@ashlr/stack-core 0.3.1 → 0.3.6

package/src/ai/phantom-wire-known-placeholder.test.ts

@@ -0,0 +1,170 @@
+import { afterEach, beforeEach, describe, expect, it, setDefaultTimeout } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { type Harness, setupFakePhantom } from "../__tests__/_harness.ts";
+import { verificationHintFor, webhookStubFor, wirePhantomForRecipe } from "./phantom-wire.ts";
+import type { Recipe } from "./recipe.ts";
+
+// The wiring check spawns the fake `phantom` shim (bash + python3); keep the
+// sibling files' raised timeout.
+setDefaultTimeout(30_000);
+
+describe("ai/phantom-wire known placeholder as the entire template", () => {
+  let harness: Harness;
+  let dir: string;
+
+  beforeEach(() => {
+    harness = setupFakePhantom();
+    dir = mkdtempSync(join(tmpdir(), "wire-known-placeholder-"));
+  });
+  afterEach(() => {
+    harness.cleanup();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  const recipe = (...names: string[]): Recipe => ({
+    id: "known-placeholder",
+    query: "q",
+    createdAt: "2026-04-18T00:00:00.000Z",
+    providers: names.map((name) => ({ name })),
+  });
+
+  it("preserves punctuation adjacent to known placeholder replacements", () => {
+    const stub = webhookStubFor("stripe");
+
+    expect(stub).toContain(
+      "// Auto-generated by `stack apply` — webhook handler stub for stripe.\n",
+    );
+    expect(stub).toContain('//   const signature = req.headers.get("stripe-signature");\n');
+    expect(stub).toContain("//   // (`phantom reveal STRIPE_WEBHOOK_SECRET`) and compare in\n");
+    expect(stub).toContain(
+      "// export async function handleStripeWebhook(req: Request): Promise<Response> {\n",
+    );
+    expect(stub).not.toContain("${");
+  });
+
+  it.each([
+    "${provider}", // the name slot's own spelling
+    "${capitalize(provider)}", // the handler-name slot's spelling
+    "${webhookSecretKeyFor(provider)}", // the secret-key slot's spelling
+    "${signatureHeaderFor(provider)}", // the header slot's spelling
+    "${verificationHintFor(provider)}", // the hint slot's spelling
+  ])("emits the replacement value itself at every site for the whole-name token %j", (name) => {
+    // The name is exactly one of the template's slot spellings — the
+    // placeholder is the entire input, with no ordinary text around it.
+    // At each expansion site the emitted output equals the replacement
+    // value (the name, in that site's case); the token-shaped value is
+    // never fed back through the slots — a second pass would erase or
+    // rewrite it, and none runs.
+    const stub = webhookStubFor(name);
+
+    // Case-preserving sites: the output is the replacement value
+    // byte-for-byte. `capitalize` folds only the first code point, and
+    // `$` uppercases to itself, so the handler site is identical too.
+    expect(stub).toContain(`webhook handler stub for ${name}.`);
+    expect(stub).toContain(`forge a ${name} webhook.`);
+    expect(stub).toContain(`handle${name}Webhook(req: Request)`);
+    // Both `toUpperCase()` secret-key sites hold the whole-name-uppercased
+    // value — the fold happens inside the replacement, proof the value was
+    // substituted (an unresolved slot would sit in template case).
+    expect(stub.split(`phantom reveal ${name.toUpperCase()}_WEBHOOK_SECRET`).length - 1).toBe(2);
+
+    // Five `${...}` spans — one per expansion site — and every one is the
+    // carried token in that site's case, none resolved away or duplicated.
+    const tokens = [...stub.matchAll(/\$\{[^}]*\}/g)].map((m) => m[0]);
+    expect(tokens).toHaveLength(5);
+    for (const token of tokens) expect(token.toLowerCase()).toBe(name.toLowerCase());
+
+    // The remaining slots took their own values in the same single pass:
+    // the generic signature header and the fallback hint — the carried
+    // token never reached their switch cases either.
