@ashlr/stack-core 0.1.1 → 0.2.2

package/src/__tests__/phantom-contract.test.ts

@@ -0,0 +1,177 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { wirePhantomForRecipe } from "../ai/phantom-wire.ts";
+import { StackError } from "../errors.ts";
+import {
+  __resetPhantomCache,
+  addSecret,
+  isPhantomInstalled,
+  listSecrets,
+  removeSecret,
+  revealSecret,
+} from "../phantom.ts";
+import { takeRevealRefusals, tryRevealSecret } from "../providers/_helpers.ts";
+
+/**
+ * Producer/consumer contract: Stack's Phantom wrapper against a REAL
+ * `phantom` binary (Phantom Secrets 0.7.9 or newer).
+ *
+ * The fake in `_harness.ts` encodes what Stack assumes Phantom does; this
+ * suite checks those assumptions against the producer. It is opt-in because
+ * CI does not install Phantom:
+ *
+ *   STACK_PHANTOM_CONTRACT_BIN=/abs/path/to/phantom bun test phantom-contract
+ *
+ * The vault is an isolated encrypted-file vault under a temp HOME, unlocked
+ * with a throwaway passphrase. No keychain, network or real credential is used.
+ * Tests share that vault and run in order: later tests rely on names stored
+ * by earlier ones.
+ */
+
+const realBin = process.env.STACK_PHANTOM_CONTRACT_BIN;
+const enabled = Boolean(realBin && isAbsolute(realBin));
+
+const SYNTHETIC_VALUE = "stack-contract-synthetic-value-7f3e";
+
+describe.skipIf(!enabled)("phantom CLI contract (real binary)", () => {
+  let root = "";
+  let project = "";
+  const saved: Record<string, string | undefined> = {};
+  const cwd = process.cwd();
+
+  function phantom(args: string[], input?: string) {
+    return spawnSync("phantom", args, {
+      cwd: project,
+      input,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+  }
+
+  function vaultNames(): string[] {
+    const out = phantom(["list", "--json"]);
+    expect(out.status).toBe(0);
+    return (JSON.parse(out.stdout) as Array<{ name: string }>).map((e) => e.name).sort();
+  }
+
+  beforeAll(() => {
+    root = realpathSync(mkdtempSync(join(tmpdir(), "stack-phantom-contract-")));
+    const bin = join(root, "bin");
+    project = join(root, "project");
+    mkdirSync(bin);
+    mkdirSync(project);
+    mkdirSync(join(root, "home"));
+    symlinkSync(realBin as string, join(bin, "phantom"));
+    for (const k of ["PATH", "HOME", "PHANTOM_VAULT_PASSPHRASE", "RUST_BACKTRACE"]) {
+      saved[k] = process.env[k];
+    }
+    process.env.PATH = `${bin}:${process.env.PATH ?? ""}`;
+    process.env.HOME = join(root, "home");
+    process.env.PHANTOM_VAULT_PASSPHRASE = "stack-contract-throwaway-passphrase";
+    process.env.RUST_BACKTRACE = "0";
+    __resetPhantomCache();
+    spawnSync("git", ["init", "-q"], { cwd: project });
+    const init = phantom(["init", "--empty"]);
+    expect(init.status).toBe(0);
+    process.chdir(project);
+  });
+
+  afterAll(() => {
+    process.chdir(cwd);
+    for (const [k, v] of Object.entries(saved)) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
+    __resetPhantomCache();
+    if (root) rmSync(root, { recursive: true, force: true });
+  });
+
+  test("version probe detects the binary", async () => {
+    expect(await isPhantomInstalled()).toBe(true);
+  });
+
+  // Argv is asserted against the fake in phantom-harness.test.ts; the real
