@ashlr/stack-core 0.1.1 → 0.3.0

package/src/__tests__/phantom-project-preflight.test.ts

@@ -0,0 +1,118 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { emptyConfig, readConfig, writeConfig } from "../config.ts";
+import { addSecret } from "../phantom.ts";
+import { addService } from "../pipeline.ts";
+import type { Provider } from "../providers/_base.ts";
+import { providers } from "../providers/index.ts";
+import { type Harness, setupFakePhantom } from "./_harness.ts";
+
+describe("project metadata before provider contact", () => {
+  let h: Harness;
+  let cwd: string;
+  const contacts = { login: 0, provision: 0, materialize: 0, deprovision: 0 };
+
+  beforeEach(async () => {
+    h = setupFakePhantom({}, { initialized: false });
+    cwd = mkdtempSync(join(tmpdir(), "stack-preflight-"));
+    await writeConfig(emptyConfig(), cwd);
+    contacts.login = contacts.provision = contacts.materialize = contacts.deprovision = 0;
+    const provider: Provider = {
+      name: "preflightfixture",
+      displayName: "Inert fixture",
+      category: "ai",
+      authKind: "api_key",
+      async login() {
+        contacts.login++;
+        return { token: "synthetic" };
+      },
+      async provision() {
+        contacts.provision++;
+        return { id: "synthetic", displayName: "fixture" };
+      },
+      async materialize() {
+        contacts.materialize++;
+        return { secrets: { NEW_KEY: "synthetic" } };
+      },
+      async deprovision() {
+        contacts.deprovision++;
+      },
+    };
+    providers.preflightfixture = async () => provider;
+  });
+
+  afterEach(() => {
+    Reflect.deleteProperty(providers, "preflightfixture");
+    h.cleanup();
+    rmSync(cwd, { recursive: true, force: true });
+  });
+
+  test("uninitialized config refuses login and provisioning without initializing a vault", async () => {
+    const before = readFileSync(join(cwd, ".stack.toml"), "utf8");
+    await expect(addService({ providerName: "preflightfixture", cwd })).rejects.toMatchObject({
+      code: "PHANTOM_PROJECT_NOT_INITIALIZED",
+    });
+    expect(contacts).toEqual({ login: 0, provision: 0, materialize: 0, deprovision: 0 });
+    expect(h.callsTo("status")).toEqual([{ cmd: "status", args: ["--json"] }]);
+    expect(h.callsTo("init")).toEqual([]);
+    expect(h.callsTo("add")).toEqual([]);
+    expect(h.callsTo("list")).toEqual([]);
+    expect(readFileSync(join(cwd, ".stack.toml"), "utf8")).toBe(before);
+  });
+
+  test.each([
+    "not-json",
+    '{"schema_version":1,"inspection":"metadata-only"}',
+    '{"schema_version":2,"inspection":"metadata-only","initialized":true}',
+    '{"schema_version":1,"inspection":"metadata-only","initialized":"true"}',
+    '{"schema_version":1,"inspection":"vault-health","initialized":true}',
+  ])("unknown metadata refuses all provider contact (%s)", async (status) => {
+    writeFileSync(
+      join(h.dir, "phantom"),
+      `#!/bin/sh\ncase "$1" in --version) echo fixture;; *) printf '%s' '${status}';; esac\n`,
+    );
+    await expect(addService({ providerName: "preflightfixture", cwd })).rejects.toMatchObject({
+      code: "PHANTOM_METADATA_UNAVAILABLE",
+    });
+    expect(contacts).toEqual({ login: 0, provision: 0, materialize: 0, deprovision: 0 });
+    expect((await readConfig(cwd)).services.preflightfixture).toBeUndefined();
+  });
+
+  test("signal-terminated storage never commits pipeline configuration", async () => {
+    writeFileSync(
+      join(h.dir, "phantom"),
+      `#!/bin/sh
+case "$1" in
+ --version) echo fixture;;
+ status) echo '{"schema_version":1,"inspection":"metadata-only","initialized":true}';;
+ *) kill -TERM $$;;
+esac
+`,
+    );
+    await expect(addService({ providerName: "preflightfixture", cwd })).rejects.toMatchObject({
+      code: "ADD_SERVICE_ROLLED_BACK",
+    });
+    expect(contacts).toEqual({ login: 1, provision: 1, materialize: 1, deprovision: 1 });
+    expect((await readConfig(cwd)).services.preflightfixture).toBeUndefined();
+  });
+
+  test("cached collision output followed by signal cannot commit pipeline configuration", async () => {
+    await addSecret("NEW_KEY", "synthetic", cwd);
+    writeFileSync(
+      join(h.dir, "phantom"),
+      `#!/bin/sh
+case "$1" in
+ status) echo '{"schema_version":1,"inspection":"metadata-only","initialized":true}';;
+ *) echo 'already protected' >&2; kill -TERM $$;;
+esac
+`,
+    );
+    await expect(addService({ providerName: "preflightfixture", cwd })).rejects.toMatchObject({
+      code: "ADD_SERVICE_ROLLED_BACK",
+    });
+    expect(contacts).toEqual({ login: 1, provision: 1, materialize: 1, deprovision: 1 });
+    expect((await readConfig(cwd)).services.preflightfixture).toBeUndefined();
+  });
+});

