@ashlr/stack-core 0.2.2 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ashlr/stack-core",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Ashlr Stack core — provider adapters, .stack.toml config, Phantom integration. Shared logic behind the Stack CLI and MCP server.",
   "license": "MIT",
   "author": {

package/src/__tests__/agent-onboard.test.ts

@@ -215,3 +215,65 @@ describe("applyOnboarding and undoOnboarding", () => {
     expect(readFileSync(configPathFor("gemini", home), "utf-8")).not.toMatch(/key|token|secret/i);
   });
 });
+
+it.each(["null", "[]", "42", '{"mcpServers":null}', '{"mcpServers":42}', "{broken"])(
+  "refuses malformed JSON config %s without writing",
+  async (raw) => {
+    const path = configPathFor("claude", home);
+    writeFileSync(path, raw);
+    const result = await applyOnboarding({ ...opts(), clients: ["claude"] });
+    expect(result.written).toEqual([]);
+    expect(result.manifestPath).toBeNull();
+    expect(result.skipped[0]?.state).toBe("error");
+    expect(result.skipped[0]?.error).toBeTruthy();
+    expect(readFileSync(path, "utf-8")).toBe(raw);
+  },
+);
+
+it.each([
+  ["", "not-wired"],
+  ['[mcp_servers.other]\ncommand = "ashlr"', "not-wired"],
+  [
+    '[mcp_servers."ashlr-hub"] # gateway\r\ncommand = "ashlr" # command\r\nargs = ["mcp"]\r\n[other]\r\ncommand = "different"',
+    "wired",
+  ],
+  ['[mcp_servers.ashlr-hub]\ncommand = "ashlr"\nargs = []', "differs"],
+  ['[mcp_servers.ashlr-hub]\nargs = ["mcp"]', "differs"],
+] as const)("inspects TOML %s", (raw, state) => {
+  const path = configPathFor("codex", home);
+  mkdirSync(join(home, ".codex"));
+  writeFileSync(path, raw);
+  expect(planOnboarding({ ...opts(), clients: ["codex"] })[0]?.state).toBe(state);
+  expect(readFileSync(path, "utf-8")).toBe(raw);
+});
+
+it.each(["missing config", "missing backup"])(
+  "undo retains manifest for %s and permits retry",
+  async (mode) => {
+    const path = configPathFor("claude", home);
+    writeFileSync(path, "{}");
+    const applied = await applyOnboarding({
+      ...opts(),
+      clients: ["claude"],
+      includeUndetected: true,
+    });
+    const entry = applied.written[0]!;
+    const target = mode === "missing config" ? path : entry.backupPath!;
+    const original = readFileSync(target, "utf-8");
+    rmSync(target);
+    const result = await undoOnboarding({ home });
+    expect(result.restored).toEqual([]);
+    expect(result.refused).toEqual([
+      {
+        entry,
+        reason:
+          mode === "missing config" ? "config file no longer exists" : "backup file is missing",
+      },
+    ]);
+    expect(JSON.parse(readFileSync(applied.manifestPath!, "utf-8")).entries).toEqual([entry]);
+    writeFileSync(target, original);
+    expect((await undoOnboarding({ home })).restored).toEqual([entry]);
+    expect(readFileSync(path, "utf-8")).toBe("{}");
+    expect(existsSync(applied.manifestPath!)).toBe(false);
+  },
+);

package/src/__tests__/base-urls.test.ts

@@ -55,6 +55,17 @@ describe("overrides are honored", () => {
       "http://gpu-box:11434/v1",
     );
   });
+  test.each(["/", "///"])("trailing %s does not duplicate composed separators", (slashes) => {
+    expect(
+      `${anthropicBaseUrl({ ANTHROPIC_BASE_URL: `https://gw.example/anthropic${slashes}` })}/v1/models`,
+    ).toBe("https://gw.example/anthropic/v1/models");
+    expect(
+      `${openaiBaseUrl({ OPENAI_BASE_URL: `https://gw.example/openai/v1${slashes}` })}/models`,
+    ).toBe("https://gw.example/openai/v1/models");
+    expect(
+      `${defaultOllamaEndpoint({ OLLAMA_HOST: `https://gw.example/ollama${slashes}` }).baseUrl}/models`,
+    ).toBe("https://gw.example/ollama/v1/models");
+  });
 });
 
