@ashlr/stack-core 0.2.2 → 0.3.1

package/src/__tests__/import-integration.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
@@ -33,6 +33,7 @@ describe("import pipeline", () => {
   afterEach(() => {
     process.chdir(originalCwd);
     h.cleanup();
+    rmSync(cwd, { recursive: true, force: true });
   });
 
   test("typical Next.js .env gets parsed, stored, and mapped to services", async () => {
@@ -49,7 +50,7 @@ PORT=3000
 `.trim();
     writeFileSync(join(cwd, ".env"), envContent);
 
-    const parsed = parseEnv(envContent);
+    const parsed = parseEnv(readFileSync(join(cwd, ".env"), "utf8"));
     expect(parsed.map((p) => p.key)).toContain("OPENAI_API_KEY");
     expect(parsed.map((p) => p.key)).toContain("NODE_ENV");
 
@@ -70,7 +71,12 @@ PORT=3000
     const vault = await readVault(h.dir);
     expect(vault.OPENAI_API_KEY).toBe("sk-fake");
     expect(vault.NODE_ENV).toBe("development");
-    expect((await listSecrets()).length).toBeGreaterThanOrEqual(8);
+    const expectedVault = Object.fromEntries(parsed.map(({ key, value }) => [key, value]));
+    expect(vault).toEqual(expectedVault);
+    expect((await listSecrets()).sort()).toEqual(Object.keys(expectedVault).sort());
+    expect(h.callsTo("add").map(({ args }) => args)).toEqual(
+      parsed.map(({ key }) => [key, "--stdin"]),
+    );
 
     // Build a .stack.toml from the detected groups.
     const config = emptyConfig("import-test");
@@ -83,5 +89,13 @@ PORT=3000
     expect(roundTripped.services.supabase).toBeDefined();
     expect(roundTripped.services.openai).toBeDefined();
     expect(roundTripped.services.sentry.mcp).toBe("sentry");
-  });
+    expect(Object.keys(roundTripped.services).sort()).toEqual(["openai", "sentry", "supabase"]);
+    for (const [provider, keys] of Object.entries(grouped)) {
+      expect(roundTripped.services[provider].secrets).toEqual(keys);
+    }
+    const serialized = readFileSync(join(cwd, ".stack.toml"), "utf8");
+    for (const { value } of parsed) expect(serialized).not.toContain(value);
+    // Eight sequential real child processes plus list/version probes are integration
+    // work, not a five-second performance assertion (especially under coverage).
+  }, 30_000);
 });

package/src/__tests__/inference.test.ts

@@ -176,6 +176,44 @@ describe("LocalSLMBackend — infer", () => {
     expect(call).toBeGreaterThanOrEqual(2);
   });
 
+  test.each(["invalid UTF-8", "replacement character"])(
+    "falls back when a 200 response contains an unusable %s assistant message",
+    async (kind) => {
+      const calls: string[] = [];
+      const fetchImpl = (async (input: string | URL | Request) => {
+        const url =
+          typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+        calls.push(url);
+        if (url.includes("secondary")) return okChatResponse(VALID_RECIPE_JSON);
+
+        // The envelope is valid JSON even after a malformed byte is decoded as U+FFFD.
+        const envelope = '{"choices":[{"message":{"content":"X"}}]}';
+        const bytes = new TextEncoder().encode(envelope);
+        if (kind === "invalid UTF-8") {
+          bytes[envelope.indexOf("X")] = 0xff;
+          return new Response(bytes, { status: 200 });
+        }
+        return new Response(envelope.replace("X", "\uFFFD"), { status: 200 });
+      }) as unknown as typeof fetch;
+      const backend = new LocalSLMBackend({
+        endpoints: [
+          { name: "primary", baseUrl: "http://primary/v1", model: "a" },
+          { name: "secondary", baseUrl: "http://secondary/v1", model: "b" },
+        ],
+        fetchImpl,
+        costTracker: new CostTracker(),
+      });
+
+      const result = await backend.infer({ query: "x", catalogContext: "" });
+      expect(result.recipe?.providers.map((provider) => provider.name)).toEqual(["neon", "clerk"]);
+      expect(backend.lastEndpoint).toBe("secondary");
+      expect(calls).toEqual([
+        "http://primary/v1/chat/completions",
+        "http://secondary/v1/chat/completions",
+      ]);
+    },
+  );
+
   test("throws NoInferenceBackendError when every endpoint fails", async () => {
     const fetchImpl = (async () => {
       throw new Error("down");