package/src/__tests__/phantom-wire.test.ts

@@ -1,9 +1,14 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { existsSync, readFileSync } from "node:fs";
+import { afterEach, beforeEach, describe, expect, it, setDefaultTimeout } from "bun:test";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { wirePhantomForRecipe } from "../ai/phantom-wire.ts";
-import type { Recipe } from "../ai/recipe.ts";
-import { setupFakePhantom, type Harness } from "./_harness.ts";
+import { type Recipe, readRecipe, writeRecipe } from "../ai/recipe.ts";
+import { listSecrets } from "../phantom.ts";
+import { type Harness, setupFakePhantom } from "./_harness.ts";
+
+// Every test spawns the fake `phantom` shim (bash + several python3 calls),
+// which takes multiple seconds on loaded machines — well past the 5s default.
+setDefaultTimeout(30_000);
 
 describe("ai/phantom-wire", () => {
   let harness: Harness;
@@ -22,17 +27,16 @@ describe("ai/phantom-wire", () => {
     providers: [{ name: "stripe" }],
   };
 
-  it("calls `phantom add STRIPE_SECRET_KEY` and writes a webhook stub", async () => {
+  it("never writes to the vault, reports the missing secret, and writes a webhook stub", async () => {
     const result = await wirePhantomForRecipe(STRIPE_RECIPE, { cwd: harness.dir });
 
-    expect(result.envelopes).toContain("stripe:STRIPE_SECRET_KEY");
-
-    // Fake phantom treats `--rotate` as an unknown arg and succeeds anyway
-    // (our fake echoes success for unknown cases via the `*` branch exit 0),
-    // but we always log the call — so the `add` log should mention the key.
-    const adds = harness.callsTo("add");
-    const keys = adds.flatMap((c) => c.args);
-    expect(keys).toContain("STRIPE_SECRET_KEY");
+    // Phantom Secrets refuses values in argv and denies overwriting names, so
+    // apply must not try to plant placeholders. It only reads names.
+    expect(harness.callsTo("add")).toEqual([]);
+    expect(harness.callsTo("list")).toEqual([{ cmd: "list", args: ["--json"] }]);
+    expect(JSON.parse(readFileSync(harness.vaultPath, "utf-8"))).toEqual({});
+    expect(result.present).toEqual([]);
+    expect(result.missing).toContain("stripe:STRIPE_SECRET_KEY");
 
     const stubPath = join(harness.dir, ".stack/webhooks/stripe.ts");
     expect(existsSync(stubPath)).toBe(true);
@@ -42,19 +46,242 @@ describe("ai/phantom-wire", () => {
     expect(result.webhooks).toHaveLength(1);
   });
 
