@ashlr/stack-core 0.3.1 → 0.3.6

package/src/ai/phantom-wire-single-quote.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from "bun:test";
+import { webhookStubFor } from "./phantom-wire.ts";
+
+describe("ai/phantom-wire single quotes in replacement text", () => {
+  it.each(["pay'hook", "'hook", "hook'", "'", "a''b", "svc$'pay"])(
+    "preserves quotes at every expansion site for %j",
+    (name) => {
+      const stub = webhookStubFor(name);
+      // A sentinel render provides a whole-output oracle without treating $'
+      // as a String.replace replacement directive.
+      const sentinel = name.replaceAll("'", "\u0000");
+      const expected = webhookStubFor(sentinel).replaceAll("\u0000", () => "'");
+
+      expect(stub).toBe(expected);
+      expect(stub).toContain(`webhook handler stub for ${name}.`);
+      expect(stub).toContain(`forge a ${name} webhook.`);
+      expect(stub).toContain(`handle${name[0].toUpperCase()}${name.slice(1)}Webhook`);
+      expect(stub.split(`phantom reveal ${name.toUpperCase()}_WEBHOOK_SECRET`).length - 1).toBe(2);
+      expect(stub.split("'").length - 1).toBe((name.split("'").length - 1) * 5 + 1);
+    },
+  );
+});

package/src/ai/phantom-wire-tab.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "bun:test";
+import { verificationHintFor, webhookStubFor } from "./phantom-wire.ts";
+
+const tabCount = (s: string) => s.split("\t").length - 1;
+
+describe("ai/phantom-wire replacement text containing a tab", () => {
+  it("preserves the literal tab byte at all five expansion sites", () => {
+    const stub = webhookStubFor("a\tb");
+    const flat = webhookStubFor("ab");
+
+    expect(stub).toContain("webhook handler stub for a\tb.");
+    expect(stub).toContain("forge a a\tb webhook.");
+    expect(stub).toContain("handleA\tbWebhook(req: Request)");
+    expect(stub.split("phantom reveal A\tB_WEBHOOK_SECRET").length - 1).toBe(2);
+
+    // Exactly one tab per site over the flat render; none expanded or escaped.
+    expect(tabCount(stub)).toBe(tabCount(flat) + 5);
+    expect(stub.charCodeAt(stub.indexOf("stub for a") + "stub for a".length)).toBe(0x09);
+    expect(stub).not.toContain("\\t");
+    expect(stub).not.toContain("${");
+
+    // Other slots are unaffected by the tab-bearing name.
+    expect(stub).toContain('req.headers.get("x-webhook-signature")');
+    expect(verificationHintFor("a\tb")).toBe(verificationHintFor("zzq"));
+  });
+
+  it.each(["\tx", "x\t", "a\tb\tc", "\t", "a\t\tb"])(
+    "keeps every literal tab in %j at all five expansion sites",
+    (name) => {
+      const stub = webhookStubFor(name);
+      const flat = webhookStubFor(name.replace(/\t/g, ""));
+      const capitalized = `${name[0].toUpperCase()}${name.slice(1)}`;
+
+      expect(stub).toContain(`webhook handler stub for ${name}.`);
+      expect(stub).toContain(`forge a ${name} webhook.`);
+      expect(stub).toContain(`handle${capitalized}Webhook(req: Request)`);
+      expect(stub.split(`phantom reveal ${name.toUpperCase()}_WEBHOOK_SECRET`).length - 1).toBe(2);
+      expect(tabCount(stub)).toBe(tabCount(flat) + 5 * tabCount(name));
+      expect(stub).not.toContain("\\t");
+    },
+  );
+});