 describe("callers read the variables at call time", () => {
@@ -108,14 +119,39 @@ describe("callers read the variables at call time", () => {
 
   test("key checks follow ANTHROPIC_BASE_URL and OPENAI_BASE_URL", async () => {
     process.env.ANTHROPIC_BASE_URL = "http://127.0.0.1:4000/";
-    process.env.OPENAI_BASE_URL = "http://127.0.0.1:4000/v1";
+    process.env.OPENAI_BASE_URL = "http://127.0.0.1:4000/v1/";
     await anthropic.healthcheck!(ctx, entry("anthropic", "ANTHROPIC_API_KEY"));
     await openai.healthcheck!(ctx, entry("openai", "OPENAI_API_KEY"));
     expect(urls).toEqual(["http://127.0.0.1:4000/v1/models", "http://127.0.0.1:4000/v1/models"]);
   });
 
+  test.each(["", "/", "///"])(
+    "equivalent base URLs with trailing %j hit the same endpoints",
+    async (suffix) => {
+      process.env.ANTHROPIC_BASE_URL = `https://gw.example/anthropic${suffix}`;
+      process.env.OPENAI_BASE_URL = `https://gw.example/openai/v1${suffix}`;
+      process.env.OLLAMA_HOST = `https://gw.example/ollama${suffix}`;
+
+      expect(
+        (await anthropic.healthcheck!(ctx, entry("anthropic", "ANTHROPIC_API_KEY"))).kind,
+      ).toBe("ok");
+      expect((await openai.healthcheck!(ctx, entry("openai", "OPENAI_API_KEY"))).kind).toBe("ok");
+      expect(
+        await new LocalSLMBackend({
+          endpoints: [defaultOllamaEndpoint()],
+          fetchImpl: globalThis.fetch,
+        }).healthy(),
+      ).toBe(true);
+      expect(urls).toEqual([
+        "https://gw.example/anthropic/v1/models",
+        "https://gw.example/openai/v1/models",
+        "https://gw.example/ollama/v1/models",
+      ]);
+    },
+  );
+
   test("the local SLM backend picks up OLLAMA_HOST when constructed", async () => {
-    process.env.OLLAMA_HOST = "gpu-box:11435";
+    process.env.OLLAMA_HOST = "gpu-box:11435/";
     const seen: string[] = [];
     const down = (async (u: string | URL | Request) => {
       seen.push(String(u));
@@ -160,3 +196,13 @@ describe("gateway rule for keyed providers", () => {
     );
   });
 });
+
+test.each([
+  ["gpu-box/models///", "http://gpu-box:11434/models"],
+  [":8080/models", "http://localhost:8080/models"],
+  ["[::1]/models", "http://[::1]:11434/models"],
+  ["[::1]:8080/models", "http://[::1]:8080/models"],
+  [" HTTPS://ollama.example/models/// ", "HTTPS://ollama.example/models"],
+])("Ollama normalizes %s", (input, expected) => {
+  expect(ollamaBaseUrl({ OLLAMA_HOST: input })).toBe(expected);
+});

package/src/__tests__/catalog.test.ts

@@ -0,0 +1,31 @@
+import { expect, test } from "bun:test";
+import {
+  PROVIDERS_REF,
+  PROVIDER_CATEGORIES,
+  findProviderRef,
+  groupByCategory,
+} from "../catalog.ts";
+
+test.each(PROVIDERS_REF)("catalog resolves $name by identity", (provider) => {
+  expect(findProviderRef(provider.name)).toBe(provider);
+  expect(PROVIDER_CATEGORIES).toContain(provider.category);
+});
+
+test.each(["", "OPENAI", " openai", "openai ", "constructor", "__proto__", "missing"])(
+  "catalog rejects noncanonical name %s",
+  (name) => expect(findProviderRef(name)).toBeUndefined(),
+);
+
+test("category groups partition the catalog without sharing mutable buckets", () => {
+  const groups = groupByCategory();
+  expect(Object.values(groups).flat()).toHaveLength(PROVIDERS_REF.length);
+  expect(new Set(PROVIDERS_REF.map((p) => p.name)).size).toBe(PROVIDERS_REF.length);
+  for (const [category, providers] of Object.entries(groups)) {
+    expect(providers).toEqual(PROVIDERS_REF.filter((p) => p.category === category));
+  }
+  const first = PROVIDERS_REF[0]!;
+  groups[first.category]!.pop();
+  expect(groupByCategory()[first.category]).toEqual(
+    PROVIDERS_REF.filter((p) => p.category === first.category),
+  );
+});