-  it("noWire: true skips envelopes and webhooks entirely", async () => {
+  it("wires an altered local recipe without authenticating its contents", async () => {
+    const path = await writeRecipe(STRIPE_RECIPE, harness.dir);
+    const original = readFileSync(path, "utf-8");
+    expect(original).toContain("stripe");
+    writeFileSync(path, original.replace('stripe"', 'github"'));
+
+    const recipe = await readRecipe(STRIPE_RECIPE.id, harness.dir);
+    expect(recipe.providers).toEqual([{ name: "github" }]);
+    const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
+    expect(result.missing).toContain("github:GITHUB_TOKEN");
+    expect(result.webhooks).toEqual([join(harness.dir, ".stack/webhooks/github.ts")]);
+  });
+
+  it("generates a commented request handler and response for every webhook provider", async () => {
+    const providers = ["stripe", "clerk", "supabase", "github"];
+    const recipe: Recipe = {
+      ...STRIPE_RECIPE,
+      providers: providers.map((name) => ({ name })),
+    };
+    const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
+    expect(result.webhooks).toEqual(
+      providers.map((provider) => join(harness.dir, ".stack/webhooks", `${provider}.ts`)),
+    );
+
+    for (const [index, provider] of providers.entries()) {
+      const stub = readFileSync(result.webhooks[index], "utf-8");
+      const handlerName = `handle${provider[0].toUpperCase()}${provider.slice(1)}Webhook`;
+      const example = stub.match(/^\/\/ export async function [\s\S]*?^\/\/ }$/m)?.[0];
+      expect(example).toBeDefined();
+      expect(example).toContain(
+        `// export async function ${handlerName}(req: Request): Promise<Response> {`,
+      );
+      expect(example).toContain('//   return new Response("ok", { status: 200 });');
+    }
+  });
+
+  it.each([
+    ["stripe", "handleStripeWebhook"],
+    ["clerk", "handleClerkWebhook"],
+    ["supabase", "handleSupabaseWebhook"],
+    ["github", "handleGithubWebhook"],
+  ])("returns the unsigned %s response without reading the body", async (provider, name) => {
+    const recipe: Recipe = { ...STRIPE_RECIPE, providers: [{ name: provider }] };
+    const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
+    const stub = readFileSync(result.webhooks[0], "utf-8");
+    const example = stub.match(/^\/\/ export async function [\s\S]*?^\/\/ }$/m)?.[0];
+    if (!example) throw new Error(`Missing ${provider} webhook example`);
+    const examplePath = join(harness.dir, `${provider}-unsigned-example.ts`);
+    writeFileSync(examplePath, example.replace(/^\/\/ ?/gm, ""));
+    const handler: unknown = (await import(examplePath))[name];
+    if (typeof handler !== "function") throw new Error(`Missing ${name}`);
+
+    const request = new Request("https://example.com", {
+      method: "POST",
+      body: "untrusted webhook payload",
+    });
+    const response: Response = await handler(request);
+    expect(response.status).toBe(400);
+    expect(await response.text()).toBe("Missing signature");
+    expect(request.bodyUsed).toBe(false);
+  });
+
+  it.each([
+    ["stripe", "stripe-signature", "handleStripeWebhook"],
+    ["clerk", "svix-signature", "handleClerkWebhook"],
+    ["supabase", "x-supabase-signature", "handleSupabaseWebhook"],
+    ["github", "x-hub-signature-256", "handleGithubWebhook"],
+  ])("rejects missing signatures and interrupted %s requests", async (provider, header, name) => {
+    const recipe: Recipe = { ...STRIPE_RECIPE, providers: [{ name: provider }] };
+    const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
+    expect(result.webhooks).toHaveLength(1);
+
+    const stub = readFileSync(result.webhooks[0], "utf-8");
+    expect(stub.split("\n").every((line) => line === "" || line.startsWith("//"))).toBe(true);
+    expect(stub).toContain("This entire example is commented out and does not verify signatures.");
+    expect(stub).toContain(
+      "If uncommented as-is, it accepts any non-empty signature header and returns\n" +
+        "// 200 without authenticating the request. Implement verification first.",
+    );
+    const example = stub.match(/^\/\/ export async function [\s\S]*?^\/\/ }$/m)?.[0];
+    if (!example) throw new Error(`Missing ${provider} webhook example`);
+    expect(example).toContain(
+      "//   // TODO(security): signature verification is NOT implemented here. The\n" +
+        "//   // header check above proves only that a signature header arrived; its\n" +
+        "//   // value is never compared to anything.",
+    );
+    expect(example).toContain(
+      `//   // is unauthenticated, attacker-controlled input — anyone who can POST\n//   // to this endpoint can forge a ${provider} webhook.`,
+    );
+    expect(example).toContain(
+      "//   // constant time; reject missing or invalid signatures, and only then\n" +
+        "//   // parse, trust, or act on the body.",
+    );
+    const examplePath = join(harness.dir, `${provider}-example.ts`);
+    writeFileSync(examplePath, example.replace(/^\/\/ ?/gm, ""));
+    const handler: unknown = (await import(examplePath))[name];
+    expect(typeof handler).toBe("function");
+    if (typeof handler !== "function") throw new Error(`Missing ${name}`);
+
+    const missingHeaders: HeadersInit[] = [
+      {},
+      { "x-unrelated-signature": "present" },
+      { [header]: "" },
+    ];
+    for (const headers of missingHeaders) {
+      const response: Response = await handler(new Request("https://example.com", { headers }));