+  // binary rejects a positional value, so storing at all proves stdin.
+  test("addSecret stores a new name", async () => {
+    await addSecret("STACK_CONTRACT_A", SYNTHETIC_VALUE, project);
+    expect(vaultNames()).toContain("STACK_CONTRACT_A");
+  });
+
+  test("listSecrets returns exactly the stored names", async () => {
+    await addSecret("STACK_CONTRACT_B", SYNTHETIC_VALUE, project);
+    expect((await listSecrets(project)).sort()).toEqual(vaultNames());
+  });
+
+  test("completed identical creates refuse with typed errors and preserve the full name inventory", async () => {
+    await addSecret("STACK_CONTRACT_C", SYNTHETIC_VALUE, project);
+    const names = vaultNames();
+    expect(names).toContain("STACK_CONTRACT_C");
+    for (let repeat = 0; repeat < 2; repeat++) {
+      let caught: unknown;
+      try {
+        await addSecret("STACK_CONTRACT_C", SYNTHETIC_VALUE, project);
+      } catch (err) {
+        caught = err;
+      }
+      expect(caught).toBeInstanceOf(StackError);
+      if (!(caught instanceof StackError)) throw new Error("Expected a typed collision.");
+      expect(caught.code).toBe("PHANTOM_SECRET_EXISTS");
+      expect(caught.message).not.toContain(SYNTHETIC_VALUE);
+      expect(vaultNames()).toEqual(names);
+    }
+  });
+
+  // Phantom offers no headless read, so only the name's survival is observable.
+  test("addSecret on an existing name fails with a typed error and keeps the name", async () => {
+    let caught: unknown;
+    try {
+      await addSecret("STACK_CONTRACT_A", "replacement-value", project);
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(StackError);
+    expect((caught as StackError).code).toBe("PHANTOM_SECRET_EXISTS");
+    expect((caught as StackError).message).not.toContain("replacement-value");
+    expect(vaultNames()).toContain("STACK_CONTRACT_A");
+  });
+
+  test("revealSecret without a terminal fails closed with a typed error", async () => {
+    let caught: unknown;
+    try {
+      await revealSecret("STACK_CONTRACT_A", project);
+    } catch (err) {
+      caught = err;
+    }
+    expect((caught as StackError).code).toBe("PHANTOM_TRUSTED_TERMINAL_REQUIRED");
+    expect(String((caught as Error).message)).not.toContain(SYNTHETIC_VALUE);
+    takeRevealRefusals();
+    expect(await tryRevealSecret("STACK_CONTRACT_A")).toBeUndefined();
+    // Doctor relies on this to report "stored, unverified" instead of "missing".
+    expect(takeRevealRefusals()).toEqual(["STACK_CONTRACT_A"]);
+  });
+
+  test("removeSecret without a terminal reports that nothing was removed", async () => {
+    expect(await removeSecret("STACK_CONTRACT_B", project)).toBe(false);
+    expect(vaultNames()).toContain("STACK_CONTRACT_B");
+  });
+
+  test("recipe wiring never writes placeholder values into the vault", async () => {
+    const before = vaultNames();
+    const result = await wirePhantomForRecipe(
+      {
+        id: "contract",
+        query: "contract",
+        createdAt: new Date(0).toISOString(),
+        providers: [{ name: "openai" }],
+      },
+      { cwd: project },
+    );
+    expect(result.present).toEqual([]);
+    expect(result.missing).toContain("openai:OPENAI_API_KEY");
+    expect(result.skipped).toEqual([]);
+    expect(vaultNames()).toEqual(before);
+  });
+});

