@dzhechkov/p-replicator 1.12.0 → 1.13.2

package/tests/unit/sync-templates-guard.test.js

@@ -2,8 +2,9 @@
 
 // scripts/sync-templates.js copies <found root>/.claude/{skills,commands,agents,rules,hooks} over
 // templates/.claude/ — the directory that becomes the npm tarball. It finds its source by walking up
-// to five parents and taking the FIRST one containing .claude/skills, which inside a monorepo is the
-// MONOREPO, whose .claude/skills holds a whole different toolkit.
+// to five parents, stopping at the package repository boundary, and taking the FIRST one containing
+// .claude/skills, which inside a monorepo is the MONOREPO, whose .claude/skills holds a whole
+// different toolkit.
 //
 // Nothing had fired only because package.json's prepublishOnly points at the publish gate, not here.
 // "Safe because dead" is not a safety property: a dead script can be revived by anyone who does not
@@ -61,7 +62,11 @@ const DECLARATION = 'p-replicator-sync-source: v1';
  *  with its own templates/.claude tree. `marker` decides whether the root claims to be the source. */
 function fixture(opts) {
   const o = opts || {};
-  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-sync-')));
+  const parent = o.parent || os.tmpdir();
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(parent, 'p-rep-sync-')));
+  const boundary = o.boundary === undefined ? 'dir' : o.boundary;
+  if (boundary === 'dir') fs.mkdirSync(path.join(root, '.git'));
+  if (boundary === 'file') fs.writeFileSync(path.join(root, '.git'), 'gitdir: /nonexistent\n');
   if (o.rootHasClaude !== false) {
     fs.mkdirSync(path.join(root, '.claude', 'skills', 'intruder'), { recursive: true });
     fs.writeFileSync(path.join(root, '.claude', 'skills', 'intruder', 'SKILL.md'),
@@ -208,6 +213,44 @@ describe.skip = describe.skip || (() => {});
     } finally { cleanup(f.root); }
   });
 
+  test('P10 — a .claude/skills ABOVE the repository boundary is not a candidate root', () => {
+    const grandparent = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-intruder-')));
+    fs.mkdirSync(path.join(grandparent, '.claude', 'skills', 'intruder'), { recursive: true });
+    fs.writeFileSync(path.join(grandparent, '.claude', 'skills', 'intruder', 'SKILL.md'),
+      '# outside the fixture repository\n');
+    try {
+      const bounded = fixture({ parent: grandparent, rootHasClaude: false, boundary: 'dir' });
+      try {
+        const r = runScript(bounded.pkg);
+        assert.equal(r.code, 0, 'the repository boundary must stop the walk: ' + r.out);
+        assert.match(r.out, /Not in repo context — skipping sync/);
+      } finally { cleanup(bounded.root); }
+
+      const unbounded = fixture({ parent: grandparent, rootHasClaude: false, boundary: false });
+      try {
+        const r = runScript(unbounded.pkg);
+        assert.equal(r.code, 1, 'without a boundary the outside candidate must still be found');
+        assert.match(r.out, /REFUSING to sync/,
+          'the contrast proves the boundary, rather than the host /tmp state, caused the skip');
+      } finally { cleanup(unbounded.root); }
+    } finally { cleanup(grandparent); }
+  });
+
+  test('P11 — a .git FILE (worktree) is a boundary too', () => {
+    const grandparent = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-intruder-')));
+    fs.mkdirSync(path.join(grandparent, '.claude', 'skills', 'intruder'), { recursive: true });
+    fs.writeFileSync(path.join(grandparent, '.claude', 'skills', 'intruder', 'SKILL.md'),
+      '# outside the fixture worktree\n');
+    try {
+      const f = fixture({ parent: grandparent, rootHasClaude: false, boundary: 'file' });
+      try {
+        const r = runScript(f.pkg);
+        assert.equal(r.code, 0, 'a worktree .git file must stop the walk: ' + r.out);
+        assert.match(r.out, /Not in repo context — skipping sync/);
+      } finally { cleanup(f.root); }
+    } finally { cleanup(grandparent); }
+  });
+
   test('P5 — no helper tells a reader to run it', () => {
     // The helper printed "Run prepublishOnly first: node scripts/sync-templates.js" when templates/
     // was missing: a live invitation to the hazardous command, in the one situation where a reader