+    expect(stub).toContain('req.headers.get("x-webhook-signature")');
+    expect(stub).toContain("//   // Verify per the provider's documented signature scheme.");
+    expect(verificationHintFor(name)).toBe(verificationHintFor("zzq"));
+  });
+
+  it.each([
+    ["stripe", "Stripe: `stripe.webhooks.constructEvent` — HMAC-SHA256 with timestamp tolerance."],
+    ["clerk", "Clerk (svix): `new Webhook(secret).verify(body, headers)`."],
+    ["supabase", "Supabase: `x-supabase-signature` per Supabase's documented webhook scheme."],
+    ["github", "GitHub: `x-hub-signature-256` is `sha256=` + HMAC-SHA256 of the raw body."],
+  ])("renders the %s hint slot as exactly its replacement value", (provider, hint) => {
+    // A known provider name is the whole template of the hint slot: the
+    // render is exactly the fixed replacement — no wrapper, no leftover
+    // `${...}` — and the stub carries that value once, on the TODO line.
+    expect(verificationHintFor(provider)).toBe(hint);
+    const stub = webhookStubFor(provider);
+    expect(stub.split(`//   // ${hint}\n`).length - 1).toBe(1);
+    expect(stub).not.toContain("${");
+  });
+
+  it("emits the name where the `${provider}` slot stood — output equals the value it resolved to", () => {
+    // The name spells the `provider` slot itself, so at the name sites the
+    // emitted text is indistinguishable from an unfilled slot. The proof
+    // the output is the *replacement value* and not a skipped slot: the
+    // two reveal sites carry `${PROVIDER}` — the value uppercased, work
+    // only the substitution path does — while the sibling slots resolved
+    // to their own real values. A recursive pass would have re-resolved
+    // the carried `${provider}` into something else; every occurrence
+    // stays the literal value.
+    const name = "${provider}";
+    const stub = webhookStubFor(name);
+
+    // The slot's replacement IS the name: at all three name sites the
+    // rendered text equals the value that was passed in.
+    expect(stub).toContain(`webhook handler stub for ${name}.`);
+    expect(stub).toContain(`handle${name}Webhook(req: Request)`);
+    expect(stub).toContain(`forge a ${name} webhook.`);
+    expect(stub.split("${provider}").length - 1).toBe(3);
+    // Folded at the reveal sites — substituted, not left raw. The folded
+    // token appears exactly twice, each time inside a `phantom reveal` line.
+    expect(stub.split("phantom reveal ${PROVIDER}_WEBHOOK_SECRET").length - 1).toBe(2);
+    expect(stub.split("${PROVIDER}").length - 1).toBe(2);
+
+    // Single pass: the header and hint slots took real values; the carried
+    // `${provider}` token was never offered back to any slot.
+    expect(stub).toContain('req.headers.get("x-webhook-signature")');
+    expect(stub).toContain("//   // Verify per the provider's documented signature scheme.");
+    const tokens = [...stub.matchAll(/\$\{[^}]*\}/g)].map((m) => m[0]);
+    expect(tokens).toEqual([
+      "${provider}",
+      "${PROVIDER}",
+      "${provider}",
+      "${provider}",
+      "${PROVIDER}",
+    ]);
+  });
+
+  it("skips a whole-name known-placeholder token byte-for-byte through wiring and writes nothing for it", async () => {
+    // Through `wirePhantomForRecipe` the slot-spelling name matches no
+    // catalog provider: it returns in `skipped` byte-for-byte — the entire
+    // token intact — gets no stub on disk, and provokes no vault write.
+    // The known provider listed beside it wires normally, unaffected by
+    // the placeholder-shaped neighbour.
+    const name = "${webhookSecretKeyFor(provider)}";
+    const stubPath = join(dir, ".stack", "webhooks", "clerk.ts");
+    const result = await wirePhantomForRecipe(recipe(name, "clerk"), { cwd: dir });
+
+    expect(result).toEqual({
+      present: [],
+      missing: ["clerk:CLERK_SECRET_KEY"],
+      webhooks: [stubPath],
+      skipped: [name],
+    });
+    expect(result.skipped[0]).toBe(name);
+
+    // Only clerk's documented stub lands — nothing for the placeholder
+    // name, and the stub on disk is the same render `webhookStubFor`
+    // returns.