package/src/ai/phantom-wire-unknown-placeholder.test.ts

@@ -0,0 +1,189 @@
+import { afterEach, beforeEach, describe, expect, it, setDefaultTimeout } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { type Harness, setupFakePhantom } from "../__tests__/_harness.ts";
+import { verificationHintFor, webhookStubFor, wirePhantomForRecipe } from "./phantom-wire.ts";
+import type { Recipe } from "./recipe.ts";
+
+// The wiring check spawns the fake `phantom` shim (bash + python3); keep the
+// sibling files' raised timeout.
+setDefaultTimeout(30_000);
+
+describe("ai/phantom-wire unknown placeholder surrounded by ordinary text", () => {
+  let harness: Harness;
+  let dir: string;
+
+  beforeEach(() => {
+    harness = setupFakePhantom();
+    dir = mkdtempSync(join(tmpdir(), "wire-unknown-placeholder-"));
+  });
+  afterEach(() => {
+    harness.cleanup();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  const recipe = (...names: string[]): Recipe => ({
+    id: "unknown-placeholder",
+    query: "q",
+    createdAt: "2026-04-18T00:00:00.000Z",
+    providers: names.map((name) => ({ name })),
+  });
+
+  it.each(["${UNKNOWN}stripe", "stripe${UNKNOWN}"])(
+    "substitutes the provider beside an unknown token without resolving the token: %s",
+    (name) => {
+      const stub = webhookStubFor(name);
+
+      // The provider interpolation resolves to the supplied name in both
+      // locations, while the adjacent unknown token remains literal data.
+      expect(stub).toContain(`webhook handler stub for ${name}.`);
+      expect(stub).toContain(`forge a ${name} webhook.`);
+      expect(stub).not.toContain("${provider}");
+      expect(stub.split("${UNKNOWN}").length - 1).toBe(5);
+    },
+  );
+
+  it("keeps an unknown ${...} token and the text around it byte-for-byte at every site", () => {
+    // `pre${HOOK_URL}post` matches none of the template's slots — expansion
+    // fills `provider`, `capitalize(provider)`, `webhookSecretKeyFor(provider)`
+    // and `signatureHeaderFor(provider)`; a `${...}` arriving inside the name
+    // has no substitution and is pure data. It must reach each of the five
+    // expansion sites still seated between the name's own `pre`/`post` text:
+    // a resolver would empty it, splice a value in, or orphan the text around
+    // it. The token is already uppercase, so even the `toUpperCase()`
+    // secret-key sites hold the identical bytes.
+    const name = "pre${HOOK_URL}post";
+    const stub = webhookStubFor(name);
+
+    expect(stub).toContain(`webhook handler stub for ${name}.`);
+    expect(stub).toContain(`forge a ${name} webhook.`);
+    // `capitalize(provider)` folds only the name's first letter — the token
+    // and the text after it are untouched.
+    expect(stub).toContain("handlePre${HOOK_URL}postWebhook(req: Request)");
+    // `webhookSecretKeyFor(provider)` sites: the already-uppercase token and
+    // its uppercase surrounding text survive in both reveal lines.
+    expect(stub.split("phantom reveal PRE${HOOK_URL}POST_WEBHOOK_SECRET").length - 1).toBe(2);
+
+    // Every `${...}` in the stub is the carried token — five expansion
+    // sites, five occurrences, no other unresolved placeholder-shaped text.
+    const tokens = [...stub.matchAll(/\$\{[^}]*\}/g)].map((m) => m[0]);
+    expect(tokens).toEqual(Array(5).fill("${HOOK_URL}"));
+    // The ordinary text still flanks the token at every site: each
+    // occurrence sits between the name's own `pre` and `post` (in whatever
+    // case that site's transform gives them), never beside injected text.
+    expect(stub.match(/pre\$\{HOOK_URL\}post/gi)).toHaveLength(5);
+
+    // Nothing resolved the token as a slot: the generic signature header and
+    // the fallback verification hint apply unchanged.
+    expect(stub).toContain('req.headers.get("x-webhook-signature")');
+    expect(stub).toContain("//   // Verify per the provider's documented signature scheme.");
+    expect(verificationHintFor(name)).toBe(verificationHintFor("zzq"));
+  });
+
+  it("folds a lowercase token's interior only at the secret-key sites and keeps it verbatim elsewhere", () => {
+    // Same scenario with a token whose interior is lowercase. The three
+    // case-preserving sites carry the name — token and surrounding text —
+    // byte-for-byte; the two `toUpperCase()` secret-key sites fold the
+    // token's letters along with the text around it, because they uppercase
+    // the whole name. Either way the token is still there, still `${...}`,
+    // still between the same surrounding text — never resolved, emptied or
+    // duplicated.
+    const stub = webhookStubFor("before${hook_url}after");
+
+    // Case-preserving sites carry `before${hook_url}after` byte-for-byte.
+    expect(stub).toContain("webhook handler stub for before${hook_url}after.");
+    expect(stub).toContain("forge a before${hook_url}after webhook.");
+    expect(stub).toContain("handleBefore${hook_url}afterWebhook(req: Request)");