package/tests/unit/traceability-completion-gate.test.js

@@ -0,0 +1,267 @@
+'use strict';
+
+const { describe, test } = require('node:test');
+const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const PACKAGE_ROOT = path.resolve(__dirname, '..', '..');
+const CHECKER = path.join(PACKAGE_ROOT, 'scripts', 'check-pipeline-gaps.sh');
+const TRACEABILITY_FIXTURE = path.join(PACKAGE_ROOT, 'tests', 'fixtures', 'prep-traceability-fixture');
+const FEATURE_TEMPLATE = path.join(PACKAGE_ROOT, 'templates', '.claude', 'commands', 'feature.md');
+const PROJECT_TEMPLATE = path.join(
+  PACKAGE_ROOT, 'templates', '.claude', 'skills', 'sparc-prd-mini', 'SKILL.md',
+);
+
+const ROLES = {
+  specification: '01_specification.md',
+  pseudocode: '02_pseudocode.md',
+  architecture: '03_architecture.md',
+  refinement: '04_refinement.md',
+  completion: '05_completion.md',
+};
+
+function write(root, relative, body) {
+  const target = path.join(root, relative);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, body);
+  return target;
+}
+
+function roleMap(root, relative, heading) {
+  const rows = Object.entries(ROLES).map(([role, target]) => `  ${role}: ${target}`);
+  return write(root, relative,
+    `${heading}\n\n\`\`\`yaml\nDOCUMENT_ROLE_MAP:\n${rows.join('\n')}\n\`\`\`\n`);
+}
+
+function temp(t, prefix = 'traceability-completion-') {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  return root;
+}
+
+function createContour(root, options = {}) {
+  const slug = options.slug || 'demo';
+  const prefix = path.join('docs', 'features', slug);
+  const specification = options.specification || [
+    `# ${slug} specification`,
+    '',
+    `### FR-${slug}-1 — feature requirement`,
+    '',
+    `### AC-${slug}-1 — accepts a valid request`,
+    '',
+    `### AC-${slug}-2 — rejects an invalid request`,
+    '',
+  ].join('\n');
+  const digest = crypto.createHash('sha256').update(specification).digest('hex');
+  write(root, path.join(prefix, ROLES.specification), specification);
+  write(root, path.join(prefix, ROLES.pseudocode), [
+    `### Algorithm: ${slug}`,
+    `REQUIREMENT: \`FR-${slug}-1\``,
+    `REQUIREMENT: \`AC-${slug}-1\``,
+    `REQUIREMENT: \`AC-${slug}-2\``,
+    '',
+  ].join('\n'));
+  write(root, path.join(prefix, ROLES.architecture), '# Architecture\n');
+  write(root, path.join(prefix, ROLES.refinement), '# Refinement\n');
+  write(root, path.join(prefix, ROLES.completion), options.completion || [
+    '# Completion',
+    '',
+    '## Criterion coverage',
+    '| Criterion | Test file | Test title |',
+    '|-----------|-----------|------------|',
+    `| AC-${slug}-1 | tests/${slug}.test.js | accepts a valid request |`,
+    `| AC-${slug}-2 | tests/${slug}.test.js | rejects an invalid request |`,
+    '',
+  ].join('\n'));
+  write(root, path.join(prefix, 'validation-report.md'), options.validation || [
+    '# Validation report',
+    `Spec revision: sha256:${digest}`,
+    '',
+    '## Criterion scenarios',
+    '| Criterion | Scenario |',
+    '|-----------|----------|',
+    `| AC-${slug}-1 | accepts a valid request |`,
+    `| AC-${slug}-2 | rejects an invalid request |`,
+    '',
+  ].join('\n'));
+  write(root, path.join('tests', `${slug}.test.js`), options.testBody || [
+    "test('accepts a valid request', () => {});",
+    "test('rejects an invalid request', () => {});",
+    '',
+  ].join('\n'));
+  return { slug, prefix, digest, specification };
+}
+
+function maps(root) {
+  return {
+    feature: roleMap(root, 'feature-map.md', '### Phase 1 document role map'),
+    project: roleMap(root, 'project-map.md', '### Project-level default'),
+  };
+}
+
+function runChecker(root, flags, options = {}) {
+  const roleMaps = options.maps || maps(root);
+  const result = spawnSync('bash', [options.checker || CHECKER, root, ...flags,
+    '--role-map-source', roleMaps.feature,
+    '--project-role-map-source', roleMaps.project,