package/src/__tests__/phantom-harness.test.ts

@@ -1,12 +1,17 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import {
   addSecret,
+  assertProjectInitialized,
+  completionForClose,
+  exec,
   isPhantomInstalled,
   listSecrets,
   removeSecret,
   revealSecret,
 } from "../phantom.ts";
-import { type Harness, setupFakePhantom } from "./_harness.ts";
+import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
 
 describe("phantom wrapper against the fake harness", () => {
   let h: Harness;
@@ -23,10 +28,123 @@ describe("phantom wrapper against the fake harness", () => {
     expect(await isPhantomInstalled()).toBe(true);
   });
 
-  test("addSecret writes to the fake vault", async () => {
+  test("addSecret writes to the fake vault over stdin, never argv", async () => {
     await addSecret("NEW_KEY", "new-value");
-    expect(await revealSecret("NEW_KEY")).toBe("new-value");
-    expect(h.callsTo("add").length).toBe(1);
+    expect((await readVault(h.dir)).NEW_KEY).toBe("new-value");
+    expect(h.callsTo("add")).toEqual([{ cmd: "add", args: ["NEW_KEY", "--stdin"] }]);
+  });
+
+  test.each(["one\ntwo", "one\rtwo", "one\r\ntwo", "one\n", "one\r"])(
+    "addSecret refuses unsupported CR/LF input before spawning (%j)",
+    async (value) => {
+      await expect(addSecret("NEW_KEY", value)).rejects.toMatchObject({
+        code: "PHANTOM_SECRET_VALUE_UNSUPPORTED",
+      });
+      expect(h.calls()).toEqual([]);
+      expect((await readVault(h.dir)).NEW_KEY).toBeUndefined();
+    },
+  );
+
+  test("the inert producer fixture matches 0.7.9 read_line and CR/LF stripping", async () => {
+    await exec(["add", "DIRECT_KEY", "--stdin"], { stdin: "first\r\nsecond" });
+    expect((await readVault(h.dir)).DIRECT_KEY).toBe("first");
+  });
+
+  test("signal-terminated add fails and never authorizes a later collision", async () => {
+    const bin = join(h.dir, "phantom");
+    const original = readFileSync(bin, "utf8");
+    writeFileSync(
+      bin,
+      '#!/bin/sh\ncase "$1" in --version) echo fixture;; *) kill -TERM $$;; esac\n',
+    );
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_EXEC_FAILED",
+    });
+    writeFileSync(h.vaultPath, JSON.stringify({ NEW_KEY: "foreign" }));
+    writeFileSync(bin, original);
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+    expect((await readVault(h.dir)).NEW_KEY).toBe("foreign");
+  });
+
+  test("signal-terminated remove reports failure; subsequent collision still refuses", async () => {
+    await addSecret("NEW_KEY", "same");
+    const bin = join(h.dir, "phantom");
+    const original = readFileSync(bin, "utf8");
+    writeFileSync(bin, "#!/bin/sh\nkill -TERM $$\n");
+    const result = await exec(["remove", "NEW_KEY"], { allowFailure: true });
+    expect(result).toMatchObject({ code: 1, signal: "SIGTERM", completion: "signal" });
+    expect(await removeSecret("NEW_KEY")).toBe(false);
+    writeFileSync(bin, original);
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+    expect((await readVault(h.dir)).NEW_KEY).toBe("same");
+  });
+
+  test("collision wording from a killed repeat never becomes confirmed success", async () => {
+    await addSecret("NEW_KEY", "same");
+    const bin = join(h.dir, "phantom");
+    const original = readFileSync(bin, "utf8");
+    writeFileSync(bin, "#!/bin/sh\necho 'already protected' >&2\nkill -TERM $$\n");
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_EXEC_FAILED",
+      message: "Phantom add did not complete; secret storage is unconfirmed.",
+    });
+    writeFileSync(bin, original);
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+    expect((await readVault(h.dir)).NEW_KEY).toBe("same");
+  });
+
+  test("null close fields remain unknown without a signal; signals never attest completion", () => {
+    expect(completionForClose(null, null)).toBe("unknown");
+    expect(completionForClose(null, "SIGTERM")).toBe("signal");
+    expect(completionForClose(0, "SIGTERM")).toBe("signal");
+    expect(completionForClose(0, null)).toBe("exited");
+    expect(completionForClose(9, null)).toBe("exited");
+  });
+
+  test("initialization preflight consumes only metadata status", async () => {
+    await assertProjectInitialized(h.dir);
+    expect(h.callsTo("status")).toEqual([{ cmd: "status", args: ["--json"] }]);
+    expect(h.callsTo("list")).toEqual([]);
+    expect(h.callsTo("init")).toEqual([]);
+    expect(h.callsTo("reveal")).toEqual([]);
+    expect(h.callsTo("add")).toEqual([]);
+  });
+
+  test("failed inventory stays unknown instead of appearing empty", async () => {
+    writeFileSync(
+      join(h.dir, "phantom"),
+      '#!/bin/sh\ncase "$1" in --version) echo fixture;; *) exit 9;; esac\n',
+    );
+    await expect(listSecrets()).rejects.toMatchObject({ code: "PHANTOM_METADATA_UNAVAILABLE" });
+  });
+
+  test("addSecret of an existing name fails with PHANTOM_SECRET_EXISTS", async () => {
+    await expect(addSecret("EXISTING_KEY", "other")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+    expect((await readVault(h.dir)).EXISTING_KEY).toBe("preset-value");
+  });
+
+  test("addSecret refuses identical and different completed repeats", async () => {
+    await addSecret("NEW_KEY", "same");
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+    await expect(addSecret("NEW_KEY", "different")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+  });
+
+  test("revealSecret fails closed without a terminal", async () => {
+    await expect(revealSecret("EXISTING_KEY")).rejects.toMatchObject({
+      code: "PHANTOM_TRUSTED_TERMINAL_REQUIRED",
+    });
   });
 