+    expect(readdirSync(join(dir, ".stack", "webhooks"))).toEqual(["clerk.ts"]);
+    expect(readFileSync(stubPath, "utf-8")).toBe(webhookStubFor("clerk"));
+    expect(existsSync(join(dir, ".stack", "webhooks", `${name}.ts`))).toBe(false);
+
+    // The whole call log is reads (`--version`, `list`); the vault file
+    // still parses to an empty object.
+    expect(harness.calls().every((c) => c.cmd === "--version" || c.cmd === "list")).toBe(true);
+    expect(harness.callsTo("add")).toEqual([]);
+    expect(JSON.parse(readFileSync(harness.vaultPath, "utf-8"))).toEqual({});
+  });
+});

package/src/ai/phantom-wire-malformed-json.test.ts

@@ -0,0 +1,227 @@
+import { afterAll, afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { EventEmitter } from "node:events";
+import {
+  chmodSync,
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { StackError } from "../errors.ts";
+import { __resetPhantomCache, __setPhantomSpawn, listSecrets } from "../phantom.ts";
+import { wirePhantomForRecipe } from "./phantom-wire.ts";
+import type { Recipe } from "./recipe.ts";
+
+// Stubbed `phantom` subprocess, like the sibling phantom-wire-*.test.ts files:
+// `--version` succeeds and `list --json` emits whatever bytes `listOutput`
+// holds. Because spawn itself is replaced, no child process — and no socket —
+// ever exists: the malformed-inventory path provably makes no network access.
+// `calls` records every argv so the tests can pin the read-only verbs
+// (`--version`, `list --json`) and exclude every mutating one.
+let installed = true;
+let listOutput: string[] | "unreadable" = ["[]"];
+let calls: string[][] = [];
+
+function fakeSpawn(_bin: string, args: string[]) {
+  calls.push([...args]);
+  const child = new EventEmitter() as EventEmitter & Record<string, unknown>;
+  const out = new EventEmitter();
+  const err = new EventEmitter();
+  Object.assign(child, {
+    stdout: Object.assign(out, { destroy() {} }),
+    stderr: Object.assign(err, { destroy() {} }),
+    stdin: { on() {}, write() {}, end() {}, destroy() {} },
+    pid: undefined,
+    kill() {},
+    unref() {},
+  });
+  queueMicrotask(() => {
+    if (!installed) {
+      child.emit("error", Object.assign(new Error("ENOENT"), { code: "ENOENT" }));
+      return;
+    }
+    if (args[0] === "list") {
+      if (listOutput === "unreadable") {
+        child.emit("close", 1, null);
+        return;
+      }
+      // Emit each element as its own `data` event: exec() reassembles stdout
+      // from chunks, and only the joined bytes are parsed.
+      for (const chunk of listOutput) out.emit("data", Buffer.from(chunk));
+    }
+    child.emit("close", 0, null);
+  });
+  return child;
+}
+
+function recipeOf(...names: string[]): Recipe {
+  return {
+    id: "malformed-json",
+    query: "malformed",
+    createdAt: "2026-04-18T00:00:00.000Z",
+    providers: names.map((name) => ({ name })),
+  };
+}
+
+async function listSecretsError(cwd: string): Promise<unknown> {
+  try {
+    await listSecrets(cwd);
+  } catch (err) {
+    return err;
+  }
+  throw new Error("listSecrets resolved; expected a rejection");
+}
+
+describe("ai/phantom-wire malformed vault inventory JSON", () => {
+  const savedPath = process.env.PATH;
+  let binDir: string;
+  let projectDir: string;
+
+  beforeEach(() => {
+    binDir = realpathSync(mkdtempSync(join(tmpdir(), "wire-badjson-bin-")));
+    projectDir = realpathSync(mkdtempSync(join(tmpdir(), "wire-badjson-")));
+    // Binary only needs to resolve on PATH; spawn is stubbed. `.sh` target
+    // matches the sibling tests (macOS provenance policy).
