@ashlr/stack-core 0.1.1 → 0.3.0

package/src/__tests__/detect-source.test.ts

@@ -1,11 +1,17 @@
-import { describe, expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { delimiter, dirname, join } from "node:path";
 import { scanSource } from "../detect-source.ts";
 
+const projects: string[] = [];
+afterEach(() => {
+  for (const dir of projects.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
 function makeProject(files: Record<string, string>): string {
   const dir = mkdtempSync(join(tmpdir(), "stack-scan-"));
+  projects.push(dir);
   for (const [path, content] of Object.entries(files)) {
     const full = join(dir, path);
     const parent = join(full, "..");
@@ -94,7 +100,7 @@ describe("source scanner — config files", () => {
 
   test("wrangler.toml picks up Cloudflare", async () => {
     const cwd = makeProject({
-      "wrangler.toml": "name = \"my-worker\"\nmain = \"src/index.ts\"",
+      "wrangler.toml": 'name = "my-worker"\nmain = "src/index.ts"',
     });
     const hits = await scanSource(cwd);
     expect(hits.some((h) => h.provider === "cloudflare")).toBe(true);
@@ -145,3 +151,176 @@ require (
     expect(names).toContain("stripe");
   });
 });
+
+test.each(["{broken", "null", "{}"])(
+  "malformed or empty package %s does not hide other evidence",
+  async (raw) => {
+    const cwd = makeProject({ "package.json": raw, "fly.toml": "" });
+    expect(await scanSource(cwd)).toEqual([
+      { provider: "fly", confidence: "high", signals: ["fly.toml"] },
+    ]);
+  },
+);
+
+test.each([
+  [
+    "pyproject.toml",
+    '[project]\ndependencies = ["supabase-py>=1", "anthropic", "resend"]',
+    ["anthropic", "resend", "supabase"],
+  ],
+  [
+    "Cargo.toml",
+    '[dependencies]\nasync-openai = "1"\nsentry = "1"\nasync-stripe = "1"',
+    ["openai", "sentry", "stripe"],
+  ],
+  [
+    "requirements.txt",
+    "# openai\n\nANTHROPIC[extra]>=1\r\nmodal==1\nreplicate~=1\nbraintrust!=1\nunknown",
+    ["anthropic", "braintrust", "modal", "replicate"],
+  ],
+  [
+    "go.mod",
+    "module example.com/app\nrequire github.com/liushuangls/go-anthropic v1\nrequire github.com/sashabaranov/go-openai v1",
+    ["openai", "anthropic"],
+  ],
+] as const)("scans %s with exact evidence", async (file, content, providers) => {
+  const hits = await scanSource(makeProject({ [file]: content }));
+  expect(hits.map((hit) => hit.provider)).toEqual([...providers]);
+  for (const hit of hits) {
+    expect(hit.signals).toHaveLength(1);
+    expect(hit.signals[0]).toStartWith(`${file}:`);
+  }
+});
+
+test("deduplicates dependency evidence and upgrades confidence without losing signals", async () => {
+  const hits = await scanSource(
+    makeProject({
+      "package.json": JSON.stringify({
+        dependencies: { "@vercel/kv": "1" },
+        devDependencies: { "@vercel/kv": "1" },
+      }),
+      "vercel.json": "{}",
+      ".env.sample": "VERCEL_TOKEN=\nUNKNOWN_NAME=",
+      ".env.template": "VERCEL_TOKEN=",
+    }),
+  );
+  expect(hits).toEqual([
+    {
+      provider: "vercel",
+      confidence: "high",
+      signals: [
+        "package.json:@vercel/kv",
+        "vercel.json",
+        ".env.sample:VERCEL_TOKEN",
+        ".env.template:VERCEL_TOKEN",
+      ],
+    },
+  ]);
+});
+
+test("scans a project directory containing spaces and reports relative file paths", async () => {
+  const root = makeProject({
+    "project with spaces/package.json": JSON.stringify({ dependencies: { openai: "1" } }),
+    "project with spaces/supabase/config.toml": "[api]",
+    "project with spaces/.env.example": "OPENAI_API_KEY=",
+    "project with spaces/vercel.json": "{}",
+  });
+
+  expect(await scanSource(join(root, "project with spaces"))).toEqual([
+    {
+      provider: "openai",
+      confidence: "high",
+      signals: ["package.json:openai", ".env.example:OPENAI_API_KEY"],