+      expect(response.status).toBe(400);
+      expect(await response.text()).toBe("Missing signature");
+    }
+
+    // A non-empty header reaches the placeholder; it is not signature verification.
+    const response: Response = await handler(
+      new Request("https://example.com", {
+        method: "POST",
+        headers: { [header]: "placeholder" },
+        body: "unverified webhook payload",
+      }),
+    );
+    expect(response.status).toBe(200);
+
+    const networkError = new Error("request body connection lost");
+    const interruptedBody = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        controller.error(networkError);
+      },
+    });
+    const interruptedRequest = new Request("https://example.com", {
+      method: "POST",
+      headers: { [header]: "placeholder" },
+      body: interruptedBody,
+    });
+    await expect(handler(interruptedRequest)).rejects.toBe(networkError);
+  });
+
+  it.each([
+    ["stripe", "stripe-signature", "handleStripeWebhook"],
+    ["clerk", "svix-signature", "handleClerkWebhook"],
+    ["supabase", "x-supabase-signature", "handleSupabaseWebhook"],
+    ["github", "x-hub-signature-256", "handleGithubWebhook"],
+  ])(
+    "returns the successful %s webhook response after reading the body",
+    async (provider, header, name) => {
+      const recipe: Recipe = { ...STRIPE_RECIPE, providers: [{ name: provider }] };
+      const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
+      const stub = readFileSync(result.webhooks[0], "utf-8");
+      const example = stub.match(/^\/\/ export async function [\s\S]*?^\/\/ }$/m)?.[0];
+      if (!example) throw new Error(`Missing ${provider} webhook example`);
+      const examplePath = join(harness.dir, `${provider}-success-example.ts`);
+      writeFileSync(examplePath, example.replace(/^\/\/ ?/gm, ""));
+      const handler: unknown = (await import(examplePath))[name];
+      if (typeof handler !== "function") throw new Error(`Missing ${name}`);
+
+      const request = new Request("https://example.com", {
+        method: "POST",
+        headers: { [header]: "placeholder" },
+        body: "unverified webhook payload",
+      });
+      const response: Response = await handler(request);
+      expect(request.bodyUsed).toBe(true);
+      expect(response.status).toBe(200);
+      expect(await response.text()).toBe("ok");
+    },
+  );
+
+  it.each(["stripe", "clerk", "supabase", "github"])(
+    "places the signature verification TODO before trusting the %s webhook body",
+    async (provider) => {
+      const recipe: Recipe = { ...STRIPE_RECIPE, providers: [{ name: provider }] };
+      const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
+      expect(result.webhooks).toHaveLength(1);
+      const stub = readFileSync(result.webhooks[0], "utf-8");
+      const example = stub.match(/^\/\/ export async function [\s\S]*?^\/\/ }$/m)?.[0];
+      if (!example) throw new Error(`Missing ${provider} webhook example`);
+
+      // Reading the raw body supplies an input to verification; no executable
+      // handling of it should appear before the verification reminder.
+      expect(example).toContain(
+        "//   const body = await req.text();\n" +
+          "//   // TODO(security): signature verification is NOT implemented here.",
+      );
+      const todo = example.indexOf("TODO(security): signature verification is NOT implemented");
+      const success = example.indexOf('return new Response("ok", { status: 200 })');
+      expect(todo).toBeGreaterThanOrEqual(0);
+      expect(success).toBeGreaterThan(todo);
+    },
+  );
+
+  it.each([
+    ["stripe", "stripe.webhooks.constructEvent"],
+    ["clerk", "new Webhook(secret).verify(body, headers)"],
+    ["supabase", "`x-supabase-signature` per Supabase's documented webhook scheme"],
+    ["github", "`sha256=` + HMAC-SHA256"],
+  ])(
+    "points the %s stub at the provider's verification scheme without claiming it ran",
+    async (provider, hint) => {
+      const recipe: Recipe = { ...STRIPE_RECIPE, providers: [{ name: provider }] };
+      const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
+      const example = readFileSync(result.webhooks[0], "utf-8").match(
+        /^\/\/ export async function [\s\S]*?^\/\/ }$/m,
+      )?.[0];
+      if (!example) throw new Error(`Missing ${provider} webhook example`);
+
+      // The TODO names where verification belongs and how the provider does it.
+      expect(example).toContain(hint);
+
+      // No comment may describe the request as already verified, and the
+      // uncommented handler must contain no verification code — the TODO's
+      // "NOT implemented" claim has to be true, not aspirational.
+      expect(example).not.toMatch(
+        /signature verified|verified signature|request is authenticated/i,
+      );
+      const runnable = example
+        .replace(/^\/\/ ?/gm, "")
+        .split("\n")
+        .filter((line) => !line.trimStart().startsWith("//"))
+        .join("\n");
+      expect(runnable).not.toMatch(/createHmac|timingSafeEqual|\.verify\(/);
+    },
+  );
+
+  it("noWire: true skips the vault check and webhooks entirely", async () => {
     const result = await wirePhantomForRecipe(STRIPE_RECIPE, {
       cwd: harness.dir,
       noWire: true,
     });
-    expect(result).toEqual({ envelopes: [], webhooks: [], skipped: [] });
+    expect(result).toEqual({ present: [], missing: [], webhooks: [], skipped: [] });
 