+    // The original-case token appears only at those three sites; its folded
+    // form appears only at the two reveal lines.
+    expect(stub.split("${hook_url}").length - 1).toBe(3);
+    expect(stub.split("${HOOK_URL}").length - 1).toBe(2);
+    expect(stub.split("phantom reveal BEFORE${HOOK_URL}AFTER_WEBHOOK_SECRET").length - 1).toBe(2);
+
+    // Five `${...}` tokens in total, every one the carried placeholder in
+    // either its original or its reveal-site case — and each still seated
+    // between the surrounding `before`/`after` text.
+    const tokens = [...stub.matchAll(/\$\{[^}]*\}/g)].map((m) => m[0]);
+    expect(tokens).toHaveLength(5);
+    for (const token of tokens) expect(token.toLowerCase()).toBe("${hook_url}");
+    expect(stub.match(/before\$\{hook_url\}after/gi)).toHaveLength(5);
+  });
+
+  it.each(["a{{mustache}}b", "a%name%b", "a%sb", "a$1b"])(
+    "carries the foreign placeholder syntax in %s literally when wrapped in ordinary text",
+    (name) => {
+      // `{{...}}`, `%...%`, `%s` and `$1` are placeholder syntaxes this
+      // template does not use at all. Surrounded by ordinary text they are
+      // pure data: byte-for-byte at the title and forge sites, folded only
+      // at the first letter by `capitalize` at the handler site, and folded
+      // with the rest of the name at the two `toUpperCase()` secret-key
+      // sites — never resolved, emptied or merged.
+      const stub = webhookStubFor(name);
+      const capitalized = `${name[0].toUpperCase()}${name.slice(1)}`;
+
+      expect(stub).toContain(`webhook handler stub for ${name}.`);
+      expect(stub).toContain(`forge a ${name} webhook.`);
+      expect(stub).toContain(`handle${capitalized}Webhook(req: Request)`);
+      expect(stub.split(`phantom reveal ${name.toUpperCase()}_WEBHOOK_SECRET`).length - 1).toBe(2);
+
+      // Two verbatim sites + one first-letter-folded site + two folded
+      // sites = the five expansion sites. The template contributes none of
+      // these syntaxes itself, so every occurrence is one the name carried.
+      expect(stub.split(name).length - 1).toBe(2);
+      expect(stub.split(capitalized).length - 1).toBe(1);
+      expect(stub.split(name.toUpperCase()).length - 1).toBe(2);
+      expect(stub).not.toContain("${");
+    },
+  );
+
+  it("skips a placeholder-surrounded name byte-for-byte through wiring and writes nothing for it", async () => {
+    // Through `wirePhantomForRecipe` the name matches no catalog provider:
+    // it returns in `skipped` byte-for-byte — token and surrounding text
+    // intact — gets no stub on disk, and provokes no vault write. The known
+    // provider listed beside it wires normally, unaffected by the
+    // placeholder-shaped neighbour.
+    const name = "pre${HOOK_URL}post";
+    const stubPath = join(dir, ".stack", "webhooks", "stripe.ts");
+    const result = await wirePhantomForRecipe(recipe(name, "stripe"), { cwd: dir });
+
+    expect(result).toEqual({
+      present: [],
+      missing: ["stripe:STRIPE_SECRET_KEY"],
+      webhooks: [stubPath],
+      skipped: [name],
+    });
+    expect(result.skipped[0]).toBe(name);
+
+    // Only stripe's documented stub lands — nothing for the
+    // placeholder-shaped name, and the stub on disk is the same render
+    // `webhookStubFor` returns.
+    expect(readdirSync(join(dir, ".stack", "webhooks"))).toEqual(["stripe.ts"]);
+    expect(readFileSync(stubPath, "utf-8")).toBe(webhookStubFor("stripe"));
+    expect(existsSync(join(dir, ".stack", "webhooks", `${name}.ts`))).toBe(false);
+
+    // The whole call log is reads (`--version`, `list`); the vault file
+    // still parses to an empty object.
+    expect(harness.calls().every((c) => c.cmd === "--version" || c.cmd === "list")).toBe(true);
+    expect(harness.callsTo("add")).toEqual([]);
+    expect(JSON.parse(readFileSync(harness.vaultPath, "utf-8"))).toEqual({});
+  });
+
+  it("renders the known provider's placeholders and leaves a bare unknown ${...} token untouched in one recipe", async () => {
+    // Known (`stripe`) and unknown (`${UNKNOWN}`) together: the known
+    // provider's stub has every slot replaced (no `${` left); the unknown
+    // token is skipped verbatim and no file is written under its name.
+    const unknown = "${UNKNOWN}";
+    const stubPath = join(dir, ".stack", "webhooks", "stripe.ts");
+    const result = await wirePhantomForRecipe(recipe("stripe", unknown), { cwd: dir });
+
+    expect(result.skipped).toEqual([unknown]);
+    expect(result.webhooks).toEqual([stubPath]);
+    const stub = readFileSync(stubPath, "utf-8");
+    expect(stub).toBe(webhookStubFor("stripe"));
+    expect(stub).toContain("webhook handler stub for stripe.");
+    expect(stub).toContain("handleStripeWebhook");
+    expect(stub).not.toContain("${");
+    expect(readdirSync(join(dir, ".stack", "webhooks"))).toEqual(["stripe.ts"]);
+  });
+});