+    },
+    { provider: "supabase", confidence: "high", signals: ["supabase/config.toml"] },
+    { provider: "vercel", confidence: "high", signals: ["vercel.json"] },
+  ]);
+});
+
+test("finds the same source markers in equivalent paths with and without spaces", async () => {
+  const files: Record<string, string> = {
+    "package.json": JSON.stringify({ dependencies: { openai: "1" } }),
+    "requirements.txt": "modal==1",
+    "pyproject.toml": '[project]\ndependencies = ["resend"]',
+    "go.mod": "module example.com/app\nrequire github.com/stripe/stripe-go/v76 v76.0.0",
+    "Cargo.toml": '[dependencies]\nsentry = "1"',
+    "supabase/config.toml": "[api]",
+    ".github/workflows/ci.yml": "name: CI",
+    ".env.example": "ANTHROPIC_API_KEY=",
+  };
+  const root = makeProject(
+    Object.fromEntries(
+      ["project", "parent with spaces/project with spaces"].flatMap((dir) =>
+        Object.entries(files).map(([path, content]) => [join(dir, path), content]),
+      ),
+    ),
+  );
+
+  const plain = await scanSource(join(root, "project"));
+  const spaced = await scanSource(join(root, "parent with spaces", "project with spaces"));
+  expect(plain).toEqual([
+    {
+      provider: "github",
+      confidence: "high",
+      signals: [".github/workflows", ".github/workflows/ci.yml"],
+    },
+    { provider: "modal", confidence: "high", signals: ["requirements.txt:modal"] },
+    { provider: "openai", confidence: "high", signals: ["package.json:openai"] },
+    { provider: "resend", confidence: "high", signals: ["pyproject.toml:resend"] },
+    { provider: "sentry", confidence: "high", signals: ["Cargo.toml:sentry"] },
+    { provider: "stripe", confidence: "high", signals: ["go.mod:github.com/stripe/stripe-go/v76"] },
+    { provider: "supabase", confidence: "high", signals: ["supabase/config.toml"] },
+    { provider: "anthropic", confidence: "medium", signals: [".env.example:ANTHROPIC_API_KEY"] },
+  ]);
+  expect(spaced).toEqual(plain);
+});
+
+test("empty project has no detections", async () => {
+  expect(await scanSource(makeProject({}))).toEqual([]);
+});
+
+test.each([["--json"], ["--yes"]])(
+  "scan %s rejects a nonexistent project without creating files",
+  async (flag) => {
+    const root = makeProject({});
+    const home = makeProject({});
+    const missing = join(root, "missing", "project");
+    const cli = join(import.meta.dir, "..", "..", "..", "cli", "src", "index.ts");
+    const proc = Bun.spawn([process.execPath, cli, "scan", flag, "--path", missing], {
+      cwd: root,
+      env: {
+        PATH: [dirname(process.execPath), "/usr/bin", "/bin"].join(delimiter),
+        HOME: home,
+        CI: "1",
+        NO_COLOR: "1",
+        STACK_TELEMETRY: "0",
+        STACK_NO_UPDATE_CHECK: "1",
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [code, stdout, stderr] = await Promise.all([
+      proc.exited,
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+    ]);
+
+    expect(code).toBe(1);
+    expect(stdout + stderr).toContain(`Path "${missing}" does not exist or is not a directory.`);
+    expect(stdout).not.toContain('"hits"');
+    expect(stdout).not.toContain("No providers detected");
+    expect(existsSync(missing)).toBe(false);
+    expect(readdirSync(root)).toEqual([]);
+  },
+  30_000,
+);
+
+test.each([
+  ["package.json", JSON.stringify({ name: "openai", dependencies: {}, devDependencies: {} })],
+  ["requirements.txt", ""],
+  ["pyproject.toml", "[project]\ndependencies = []\n"],
+  ["go.mod", "module example.com/app\n\ngo 1.22\n"],
+  ["Cargo.toml", '[package]\nname = "app"\nversion = "0.1.0"\n\n[dependencies]\n'],
+] as const)("empty dependency manifest %s produces no detections", async (file, content) => {
+  expect(await scanSource(makeProject({ [file]: content }))).toEqual([]);
+});