package/src/__tests__/no-orphan-modules.test.ts

@@ -0,0 +1,114 @@
+import { afterEach, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { ENTRY_POINTS, findOrphanModules } from "../../../../scripts/no-orphan-modules.ts";
+
+const root = resolve(import.meta.dir, "../../../..");
+const scratch: string[] = [];
+const core = "packages/core/src/";
+const cli = "packages/cli/src/";
+const entries = [`${core}index.ts`, `${cli}index.ts`];
+
+afterEach(() => {
+  for (const dir of scratch.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+function fixture(files: Record<string, string>): string {
+  const dir = mkdtempSync(join(tmpdir(), "stack-orphans-"));
+  scratch.push(dir);
+  for (const [path, text] of Object.entries({
+    "tsconfig.json": JSON.stringify({
+      compilerOptions: {
+        moduleResolution: "bundler",
+        module: "esnext",
+        baseUrl: ".",
+        paths: { "@ashlr/stack-core": [`${core}index.ts`], "@ashlr/stack-core/*": [`${core}*`] },
+      },
+    }),
+    "scripts/placeholder.ts": "",
+    [entries[0]!]: "",
+    [entries[1]!]: "",
+    ...files,
+  })) {
+    const file = join(dir, path);
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, text);
+  }
+  return dir;
+}
+
+// A whole-repository static scan can exceed Bun's 5s default on a loaded runner.
+test("every core and CLI module is reachable from an entry point or production consumer", () => {
+  expect(findOrphanModules(root)).toEqual([]);
+}, 30_000);
+
+test("the entry point allowlist matches the public core exports and CLI executable", () => {
+  const manifest = JSON.parse(readFileSync(join(root, "packages/core/package.json"), "utf8"));
+  expect([...ENTRY_POINTS].sort()).toEqual(
+    [
+      ...Object.values(manifest.exports).map(
+        (path) => `packages/core/${String(path).replace(/^\.\//, "")}`,
+      ),
+      `${cli}index.ts`,
+    ].sort(),
+  );
+});
+
+test("reports new orphans, test-only imports, self imports, dead chains and cycles", () => {
+  const dir = fixture({
+    [`${core}orphan.ts`]: "export const unused = true;",
+    [`${core}orphan.test.ts`]: 'import "./orphan.ts";',
+    [`${cli}__tests__/keep.test.ts`]: 'import "../../../core/src/orphan.ts";',
+    [`${core}types.d.ts`]: 'import "./orphan.ts";',
+    "scripts/legacy.node-tests.mjs": 'import "../packages/core/src/orphan.ts";',
+    [`${core}self.ts`]: 'import "./self.ts";',
+    [`${cli}chain.ts`]: 'import "./leaf.ts";',
+    [`${cli}leaf.ts`]: "export {};",
+    [`${core}a.ts`]: 'import "./b.ts";',
+    [`${core}b.ts`]: 'import "./a.ts";',
+  });
+  expect(findOrphanModules(dir, entries)).toEqual([
+    `${cli}chain.ts`,
+    `${cli}leaf.ts`,
+    `${core}a.ts`,
+    `${core}b.ts`,
+    `${core}orphan.ts`,
+    `${core}self.ts`,
+  ]);
+});
+
+test("resolves aliases, JS specifiers, reexports, types, dynamic imports and require", () => {
+  const dir = fixture({
+    [`${cli}index.ts`]:
+      'import "@ashlr/stack-core"; import("./lazy.ts"); require("./required.ts");',
+    [`${core}index.ts`]: 'export * from "./live.js"; export type { T } from "./types.ts";',
+    [`${core}live.ts`]: "export const live = true;",
+    [`${core}types.ts`]: "export type T = string;",
+    [`${cli}lazy.ts`]:
+      'import dep = require("./equals.ts"); type T = import("./import-type.ts").T;',
+    [`${cli}required.ts`]: 'import "./side-effect.ts";',
+    [`${cli}equals.ts`]: "export {};",
+    [`${cli}import-type.ts`]: "export type T = string;",
+    [`${cli}side-effect.ts`]: "export {};",
+    "packages/mcp/src/consumer.ts": 'import "@ashlr/stack-core/external.ts";',
+    [`${core}external.ts`]: "export {};",
+  });
+  expect(findOrphanModules(dir, entries)).toEqual([]);
+});
+
+test("comments and strings are not importers; stale entry points fail closed", () => {
+  const dir = fixture({
+    [`${cli}index.ts`]: [
+      '// import "./unused.ts";',
+      "const text = 'import(\"./unused.ts\")';",
+      String.raw`const regex = /import(".\/unused.ts")/;`,
+      'obj.require("./unused.ts");',
+    ].join("\n"),
+    [`${cli}unused.ts`]: "export {};",
+  });
+  expect(findOrphanModules(dir, entries)).toEqual([`${cli}unused.ts`]);
+  expect(() => findOrphanModules(dir, [...entries, `${core}missing.ts`])).toThrow(
+    "Missing entry point",
+  );
+});