+    writeFileSync(join(binDir, "phantom.sh"), "#!/bin/sh\n");
+    chmodSync(join(binDir, "phantom.sh"), 0o755);
+    symlinkSync(join(binDir, "phantom.sh"), join(binDir, "phantom"));
+    process.env.PATH = binDir;
+    installed = true;
+    listOutput = ["[]"];
+    calls = [];
+    __resetPhantomCache();
+    __setPhantomSpawn(fakeSpawn as never);
+  });
+
+  afterEach(() => {
+    process.env.PATH = savedPath;
+    rmSync(binDir, { recursive: true, force: true });
+    rmSync(projectDir, { recursive: true, force: true });
+  });
+
+  afterAll(() => {
+    __setPhantomSpawn();
+    __resetPhantomCache();
+  });
+
+  it.each([
+    // A zero-byte answer is a successful exit with nothing to parse.
+    ["empty stdout", [""]],
+    ["whitespace only", ["  \n\t "]],
+    // Truncated mid-entry: the bytes still carry a plausible secret name,
+    // which must never be reported as present.
+    ["truncated mid-entry", ['[{"name":"STRIPE_SECRET_KEY"']],
+    // A valid array followed by junk: JSON.parse rejects trailing content.
+    ["trailing garbage", ['[{"name":"STRIPE_SECRET_KEY"}]\n{"name":"EXTRA"}']],
+    // The decorated table an older Phantom prints when it ignores `--json` —
+    // the exact "upgrade Phantom Secrets" scenario the error names.
+    ["human table output", ["-> 1 secret(s) in vault (encrypted-file):\n   - STRIPE_SECRET_KEY\n"]],
+    // Leading BOM is not JSON whitespace.
+    ["BOM-prefixed array", ['\uFEFF[{"name":"STRIPE_SECRET_KEY"}]']],
+    // Interleaved garbage across chunk boundaries is still one unparseable body.
+    ["noise split across chunks", ['[{"name":"STRIPE', '"}} nonsense [']],
+  ])(
+    "reports %s as the documented unrecognized-output error, never an uncaught SyntaxError",
+    async (_label, chunks) => {
+      listOutput = chunks;
+
+      const err = await listSecretsError(projectDir);
+      // The handler's expected error: a typed StackError with the documented
+      // code — not the raw JSON.parse SyntaxError escaping uncaught.
+      expect(err).toBeInstanceOf(StackError);
+      expect(err).not.toBeInstanceOf(SyntaxError);
+      expect(err).toMatchObject({
+        code: "PHANTOM_OUTPUT_UNRECOGNIZED",
+        message:
+          "phantom list --json did not return JSON; upgrade Phantom Secrets to 0.7.9 or newer.",
+      });
+
+      // The wiring request still resolves: the unreadable inventory degrades
+      // to `skipped` with no present/missing claims — including the plausible
+      // name the truncated bytes contained — while the webhook stub is written.
+      const result = await wirePhantomForRecipe(recipeOf("stripe"), { cwd: projectDir });
+      expect(result.present).toEqual([]);
+      expect(result.missing).toEqual([]);
+      expect(result.skipped).toEqual(["stripe"]);
+      const stubPath = join(projectDir, ".stack/webhooks/stripe.ts");
+      expect(result.webhooks).toEqual([stubPath]);
+      expect(existsSync(stubPath)).toBe(true);
+
+      // Metadata only: the install probe plus two inventory reads. The spawn
+      // stub means no process or socket exists; no mutating verb ever runs.
+      expect(calls).toEqual([["--version"], ["list", "--json"], ["list", "--json"]]);
+    },
+  );
+
+  it.each([
+    ["a string entry", '["STRIPE_SECRET_KEY"]'],
+    ["a null entry", "[null]"],
+    ["a nested array entry", '[["STRIPE_SECRET_KEY"]]'],
+    ["a numeric name", '[{"name":42}]'],
+    ["an empty name", '[{"name":""}]'],
+    ["an entry with no name", '[{"detected_service":null}]'],
+    // One malformed entry poisons the whole inventory: names are never
+    // partially trusted.
