@eltonssouza/development-utility-kit 1.0.0

package/dashboard/test/sprint3.test.js

@@ -0,0 +1,560 @@
+'use strict';
+
+/**
+ * Sprint 3 failing tests — written before implementation (TDD RED phase).
+ * Tests for T-014 docs panel wiring, T-015-T-019 docs content files, T-020 QA final.
+ * Run: node --test dashboard/test/sprint3.test.js
+ */
+
+const { test, describe, before } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const PUBLIC_DIR = path.join(REPO_ROOT, 'dashboard', 'public');
+const DOCS_DIR = path.join(PUBLIC_DIR, 'content', 'docs');
+
+// ── T-014: Docs panel wiring in app.js ───────────────────────────────────────
+
+describe('T-014: docs panel dynamic wiring in app.js', () => {
+  let js;
+  before(() => {
+    js = fs.readFileSync(path.join(PUBLIC_DIR, 'app.js'), 'utf8');
+  });
+
+  test('contains api/docs/skills call', () => {
+    assert.ok(js.includes('/api/docs/skills'), 'Missing /api/docs/skills fetch in app.js');
+  });
+
+  test('contains api/docs/agents call', () => {
+    assert.ok(js.includes('/api/docs/agents'), 'Missing /api/docs/agents fetch in app.js');
+  });
+
+  test('contains api/docs/adrs call', () => {
+    assert.ok(js.includes('/api/docs/adrs'), 'Missing /api/docs/adrs fetch in app.js');
+  });
+
+  test('contains api/docs/file call', () => {
+    assert.ok(js.includes('/api/docs/file'), 'Missing /api/docs/file fetch in app.js');
+  });
+
+  test('total api/docs/* references >= 4', () => {
+    const count = (js.match(/api\/docs\/skills|api\/docs\/agents|api\/docs\/adrs|api\/docs\/file/g) || []).length;
+    assert.ok(count >= 4, `Expected >= 4 api/docs/* references in app.js, got ${count}`);
+  });
+
+  test('contains sessionStorage usage', () => {
+    const count = (js.match(/sessionStorage/g) || []).length;
+    assert.ok(count >= 1, `Expected >= 1 sessionStorage usage in app.js, got ${count}`);
+  });
+
+  test('contains getCached or sessionStorage.getItem', () => {
+    assert.ok(
+      js.includes('getCached') || js.includes('sessionStorage.getItem'),
+      'Missing cache retrieval (getCached or sessionStorage.getItem)'
+    );
+  });
+
+  test('contains setCache or sessionStorage.setItem', () => {
+    assert.ok(
+      js.includes('setCache') || js.includes('sessionStorage.setItem'),
+      'Missing cache write (setCache or sessionStorage.setItem)'
+    );
+  });
+
+  test('contains kud_cache_skills key', () => {
+    assert.ok(js.includes('kud_cache_skills'), 'Missing kud_cache_skills session key');
+  });
+
+  test('contains kud_cache_agents key', () => {
+    assert.ok(js.includes('kud_cache_agents'), 'Missing kud_cache_agents session key');
+  });
+
+  test('contains kud_cache_adrs key', () => {
+    assert.ok(js.includes('kud_cache_adrs'), 'Missing kud_cache_adrs session key');
+  });
+
+  test('contains initDocsPanel function', () => {
+    assert.ok(js.includes('initDocsPanel'), 'Missing initDocsPanel function');
+  });
+
+  test('contains loadDynamicSection function', () => {
+    assert.ok(js.includes('loadDynamicSection'), 'Missing loadDynamicSection function');
+  });
+
+  test('inline markdown render via marked.parse or renderMarkdown', () => {
+    assert.ok(
+      js.includes('renderMarkdown') || js.includes('marked.parse'),
+      'Missing inline markdown rendering'
+    );
+  });
+});
+
+// ── T-015: architecture-overview.{pt,en}.md ──────────────────────────────────
+
+describe('T-015: docs content — architecture overview', () => {
+  const ptFile = path.join(DOCS_DIR, 'architecture-overview.pt.md');
+  const enFile = path.join(DOCS_DIR, 'architecture-overview.en.md');
+
+  test('architecture-overview.pt.md exists', () => {
+    assert.ok(fs.existsSync(ptFile), 'architecture-overview.pt.md does not exist');
+  });
+
+  test('architecture-overview.en.md exists', () => {
+    assert.ok(fs.existsSync(enFile), 'architecture-overview.en.md does not exist');
+  });
+
+  test('architecture-overview.pt.md has size > 800 bytes', () => {
+    const stat = fs.statSync(ptFile);
+    assert.ok(stat.size > 800, `architecture-overview.pt.md too small: ${stat.size} bytes`);
+  });
+
+  test('architecture-overview.en.md has size > 800 bytes', () => {
+    const stat = fs.statSync(enFile);
+    assert.ok(stat.size > 800, `architecture-overview.en.md too small: ${stat.size} bytes`);
+  });
+
