okChatResponse(content: string, usage?: { prompt_tokens?: number; completion_tokens?: number }) {
+function okChatResponse(
+  content: string,
+  usage?: { prompt_tokens?: number; completion_tokens?: number },
+) {
   return new Response(
     JSON.stringify({
       choices: [{ message: { content } }],
@@ -117,7 +120,10 @@ describe("LocalSLMBackend — infer", () => {
   test("happy path — parses recipe + records usage with reported tokens", async () => {
     const costTracker = new CostTracker();
     const fetchImpl = (async () =>
-      okChatResponse(VALID_RECIPE_JSON, { prompt_tokens: 120, completion_tokens: 45 })) as unknown as typeof fetch;
+      okChatResponse(VALID_RECIPE_JSON, {
+        prompt_tokens: 120,
+        completion_tokens: 45,
+      })) as unknown as typeof fetch;
 
     const backend = new LocalSLMBackend({
       endpoints: [{ name: "lm-studio-fake", baseUrl: "http://fake/v1", model: "test" }],
@@ -146,7 +152,8 @@ describe("LocalSLMBackend — infer", () => {
   test("falls back to the second endpoint when the first fails", async () => {
     let call = 0;
     const fetchImpl = (async (input: string | URL | Request) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const url =
+        typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
       call++;
       if (url.includes("primary")) {
         throw new Error("ECONNREFUSED");
@@ -228,14 +235,15 @@ describe("LocalSLMBackend — infer", () => {
       costTracker: new CostTracker(),
     });
 
-    await expect(
-      backend.infer({ query: "x", catalogContext: "" }),
-    ).rejects.toBeInstanceOf(NoInferenceBackendError);
+    await expect(backend.infer({ query: "x", catalogContext: "" })).rejects.toBeInstanceOf(
+      NoInferenceBackendError,
+    );
   });
 
   test("healthy pings /models and returns true when any endpoint responds", async () => {
     const fetchImpl = (async (input: string | URL | Request) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const url =
+        typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
       if (url.endsWith("/models")) return new Response("[]", { status: 200 });
       return new Response("", { status: 500 });
     }) as unknown as typeof fetch;
@@ -252,19 +260,17 @@ describe("parseRecipeDraft", () => {
   test("parses plain JSON", () => {
     const draft = parseRecipeDraft(VALID_RECIPE_JSON);
     expect(draft.providers).toHaveLength(2);
-    expect(draft.providers[0]!.name).toBe("neon");
+    expect(draft.providers[0]?.name).toBe("neon");
   });
 
   test("tolerates markdown fences", () => {
-    const wrapped = "```json\n" + VALID_RECIPE_JSON + "\n```";
+    const wrapped = `\`\`\`json\n${VALID_RECIPE_JSON}\n\`\`\``;
     const draft = parseRecipeDraft(wrapped);
     expect(draft.providers).toHaveLength(2);
   });
 
   test("tolerates leading prose", () => {
-    const draft = parseRecipeDraft(
-      "Sure! Here's the recipe:\n" + VALID_RECIPE_JSON + "\nLet me know!",
-    );
+    const draft = parseRecipeDraft(`Sure! Here's the recipe:\n${VALID_RECIPE_JSON}\nLet me know!`);
     expect(draft.providers).toHaveLength(2);
   });
 