package/src/__tests__/cloudflare-provider.test.ts

@@ -70,4 +70,27 @@ describe("cloudflare provider (mocked fetch)", () => {
     expect(status.kind).toBe("ok");
     expect(seenAuth).toBe("Bearer cf-cached");
   });
+
+  test("an empty 204 verification response does not verify a cached token", async () => {
+    const { addSecret } = await import("../phantom.ts");
+    await addSecret("CLOUDFLARE_API_TOKEN", "cf-cached");
+
+    let requests = 0;
+    globalThis.fetch = (async (url: string | URL | Request) => {
+      expect(String(url)).toBe("https://api.cloudflare.com/client/v4/user/tokens/verify");
+      requests++;
+      return new Response(null, { status: 204 });
+    }) as unknown as typeof fetch;
+
+    const ctx: ProviderContext = { cwd: process.cwd(), interactive: false, log: () => {} };
+    expect(
+      await cloudflare.healthcheck!(ctx, {
+        provider: "cloudflare",
+        secrets: ["CLOUDFLARE_API_TOKEN"],
+        created_at: new Date().toISOString(),
+      }),
+    ).toEqual({ kind: "error", detail: "token invalid" });
+    await expect(cloudflare.login(ctx)).rejects.toMatchObject({ code: "CLOUDFLARE_AUTH_REQUIRED" });
+    expect(requests).toBe(2);
+  });
 });

package/src/__tests__/config-split.test.ts

@@ -7,6 +7,7 @@ import {
   CONFIG_FILENAME,
   LOCAL_FILENAME,
   emptyConfig,
+  getService,
   readConfig,
   writeConfig,
 } from "../config.ts";
@@ -72,6 +73,71 @@ describe("committed + local config split", () => {
     expect(roundtrip.services.supabase.secrets).toEqual(["FOO"]);
   });
 
+  test("round-trips a service name containing a hyphen through both files", async () => {
+    const original = emptyConfig("fixture-template");
+    original.services["fixture-api"] = {
+      provider: "neon",
+      resource_id: "hyphen-resource",
+      region: "us-east-1",
+      secrets: ["FIXTURE_API_URL", "FIXTURE_API_KEY"],
+      mcp: "fixture-api",
+      meta: { endpoint: "fixture-endpoint" },
+      created_at: "2026-10-30T00:00:00Z",
+      created_by: "test",
+    };
+    await writeConfig(original, cwd);
+
+    const shape = parseToml(readFileSync(join(cwd, CONFIG_FILENAME), "utf-8"));
+    const local = parseToml(readFileSync(join(cwd, LOCAL_FILENAME), "utf-8"));
+    expect(Object.keys(shape.services as object)).toEqual(["fixture-api"]);
+    expect(Object.keys(local.services as object)).toEqual(["fixture-api"]);
+    expect(shape.services).toEqual({
+      "fixture-api": {
+        provider: "neon",
+        secrets: ["FIXTURE_API_URL", "FIXTURE_API_KEY"],
+        mcp: "fixture-api",
+      },
+    });
+    expect(local.services).toEqual({
+      "fixture-api": {
+        resource_id: "hyphen-resource",
+        region: "us-east-1",
+        meta: { endpoint: "fixture-endpoint" },
+        created_at: "2026-10-30T00:00:00Z",
+        created_by: "test",
+      },
+    });
+
+    const merged = await readConfig(cwd);
+    expect(Object.keys(merged.services)).toEqual(["fixture-api"]);
+    expect(getService(merged, "fixture-api")).toEqual(original.services["fixture-api"]);
+  });
+
+  test("legacy file with a hyphenated service name migrates without losing it", async () => {
+    const legacy = `
+[stack]
+version = "1"
+project_id = "stk_hyphen"
+
+[services.fixture-api]
+provider = "neon"
+resource_id = "hyphen-legacy"
+secrets = ["X"]
+created_at = "2026-04-17T00:00:00Z"
+`.trim();
+    writeFileSync(join(cwd, CONFIG_FILENAME), legacy);
+    const config = await readConfig(cwd);
+    expect(Object.keys(config.services)).toEqual(["fixture-api"]);
+    expect(config.services["fixture-api"].resource_id).toBe("hyphen-legacy");
+
+    await writeConfig(config, cwd);
+    const shape = readFileSync(join(cwd, CONFIG_FILENAME), "utf-8");
+    expect(shape).toContain("fixture-api");
+    expect(shape).not.toContain("hyphen-legacy");
+    const roundTrip = await readConfig(cwd);
+    expect(roundTrip.services["fixture-api"]).toEqual(config.services["fixture-api"]);
+  });
+
   test("writeConfig auto-appends .stack.local.toml to .gitignore", async () => {
     await writeConfig(emptyConfig(), cwd);
     const gitignore = readFileSync(join(cwd, ".gitignore"), "utf-8");