+  ], { cwd: options.cwd || PACKAGE_ROOT, encoding: 'utf8', timeout: 10000 });
+  return {
+    status: result.status,
+    signal: result.signal,
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+    output: `${result.stdout || ''}${result.stderr || ''}`,
+  };
+}
+
+describe('traceability completion and report gates', () => {
+  test('P1 — clean contour: --completion and --report-revision exit 0 with PASS verdicts', (t) => {
+    const root = temp(t);
+    createContour(root);
+    const result = runChecker(root, ['--completion', '--report-revision']);
+    assert.equal(result.status, 0, result.output);
+    assert.match(result.output, /VERDICT completion=PASS features=1 gaps=0 inconclusive=0/);
+    assert.match(result.output, /VERDICT report-revision=PASS features=1 gaps=0 inconclusive=0/);
+  });
+
+  test('P2 — an AC with no coverage row is a named gap (exit 1)', (t) => {
+    const root = temp(t);
+    const contour = createContour(root);
+    const completion = path.join(root, contour.prefix, ROLES.completion);
+    fs.writeFileSync(completion, fs.readFileSync(completion, 'utf8')
+      .replace(/^\| AC-demo-2 .*\n/m, ''));
+    const result = runChecker(root, ['--completion']);
+    assert.equal(result.status, 1, result.output);
+    assert.match(result.output,
+      /GAP contour=demo completion AC-demo-2 has no row in Criterion coverage/);
+    assert.match(result.output, /VERDICT completion=FAIL/);
+  });
+
+  test('P3 — a row whose id is not in the specification is a named gap', (t) => {
+    const root = temp(t);
+    const contour = createContour(root);
+    const completion = path.join(root, contour.prefix, ROLES.completion);
+    fs.appendFileSync(completion,
+      '| AC-demo-9 | tests/demo.test.js | accepts a valid request |\n');
+    const result = runChecker(root, ['--completion']);
+    assert.equal(result.status, 1, result.output);
+    assert.match(result.output,
+      /GAP contour=demo completion row AC-demo-9 is not declared in the specification/);
+  });
+
+  test('P4 — a row whose test file lacks the title is a named gap; escaping and symlinked paths are refused', (t) => {
+    const root = temp(t);
+    const contour = createContour(root, { testBody: "test('another title', () => {});\n" });
+    const completion = path.join(root, contour.prefix, ROLES.completion);
+    let result = runChecker(root, ['--completion']);
+    assert.equal(result.status, 1, result.output);
+    assert.match(result.output,
+      /AC-demo-1 test file tests\/demo\.test\.js does not contain title "accepts a valid request"/);
+
+    fs.writeFileSync(completion, fs.readFileSync(completion, 'utf8')
+      .replace('tests/demo.test.js | accepts a valid request',
+        '../outside.test.js | accepts a valid request'));
+    result = runChecker(root, ['--completion']);
+    assert.equal(result.status, 1, result.output);
+    assert.match(result.output, /test file \.\.\/outside\.test\.js escapes the project root/);
+
+    const outside = temp(t, 'traceability-completion-outside-');
+    write(outside, 'linked.test.js', "test('accepts a valid request', () => {});\n");
+    fs.symlinkSync(path.join(outside, 'linked.test.js'), path.join(root, 'tests', 'linked.test.js'));
+    fs.writeFileSync(completion, fs.readFileSync(completion, 'utf8')
+      .replace('../outside.test.js', 'tests/linked.test.js'));
+    result = runChecker(root, ['--completion']);
+    assert.equal(result.status, 1, result.output);
+    assert.match(result.output, /test file tests\/linked\.test\.js uses a symlink/);
+  });
+
+  test('P5 — a stale revision line exits 1 naming both prefixes; a missing line exits 2', (t) => {
+    const root = temp(t);
+    const contour = createContour(root);
+    const report = path.join(root, contour.prefix, 'validation-report.md');
+    const stale = 'a'.repeat(64);
+    fs.writeFileSync(report, fs.readFileSync(report, 'utf8')