package/src/__tests__/interactive-prompt.test.ts

@@ -0,0 +1,106 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { emptyConfig, writeConfig } from "../config.ts";
+import { addService } from "../pipeline.ts";
+import type { PromptRequest, Provider, ProviderContext } from "../providers/_base.ts";
+import { promptSecret } from "../providers/_helpers.ts";
+import { providers } from "../providers/index.ts";
+import { type Harness, setupFakePhantom } from "./_harness.ts";
+
+/**
+ * Regression coverage for the interactive-auth hang: a provider's PAT/key
+ * paste must go through the host-supplied `ctx.prompt` (which the CLI pauses
+ * its spinner around) rather than writing to stderr and blocking on stdin
+ * behind a live spinner. See `promptSecret` + `ProviderContext.prompt`.
+ */
+describe("interactive credential prompting", () => {
+  test("promptSecret routes through ctx.prompt, trims, and marks the field secret", async () => {
+    const seen: PromptRequest[] = [];
+    const ctx: ProviderContext = {
+      cwd: ".",
+      interactive: true,
+      log: () => {},
+      prompt: async (req) => {
+        seen.push(req);
+        return "  tok-abc123  "; // surrounding whitespace must be trimmed off
+      },
+    };
+
+    const token = await promptSecret(ctx, {
+      message: "Paste your access token",
+      howTo: "create one at https://example.com/tokens",
+    });
+
+    expect(token).toBe("tok-abc123");
+    expect(seen).toHaveLength(1);
+    expect(seen[0]).toEqual({
+      message: "Paste your access token",
+      howTo: "create one at https://example.com/tokens",
+      secret: true,
+    });
+  });
+
+  describe("threaded through addService", () => {
+    let h: Harness;
+    let cwd: string;
+    let originalCwd: string;
+
+    beforeEach(async () => {
+      h = setupFakePhantom();
+      cwd = mkdtempSync(join(tmpdir(), "stack-prompt-"));
+      originalCwd = process.cwd();
+      process.chdir(cwd);
+      await writeConfig(emptyConfig("test-template"), cwd);
+    });
+
+    afterEach(() => {
+      process.chdir(originalCwd);
+      Reflect.deleteProperty(providers, "promptsvc");
+      h.cleanup();
+    });
+
+    test("addService threads prompt into ctx so login receives the host-entered value", async () => {
+      let promptCalls = 0;
+      let loginToken: string | undefined;
+      const stubProvider: Provider = {
+        name: "promptsvc",
+        displayName: "Prompt Service",
+        category: "database",
+        authKind: "pat",
+        async login(ctx) {
+          // Exactly what every real provider's PAT-paste path now does.
+          const token = await promptSecret(ctx, { message: "Paste your Prompt Service token" });
+          loginToken = token;
+          return { token, identity: { id: "user-1" } };
+        },
+        async provision() {
+          return { id: "res-1", displayName: "res-1" };
+        },
+        async materialize() {
+          // No secrets/mcp keeps the pipeline off the Phantom vault, so this
+          // assertion runs identically on every platform.
+          return { secrets: {} };
+        },
+      };
+      providers.promptsvc = async () => stubProvider;
+
+      const result = await addService({
+        providerName: "promptsvc",
+        cwd,
+        interactive: true,
+        prompt: async () => {
+          promptCalls += 1;
+          return "host-entered-token";
+        },
+      });
+
+      expect(result.providerName).toBe("promptsvc");
+      // The host's prompt callback was invoked, and its value reached login via
+      // ctx → promptSecret — proof the wiring is end to end, not bypassed.
+      expect(promptCalls).toBe(1);
+      expect(loginToken).toBe("host-entered-token");
+    });
+  });
+});