package/src/__tests__/config.test.ts

@@ -1,9 +1,10 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtempSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
   CONFIG_FILENAME,
+  LOCAL_FILENAME,
   emptyConfig,
   hasConfig,
   readConfig,
@@ -11,8 +12,15 @@ import {
   writeConfig,
 } from "../config.ts";
 
+const scratch: string[] = [];
+afterEach(() => {
+  for (const dir of scratch.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
 function freshCwd(): string {
-  return mkdtempSync(join(tmpdir(), "stack-test-"));
+  const dir = mkdtempSync(join(tmpdir(), "stack-test-"));
+  scratch.push(dir);
+  return dir;
 }
 
 describe("config", () => {
@@ -20,7 +28,7 @@ describe("config", () => {
 
   beforeEach(() => {
     previousRegistryDir = process.env.STACK_REGISTRY_DIR;
-    process.env.STACK_REGISTRY_DIR = mkdtempSync(join(tmpdir(), "stack-cfg-reg-"));
+    process.env.STACK_REGISTRY_DIR = freshCwd();
   });
 
   afterEach(() => {
@@ -64,4 +72,85 @@ describe("config", () => {
     const cwd = freshCwd();
     await expect(readConfig(cwd)).rejects.toThrow(/No .stack.toml at/);
   });
+  test.each([".stack.toml", ".stack.local.toml"])(
+    "rejects malformed %s without rewriting files",
+    async (file) => {
+      const cwd = freshCwd();
+      writeFileSync(join(cwd, CONFIG_FILENAME), '[stack]\nversion = "1"');
+      writeFileSync(join(cwd, file), "[broken");
+      await expect(readConfig(cwd)).rejects.toThrow();
+      expect(readFileSync(join(cwd, file), "utf-8")).toBe("[broken");
+    },
+  );
+
+  test.each(["", "node_modules/", "node_modules/\n", " .stack.local.toml \r\n"])(
+    "gitignore update preserves existing content %j and is idempotent",
+    async (initial) => {
+      const cwd = freshCwd();
+      writeFileSync(join(cwd, ".gitignore"), initial);
+      const config = emptyConfig();
+      await writeConfig(config, cwd);
+      const first = readFileSync(join(cwd, ".gitignore"), "utf-8");
+      expect(first.startsWith(initial)).toBe(true);
+      expect(
+        first.split(/\r?\n/).filter((line) => line.trim() === ".stack.local.toml"),
+      ).toHaveLength(1);
+      await writeConfig(config, cwd);
+      expect(readFileSync(join(cwd, ".gitignore"), "utf-8")).toBe(first);
+    },
+  );
+
+  test("empty shape supplies defaults without creating local files", async () => {
+    const cwd = freshCwd();
+    writeFileSync(join(cwd, CONFIG_FILENAME), "");
+    const config = await readConfig(cwd);
+    expect(config.stack.version).toBe("1");
+    expect(config.stack.project_id).toMatch(/^stk_[a-f0-9]{12}$/);
+    expect(config.services).toEqual({});
+    expect(readFileSync(join(cwd, CONFIG_FILENAME), "utf-8")).toBe("");
+    expect(existsSync(join(cwd, LOCAL_FILENAME))).toBe(false);
+    expect(existsSync(join(cwd, ".gitignore"))).toBe(false);