+  test('architecture-overview.pt.md contains ASCII diagram or prompt flow reference', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    const count = (content.match(/ASCII|prompt →|skill match|entry point|entry-point/g) || []).length;
+    assert.ok(count >= 1, `Expected >= 1 match for ASCII/prompt/skill-match in architecture-overview.pt.md, got ${count}`);
+  });
+
+  test('architecture-overview.pt.md mentions 2-layer architecture (skill + agent)', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(
+      (content.toLowerCase().includes('skill') || content.toLowerCase().includes('skills')) &&
+      (content.toLowerCase().includes('agent') || content.toLowerCase().includes('agents')),
+      'Missing skill/agent architecture mention in architecture-overview.pt.md'
+    );
+  });
+
+  test('architecture-overview.pt.md mentions Task tool dispatch', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(
+      content.includes('Task') || content.includes('task tool') || content.includes('dispatch'),
+      'Missing Task tool dispatch mention in architecture-overview.pt.md'
+    );
+  });
+
+  test('architecture-overview.en.md contains ASCII diagram or prompt flow reference', () => {
+    const content = fs.readFileSync(enFile, 'utf8');
+    const count = (content.match(/ASCII|prompt →|skill match|entry point|entry-point/g) || []).length;
+    assert.ok(count >= 1, `Expected >= 1 match in architecture-overview.en.md, got ${count}`);
+  });
+});
+
+// ── T-016: autonomy-matrix.{pt,en}.md ────────────────────────────────────────
+
+describe('T-016: docs content — autonomy matrix', () => {
+  const ptFile = path.join(DOCS_DIR, 'autonomy-matrix.pt.md');
+  const enFile = path.join(DOCS_DIR, 'autonomy-matrix.en.md');
+
+  test('autonomy-matrix.pt.md exists', () => {
+    assert.ok(fs.existsSync(ptFile), 'autonomy-matrix.pt.md does not exist');
+  });
+
+  test('autonomy-matrix.en.md exists', () => {
+    assert.ok(fs.existsSync(enFile), 'autonomy-matrix.en.md does not exist');
+  });
+
+  test('autonomy-matrix.pt.md has size > 800 bytes', () => {
+    const stat = fs.statSync(ptFile);
+    assert.ok(stat.size > 800, `autonomy-matrix.pt.md too small: ${stat.size} bytes`);
+  });
+
+  test('autonomy-matrix.en.md has size > 800 bytes', () => {
+    const stat = fs.statSync(enFile);
+    assert.ok(stat.size > 800, `autonomy-matrix.en.md too small: ${stat.size} bytes`);
+  });
+
+  test('autonomy-matrix.pt.md mentions product-owner >= 4 times', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    const count = (content.match(/product-owner|tech-lead/g) || []).length;
+    assert.ok(count >= 4, `Expected >= 4 product-owner/tech-lead matches in autonomy-matrix.pt.md, got ${count}`);
+  });
+
+  test('autonomy-matrix.pt.md contains decision table', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(content.includes('|'), 'Missing table (|) in autonomy-matrix.pt.md');
+  });
+
+  test('autonomy-matrix.pt.md mentions escalation rules', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(
+      content.includes('escala') || content.includes('escalate') || content.includes('escalar'),
+      'Missing escalation rules in autonomy-matrix.pt.md'
+    );
+  });
+
+  test('autonomy-matrix.en.md mentions product-owner >= 4 times', () => {
+    const content = fs.readFileSync(enFile, 'utf8');
+    const count = (content.match(/product-owner|tech-lead/g) || []).length;
+    assert.ok(count >= 4, `Expected >= 4 product-owner/tech-lead matches in autonomy-matrix.en.md, got ${count}`);
+  });
+});
+
+// ── T-017: pipeline.{pt,en}.md ───────────────────────────────────────────────
+
+describe('T-017: docs content — pipeline', () => {
+  const ptFile = path.join(DOCS_DIR, 'pipeline.pt.md');
+  const enFile = path.join(DOCS_DIR, 'pipeline.en.md');
+
+  test('pipeline.pt.md exists', () => {
+    assert.ok(fs.existsSync(ptFile), 'pipeline.pt.md does not exist');
+  });
+
+  test('pipeline.en.md exists', () => {
+    assert.ok(fs.existsSync(enFile), 'pipeline.en.md does not exist');
+  });
+
+  test('pipeline.pt.md has size > 800 bytes', () => {
+    const stat = fs.statSync(ptFile);
+    assert.ok(stat.size > 800, `pipeline.pt.md too small: ${stat.size} bytes`);
+  });
+
+  test('pipeline.en.md has size > 800 bytes', () => {
+    const stat = fs.statSync(enFile);
+    assert.ok(stat.size > 800, `pipeline.en.md too small: ${stat.size} bytes`);
+  });
+