     const stubPath = join(harness.dir, ".stack/webhooks/stripe.ts");
     expect(existsSync(stubPath)).toBe(false);
     expect(harness.callsTo("add")).toEqual([]);
+    expect(harness.callsTo("list")).toEqual([]);
   });
 
-  it("creates envelopes for every secret on a multi-secret provider", async () => {
+  it("splits a multi-secret provider into present and missing", async () => {
+    harness.cleanup();
+    harness = setupFakePhantom({ SUPABASE_URL: "https://x.supabase.co", SUPABASE_ANON_KEY: "a" });
     const recipe: Recipe = {
       id: "supa",
       query: "database",
@@ -62,15 +289,169 @@ describe("ai/phantom-wire", () => {
       providers: [{ name: "supabase" }],
     };
     const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
-    expect(result.envelopes).toEqual([
-      "supabase:SUPABASE_URL",
-      "supabase:SUPABASE_ANON_KEY",
-      "supabase:SUPABASE_SERVICE_ROLE_KEY",
-    ]);
+    expect(result.present).toEqual(["supabase:SUPABASE_URL", "supabase:SUPABASE_ANON_KEY"]);
+    expect(result.missing).toEqual(["supabase:SUPABASE_SERVICE_ROLE_KEY"]);
+    expect(result.skipped).toEqual([]);
+    expect(harness.callsTo("add")).toEqual([]);
     // Supabase is webhook-capable in our moat list.
     expect(result.webhooks).toHaveLength(1);
   });
 