+      .replace(contour.digest, stale));
+    let result = runChecker(root, ['--report-revision']);
+    assert.equal(result.status, 1, result.output);
+    assert.match(result.output,
+      new RegExp(`sha256:${stale.slice(0, 12)}… != specification sha256:${contour.digest.slice(0, 12)}…`));
+
+    fs.writeFileSync(report, fs.readFileSync(report, 'utf8')
+      .replace(/^Spec revision:.*\n/m, ''));
+    result = runChecker(root, ['--report-revision']);
+    assert.equal(result.status, 2, result.output);
+    assert.match(result.output,
+      /NOT-ESTABLISHED contour=demo report-revision line missing in validation-report\.md/);
+  });
+
+  test('P5b — --criterion-scenarios names missing and undeclared rows; a missing table exits 2', (t) => {
+    const root = temp(t);
+    const contour = createContour(root);
+    const report = path.join(root, contour.prefix, 'validation-report.md');
+    fs.writeFileSync(report, fs.readFileSync(report, 'utf8')
+      .replace(/^\| AC-demo-2 .*\n/m, '')
+      .replace('| AC-demo-1 | accepts a valid request |', [
+        '| AC-demo-1 | accepts a valid request |',
+        '| AC-demo-9 | undeclared scenario |',
+      ].join('\n')));
+    let result = runChecker(root, ['--criterion-scenarios']);
+    assert.equal(result.status, 1, result.output);
+    assert.match(result.output,
+      /GAP contour=demo criterion-scenarios AC-demo-2 has no scenario row/);
+    assert.match(result.output,
+      /GAP contour=demo criterion-scenarios row AC-demo-9 is not declared in the specification/);
+
+    fs.writeFileSync(report, [
+      '# Validation report',
+      `Spec revision: sha256:${contour.digest}`,
+      '',
+      '## Different section',
+      '',
+    ].join('\n'));
+    result = runChecker(root, ['--criterion-scenarios']);
+    assert.equal(result.status, 2, result.output);
+    assert.match(result.output, /NOT-ESTABLISHED.*criterion-scenarios table missing or malformed/);
+  });
+
+  test('P6 — flags compose and the worst status wins', (t) => {
+    const root = temp(t);
+    const contour = createContour(root);
+    const completion = path.join(root, contour.prefix, ROLES.completion);
+    const report = path.join(root, contour.prefix, 'validation-report.md');
+    fs.writeFileSync(completion, fs.readFileSync(completion, 'utf8')
+      .replace(/^\| AC-demo-2 .*\n/m, ''));
+    fs.writeFileSync(report, fs.readFileSync(report, 'utf8')
+      .replace(/^Spec revision:.*\n/m, ''));
+    const result = runChecker(root, [
+      '--traceability', '--completion', '--report-revision', '--criterion-scenarios',
+    ]);
+    assert.equal(result.status, 2, result.output);
+    assert.match(result.output, /VERDICT traceability=PASS/);
+    assert.match(result.output, /VERDICT completion=FAIL/);
+    assert.match(result.output, /VERDICT report-revision=NOT-ESTABLISHED/);
+    assert.match(result.output, /VERDICT criterion-scenarios=PASS/);
+  });
+
+  test('P7 — --traceability output is byte-identical to before on the existing fixture', (t) => {
+    const root = temp(t, 'traceability-legacy-checker-');
+    const oldScript = path.join(root, 'check-pipeline-gaps.sh');
+    const shown = spawnSync('git', ['show', 'HEAD:./scripts/check-pipeline-gaps.sh'], {
+      cwd: PACKAGE_ROOT, encoding: 'utf8', timeout: 10000,
+    });
+    assert.equal(shown.status, 0, `${shown.stdout}\n${shown.stderr}`);
+    fs.writeFileSync(oldScript, shown.stdout, { mode: 0o755 });
+    const roleMaps = { feature: FEATURE_TEMPLATE, project: PROJECT_TEMPLATE };
+    const before = runChecker(TRACEABILITY_FIXTURE, ['--traceability'], {
+      checker: oldScript, maps: roleMaps,
+    });
+    const after = runChecker(TRACEABILITY_FIXTURE, ['--traceability'], { maps: roleMaps });
+    assert.equal(after.status, before.status, after.output);
+    assert.equal(after.stdout, before.stdout);
+    assert.equal(after.stderr, before.stderr);
+  });
+});