+    expect(config.environments).toEqual([{ name: "dev", default: true }]);
+  });
+
+  test("empty shape keeps the local project id but does not add local-only services", async () => {
+    const cwd = freshCwd();
+    const local =
+      '[stack]\nproject_id = "stk_fixture"\n[services.orphan]\nresource_id = "fixture-resource"\n';
+    writeFileSync(join(cwd, CONFIG_FILENAME), "");
+    writeFileSync(join(cwd, LOCAL_FILENAME), local);
+
+    expect(await readConfig(cwd)).toEqual({
+      stack: { version: "1", project_id: "stk_fixture" },
+      services: {},
+      environments: [{ name: "dev", default: true }],
+    });
+    expect(readFileSync(join(cwd, CONFIG_FILENAME), "utf-8")).toBe("");
+    expect(readFileSync(join(cwd, LOCAL_FILENAME), "utf-8")).toBe(local);
+    expect(existsSync(join(cwd, ".gitignore"))).toBe(false);
+  });
+  test.each(['created_at = "2026-01-01T00:00:00Z"', 'resource_id = "resource-1"'])(
+    "legacy service marker %s normalizes optional fields",
+    async (marker) => {
+      const cwd = freshCwd();
+      writeFileSync(
+        join(cwd, CONFIG_FILENAME),
+        `[services.example]\n${marker}\nmcp = "example"\nregion = "local"\ncreated_by = "test"\n[services.example.meta]\ncount = 2\n`,
+      );
+      const config = await readConfig(cwd);
+      expect(config.stack.version).toBe("1");
+      expect(config.stack.project_id).toMatch(/^stk_[a-f0-9]{12}$/);
+      expect(config.services.example).toMatchObject({
+        provider: "example",
+        secrets: [],
+        mcp: "example",
+        region: "local",
+        created_by: "test",
+        meta: { count: 2 },
+      });
+      expect(Number.isNaN(Date.parse(config.services.example!.created_at))).toBe(false);
+      await writeConfig(config, cwd);
+      expect(await readConfig(cwd)).toEqual(config);
+    },
+  );
 });

package/src/__tests__/credential-staging.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { emptyConfig, readConfig, writeConfig } from "../config.ts";
@@ -267,8 +267,9 @@ describe("operation-owned credential persistence", () => {
       .trim()
       .split("\n")
       .map((line) => JSON.parse(line));
+    // Python getcwd resolves filesystem aliases such as macOS /var.
     for (const row of rows.filter((r) => ["status", "reveal", "add"].includes(r.cmd)))
-      expect(row.cwd).toBe(cwd);
+      expect(row.cwd).toBe(realpathSync(cwd));
     expect((await readConfig(cwd)).services.stagefixture).toBeDefined();
   });
   for (const fail of ["login", "provision", "materialize", "success"] as const) {

package/src/__tests__/detect-source.test.ts

@@ -1,11 +1,17 @@
-import { describe, expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { afterEach, describe, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { delimiter, dirname, join } from "node:path";
 import { scanSource } from "../detect-source.ts";
 