+  it("skips providers when the vault can't be listed, but still writes stubs", async () => {
+    writeFileSync(harness.vaultPath, "not json");
+    const result = await wirePhantomForRecipe(STRIPE_RECIPE, { cwd: harness.dir });
+    expect(result.skipped).toEqual(["stripe"]);
+    expect(result.present).toEqual([]);
+    expect(result.missing).toEqual([]);
+    expect(result.webhooks).toHaveLength(1);
+    expect(harness.callsTo("add")).toEqual([]);
+  });
+
+  it("surfaces a failed inventory command as unavailable and skips providers", async () => {
+    const phantomPath = join(harness.dir, "phantom");
+    const shim = readFileSync(phantomPath, "utf-8");
+    // Even plausible inventory on stdout is not evidence when the command fails.
+    expect(shim).toContain("  list)\n");
+    writeFileSync(
+      phantomPath,
+      shim.replace(
+        "  list)\n",
+        `  list)\n    echo '[{"name":"STRIPE_SECRET_KEY"}]'\n    echo 'inventory unavailable' >&2\n    exit 1\n`,
+      ),
+    );
+
+    await expect(listSecrets(harness.dir)).rejects.toMatchObject({
+      code: "PHANTOM_METADATA_UNAVAILABLE",
+      message: "Phantom secret inventory is unavailable; stored names are unknown.",
+    });
+    const recipe: Recipe = { ...STRIPE_RECIPE, providers: [{ name: "stripe" }, { name: "neon" }] };
+    const stubPath = join(harness.dir, ".stack/webhooks/stripe.ts");
+    expect(await wirePhantomForRecipe(recipe, { cwd: harness.dir })).toEqual({
+      present: [],
+      missing: [],
+      webhooks: [stubPath],
+      skipped: ["stripe", "neon"],
+    });
+    expect(existsSync(stubPath)).toBe(true);
+    expect(harness.callsTo("list")).toEqual([
+      { cmd: "list", args: ["--json"] },
+      { cmd: "list", args: ["--json"] },
+    ]);
+    expect(harness.callsTo("add")).toEqual([]);
+    expect(JSON.parse(readFileSync(harness.vaultPath, "utf-8"))).toEqual({});
+  });
+
+  it("treats surrounding whitespace in vault inventory JSON the same as compact JSON", async () => {
+    const inventory = '[{"name":"STRIPE_SECRET_KEY"}]';
+    const setListOutput = (output: string) => {
+      writeFileSync(
+        join(harness.dir, "phantom"),
+        `#!/usr/bin/env bash\ncase "$1" in\n  --version) echo "phantom fake 0.0.1" ;;\n  list) printf '%s' '${output}' ;;\n  *) exit 1 ;;\nesac\n`,
+      );
+    };
+
+    setListOutput(inventory);
+    const compact = await wirePhantomForRecipe(STRIPE_RECIPE, { cwd: harness.dir });
+    expect(compact).toEqual({
+      present: ["stripe:STRIPE_SECRET_KEY"],
+      missing: [],
+      skipped: [],
+      webhooks: [join(harness.dir, ".stack/webhooks/stripe.ts")],
+    });
+
+    setListOutput(` \t\r\n${inventory}\n\t `);
+    expect(await wirePhantomForRecipe(STRIPE_RECIPE, { cwd: harness.dir })).toEqual(compact);
+  });
+
+  it("rejects malformed vault inventory JSON and keeps the provider's secrets unknown", async () => {
+    // A successful command may still return a truncated inventory containing a plausible name.
+    writeFileSync(
+      join(harness.dir, "phantom"),
+      `#!/usr/bin/env bash\ncase "$1" in\n  --version) echo "phantom fake 0.0.1" ;;\n  list) printf '%s' '[{"name":"STRIPE_SECRET_KEY"}' ;;\n  *) exit 1 ;;\nesac\n`,
+    );
+
+    await expect(listSecrets(harness.dir)).rejects.toMatchObject({
+      code: "PHANTOM_OUTPUT_UNRECOGNIZED",
+      message:
+        "phantom list --json did not return JSON; upgrade Phantom Secrets to 0.7.9 or newer.",
+    });
+    const result = await wirePhantomForRecipe(STRIPE_RECIPE, { cwd: harness.dir });
+    expect(result).toEqual({
+      present: [],
+      missing: [],
+      skipped: ["stripe"],
+      webhooks: [join(harness.dir, ".stack/webhooks/stripe.ts")],
+    });
+    expect(existsSync(result.webhooks[0])).toBe(true);
+    expect(JSON.parse(readFileSync(harness.vaultPath, "utf-8"))).toEqual({});
+  });
+
+  it("rejects a JSON number from the vault inventory and skips the provider", async () => {
+    // Return valid JSON from a successful list command, but not the required array.
+    writeFileSync(
+      join(harness.dir, "phantom"),
+      '#!/usr/bin/env bash\ncase "$1" in\n  --version) echo "phantom fake 0.0.1" ;;\n  list) echo 42 ;;\n  *) exit 1 ;;\nesac\n',
+    );
+
+    await expect(listSecrets(harness.dir)).rejects.toMatchObject({
+      code: "PHANTOM_OUTPUT_UNRECOGNIZED",
+      message: "phantom list --json did not return an array.",
+    });
+    const result = await wirePhantomForRecipe(STRIPE_RECIPE, { cwd: harness.dir });
+    expect(result).toEqual({
+      present: [],
+      missing: [],
+      skipped: ["stripe"],
+      webhooks: [join(harness.dir, ".stack/webhooks/stripe.ts")],
+    });
+    expect(existsSync(result.webhooks[0])).toBe(true);
+  });
+
+  it.each(["true", "false"])(
+    "rejects JSON boolean %s from the vault inventory and skips the provider",
+    async (output) => {
+      writeFileSync(
+        join(harness.dir, "phantom"),
+        `#!/usr/bin/env bash\ncase "$1" in\n  --version) echo "phantom fake 0.0.1" ;;\n  list) echo ${output} ;;\n  *) exit 1 ;;\nesac\n`,
+      );
+
+      await expect(listSecrets(harness.dir)).rejects.toMatchObject({
+        code: "PHANTOM_OUTPUT_UNRECOGNIZED",
+        message: "phantom list --json did not return an array.",
+      });
+      const result = await wirePhantomForRecipe(STRIPE_RECIPE, { cwd: harness.dir });
+      expect(result).toEqual({
+        present: [],
+        missing: [],
+        skipped: ["stripe"],
+        webhooks: [join(harness.dir, ".stack/webhooks/stripe.ts")],
+      });
+      expect(existsSync(result.webhooks[0])).toBe(true);
+      expect(harness.callsTo("add")).toEqual([]);
+    },
+  );
+
+  it("does not report a JSON string vault response as a verified secret", async () => {
+    // A successful command returning the expected name as a scalar is not an inventory.
+    writeFileSync(
+      join(harness.dir, "phantom"),
+      `#!/usr/bin/env bash\ncase "$1" in\n  --version) echo "phantom fake 0.0.1" ;;\n  list) printf '%s' '"STRIPE_SECRET_KEY"' ;;\n  *) exit 1 ;;\nesac\n`,
+    );
+
+    await expect(listSecrets(harness.dir)).rejects.toMatchObject({
+      code: "PHANTOM_OUTPUT_UNRECOGNIZED",
+      message: "phantom list --json did not return an array.",
+    });
+    const result = await wirePhantomForRecipe(STRIPE_RECIPE, { cwd: harness.dir });
+    expect(result).toEqual({
+      present: [],
+      missing: [],
+      skipped: ["stripe"],
+      webhooks: [join(harness.dir, ".stack/webhooks/stripe.ts")],
+    });
+    expect(existsSync(result.webhooks[0])).toBe(true);
+  });
+
   it("skips providers with no webhook stub without crashing", async () => {
     const recipe: Recipe = {
       id: "neon",
@@ -80,6 +461,6 @@ describe("ai/phantom-wire", () => {
     };
     const result = await wirePhantomForRecipe(recipe, { cwd: harness.dir });
     expect(result.webhooks).toEqual([]);
-    expect(result.envelopes.length).toBeGreaterThan(0);
+    expect(result.missing.length).toBeGreaterThan(0);
   });
 });