package/src/ai/phantom-wire-vault-name-case.test.ts

@@ -0,0 +1,46 @@
+import { afterEach, beforeEach, describe, expect, it, setDefaultTimeout } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { type Harness, setupFakePhantom } from "../__tests__/_harness.ts";
+import { wirePhantomForRecipe } from "./phantom-wire.ts";
+import type { Recipe } from "./recipe.ts";
+
+setDefaultTimeout(30_000);
+
+const recipe: Recipe = {
+  id: "vault-case",
+  query: "q",
+  createdAt: "2026-04-18T00:00:00.000Z",
+  providers: [{ name: "github" }],
+};
+
+describe("ai/phantom-wire vault secret name case", () => {
+  let harness: Harness | undefined;
+  let dir: string;
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "wire-vault-case-"));
+  });
+  afterEach(() => {
+    harness?.cleanup();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("treats the exact-case vault name as present", async () => {
+    harness = setupFakePhantom({ GITHUB_TOKEN: "x" });
+    const result = await wirePhantomForRecipe(recipe, { cwd: dir });
+    expect(result.present).toEqual(["github:GITHUB_TOKEN"]);
+    expect(result.missing).toEqual([]);
+  });
+
+  it.each(["github_token", "Github_Token"])(
+    "treats the differently cased vault name %s as missing",
+    async (stored) => {
+      harness = setupFakePhantom({ [stored]: "x" });
+      const result = await wirePhantomForRecipe(recipe, { cwd: dir });
+      expect(result.present).toEqual([]);
+      expect(result.missing).toEqual(["github:GITHUB_TOKEN"]);
+    },
+  );
+});