   test("listSecrets returns vault keys", async () => {
@@ -36,9 +154,8 @@ describe("phantom wrapper against the fake harness", () => {
     expect(keys).toContain("ANOTHER");
   });
 
-  test("removeSecret deletes from the fake vault", async () => {
-    await removeSecret("EXISTING_KEY");
-    const keys = await listSecrets();
-    expect(keys).not.toContain("EXISTING_KEY");
+  test("removeSecret without a terminal reports false and keeps the secret", async () => {
+    expect(await removeSecret("EXISTING_KEY")).toBe(false);
+    expect(await listSecrets()).toContain("EXISTING_KEY");
   });
 });

package/src/__tests__/phantom-project-preflight.test.ts

@@ -0,0 +1,118 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { emptyConfig, readConfig, writeConfig } from "../config.ts";
+import { addSecret } from "../phantom.ts";
+import { addService } from "../pipeline.ts";
+import type { Provider } from "../providers/_base.ts";
+import { providers } from "../providers/index.ts";
+import { type Harness, setupFakePhantom } from "./_harness.ts";
+
+describe("project metadata before provider contact", () => {
+  let h: Harness;
+  let cwd: string;
+  const contacts = { login: 0, provision: 0, materialize: 0, deprovision: 0 };
+
+  beforeEach(async () => {
+    h = setupFakePhantom({}, { initialized: false });
+    cwd = mkdtempSync(join(tmpdir(), "stack-preflight-"));
+    await writeConfig(emptyConfig(), cwd);
+    contacts.login = contacts.provision = contacts.materialize = contacts.deprovision = 0;
+    const provider: Provider = {
+      name: "preflightfixture",
+      displayName: "Inert fixture",
+      category: "ai",
+      authKind: "api_key",
+      async login() {
+        contacts.login++;
+        return { token: "synthetic" };
+      },
+      async provision() {
+        contacts.provision++;
+        return { id: "synthetic", displayName: "fixture" };
+      },
+      async materialize() {
+        contacts.materialize++;
+        return { secrets: { NEW_KEY: "synthetic" } };
+      },
+      async deprovision() {
+        contacts.deprovision++;
+      },
+    };
+    providers.preflightfixture = async () => provider;
+  });
+
+  afterEach(() => {
+    Reflect.deleteProperty(providers, "preflightfixture");
+    h.cleanup();
+    rmSync(cwd, { recursive: true, force: true });
+  });
+
+  test("uninitialized config refuses login and provisioning without initializing a vault", async () => {
+    const before = readFileSync(join(cwd, ".stack.toml"), "utf8");
+    await expect(addService({ providerName: "preflightfixture", cwd })).rejects.toMatchObject({
+      code: "PHANTOM_PROJECT_NOT_INITIALIZED",
+    });
+    expect(contacts).toEqual({ login: 0, provision: 0, materialize: 0, deprovision: 0 });
+    expect(h.callsTo("status")).toEqual([{ cmd: "status", args: ["--json"] }]);
+    expect(h.callsTo("init")).toEqual([]);
+    expect(h.callsTo("add")).toEqual([]);
+    expect(h.callsTo("list")).toEqual([]);
+    expect(readFileSync(join(cwd, ".stack.toml"), "utf8")).toBe(before);
+  });
+
+  test.each([
+    "not-json",
+    '{"schema_version":1,"inspection":"metadata-only"}',
+    '{"schema_version":2,"inspection":"metadata-only","initialized":true}',
+    '{"schema_version":1,"inspection":"metadata-only","initialized":"true"}',
+    '{"schema_version":1,"inspection":"vault-health","initialized":true}',
+  ])("unknown metadata refuses all provider contact (%s)", async (status) => {
+    writeFileSync(
+      join(h.dir, "phantom"),