package/src/__tests__/pipeline-integration.test.ts

@@ -2,6 +2,8 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { wirePhantomForRecipe } from "../ai/phantom-wire.ts";
+import { readRecipe, writeRecipe } from "../ai/recipe.ts";
 import { emptyConfig, writeConfig } from "../config.ts";
 import { addService } from "../pipeline.ts";
 import type { Provider } from "../providers/_base.ts";
@@ -90,6 +92,36 @@ describe("addService full loop", () => {
     const mcp = JSON.parse(mcpRaw) as { mcpServers: Record<string, unknown> };
     expect(mcp.mcpServers.stubsvc).toBeDefined();
 
-    delete providers.stubsvc;
+    Reflect.deleteProperty(providers, "stubsvc");
   });
 });
+
+test("apply wiring preserves an existing value and leaves missing values absent", async () => {
+  const initialVault = {
+    NEON_API_KEY: "existing-test-value",
+    UNRELATED_KEY: "unrelated-test-value",
+  };
+  const h = setupFakePhantom(initialVault);
+  try {
+    const recipe = {
+      id: "preserve-existing-value",
+      query: "database",
+      createdAt: "2026-04-18T00:00:00.000Z",
+      providers: [{ name: "neon" }],
+    };
+    await writeRecipe(recipe, h.dir);
+    const loaded = await readRecipe(recipe.id, h.dir);
+
+    // This is the vault-wiring phase used by stack apply after provisioning.
+    const result = await wirePhantomForRecipe(loaded, { cwd: h.dir });
+    expect(result.present).toEqual(["neon:NEON_API_KEY"]);
+    expect(result.missing).toEqual(["neon:DATABASE_URL"]);
+    expect(result.skipped).toEqual([]);
+    expect(h.callsTo("list")).toEqual([{ cmd: "list", args: ["--json"] }]);
+    expect(h.callsTo("add")).toEqual([]);
+    expect(h.callsTo("remove")).toEqual([]);
+    expect(await readVault(h.dir)).toEqual(initialVault);
+  } finally {
+    h.cleanup();
+  }
+});