+const projects: string[] = [];
+afterEach(() => {
+  for (const dir of projects.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
 function makeProject(files: Record<string, string>): string {
   const dir = mkdtempSync(join(tmpdir(), "stack-scan-"));
+  projects.push(dir);
   for (const [path, content] of Object.entries(files)) {
     const full = join(dir, path);
     const parent = join(full, "..");
@@ -145,3 +151,176 @@ require (
     expect(names).toContain("stripe");
   });
 });
+
+test.each(["{broken", "null", "{}"])(
+  "malformed or empty package %s does not hide other evidence",
+  async (raw) => {
+    const cwd = makeProject({ "package.json": raw, "fly.toml": "" });
+    expect(await scanSource(cwd)).toEqual([
+      { provider: "fly", confidence: "high", signals: ["fly.toml"] },
+    ]);
+  },
+);
+
+test.each([
+  [
+    "pyproject.toml",
+    '[project]\ndependencies = ["supabase-py>=1", "anthropic", "resend"]',
+    ["anthropic", "resend", "supabase"],
+  ],
+  [
+    "Cargo.toml",
+    '[dependencies]\nasync-openai = "1"\nsentry = "1"\nasync-stripe = "1"',
+    ["openai", "sentry", "stripe"],
+  ],
+  [
+    "requirements.txt",
+    "# openai\n\nANTHROPIC[extra]>=1\r\nmodal==1\nreplicate~=1\nbraintrust!=1\nunknown",
+    ["anthropic", "braintrust", "modal", "replicate"],
+  ],
+  [
+    "go.mod",
+    "module example.com/app\nrequire github.com/liushuangls/go-anthropic v1\nrequire github.com/sashabaranov/go-openai v1",
+    ["openai", "anthropic"],
+  ],
+] as const)("scans %s with exact evidence", async (file, content, providers) => {
+  const hits = await scanSource(makeProject({ [file]: content }));
+  expect(hits.map((hit) => hit.provider)).toEqual([...providers]);
+  for (const hit of hits) {
+    expect(hit.signals).toHaveLength(1);
+    expect(hit.signals[0]).toStartWith(`${file}:`);
+  }
+});
+
+test("deduplicates dependency evidence and upgrades confidence without losing signals", async () => {
+  const hits = await scanSource(
+    makeProject({
+      "package.json": JSON.stringify({
+        dependencies: { "@vercel/kv": "1" },
+        devDependencies: { "@vercel/kv": "1" },
+      }),
+      "vercel.json": "{}",
+      ".env.sample": "VERCEL_TOKEN=\nUNKNOWN_NAME=",
+      ".env.template": "VERCEL_TOKEN=",
+    }),
+  );
+  expect(hits).toEqual([
+    {
+      provider: "vercel",
+      confidence: "high",
+      signals: [
+        "package.json:@vercel/kv",
+        "vercel.json",
+        ".env.sample:VERCEL_TOKEN",
+        ".env.template:VERCEL_TOKEN",
+      ],
+    },
+  ]);
+});
+
+test("scans a project directory containing spaces and reports relative file paths", async () => {
+  const root = makeProject({
+    "project with spaces/package.json": JSON.stringify({ dependencies: { openai: "1" } }),
+    "project with spaces/supabase/config.toml": "[api]",
+    "project with spaces/.env.example": "OPENAI_API_KEY=",
+    "project with spaces/vercel.json": "{}",
+  });
+
+  expect(await scanSource(join(root, "project with spaces"))).toEqual([
+    {
+      provider: "openai",
+      confidence: "high",
+      signals: ["package.json:openai", ".env.example:OPENAI_API_KEY"],
+    },
+    { provider: "supabase", confidence: "high", signals: ["supabase/config.toml"] },
+    { provider: "vercel", confidence: "high", signals: ["vercel.json"] },
+  ]);
+});
+
+test("finds the same source markers in equivalent paths with and without spaces", async () => {
+  const files: Record<string, string> = {
+    "package.json": JSON.stringify({ dependencies: { openai: "1" } }),
+    "requirements.txt": "modal==1",
+    "pyproject.toml": '[project]\ndependencies = ["resend"]',
+    "go.mod": "module example.com/app\nrequire github.com/stripe/stripe-go/v76 v76.0.0",