package/src/ai/phantom-wire.test.ts

@@ -0,0 +1,144 @@
+import { afterAll, afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { EventEmitter } from "node:events";
+import {
+  chmodSync,
+  mkdtempSync,
+  readdirSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { __resetPhantomCache, __setPhantomSpawn } from "../phantom.ts";
+import { wirePhantomForRecipe } from "./phantom-wire.ts";
+import type { Recipe } from "./recipe.ts";
+
+// Stubbed `phantom` subprocess, like phantom-wire-order.test.ts, but recording
+// every argv: an empty wiring request may run the read-only probes
+// (`--version`, `list --json`) but must never reach a mutating subcommand
+// (`add`, `remove`, `init`) or write a file.
+let installed = true;
+let vault: string[] | "unreadable" = [];
+let calls: string[][] = [];
+
+function fakeSpawn(_bin: string, args: string[]) {
+  calls.push([...args]);
+  const child = new EventEmitter() as EventEmitter & Record<string, unknown>;
+  const out = new EventEmitter();
+  const err = new EventEmitter();
+  Object.assign(child, {
+    stdout: Object.assign(out, { destroy() {} }),
+    stderr: Object.assign(err, { destroy() {} }),
+    stdin: { on() {}, write() {}, end() {}, destroy() {} },
+    pid: undefined,
+    kill() {},
+    unref() {},
+  });
+  queueMicrotask(() => {
+    if (!installed) {
+      child.emit("error", Object.assign(new Error("ENOENT"), { code: "ENOENT" }));
+      return;
+    }
+    if (args[0] === "list") {
+      if (vault === "unreadable") {
+        child.emit("close", 1, null);
+        return;
+      }
+      out.emit("data", Buffer.from(JSON.stringify(vault.map((name) => ({ name })))));
+    }
+    child.emit("close", 0, null);
+  });
+  return child;
+}
+
+function recipeOf(...names: string[]): Recipe {
+  return {
+    id: "empty-wire",
+    query: "empty",
+    createdAt: "2026-04-18T00:00:00.000Z",
+    providers: names.map((name) => ({ name })),
+  };
+}
+
+const EMPTY_RESULT = { present: [], missing: [], webhooks: [], skipped: [] };
+
+describe("ai/phantom-wire empty wiring request", () => {
+  const savedPath = process.env.PATH;
+  let binDir: string;
+  let projectDir: string;
+
+  beforeEach(() => {
+    binDir = realpathSync(mkdtempSync(join(tmpdir(), "wire-empty-bin-")));
+    // The project dir starts empty and must stay empty: no `.stack/` tree,
+    // no webhook stubs, nothing.
+    projectDir = realpathSync(mkdtempSync(join(tmpdir(), "wire-empty-")));
+    // Binary only needs to resolve on PATH; spawn is stubbed. `.sh` target
+    // matches the sibling tests (macOS provenance policy).
+    writeFileSync(join(binDir, "phantom.sh"), "#!/bin/sh\n");
+    chmodSync(join(binDir, "phantom.sh"), 0o755);
+    symlinkSync(join(binDir, "phantom.sh"), join(binDir, "phantom"));
+    process.env.PATH = binDir;
+    installed = true;
+    vault = [];
+    calls = [];
+    __resetPhantomCache();
+    __setPhantomSpawn(fakeSpawn as never);
+  });
+
+  afterEach(() => {
+    process.env.PATH = savedPath;
+    rmSync(binDir, { recursive: true, force: true });
+    rmSync(projectDir, { recursive: true, force: true });
+  });
+
+  afterAll(() => {
+    __setPhantomSpawn();
+    __resetPhantomCache();
+  });
+
+  it("returns the documented empty result and performs no write for a providerless recipe", async () => {
+    const r = await wirePhantomForRecipe(recipeOf(), { cwd: projectDir });
+
+    expect(r).toEqual(EMPTY_RESULT);
+    // Nothing requested, so no process ran at all: no install probe, no
+    // `list`, and certainly no `add`, `remove`, or `init`.
+    expect(calls).toEqual([]);
+    expect(readdirSync(projectDir)).toEqual([]);
+  });
+
+  it("performs no write for a providerless recipe even when the vault is unreadable", async () => {
+    vault = "unreadable";
+    const r = await wirePhantomForRecipe(recipeOf(), { cwd: projectDir });
+
+    // The unreadable vault leaves nothing to skip: every list stays empty.
+    expect(r).toEqual(EMPTY_RESULT);
+    expect(calls).toEqual([]);
+    expect(readdirSync(projectDir)).toEqual([]);
+  });
+
+  it("performs no write for a providerless recipe when phantom is not installed", async () => {
+    installed = false;
+    const r = await wirePhantomForRecipe(recipeOf(), { cwd: projectDir });
+
+    // With no providers there is nothing to skip and no stub to write, so a
+    // missing phantom still yields the documented empty result.
+    expect(r).toEqual(EMPTY_RESULT);
+    expect(calls).toEqual([]);
+    expect(readdirSync(projectDir)).toEqual([]);
+  });
+
+  it("spawns nothing and writes nothing when the request opts out with noWire", async () => {
+    // `--no-wire` returns before the install probe: providers or not, an
+    // opted-out request must not touch phantom or the filesystem at all.
+    for (const recipe of [recipeOf(), recipeOf("stripe", "github")]) {
+      calls = [];
+      const r = await wirePhantomForRecipe(recipe, { cwd: projectDir, noWire: true });
+
+      expect(r).toEqual(EMPTY_RESULT);
+      expect(calls).toEqual([]);
+      expect(readdirSync(projectDir)).toEqual([]);
+    }
+  });
+});

package/src/ai/phantom-wire.ts

@@ -50,7 +50,8 @@ export async function wirePhantomForRecipe(
   opts: { cwd?: string; noWire?: boolean } = {},
 ): Promise<WireResult> {
   const result: WireResult = { present: [], missing: [], webhooks: [], skipped: [] };
-  if (opts.noWire) return result;
+  // Nothing requested: no vault to check, no stub to write, no process to spawn.
+  if (opts.noWire || recipe.providers.length === 0) return result;
 
   const cwd = opts.cwd ?? process.cwd();
 