package/src/__tests__/mcp-mirror.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { mergeMcpEntry, removeMcpEntry } from "../mcp-writer.ts";
+
+const tmp = () => mkdtempSync(join(tmpdir(), "stack-mirror-"));
+const readJson = (p: string) => JSON.parse(readFileSync(p, "utf-8"));
+
+describe("mcp-writer client mirroring", () => {
+  test("does not create client dirs that are absent", async () => {
+    const cwd = tmp();
+    await mergeMcpEntry({ name: "s", type: "stdio", command: "npx" }, cwd);
+    expect(existsSync(join(cwd, ".mcp.json"))).toBe(true);
+    expect(existsSync(join(cwd, ".cursor"))).toBe(false);
+    expect(existsSync(join(cwd, ".gemini"))).toBe(false);
+  });
+
+  test("mirrors into .cursor/mcp.json and .gemini/settings.json when dirs exist", async () => {
+    const cwd = tmp();
+    mkdirSync(join(cwd, ".cursor"));
+    mkdirSync(join(cwd, ".gemini"));
+    writeFileSync(
+      join(cwd, ".gemini", "settings.json"),
+      JSON.stringify({ theme: "dark", mcpServers: { other: { command: "o" } } }),
+    );
+    await mergeMcpEntry(
+      { name: "s", type: "stdio", command: "npx", args: ["-y", "x"], env: { K: "v" } },
+      cwd,
+    );
+    const g = readJson(join(cwd, ".gemini", "settings.json"));
+    expect(g.theme).toBe("dark");
+    expect(g.mcpServers.other.command).toBe("o");
+    expect(g.mcpServers.s).toEqual({ command: "npx", args: ["-y", "x"], env: { K: "v" } });
+    expect(readJson(join(cwd, ".cursor", "mcp.json")).mcpServers.s.command).toBe("npx");
+    // idempotent
+    await mergeMcpEntry(
+      { name: "s", type: "stdio", command: "npx", args: ["-y", "x"], env: { K: "v" } },
+      cwd,
+    );
+    expect(Object.keys(readJson(join(cwd, ".gemini", "settings.json")).mcpServers).sort()).toEqual([
+      "other",
+      "s",
+    ]);
+  });
+
+  test("gemini uses httpUrl for http and url for sse, with no type field", async () => {
+    const cwd = tmp();
+    mkdirSync(join(cwd, ".gemini"));
+    await mergeMcpEntry({ name: "h", type: "http", url: "https://a.example/mcp" }, cwd);
+    await mergeMcpEntry({ name: "e", type: "sse", url: "https://b.example/sse" }, cwd);
+    const m = readJson(join(cwd, ".gemini", "settings.json")).mcpServers;
+    expect(m.h).toEqual({ httpUrl: "https://a.example/mcp" });
+    expect(m.e).toEqual({ url: "https://b.example/sse" });
+    expect(readJson(join(cwd, ".mcp.json")).mcpServers.h.type).toBe("http");
+  });
+
+  test("a malformed sibling config is left untouched and does not fail the write", async () => {
+    const cwd = tmp();
+    mkdirSync(join(cwd, ".gemini"));
+    writeFileSync(join(cwd, ".gemini", "settings.json"), "{not json");
+    await mergeMcpEntry({ name: "s", type: "stdio", command: "npx" }, cwd);
+    expect(readFileSync(join(cwd, ".gemini", "settings.json"), "utf-8")).toBe("{not json");
+    expect(readJson(join(cwd, ".mcp.json")).mcpServers.s.command).toBe("npx");
+  });
+
+  test("removeMcpEntry removes from mirrors and keeps other entries", async () => {
+    const cwd = tmp();
+    mkdirSync(join(cwd, ".cursor"));
+    mkdirSync(join(cwd, ".gemini"));
+    await mergeMcpEntry({ name: "a", type: "stdio", command: "x" }, cwd);
+    await mergeMcpEntry({ name: "b", type: "stdio", command: "y" }, cwd);
+    await removeMcpEntry("a", cwd);
+    for (const p of [
+      join(cwd, ".mcp.json"),
+      join(cwd, ".cursor", "mcp.json"),
+      join(cwd, ".gemini", "settings.json"),
+    ]) {
+      const m = readJson(p).mcpServers;
+      expect(m.a).toBeUndefined();
+      expect(m.b.command).toBe("y");
+    }
+  });
+
+  test("a user's own same-name entry is neither overwritten nor deleted", async () => {
+    // Cursor and Gemini configs are user-owned. A hand-written "github" entry
+    // must survive `stack add github` and its rollback or `stack remove`.
+    const cwd = tmp();
+    mkdirSync(join(cwd, ".cursor"));
+    mkdirSync(join(cwd, ".gemini"));
+    const mine = { command: "my-github-mcp", env: { TOKEN: "${env:GH}" } };
+    for (const p of [join(cwd, ".cursor", "mcp.json"), join(cwd, ".gemini", "settings.json")]) {
+      writeFileSync(p, JSON.stringify({ mcpServers: { github: mine } }));
+    }
+    await mergeMcpEntry({ name: "github", type: "stdio", command: "npx", args: ["-y", "gh"] }, cwd);
+    expect(readJson(join(cwd, ".mcp.json")).mcpServers.github.command).toBe("npx");
+    for (const p of [join(cwd, ".cursor", "mcp.json"), join(cwd, ".gemini", "settings.json")]) {
+      expect(readJson(p).mcpServers.github).toEqual(mine);
+    }
+    await removeMcpEntry("github", cwd);
+    expect(readJson(join(cwd, ".mcp.json")).mcpServers.github).toBeUndefined();
+    for (const p of [join(cwd, ".cursor", "mcp.json"), join(cwd, ".gemini", "settings.json")]) {
+      expect(readJson(p).mcpServers.github).toEqual(mine);
+    }
+  });
+
+  test("an entry Stack mirrored earlier is updated when the provider entry changes", async () => {
+    const cwd = tmp();
+    mkdirSync(join(cwd, ".cursor"));
+    await mergeMcpEntry({ name: "s", type: "stdio", command: "npx", args: ["v1"] }, cwd);
+    await mergeMcpEntry({ name: "s", type: "stdio", command: "npx", args: ["v2"] }, cwd);
+    expect(readJson(join(cwd, ".cursor", "mcp.json")).mcpServers.s.args).toEqual(["v2"]);
+    await removeMcpEntry("s", cwd);
+    expect(readJson(join(cwd, ".cursor", "mcp.json")).mcpServers.s).toBeUndefined();
+  });
+});