package/tests/unit/utils.test.js

@@ -341,12 +341,12 @@ describe('COMPONENTS.items SSOT', () => {
     }
   });
 
-  test('item counts: 10 skills, 11 commands, 4 agents, 9 rules, 1 settings', () => {
+  test('item counts: 10 skills, 11 commands, 4 agents, 13 rules, 1 settings', () => {
     assert.equal(Object.keys(utils.COMPONENTS.skills.items).length, 10, 'skills count');
     assert.equal(Object.keys(utils.COMPONENTS.commands.items).length, 11, 'commands count (post v1.4: + 9 generic commands)');
     assert.equal(Object.keys(utils.COMPONENTS.agents.items).length, 4, 'agents count');
-    assert.equal(Object.keys(utils.COMPONENTS.rules.items).length, 9,
-      'rules count (+ honest failure rules)');
+    assert.equal(Object.keys(utils.COMPONENTS.rules.items).length, 13,
+      'rules count (+ honest failure rules, + embeddable-widget, + incoming-webhooks, + long-running-job, + model-call-cost)');
     assert.ok(utils.COMPONENTS.settings, 'settings component group added in v1.4');
     assert.equal(Object.keys(utils.COMPONENTS.settings.items).length, 1, 'settings.json count');
   });
@@ -635,3 +635,40 @@ describe('COMPONENTS.hooks (v1.5.0)', () => {
       `expected >= 6 hook scripts (post v1.5.0), got ${hookCount}`);
   });
 });
+
+describe('mergeHookMatchers — identity survives the user respelling of a variable (a1ef0e41)', () => {
+  // MEASURED (backlog a1ef0e41): a user who hand-rewrote `$CLAUDE_PROJECT_DIR` into
+  // `${CLAUDE_PROJECT_DIR}` got every event hook DOUBLED on the next update, because the
+  // byte-equality Set saw two strings for one command. Both spellings expand identically in sh.
+  const shipped = (cmd) => [{ matcher: '*', hooks: [{ type: 'command', command: cmd }] }];
+
+  test('${VAR} respelling of a shipped $VAR hook does not double on merge', () => {
+    const user = shipped('node "${CLAUDE_PROJECT_DIR}/.claude/hooks/session-insights.cjs"');
+    const tpl = shipped('node "$CLAUDE_PROJECT_DIR/.claude/hooks/session-insights.cjs"');
+    const merged = utils.mergeHookMatchers(user, tpl);
+    assert.equal(merged[0].hooks.length, 1, 'one command, two spellings — must stay ONE hook');
+    // The USER's own spelling survives; the stored command is never rewritten.
+    assert.match(merged[0].hooks[0].command, /\$\{CLAUDE_PROJECT_DIR\}/);
+  });
+
+  test('whitespace-run respelling does not double either', () => {
+    const user = shipped('node  a.cjs   --flag');
+    const tpl = shipped('node a.cjs --flag');
+    assert.equal(utils.mergeHookMatchers(user, tpl)[0].hooks.length, 1);
+  });
+
+  test('genuinely different commands still both survive (dedup must not over-collapse)', () => {
+    const user = shipped('node a.cjs');
+    const tpl = shipped('node b.cjs');
+    assert.equal(utils.mergeHookMatchers(user, tpl)[0].hooks.length, 2);
+  });
+
+  test('MUTATION: byte-equality dedup (the old code) goes red on the respelling case', () => {
+    // The RED half in miniature: with canonicalization stripped, the two spellings differ.
+    const oldDedup = (a, b) => new Set(a.map((h) => h.command)).has(b.command);
+    const userHook = { command: 'node "${X}/y.cjs"' };
+    const tplHook = { command: 'node "$X/y.cjs"' };
+    assert.equal(oldDedup([userHook], tplHook), false,
+      'byte equality cannot see through the respelling — this is the measured doubling');
+  });
+});