+    "Cargo.toml": '[dependencies]\nsentry = "1"',
+    "supabase/config.toml": "[api]",
+    ".github/workflows/ci.yml": "name: CI",
+    ".env.example": "ANTHROPIC_API_KEY=",
+  };
+  const root = makeProject(
+    Object.fromEntries(
+      ["project", "parent with spaces/project with spaces"].flatMap((dir) =>
+        Object.entries(files).map(([path, content]) => [join(dir, path), content]),
+      ),
+    ),
+  );
+
+  const plain = await scanSource(join(root, "project"));
+  const spaced = await scanSource(join(root, "parent with spaces", "project with spaces"));
+  expect(plain).toEqual([
+    {
+      provider: "github",
+      confidence: "high",
+      signals: [".github/workflows", ".github/workflows/ci.yml"],
+    },
+    { provider: "modal", confidence: "high", signals: ["requirements.txt:modal"] },
+    { provider: "openai", confidence: "high", signals: ["package.json:openai"] },
+    { provider: "resend", confidence: "high", signals: ["pyproject.toml:resend"] },
+    { provider: "sentry", confidence: "high", signals: ["Cargo.toml:sentry"] },
+    { provider: "stripe", confidence: "high", signals: ["go.mod:github.com/stripe/stripe-go/v76"] },
+    { provider: "supabase", confidence: "high", signals: ["supabase/config.toml"] },
+    { provider: "anthropic", confidence: "medium", signals: [".env.example:ANTHROPIC_API_KEY"] },
+  ]);
+  expect(spaced).toEqual(plain);
+});
+
+test("empty project has no detections", async () => {
+  expect(await scanSource(makeProject({}))).toEqual([]);
+});
+
+test.each([["--json"], ["--yes"]])(
+  "scan %s rejects a nonexistent project without creating files",
+  async (flag) => {
+    const root = makeProject({});
+    const home = makeProject({});
+    const missing = join(root, "missing", "project");
+    const cli = join(import.meta.dir, "..", "..", "..", "cli", "src", "index.ts");
+    const proc = Bun.spawn([process.execPath, cli, "scan", flag, "--path", missing], {
+      cwd: root,
+      env: {
+        PATH: [dirname(process.execPath), "/usr/bin", "/bin"].join(delimiter),
+        HOME: home,
+        CI: "1",
+        NO_COLOR: "1",
+        STACK_TELEMETRY: "0",
+        STACK_NO_UPDATE_CHECK: "1",
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [code, stdout, stderr] = await Promise.all([
+      proc.exited,
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+    ]);
+
+    expect(code).toBe(1);
+    expect(stdout + stderr).toContain(`Path "${missing}" does not exist or is not a directory.`);
+    expect(stdout).not.toContain('"hits"');
+    expect(stdout).not.toContain("No providers detected");
+    expect(existsSync(missing)).toBe(false);
+    expect(readdirSync(root)).toEqual([]);
+  },
+  30_000,
+);
+
+test.each([
+  ["package.json", JSON.stringify({ name: "openai", dependencies: {}, devDependencies: {} })],
+  ["requirements.txt", ""],
+  ["pyproject.toml", "[project]\ndependencies = []\n"],
+  ["go.mod", "module example.com/app\n\ngo 1.22\n"],
+  ["Cargo.toml", '[package]\nname = "app"\nversion = "0.1.0"\n\n[dependencies]\n'],
+] as const)("empty dependency manifest %s produces no detections", async (file, content) => {
+  expect(await scanSource(makeProject({ [file]: content }))).toEqual([]);
+});

package/src/__tests__/fixtures/stack-manifest.v1.json

@@ -0,0 +1,10 @@
+{
+  "schema_version": 1,
+  "kind": "ashlr-stack-manifest",
+  "components": [
+    { "id": "core", "name": "@ashlr/stack-core", "version": "0.3.0", "distribution": "npm" },
+    { "id": "cli", "name": "@ashlr/stack", "version": "0.3.0", "distribution": "npm" },
+    { "id": "mcp", "name": "ashlr-stack-mcp", "version": "0.3.0", "distribution": "npm" },
+    { "id": "plugin", "name": "stack", "version": "0.1.0", "distribution": "claude-code-plugin" }
+  ]
+}