package/src/__tests__/fixtures/stack-manifest.v1.json

@@ -0,0 +1,10 @@
+{
+  "schema_version": 1,
+  "kind": "ashlr-stack-manifest",
+  "components": [
+    { "id": "core", "name": "@ashlr/stack-core", "version": "0.3.0", "distribution": "npm" },
+    { "id": "cli", "name": "@ashlr/stack", "version": "0.3.0", "distribution": "npm" },
+    { "id": "mcp", "name": "ashlr-stack-mcp", "version": "0.3.0", "distribution": "npm" },
+    { "id": "plugin", "name": "stack", "version": "0.1.0", "distribution": "claude-code-plugin" }
+  ]
+}

package/src/__tests__/github-provider.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import github from "../providers/github.ts";
 import type { ProviderContext } from "../providers/_base.ts";
+import github from "../providers/github.ts";
 import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
 
 describe("github provider (mocked fetch)", () => {
@@ -8,7 +8,8 @@ describe("github provider (mocked fetch)", () => {
   let realFetch: typeof fetch;
 
   beforeEach(() => {
-    h = setupFakePhantom();
+    // Provider logic after a token is read; real Phantom 0.7.9 refuses headless reveal.
+    h = setupFakePhantom({}, { legacyHeadlessReveal: true });
     realFetch = globalThis.fetch;
   });
 

package/src/__tests__/helpers.test.ts

@@ -1,6 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { addSecret } from "../phantom.ts";
-import { bearerJsonHeaders, tryRevealSecret } from "../providers/_helpers.ts";
+import { bearerJsonHeaders, takeRevealRefusals, tryRevealSecret } from "../providers/_helpers.ts";
 import { type Harness, setupFakePhantom } from "./_harness.ts";
 
 /**
@@ -11,7 +10,12 @@ import { type Harness, setupFakePhantom } from "./_harness.ts";
 describe("provider helpers", () => {
   let h: Harness;
   beforeEach(() => {
-    h = setupFakePhantom({ PRESENT_KEY: "hello-world" });
+    // Legacy headless reveal exercises the helper's own logic; the last test
+    // below covers what Phantom Secrets 0.7.9 actually does.
+    h = setupFakePhantom(
+      { PRESENT_KEY: "hello-world", EMPTY_KEY: "" },
+      { legacyHeadlessReveal: true },
+    );
   });
   afterEach(() => h.cleanup());
 
@@ -20,7 +24,6 @@ describe("provider helpers", () => {
   });
 
   test("tryRevealSecret returns undefined for an empty value", async () => {
-    await addSecret("EMPTY_KEY", "");
     expect(await tryRevealSecret("EMPTY_KEY")).toBeUndefined();
   });
 
@@ -29,6 +32,23 @@ describe("provider helpers", () => {
     expect(await tryRevealSecret("NEVER_STORED_KEY")).toBeUndefined();
   });
 
+  test("tryRevealSecret returns undefined when Phantom refuses headless reveal", async () => {
+    h.cleanup();
+    h = setupFakePhantom({ PRESENT_KEY: "hello-world" });
+    takeRevealRefusals();
+    expect(await tryRevealSecret("PRESENT_KEY")).toBeUndefined();
+    // The refusal is recorded by name so doctor can say "stored, unverified".
+    expect(takeRevealRefusals()).toEqual(["PRESENT_KEY"]);
+    expect(takeRevealRefusals()).toEqual([]);
+  });
+
+  test("a readable or absent value records no refusal", async () => {
+    takeRevealRefusals();
+    await tryRevealSecret("PRESENT_KEY");
+    await tryRevealSecret("NEVER_STORED_KEY");
+    expect(takeRevealRefusals()).toEqual([]);
+  });
+
   test("bearerJsonHeaders returns the canonical shape", () => {
     const headers = bearerJsonHeaders("my-token") as Record<string, string>;
     expect(headers.Authorization).toBe("Bearer my-token");