+      `#!/bin/sh\ncase "$1" in --version) echo fixture;; *) printf '%s' '${status}';; esac\n`,
+    );
+    await expect(addService({ providerName: "preflightfixture", cwd })).rejects.toMatchObject({
+      code: "PHANTOM_METADATA_UNAVAILABLE",
+    });
+    expect(contacts).toEqual({ login: 0, provision: 0, materialize: 0, deprovision: 0 });
+    expect((await readConfig(cwd)).services.preflightfixture).toBeUndefined();
+  });
+
+  test("signal-terminated storage never commits pipeline configuration", async () => {
+    writeFileSync(
+      join(h.dir, "phantom"),
+      `#!/bin/sh
+case "$1" in
+ --version) echo fixture;;
+ status) echo '{"schema_version":1,"inspection":"metadata-only","initialized":true}';;
+ *) kill -TERM $$;;
+esac
+`,
+    );
+    await expect(addService({ providerName: "preflightfixture", cwd })).rejects.toMatchObject({
+      code: "ADD_SERVICE_ROLLED_BACK",
+    });
+    expect(contacts).toEqual({ login: 1, provision: 1, materialize: 1, deprovision: 1 });
+    expect((await readConfig(cwd)).services.preflightfixture).toBeUndefined();
+  });
+
+  test("cached collision output followed by signal cannot commit pipeline configuration", async () => {
+    await addSecret("NEW_KEY", "synthetic", cwd);
+    writeFileSync(
+      join(h.dir, "phantom"),
+      `#!/bin/sh
+case "$1" in
+ status) echo '{"schema_version":1,"inspection":"metadata-only","initialized":true}';;
+ *) echo 'already protected' >&2; kill -TERM $$;;
+esac
+`,
+    );
+    await expect(addService({ providerName: "preflightfixture", cwd })).rejects.toMatchObject({
+      code: "ADD_SERVICE_ROLLED_BACK",
+    });
+    expect(contacts).toEqual({ login: 1, provision: 1, materialize: 1, deprovision: 1 });
+    expect((await readConfig(cwd)).services.preflightfixture).toBeUndefined();
+  });
+});

package/src/__tests__/phantom-wire.test.ts

@@ -1,9 +1,9 @@
 import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { wirePhantomForRecipe } from "../ai/phantom-wire.ts";
 import type { Recipe } from "../ai/recipe.ts";
-import { setupFakePhantom, type Harness } from "./_harness.ts";
+import { type Harness, setupFakePhantom } from "./_harness.ts";
 
 describe("ai/phantom-wire", () => {
   let harness: Harness;
@@ -22,17 +22,16 @@ describe("ai/phantom-wire", () => {
     providers: [{ name: "stripe" }],
   };
 
-  it("calls `phantom add STRIPE_SECRET_KEY` and writes a webhook stub", async () => {
+  it("never writes to the vault, reports the missing secret, and writes a webhook stub", async () => {
     const result = await wirePhantomForRecipe(STRIPE_RECIPE, { cwd: harness.dir });
 
-    expect(result.envelopes).toContain("stripe:STRIPE_SECRET_KEY");
-
-    // Fake phantom treats `--rotate` as an unknown arg and succeeds anyway
-    // (our fake echoes success for unknown cases via the `*` branch exit 0),
-    // but we always log the call — so the `add` log should mention the key.
-    const adds = harness.callsTo("add");
-    const keys = adds.flatMap((c) => c.args);
-    expect(keys).toContain("STRIPE_SECRET_KEY");
+    // Phantom Secrets refuses values in argv and denies overwriting names, so
+    // apply must not try to plant placeholders. It only reads names.
+    expect(harness.callsTo("add")).toEqual([]);
+    expect(harness.callsTo("list")).toEqual([{ cmd: "list", args: ["--json"] }]);
+    expect(JSON.parse(readFileSync(harness.vaultPath, "utf-8"))).toEqual({});
+    expect(result.present).toEqual([]);
+    expect(result.missing).toContain("stripe:STRIPE_SECRET_KEY");
 