+    ["one bad entry among valid ones", '[{"name":"OPENAI_API_KEY"},{"name":42}]'],
+  ])(
+    "rejects %s in the inventory array and keeps the provider's secrets unknown",
+    async (_label, output) => {
+      listOutput = [output];
+
+      await expect(listSecrets(projectDir)).rejects.toMatchObject({
+        code: "PHANTOM_OUTPUT_UNRECOGNIZED",
+        message: "phantom list --json contains unrecognized secret-name metadata.",
+      });
+
+      const result = await wirePhantomForRecipe(recipeOf("stripe"), { cwd: projectDir });
+      expect(result).toEqual({
+        present: [],
+        missing: [],
+        skipped: ["stripe"],
+        webhooks: [join(projectDir, ".stack/webhooks/stripe.ts")],
+      });
+      expect(calls).toEqual([["--version"], ["list", "--json"], ["list", "--json"]]);
+    },
+  );
+
+  it("parses inventory JSON only after all stdout chunks arrive", async () => {
+    // Each partial chunk is malformed JSON on its own; only the reassembled
+    // body parses. Guards against regressing to per-chunk parsing.
+    listOutput = ['[{"name":"STRI', "PE_SEC", 'RET_KEY"}]'];
+
+    expect(await listSecrets(projectDir)).toEqual(["STRIPE_SECRET_KEY"]);
+    const result = await wirePhantomForRecipe(recipeOf("stripe"), { cwd: projectDir });
+    expect(result.present).toEqual(["stripe:STRIPE_SECRET_KEY"]);
+    expect(result.skipped).toEqual([]);
+  });
+
+  it("keeps malformed inventory bytes off every verb except the read-only probes", async () => {
+    listOutput = ['[{"name":"STRIPE_SECRET_KEY"'];
+    await wirePhantomForRecipe(recipeOf("stripe"), { cwd: projectDir });
+
+    // Whatever the vault answer looks like, wiring may probe the install and
+    // read names — never `add`, `remove`, `init`, `reveal`, `status`, `sync`.
+    for (const argv of calls) expect(["--version", "list"]).toContain(argv[0]);
+    expect(calls).toEqual([["--version"], ["list", "--json"]]);
+  });
+
+  it("makes no network access: the module has no network call sites", () => {
+    // phantom-wire.ts shells out to a local `phantom` binary and writes files;
+    // the only request handler it mentions is the commented-out stub example.
+    // Pin that wiring stays metadata-only and cannot reach the network even if
+    // a future edit is tempted to fall back to a remote probe.
+    const source = readFileSync(
+      fileURLToPath(new URL("./phantom-wire.ts", import.meta.url)),
+      "utf-8",
+    );
+    expect(source).not.toMatch(
+      /\bfetch\(|node:(http|https|net|dgram|tls)|new WebSocket|XMLHttpRequest|undici/,
+    );
+  });
+});

package/src/ai/phantom-wire-missing.test.ts

@@ -0,0 +1,123 @@
+import { afterEach, beforeEach, describe, expect, it, setDefaultTimeout } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { type Harness, setupFakePhantom } from "../__tests__/_harness.ts";
+import { addSecret } from "../phantom.ts";
+import { wirePhantomForRecipe } from "./phantom-wire.ts";
+import type { Recipe } from "./recipe.ts";
+
+// Each check spawns the fake `phantom` shim (bash + python3); several checks
+// per test multiply that, so keep the sibling files' raised timeout.
+setDefaultTimeout(30_000);
+
+describe("ai/phantom-wire repeated missing-value checks", () => {
+  let harness: Harness;
+  let dir: string;
+
+  beforeEach(() => {
+    harness = setupFakePhantom();
+    dir = mkdtempSync(join(tmpdir(), "stack wire missing-"));
+  });
+  afterEach(() => {
+    harness.cleanup();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  const recipe = (...names: string[]): Recipe => ({
+    id: "recheck",
+    query: "q",
+    createdAt: "2026-04-18T00:00:00.000Z",
+    providers: names.map((name) => ({ name })),
+  });
+
+  const vaultText = () => readFileSync(harness.vaultPath, "utf-8");
+  // Every logged phantom call must be a read: the install probe or `list`.
+  const onlyReadCalls = () =>
+    harness.calls().every((c) => c.cmd === "--version" || c.cmd === "list");
+
+  it("re-reports the same secrets missing on every check and never writes placeholders", async () => {
+    const before = vaultText();
+    const first = await wirePhantomForRecipe(recipe("stripe", "github"), { cwd: dir });
+    const firstMissing = [...first.missing];
+
+    // A missing secret is a promise to the user ("store with `phantom add`).
+    // Re-checking must not shrink the list, move entries to `present`, or
+    // quietly absorb them into `skipped` — each would misreport a write.