package/src/__tests__/http.test.ts

@@ -220,8 +220,8 @@ describe("parseRetryAfter", () => {
     const parsed = parseRetryAfter(future);
     expect(parsed).toBeDefined();
     // Allow drift from test overhead; we just need it to be in the right ballpark.
-    expect(parsed!).toBeGreaterThan(5_000);
-    expect(parsed!).toBeLessThanOrEqual(12_000);
+    expect(parsed as number).toBeGreaterThan(5_000);
+    expect(parsed as number).toBeLessThanOrEqual(12_000);
   });
 
   test("HTTP-date in the past clamps to 0", () => {

package/src/__tests__/import-integration.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
@@ -33,6 +33,7 @@ describe("import pipeline", () => {
   afterEach(() => {
     process.chdir(originalCwd);
     h.cleanup();
+    rmSync(cwd, { recursive: true, force: true });
   });
 
   test("typical Next.js .env gets parsed, stored, and mapped to services", async () => {
@@ -49,7 +50,7 @@ PORT=3000
 `.trim();
     writeFileSync(join(cwd, ".env"), envContent);
 
-    const parsed = parseEnv(envContent);
+    const parsed = parseEnv(readFileSync(join(cwd, ".env"), "utf8"));
     expect(parsed.map((p) => p.key)).toContain("OPENAI_API_KEY");
     expect(parsed.map((p) => p.key)).toContain("NODE_ENV");
 
@@ -70,7 +71,12 @@ PORT=3000
     const vault = await readVault(h.dir);
     expect(vault.OPENAI_API_KEY).toBe("sk-fake");
     expect(vault.NODE_ENV).toBe("development");
-    expect((await listSecrets()).length).toBeGreaterThanOrEqual(8);
+    const expectedVault = Object.fromEntries(parsed.map(({ key, value }) => [key, value]));
+    expect(vault).toEqual(expectedVault);
+    expect((await listSecrets()).sort()).toEqual(Object.keys(expectedVault).sort());
+    expect(h.callsTo("add").map(({ args }) => args)).toEqual(
+      parsed.map(({ key }) => [key, "--stdin"]),
+    );
 
     // Build a .stack.toml from the detected groups.
     const config = emptyConfig("import-test");
@@ -83,5 +89,13 @@ PORT=3000
     expect(roundTripped.services.supabase).toBeDefined();
     expect(roundTripped.services.openai).toBeDefined();
     expect(roundTripped.services.sentry.mcp).toBe("sentry");
-  });
+    expect(Object.keys(roundTripped.services).sort()).toEqual(["openai", "sentry", "supabase"]);
+    for (const [provider, keys] of Object.entries(grouped)) {
+      expect(roundTripped.services[provider].secrets).toEqual(keys);
+    }
+    const serialized = readFileSync(join(cwd, ".stack.toml"), "utf8");
+    for (const { value } of parsed) expect(serialized).not.toContain(value);
+    // Eight sequential real child processes plus list/version probes are integration
+    // work, not a five-second performance assertion (especially under coverage).
+  }, 30_000);
 });

package/src/__tests__/inference.test.ts

@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { CostTracker } from "../ai/cost-tracker.ts";
 import {
   ClaudeMCPBackend,
   LocalSLMBackend,
@@ -6,7 +7,6 @@ import {
   getInferenceBackend,
   parseRecipeDraft,
 } from "../ai/inference.ts";
-import { CostTracker } from "../ai/cost-tracker.ts";
 
 /**
  * Inference backend tests. The local backend talks to an OpenAI-compatible
@@ -15,7 +15,10 @@ import { CostTracker } from "../ai/cost-tracker.ts";
  */
 