package/src/__tests__/neon-provider.test.ts

@@ -1,8 +1,16 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import neon from "../providers/neon.ts";
+import { readFileSync, writeFileSync } from "node:fs";
+import { emptyConfig, readConfig, writeConfig } from "../config.ts";
+import { addService } from "../pipeline.ts";
 import type { ProviderContext } from "../providers/_base.ts";
+import { providers } from "../providers/index.ts";
+import neon from "../providers/neon.ts";
 import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
 
+const inertPreconnect: typeof fetch.preconnect = () => {
+  throw new Error("Unexpected fetch preconnect in inert fixture.");
+};
+
 describe("neon provider (mocked fetch)", () => {
   let h: Harness;
   let realFetch: typeof fetch;
@@ -14,6 +22,7 @@ describe("neon provider (mocked fetch)", () => {
 
   afterEach(() => {
     globalThis.fetch = realFetch;
+    Reflect.deleteProperty(providers, "neonrollbackfixture");
     h.cleanup();
   });
 
@@ -51,9 +60,60 @@ describe("neon provider (mocked fetch)", () => {
     expect(materialized.secrets.NEON_API_KEY).toBe("neon_fake");
     expect(materialized.secrets.DATABASE_URL).toBe(connectionUri);
 
-    // Provision stores a project-scoped copy so other providers can't stomp it.
+    // Provision never writes the vault before pipeline rollback owns the resource.
     const vault = await readVault(h.dir);
-    expect(vault[`NEON_DATABASE_URL_${projectId}`]).toBe(connectionUri);
+    expect(vault[`NEON_DATABASE_URL_${projectId}`]).toBeUndefined();
+    // DATABASE_URL is written once, by the pipeline from materialize(): Phantom
+    // never replaces a stored name, so provision must not claim it first.
+    expect(vault.DATABASE_URL).toBeUndefined();
+  });
+
+  test("fresh URI storage failure reaches rollback after the created resource is returned", async () => {
+    const projectId = "proj_rollback";
+    await writeConfig(emptyConfig(), h.dir);
+    writeFileSync(h.vaultPath, JSON.stringify({ DATABASE_URL: "synthetic-existing" }));
+    const before = readFileSync(`${h.dir}/.stack.toml`, "utf8");
+    const calls = { created: 0, freshURI: 0, deleted: 0 };
+    globalThis.fetch = (async (url: string | URL | Request, init?: RequestInit) => {
+      const u = String(url);
+      const method = init?.method ?? "GET";
+      if (u.endsWith("/projects") && method === "POST") {
+        calls.created++;
+        return new Response(
+          JSON.stringify({
+            project: { id: projectId, name: "inert", region_id: "fixture" },
+            connection_uris: [{ connection_uri: "synthetic-provision-uri" }],
+          }),
+          { status: 201 },
+        );
+      }
+      if (u.endsWith(`/projects/${projectId}/connection_uri`) && method === "GET") {
+        calls.freshURI++;
+        return new Response(JSON.stringify({ uri: "synthetic-fresh-uri" }), { status: 200 });
+      }
+      if (u.endsWith(`/projects/${projectId}`) && method === "DELETE") {
+        calls.deleted++;
+        return new Response("", { status: 200 });
+      }
+      throw new Error(`unexpected inert ${method} route`);
+    }) as unknown as typeof fetch;
+    providers.neonrollbackfixture = async () => ({
+      ...neon,
+      name: "neonrollbackfixture",
+      async login() {
+        return { token: "synthetic-key", identity: {} };
+      },
+    });
+    await expect(
+      addService({ providerName: "neonrollbackfixture", cwd: h.dir, interactive: false }),
+    ).rejects.toMatchObject({ code: "ADD_SERVICE_ROLLED_BACK" });
+    expect(calls).toEqual({ created: 1, freshURI: 1, deleted: 1 });
+    expect(readFileSync(`${h.dir}/.stack.toml`, "utf8")).toBe(before);
+    expect((await readConfig(h.dir)).services.neonrollbackfixture).toBeUndefined();
+    const vault = await readVault(h.dir);
+    expect(vault.DATABASE_URL).toBe("synthetic-existing");
+    expect(vault[`NEON_DATABASE_URL_${projectId}`]).toBeUndefined();
+    expect(h.callsTo("add").map((call) => call.args[0])).toEqual(["NEON_API_KEY", "DATABASE_URL"]);
   });
 