     const stubPath = join(harness.dir, ".stack/webhooks/stripe.ts");
     expect(existsSync(stubPath)).toBe(true);
@@ -42,19 +41,22 @@ describe("ai/phantom-wire", () => {
     expect(result.webhooks).toHaveLength(1);
   });
 
-  it("noWire: true skips envelopes and webhooks entirely", async () => {
+  it("noWire: true skips the vault check and webhooks entirely", async () => {
     const result = await wirePhantomForRecipe(STRIPE_RECIPE, {
       cwd: harness.dir,
       noWire: true,
     });
-    expect(result).toEqual({ envelopes: [], webhooks: [], skipped: [] });
+    expect(result).toEqual({ present: [], missing: [], webhooks: [], skipped: [] });
 
     const stubPath = join(harness.dir, ".stack/webhooks/stripe.ts");
     expect(existsSync(stubPath)).toBe(false);
     expect(harness.callsTo("add")).toEqual([]);
+    expect(harness.callsTo("list")).toEqual([]);
   });
 
-  it("creates envelopes for every secret on a multi-secret provider", async () => {
+  it("splits a multi-secret provider into present and missing", async () => {
+    harness.cleanup();
+    harness = setupFakePhantom({ SUPABASE_URL: "https://x.supabase.co", SUPABASE_ANON_KEY: "a" });
     const recipe: Recipe = {
       id: "supa",
       query: "database",
@@ -62,15 +64,24 @@ describe("ai/phantom-wire", () => {
       providers: [{ name: "supabase" }],
     };
     const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
-    expect(result.envelopes).toEqual([
-      "supabase:SUPABASE_URL",
-      "supabase:SUPABASE_ANON_KEY",
-      "supabase:SUPABASE_SERVICE_ROLE_KEY",
-    ]);
+    expect(result.present).toEqual(["supabase:SUPABASE_URL", "supabase:SUPABASE_ANON_KEY"]);
+    expect(result.missing).toEqual(["supabase:SUPABASE_SERVICE_ROLE_KEY"]);
+    expect(result.skipped).toEqual([]);
+    expect(harness.callsTo("add")).toEqual([]);
     // Supabase is webhook-capable in our moat list.
     expect(result.webhooks).toHaveLength(1);
   });
 
+  it("skips providers when the vault can't be listed, but still writes stubs", async () => {
+    writeFileSync(harness.vaultPath, "not json");
+    const result = await wirePhantomForRecipe(STRIPE_RECIPE, { cwd: harness.dir });
+    expect(result.skipped).toEqual(["stripe"]);
+    expect(result.present).toEqual([]);
+    expect(result.missing).toEqual([]);
+    expect(result.webhooks).toHaveLength(1);
+    expect(harness.callsTo("add")).toEqual([]);
+  });
+
   it("skips providers with no webhook stub without crashing", async () => {
     const recipe: Recipe = {
       id: "neon",
@@ -80,6 +91,6 @@ describe("ai/phantom-wire", () => {
     };
     const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
     expect(result.webhooks).toEqual([]);
-    expect(result.envelopes.length).toBeGreaterThan(0);
+    expect(result.missing.length).toBeGreaterThan(0);
   });
 });

package/src/__tests__/pipeline-integration.test.ts

@@ -90,6 +90,6 @@ describe("addService full loop", () => {
     const mcp = JSON.parse(mcpRaw) as { mcpServers: Record<string, unknown> };
     expect(mcp.mcpServers.stubsvc).toBeDefined();
 
-    delete providers.stubsvc;
+    Reflect.deleteProperty(providers, "stubsvc");
   });
 });

package/src/__tests__/pipeline-recovery.test.ts

@@ -9,11 +9,12 @@ import { providers } from "../providers/index.ts";
 import { type Harness, setupFakePhantom } from "./_harness.ts";
 