package/src/__tests__/phantom-harness.test.ts

@@ -1,13 +1,18 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
+  PhantomTimeoutError,
+  __resetPhantomCache,
   addSecret,
   assertProjectInitialized,
   completionForClose,
+  countSecrets,
   exec,
   isPhantomInstalled,
   listSecrets,
+  probePhantomInstalled,
   removeSecret,
   revealSecret,
 } from "../phantom.ts";
@@ -28,6 +33,53 @@ describe("phantom wrapper against the fake harness", () => {
     expect(await isPhantomInstalled()).toBe(true);
   });
 
+  test("exec excludes parent credentials and runtime injection variables", async () => {
+    const keys = ["STACK_TEST_PARENT_CREDENTIAL", "NODE_OPTIONS", "BASH_ENV", "LD_PRELOAD"];
+    const previous = keys.map((key) => process.env[key]);
+    try {
+      for (const key of keys) process.env[key] = "inert-regression-marker";
+      writeFileSync(
+        join(h.dir, "phantom"),
+        '#!/bin/sh\nfor key in STACK_TEST_PARENT_CREDENTIAL NODE_OPTIONS BASH_ENV LD_PRELOAD; do\n  if printenv "$key" >/dev/null; then exit 9; fi\ndone\ntest -n "$HOME" && test -n "$PATH"\n',
+      );
+      expect((await exec(["--version"], { allowFailure: true })).code).toBe(0);
+    } finally {
+      keys.forEach((key, i) => {
+        if (previous[i] === undefined) delete process.env[key];
+        else process.env[key] = previous[i];
+      });
+    }
+  });
+
+  test("exec forwards Phantom's explicit vault unlock input to the child", async () => {
+    const previous = process.env.PHANTOM_VAULT_PASSPHRASE;
+    try {
+      process.env.PHANTOM_VAULT_PASSPHRASE = "inert-regression-passphrase";
+      writeFileSync(
+        join(h.dir, "phantom"),
+        '#!/bin/sh\ntest "$PHANTOM_VAULT_PASSPHRASE" = "inert-regression-passphrase"\n',
+      );
+      expect((await exec(["--version"], { allowFailure: true })).code).toBe(0);
+    } finally {
+      if (previous === undefined) Reflect.deleteProperty(process.env, "PHANTOM_VAULT_PASSPHRASE");
+      else process.env.PHANTOM_VAULT_PASSPHRASE = previous;
+    }
+  });
+
+  test("exec resolves relative PATH entries before entering the project directory", async () => {
+    const previousPath = process.env.PATH;
+    try {
+      writeFileSync(join(h.dir, "phantom"), "#!/bin/sh\nexit 9\n");
+      // A relative entry must never be reinterpreted inside the requested cwd.
+      process.env.PATH = ".:/usr/bin:/bin";
+      await expect(exec(["--version"], { cwd: h.dir })).rejects.toMatchObject({
+        code: "PHANTOM_NOT_INSTALLED",
+      });
+    } finally {
+      process.env.PATH = previousPath;
+    }
+  });
+
   test("addSecret writes to the fake vault over stdin, never argv", async () => {
     await addSecret("NEW_KEY", "new-value");