   test("healthcheck returns error when the project 404s", async () => {
@@ -76,4 +136,77 @@ describe("neon provider (mocked fetch)", () => {
     });
     expect(status.kind).toBe("error");
   });
+  test.each([204, 404])(
+    "DELETE %i is accepted exactly once without reading response bodies",
+    async (status) => {
+      let deletes = 0;
+      globalThis.fetch = Object.assign(
+        async (_url: unknown, init?: RequestInit) => {
+          expect(init?.method).toBe("DELETE");
+          deletes++;
+          return new Response(null, { status });
+        },
+        { preconnect: inertPreconnect },
+      );
+      await expect(
+        neon.deprovision!(
+          { cwd: h.dir, interactive: false, log() {} },
+          { token: "synthetic-key" },
+          "inert-project",
+        ),
+      ).resolves.toBeUndefined();
+      expect(deletes).toBe(1);
+    },
+  );
+
+  test.each([403, 500])(
+    "DELETE %i refuses unconfirmed teardown without exposing response contents",
+    async (status) => {
+      let deletes = 0;
+      globalThis.fetch = Object.assign(
+        async (_url: unknown, init?: RequestInit) => {
+          expect(init?.method).toBe("DELETE");
+          deletes++;
+          return new Response("synthetic-private-response-must-not-surface", { status });
+        },
+        { preconnect: inertPreconnect },
+      );
+      const error = await neon.deprovision!(
+        { cwd: h.dir, interactive: false, log() {} },
+        { token: "synthetic-key" },
+        "inert-project",
+      ).catch((err: Error) => err);
+      expect(error).toMatchObject({ code: "NEON_DELETE_FAILED" });
+      expect((error as Error).message).toContain(String(status));
+      expect((error as Error).message).not.toContain("synthetic-private-response-must-not-surface");
+      expect(deletes).toBe(1);
+    },
+  );
+
+  test("network failure refuses teardown with a fixed safe error and no raw transport output", async () => {
+    let deletes = 0;
+    const logs: string[] = [];
+    globalThis.fetch = Object.assign(
+      async () => {
+        deletes++;
+        throw new Error("synthetic-sensitive-transport-detail");
+      },
+      { preconnect: inertPreconnect },
+    );
+    const error = await neon.deprovision!(
+      {
+        cwd: h.dir,
+        interactive: false,
+        log(event) {
+          logs.push(event.msg);
+        },
+      },
+      { token: "synthetic-key" },
+      "inert-project",
+    ).catch((err: Error) => err);
+    expect(error).toMatchObject({ code: "NEON_DELETE_UNCONFIRMED" });
+    expect((error as Error).message).not.toContain("synthetic-sensitive-transport-detail");
+    expect(logs.join(" ")).not.toContain("synthetic-sensitive-transport-detail");
+    expect(deletes).toBe(1);
+  });
 });