 // Minimal valid chat-completion response.
-function okChatResponse(content: string, usage?: { prompt_tokens?: number; completion_tokens?: number }) {
+function okChatResponse(
+  content: string,
+  usage?: { prompt_tokens?: number; completion_tokens?: number },
+) {
   return new Response(
     JSON.stringify({
       choices: [{ message: { content } }],
@@ -117,7 +120,10 @@ describe("LocalSLMBackend — infer", () => {
   test("happy path — parses recipe + records usage with reported tokens", async () => {
     const costTracker = new CostTracker();
     const fetchImpl = (async () =>
-      okChatResponse(VALID_RECIPE_JSON, { prompt_tokens: 120, completion_tokens: 45 })) as unknown as typeof fetch;
+      okChatResponse(VALID_RECIPE_JSON, {
+        prompt_tokens: 120,
+        completion_tokens: 45,
+      })) as unknown as typeof fetch;
 
     const backend = new LocalSLMBackend({
       endpoints: [{ name: "lm-studio-fake", baseUrl: "http://fake/v1", model: "test" }],
@@ -146,7 +152,8 @@ describe("LocalSLMBackend — infer", () => {
   test("falls back to the second endpoint when the first fails", async () => {
     let call = 0;
     const fetchImpl = (async (input: string | URL | Request) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const url =
+        typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
       call++;
       if (url.includes("primary")) {
         throw new Error("ECONNREFUSED");
@@ -169,6 +176,44 @@ describe("LocalSLMBackend — infer", () => {
     expect(call).toBeGreaterThanOrEqual(2);
   });
 
+  test.each(["invalid UTF-8", "replacement character"])(
+    "falls back when a 200 response contains an unusable %s assistant message",
+    async (kind) => {
+      const calls: string[] = [];
+      const fetchImpl = (async (input: string | URL | Request) => {
+        const url =
+          typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+        calls.push(url);
+        if (url.includes("secondary")) return okChatResponse(VALID_RECIPE_JSON);
+
+        // The envelope is valid JSON even after a malformed byte is decoded as U+FFFD.
+        const envelope = '{"choices":[{"message":{"content":"X"}}]}';
+        const bytes = new TextEncoder().encode(envelope);
+        if (kind === "invalid UTF-8") {
+          bytes[envelope.indexOf("X")] = 0xff;
+          return new Response(bytes, { status: 200 });
+        }
+        return new Response(envelope.replace("X", "\uFFFD"), { status: 200 });
+      }) as unknown as typeof fetch;
+      const backend = new LocalSLMBackend({
+        endpoints: [
+          { name: "primary", baseUrl: "http://primary/v1", model: "a" },
+          { name: "secondary", baseUrl: "http://secondary/v1", model: "b" },
+        ],
+        fetchImpl,
+        costTracker: new CostTracker(),
+      });
+
+      const result = await backend.infer({ query: "x", catalogContext: "" });
+      expect(result.recipe?.providers.map((provider) => provider.name)).toEqual(["neon", "clerk"]);
+      expect(backend.lastEndpoint).toBe("secondary");
+      expect(calls).toEqual([
+        "http://primary/v1/chat/completions",
+        "http://secondary/v1/chat/completions",
+      ]);
+    },
+  );
+
   test("throws NoInferenceBackendError when every endpoint fails", async () => {
     const fetchImpl = (async () => {
       throw new Error("down");
@@ -228,14 +273,15 @@ describe("LocalSLMBackend — infer", () => {
       costTracker: new CostTracker(),
     });
 
-    await expect(
-      backend.infer({ query: "x", catalogContext: "" }),
-    ).rejects.toBeInstanceOf(NoInferenceBackendError);
+    await expect(backend.infer({ query: "x", catalogContext: "" })).rejects.toBeInstanceOf(
+      NoInferenceBackendError,
+    );
   });
 
   test("healthy pings /models and returns true when any endpoint responds", async () => {
     const fetchImpl = (async (input: string | URL | Request) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const url =
+        typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
       if (url.endsWith("/models")) return new Response("[]", { status: 200 });
       return new Response("", { status: 500 });
     }) as unknown as typeof fetch;
@@ -252,19 +298,17 @@ describe("parseRecipeDraft", () => {
   test("parses plain JSON", () => {
     const draft = parseRecipeDraft(VALID_RECIPE_JSON);
     expect(draft.providers).toHaveLength(2);
-    expect(draft.providers[0]!.name).toBe("neon");
+    expect(draft.providers[0]?.name).toBe("neon");
   });
 
   test("tolerates markdown fences", () => {
-    const wrapped = "```json\n" + VALID_RECIPE_JSON + "\n```";
+    const wrapped = `\`\`\`json\n${VALID_RECIPE_JSON}\n\`\`\``;
     const draft = parseRecipeDraft(wrapped);
     expect(draft.providers).toHaveLength(2);
   });
 