     expect((await readVault(h.dir)).NEW_KEY).toBe("new-value");
@@ -158,4 +210,53 @@ describe("phantom wrapper against the fake harness", () => {
     expect(await removeSecret("EXISTING_KEY")).toBe(false);
     expect(await listSecrets()).toContain("EXISTING_KEY");
   });
+
+  test("countSecrets reports the vault size, including when the install probe is skipped", async () => {
+    expect(await countSecrets()).toBe(1);
+    expect(await countSecrets(undefined, { skipInstallCheck: true })).toBe(1);
+  });
+
+  test("exec timeout kills a hung phantom and the install probe reports not installed", async () => {
+    writeFileSync(join(h.dir, "phantom"), "#!/bin/sh\nexec sleep 5\n");
+    __resetPhantomCache();
+    const started = Date.now();
+    const result = await exec(["--version"], { allowFailure: true, timeoutMs: 200 });
+    expect(result.completion).toBe("signal");
+    expect(result.code).not.toBe(0);
+    expect(result.timedOut).toBe(true);
+    __resetPhantomCache();
+    expect(await probePhantomInstalled({ timeoutMs: 200 })).toBe("timeout");
+    // A timeout is not cached: once Phantom answers, it is installed.
+    writeFileSync(join(h.dir, "phantom"), "#!/bin/sh\necho phantom 0.9.0\n");
+    expect(await probePhantomInstalled({ timeoutMs: 2_000 })).toBe("installed");
+    writeFileSync(join(h.dir, "phantom"), "#!/bin/sh\nexec sleep 5\n");
+    __resetPhantomCache();
+    expect(await isPhantomInstalled({ timeoutMs: 200 })).toBe(false);
+    __resetPhantomCache();
+    await expect(
+      listSecrets(undefined, { skipInstallCheck: true, timeoutMs: 200 }),
+    ).rejects.toBeInstanceOf(PhantomTimeoutError);
+    __resetPhantomCache();
+    expect(await countSecrets(undefined, { skipInstallCheck: true, timeoutMs: 200 })).toBeNull();
+    expect(Date.now() - started).toBeLessThan(2_000);
+  });
+  test.skipIf(process.platform === "win32")(
+    "timeout kills a grandchild that holds stdio and settles within the cap",
+    async () => {
+      const pidFile = join(tmpdir(), `stack-grandchild-${process.pid}-${Date.now()}.pid`);
+      writeFileSync(
+        join(h.dir, "phantom"),
+        `#!/bin/sh\nsleep 30 &\necho $! > '${pidFile}'\nwait\n`,
+      );
+      const started = Date.now();
+      const result = await exec(["--version"], { allowFailure: true, timeoutMs: 300 });
+      expect(result.timedOut).toBe(true);
+      expect(Date.now() - started).toBeLessThan(2_500);
+      expect(existsSync(pidFile)).toBe(true);
+      const pid = Number(readFileSync(pidFile, "utf8").trim());
+      expect(pid).toBeGreaterThan(0);
+      await new Promise((r) => setTimeout(r, 100));
+      expect(() => process.kill(pid, 0)).toThrow();
+    },
+  );
 });