 /**
- * Partial-failure regression: if `materialize()` throws after `provision()`
- * succeeded, we MUST still write a breadcrumb entry to .stack.toml so
- * `stack doctor --fix` / `stack remove` can find and clean up the dangling
- * upstream resource. Without this guard, the user ends up with a live
- * provider-side resource and no local record of it at all.
+ * Partial-failure rollback: if `materialize()` throws after `provision()`
+ * succeeded, we MUST roll back atomically — tear down the upstream resource
+ * (if the provider implements `deprovision`), remove any written Phantom
+ * secrets, and NOT write to .stack.toml. The user gets a clear error message
+ * directing them to manual cleanup or `stack doctor --fix` if automatic
+ * teardown isn't available.
  */
 describe("addService partial-failure breadcrumb", () => {
   let h: Harness;
@@ -33,7 +34,7 @@ describe("addService partial-failure breadcrumb", () => {
     h.cleanup();
   });
 
-  test("writes a partial entry when materialize throws post-provision", async () => {
+  test("rolls back and does NOT write .stack.toml when materialize throws post-provision (no deprovision)", async () => {
     const failingProvider: Provider = {
       name: "partialsvc",
       displayName: "Partial Service",
@@ -48,26 +49,24 @@ describe("addService partial-failure breadcrumb", () => {
       async materialize() {
         throw new Error("simulated materialize failure (e.g. keys endpoint 500)");
       },
+      // No deprovision — exercises the "manual cleanup" warning path.
     };
 
     providers.partialsvc = async () => failingProvider;
 
-    await expect(
-      addService({ providerName: "partialsvc", cwd, interactive: false }),
-    ).rejects.toThrow(/simulated materialize failure/);
+    const err = await addService({ providerName: "partialsvc", cwd, interactive: false }).catch(
+      (e: Error) => e,
+    );
 
-    // Breadcrumb must be present so cleanup tooling can find the dangling resource.
+    // Error should reference the resource id and direct to manual cleanup.
+    expect((err as Error).message).toMatch(/partial-resource-42/);
+    expect((err as Error).message).toMatch(/stack doctor --fix/);
+
+    // .stack.toml must NOT have an entry — atomicity is the point.
     const config = await readConfig(cwd);
-    expect(config.services.partialsvc).toBeDefined();
-    expect(config.services.partialsvc.resource_id).toBe("partial-resource-42");
-    expect(config.services.partialsvc.provider).toBe("partialsvc");
-    expect(config.services.partialsvc.region).toBe("us-east-1");
-    // We don't know what was materialized, so secrets must be empty.
-    expect(config.services.partialsvc.secrets).toEqual([]);
-    // Marker lets `stack doctor` distinguish partial rows from healthy ones.
-    expect(config.services.partialsvc.created_by).toBe("stack add (partial)");
+    expect(config.services.partialsvc).toBeUndefined();
 
-    delete providers.partialsvc;
+    Reflect.deleteProperty(providers, "partialsvc");
   });
 
   test("non-persist runs do NOT leave a breadcrumb (dry-run / preview)", async () => {
@@ -85,22 +84,24 @@ describe("addService partial-failure breadcrumb", () => {
       async materialize() {
         throw new Error("boom");
       },
+      // No deprovision — exercises the "manual cleanup" warning path.
     };
 
     providers.drypartialsvc = async () => failingProvider;
 
-    await expect(
-      addService({
-        providerName: "drypartialsvc",
-        cwd,
-        interactive: false,
-        persist: false,
-      }),
-    ).rejects.toThrow(/boom/);
+    const err = await addService({
+      providerName: "drypartialsvc",
+      cwd,
+      interactive: false,
+      persist: false,
+    }).catch((e: Error) => e);
+
+    // Error must reference the resource id (manual cleanup path).
+    expect((err as Error).message).toMatch(/dry-resource-1/);
 
     const config = await readConfig(cwd);
     expect(config.services.drypartialsvc).toBeUndefined();
 
-    delete providers.drypartialsvc;
+    Reflect.deleteProperty(providers, "drypartialsvc");
   });
 });