@@ -114,7 +115,7 @@ async function writeWebhookStub(cwd: string, provider: string): Promise<string>
   return path;
 }
 
-function webhookStubFor(provider: string): string {
+export function webhookStubFor(provider: string): string {
   const base = `// Auto-generated by \`stack apply\` — webhook handler stub for ${provider}.
 // Fill in the secret retrieval + signature verification before deploying.
 // This entire example is commented out and does not verify signatures.
@@ -147,9 +148,11 @@ function webhookStubFor(provider: string): string {
 /**
  * One-line pointer to the provider's documented signature scheme, inlined into
  * the stub's TODO so the implementer starts at the right verification API.
+ * Template strings carry no placeholders — each known provider returns a
+ * fixed, self-contained hint.
  * Falls back to a generic instruction for providers added later.
  */
-function verificationHintFor(provider: string): string {
+export function verificationHintFor(provider: string): string {
   switch (provider) {
     case "stripe":
       return "Stripe: `stripe.webhooks.constructEvent` — HMAC-SHA256 with timestamp tolerance.";
@@ -195,5 +198,9 @@ function signatureHeaderFor(provider: string): string {
 }
 
 function capitalize(s: string): string {
-  return s.charAt(0).toUpperCase() + s.slice(1);
+  // Code-point aware: charAt(0) would take only the high surrogate of an
+  // astral first letter (e.g. Deseret 𐐨) and never upper-case it.
+  if (s === "") return s;
+  const first = String.fromCodePoint(s.codePointAt(0) as number);
+  return first.toUpperCase() + s.slice(first.length);
 }

package/src/phantom.ts

@@ -35,6 +35,7 @@ export function completionForClose(
 }
 
 let cachedInstalled: boolean | undefined;
+let spawnImpl: typeof spawn = spawn;
 
 /**
  * `phantom --version` as three states. A timeout is not cached, because a slow
@@ -88,7 +89,7 @@ export async function exec(args: string[], opts: ExecOptions = {}): Promise<Phan
     // phantom and any grandchild holding its stdio. Interactive runs stay in
     // the foreground group so the TTY keeps working.
     const useGroup = hasTimeout && !opts.interactive && process.platform !== "win32";
-    const child = spawn(binary, args, {
+    const child = spawnImpl(binary, args, {
       env,
       cwd: opts.cwd,
       stdio: opts.interactive ? "inherit" : ["pipe", "pipe", "pipe"],
@@ -424,6 +425,14 @@ export function __resetPhantomCache(): void {
   cachedInstalled = undefined;
 }
 
+/**
+ * For tests only. Replaces the process spawner so a test can stub `phantom`
+ * without a real subprocess; call with no argument to restore the real one.
+ */
+export function __setPhantomSpawn(impl?: typeof spawn): void {
+  spawnImpl = impl ?? spawn;
+}
+
 /**
  * Redact the secret value in phantom CLI arg lists before they're interpolated
  * into any error message or log line. `phantom add <KEY> <VALUE>` is the main

package/src/stack-manifest.ts

@@ -26,9 +26,9 @@ export const STACK_MANIFEST = Object.freeze({
   schema_version: 1,
   kind: "ashlr-stack-manifest",
   components: Object.freeze([
-    Object.freeze({ id: "core", name: "@ashlr/stack-core", version: "0.3.1", distribution: "npm" }),
-    Object.freeze({ id: "cli", name: "@ashlr/stack", version: "0.3.1", distribution: "npm" }),
-    Object.freeze({ id: "mcp", name: "ashlr-stack-mcp", version: "0.3.1", distribution: "npm" }),
+    Object.freeze({ id: "core", name: "@ashlr/stack-core", version: "0.3.6", distribution: "npm" }),
+    Object.freeze({ id: "cli", name: "@ashlr/stack", version: "0.3.6", distribution: "npm" }),
+    Object.freeze({ id: "mcp", name: "ashlr-stack-mcp", version: "0.3.6", distribution: "npm" }),
     Object.freeze({
       id: "plugin",
       name: "stack",