+    for (let i = 0; i < 3; i++) {
+      const again = await wirePhantomForRecipe(recipe("stripe", "github"), { cwd: dir });
+      expect(again).toEqual(first);
+      expect(again.missing).toEqual(["stripe:STRIPE_SECRET_KEY", "github:GITHUB_TOKEN"]);
+      expect(again.present).toEqual([]);
+      expect(again.skipped).toEqual([]);
+    }
+    // Each run builds a fresh result; later checks never mutate earlier ones.
+    expect(first.missing).toEqual(firstMissing);
+
+    // Placeholder values would require a vault write. The whole call log is
+    // one `--version` probe plus one `list --json` per check — never `add`,
+    // `init`, `remove` or `sync` — and the vault file is byte-identical.
+    expect(onlyReadCalls()).toBe(true);
+    expect(harness.callsTo("list")).toHaveLength(4);
+    expect(harness.callsTo("add")).toEqual([]);
+    expect(vaultText()).toBe(before);
+    expect(JSON.parse(vaultText())).toEqual({});
+  });
+
+  it("keeps a partial vault's present/missing split identical across repeated checks", async () => {
+    writeFileSync(harness.vaultPath, JSON.stringify({ SUPABASE_ANON_KEY: "x" }));
+    const missing = [
+      "supabase:SUPABASE_URL",
+      "supabase:SUPABASE_SERVICE_ROLE_KEY",
+      "openai:OPENAI_API_KEY",
+    ];
+
+    for (let i = 0; i < 3; i++) {
+      const result = await wirePhantomForRecipe(recipe("supabase", "openai"), { cwd: dir });
+      expect(result.present).toEqual(["supabase:SUPABASE_ANON_KEY"]);
+      expect(result.missing).toEqual(missing);
+      expect(result.skipped).toEqual([]);
+    }
+
+    expect(onlyReadCalls()).toBe(true);
+    expect(harness.callsTo("add")).toEqual([]);
+    expect(JSON.parse(vaultText())).toEqual({ SUPABASE_ANON_KEY: "x" });
+  });
+
+  it("moves a secret to present only after a real `phantom add`, never from re-checking", async () => {
+    for (let i = 0; i < 2; i++) {
+      const result = await wirePhantomForRecipe(recipe("stripe"), { cwd: dir });
+      expect(result.missing).toEqual(["stripe:STRIPE_SECRET_KEY"]);
+      expect(result.present).toEqual([]);
+    }
+    expect(harness.callsTo("add")).toEqual([]);
+
+    // A real write through Phantom is the only thing that may shrink
+    // `missing`; the check itself reports it faithfully afterwards.
+    await addSecret("STRIPE_SECRET_KEY", "user-supplied-real-value", dir);
+    const after = await wirePhantomForRecipe(recipe("stripe"), { cwd: dir });
+    expect(after.present).toEqual(["stripe:STRIPE_SECRET_KEY"]);
+    expect(after.missing).toEqual([]);
+
+    // Exactly one `add` in the log — the explicit write above, in create-only
+    // `--stdin` form. The checks contributed none.
+    expect(harness.callsTo("add")).toEqual([
+      { cmd: "add", args: ["STRIPE_SECRET_KEY", "--stdin"] },
+    ]);
+  });
+
+  it("leaves no placeholder artifacts on disk beyond the documented webhook stubs", async () => {
+    // `openai` has missing secrets and no webhook stub: a repeated check must
+    // not drop a placeholder file for it anywhere in the project tree.
+    for (let i = 0; i < 2; i++) {
+      await wirePhantomForRecipe(recipe("stripe", "openai", "github"), { cwd: dir });
+    }
+
+    expect(readdirSync(dir)).toEqual([".stack"]);
+    expect(readdirSync(join(dir, ".stack"))).toEqual(["webhooks"]);
+    expect(readdirSync(join(dir, ".stack", "webhooks")).sort()).toEqual(["github.ts", "stripe.ts"]);
+    expect(existsSync(join(dir, ".env"))).toBe(false);
+    expect(harness.callsTo("add")).toEqual([]);
+    expect(JSON.parse(vaultText())).toEqual({});
+  });
+});