   test("tolerates leading prose", () => {
-    const draft = parseRecipeDraft(
-      "Sure! Here's the recipe:\n" + VALID_RECIPE_JSON + "\nLet me know!",
-    );
+    const draft = parseRecipeDraft(`Sure! Here's the recipe:\n${VALID_RECIPE_JSON}\nLet me know!`);
     expect(draft.providers).toHaveLength(2);
   });
 

package/src/__tests__/interactive-prompt.test.ts

@@ -0,0 +1,106 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { emptyConfig, writeConfig } from "../config.ts";
+import { addService } from "../pipeline.ts";
+import type { PromptRequest, Provider, ProviderContext } from "../providers/_base.ts";
+import { promptSecret } from "../providers/_helpers.ts";
+import { providers } from "../providers/index.ts";
+import { type Harness, setupFakePhantom } from "./_harness.ts";
+
+/**
+ * Regression coverage for the interactive-auth hang: a provider's PAT/key
+ * paste must go through the host-supplied `ctx.prompt` (which the CLI pauses
+ * its spinner around) rather than writing to stderr and blocking on stdin
+ * behind a live spinner. See `promptSecret` + `ProviderContext.prompt`.
+ */
+describe("interactive credential prompting", () => {
+  test("promptSecret routes through ctx.prompt, trims, and marks the field secret", async () => {
+    const seen: PromptRequest[] = [];
+    const ctx: ProviderContext = {
+      cwd: ".",
+      interactive: true,
+      log: () => {},
+      prompt: async (req) => {
+        seen.push(req);
+        return "  tok-abc123  "; // surrounding whitespace must be trimmed off
+      },
+    };
+
+    const token = await promptSecret(ctx, {
+      message: "Paste your access token",
+      howTo: "create one at https://example.com/tokens",
+    });
+
+    expect(token).toBe("tok-abc123");
+    expect(seen).toHaveLength(1);
+    expect(seen[0]).toEqual({
+      message: "Paste your access token",
+      howTo: "create one at https://example.com/tokens",
+      secret: true,
+    });
+  });
+
+  describe("threaded through addService", () => {
+    let h: Harness;
+    let cwd: string;
+    let originalCwd: string;
+
+    beforeEach(async () => {
+      h = setupFakePhantom();
+      cwd = mkdtempSync(join(tmpdir(), "stack-prompt-"));
+      originalCwd = process.cwd();
+      process.chdir(cwd);
+      await writeConfig(emptyConfig("test-template"), cwd);
+    });
+
+    afterEach(() => {
+      process.chdir(originalCwd);
+      Reflect.deleteProperty(providers, "promptsvc");
+      h.cleanup();
+    });
+
+    test("addService threads prompt into ctx so login receives the host-entered value", async () => {
+      let promptCalls = 0;
+      let loginToken: string | undefined;
+      const stubProvider: Provider = {
+        name: "promptsvc",
+        displayName: "Prompt Service",
+        category: "database",
+        authKind: "pat",
+        async login(ctx) {
+          // Exactly what every real provider's PAT-paste path now does.
+          const token = await promptSecret(ctx, { message: "Paste your Prompt Service token" });
+          loginToken = token;
+          return { token, identity: { id: "user-1" } };
+        },
+        async provision() {
+          return { id: "res-1", displayName: "res-1" };
+        },
+        async materialize() {
+          // No secrets/mcp keeps the pipeline off the Phantom vault, so this
+          // assertion runs identically on every platform.
+          return { secrets: {} };
+        },
+      };
+      providers.promptsvc = async () => stubProvider;
+
+      const result = await addService({
+        providerName: "promptsvc",
+        cwd,
+        interactive: true,
+        prompt: async () => {
+          promptCalls += 1;
+          return "host-entered-token";
+        },
+      });
+
+      expect(result.providerName).toBe("promptsvc");
+      // The host's prompt callback was invoked, and its value reached login via
+      // ctx → promptSecret — proof the wiring is end to end, not bypassed.
+      expect(promptCalls).toBe(1);
+      expect(loginToken).toBe("host-entered-token");
+    });
+  });
+});