package/src/__tests__/phantom-process.test.ts

@@ -0,0 +1,135 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { chmodSync, mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { delimiter, join, resolve } from "node:path";
+import { PhantomNotInstalledError } from "../errors.ts";
+import { phantomEnv, resolvePhantomBinary } from "../phantom-process.ts";
+
+const dirs: string[] = [];
+function tmp(): string {
+  const dir = realpathSync(mkdtempSync(join(tmpdir(), "phantom-process-")));
+  dirs.push(dir);
+  return dir;
+}
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+const name = process.platform === "win32" ? "phantom.exe" : "phantom";
+function binary(dir: string, script = "#!/bin/sh\nexit 0\n"): string {
+  const path = join(dir, name);
+  writeFileSync(path, script);
+  chmodSync(path, 0o755);
+  return path;
+}
+
+describe("Phantom process boundary", () => {
+  test("environment has an exact allowlist, including only the explicit vault unlock input", () => {
+    const pathEntry = join(tmpdir(), "phantom-env-path");
+    const allowed = {
+      PATH: pathEntry,
+      HOME: "/home/test",
+      USER: "test",
+      USERPROFILE: "C:\\test",
+      SystemRoot: "C:\\Windows",
+      APPDATA: "/app",
+      LOCALAPPDATA: "/local",
+      PATHEXT: ".EXE",
+      XDG_CONFIG_HOME: "/config",
+      XDG_DATA_HOME: "/data",
+      XDG_STATE_HOME: "/state",
+      XDG_RUNTIME_DIR: "/runtime",
+      TMPDIR: "/tmp",
+      TEMP: "/temp",
+      TMP: "/tmp",
+      LANG: "C",
+      LC_ALL: "C",
+      LC_CTYPE: "C",
+      TERM: "dumb",
+      NO_COLOR: "",
+      PHANTOM_VAULT_PASSPHRASE: "synthetic-test-input",
+    };
+    expect(
+      phantomEnv({
+        ...allowed,
+        OPENAI_API_KEY: "synthetic",
+        GITHUB_TOKEN: "synthetic",
+        NODE_OPTIONS: "--inspect",
+        LD_PRELOAD: "/untrusted",
+        DYLD_INSERT_LIBRARIES: "/untrusted",
+        BASH_ENV: "/untrusted",
+        PHANTOM_UNKNOWN: "synthetic",
+        LOCUS_CONTROL_CAPABILITY: "synthetic",
+      }),
+    ).toEqual(allowed);
+    expect(phantomEnv({ HOME: undefined })).toEqual({});
+  });
+
+  test("PATH is normalized: empty entries dropped, relative entries resolved in the caller's cwd", () => {
+    const abs = join(tmpdir(), "phantom-env-abs");
+    expect(phantomEnv({ PATH: `${delimiter}rel${delimiter}${abs}${delimiter}` })).toEqual({
+      PATH: `${resolve("rel")}${delimiter}${abs}`,
+    });
+    expect(phantomEnv({ PATH: delimiter })).toEqual({ PATH: "" });
+  });
+
+  test("resolves the first executable to an absolute path, including relative PATH entries", () => {
+    const root = tmp();
+    const bin = join(root, "bin");
+    mkdirSync(bin);
+    const expected = binary(bin);
+    expect(resolvePhantomBinary({ PATH: `missing${delimiter}bin` }, root)).toBe(expected);
+    expect(resolvePhantomBinary({ PATH: `${bin}${delimiter}${tmp()}` })).toBe(expected);
+  });
+
+  test("missing PATH, empty entries and directories fail closed", () => {
+    const root = tmp();
+    binary(root);
+    expect(() => resolvePhantomBinary({}, root)).toThrow(PhantomNotInstalledError);
+    expect(() => resolvePhantomBinary({ PATH: delimiter }, root)).toThrow(PhantomNotInstalledError);
+    const bin = tmp();
+    mkdirSync(join(bin, name));
+    expect(() => resolvePhantomBinary({ PATH: bin })).toThrow(PhantomNotInstalledError);
+  });
+
+  test.skipIf(process.platform === "win32")(
+    "non-executable files do not shadow an installation",
+    () => {
+      const first = tmp();
+      chmodSync(binary(first), 0o644);
+      const second = tmp();
+      const expected = binary(second);
+      expect(resolvePhantomBinary({ PATH: `${first}${delimiter}${second}` })).toBe(expected);
+    },
+  );
+
+  test.skipIf(process.platform === "win32")(
+    "exec uses the resolved path across cwd changes and filters the actual child env",
+    () => {
+      const root = tmp();
+      const bin = join(root, "bin");
+      mkdirSync(bin);
+      const childCwd = tmp();
+      const expected = binary(
+        bin,
+        `#!/bin/sh
+[ -z "\${OPENAI_API_KEY+x}" ] || exit 21
+[ -z "\${BASH_ENV+x}" ] || exit 22
+[ "$HOME" = "$1" ] || exit 23
+printf '%s' "$0"
+`,
+      );
+      const modulePath = new URL("../phantom.ts", import.meta.url).href;
+      const script = `import { exec } from ${JSON.stringify(modulePath)};
+const r = await exec([${JSON.stringify(root)}], { cwd: ${JSON.stringify(childCwd)} });
+process.stdout.write(r.stdout);`;
+      const r = spawnSync(process.execPath, ["--eval", script], {
+        cwd: root,
+        encoding: "utf8",
+        env: { HOME: root, PATH: "bin", OPENAI_API_KEY: "synthetic", BASH_ENV: "/nonexistent" },
+      });
+      expect(r.status).toBe(0);
+      expect(r.stdout).toBe(expected);
+    },
+  );
+});