+  test('pipeline.pt.md mentions grill-me, sprint-runner, gate-keeper, brain-keeper (>= 4 total)', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    const count = (content.match(/grill-me|sprint-runner|gate-keeper|brain-keeper/g) || []).length;
+    assert.ok(count >= 4, `Expected >= 4 pipeline keyword matches in pipeline.pt.md, got ${count}`);
+  });
+
+  test('pipeline.pt.md mentions artifacts (DISCOVERY, PRD, PLAN)', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(
+      content.includes('DISCOVERY') || content.includes('discovery'),
+      'Missing DISCOVERY artifact mention in pipeline.pt.md'
+    );
+    assert.ok(
+      content.includes('PRD') || content.includes('prd'),
+      'Missing PRD artifact mention in pipeline.pt.md'
+    );
+    assert.ok(
+      content.includes('PLAN') || content.includes('plan'),
+      'Missing PLAN artifact mention in pipeline.pt.md'
+    );
+  });
+
+  test('pipeline.en.md mentions grill-me, sprint-runner, gate-keeper, brain-keeper (>= 4)', () => {
+    const content = fs.readFileSync(enFile, 'utf8');
+    const count = (content.match(/grill-me|sprint-runner|gate-keeper|brain-keeper/g) || []).length;
+    assert.ok(count >= 4, `Expected >= 4 pipeline keyword matches in pipeline.en.md, got ${count}`);
+  });
+});
+
+// ── T-018: quality-gate.{pt,en}.md ───────────────────────────────────────────
+
+describe('T-018: docs content — quality gate', () => {
+  const ptFile = path.join(DOCS_DIR, 'quality-gate.pt.md');
+  const enFile = path.join(DOCS_DIR, 'quality-gate.en.md');
+
+  test('quality-gate.pt.md exists', () => {
+    assert.ok(fs.existsSync(ptFile), 'quality-gate.pt.md does not exist');
+  });
+
+  test('quality-gate.en.md exists', () => {
+    assert.ok(fs.existsSync(enFile), 'quality-gate.en.md does not exist');
+  });
+
+  test('quality-gate.pt.md has size > 800 bytes', () => {
+    const stat = fs.statSync(ptFile);
+    assert.ok(stat.size > 800, `quality-gate.pt.md too small: ${stat.size} bytes`);
+  });
+
+  test('quality-gate.en.md has size > 800 bytes', () => {
+    const stat = fs.statSync(enFile);
+    assert.ok(stat.size > 800, `quality-gate.en.md too small: ${stat.size} bytes`);
+  });
+
+  test('quality-gate.pt.md contains >= 5 threshold keyword matches', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    const count = (content.match(/85|70|80|0\.80|2500|300ms|JaCoCo|PIT|mutation/g) || []).length;
+    assert.ok(count >= 5, `Expected >= 5 threshold matches in quality-gate.pt.md, got ${count}`);
+  });
+
+  test('quality-gate.pt.md mentions JaCoCo', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(content.includes('JaCoCo'), 'Missing JaCoCo in quality-gate.pt.md');
+  });
+
+  test('quality-gate.pt.md mentions mutation or PIT', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(
+      content.includes('mutation') || content.includes('PIT') || content.includes('Pitest'),
+      'Missing mutation/PIT in quality-gate.pt.md'
+    );
+  });
+
+  test('quality-gate.pt.md mentions Lighthouse threshold', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(content.includes('0.80') || content.includes('Lighthouse'), 'Missing Lighthouse threshold in quality-gate.pt.md');
+  });
+
+  test('quality-gate.pt.md mentions LCP 2500ms', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(content.includes('2500'), 'Missing 2500ms LCP threshold in quality-gate.pt.md');
+  });
+
+  test('quality-gate.pt.md mentions TBT 300ms', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(content.includes('300ms') || content.includes('300 ms'), 'Missing 300ms TBT threshold in quality-gate.pt.md');
+  });
+
+  test('quality-gate.en.md contains >= 5 threshold keyword matches', () => {
+    const content = fs.readFileSync(enFile, 'utf8');
+    const count = (content.match(/85|70|80|0\.80|2500|300ms|JaCoCo|PIT|mutation/g) || []).length;
+    assert.ok(count >= 5, `Expected >= 5 threshold matches in quality-gate.en.md, got ${count}`);
+  });
+});
+
+// ── T-019: stack-rules.{pt,en}.md ────────────────────────────────────────────
+
+describe('T-019: docs content — stack rules', () => {
+  const ptFile = path.join(DOCS_DIR, 'stack-rules.pt.md');
+  const enFile = path.join(DOCS_DIR, 'stack-rules.en.md');
+
+  test('stack-rules.pt.md exists', () => {
+    assert.ok(fs.existsSync(ptFile), 'stack-rules.pt.md does not exist');
+  });
+
+  test('stack-rules.en.md exists', () => {
+    assert.ok(fs.existsSync(enFile), 'stack-rules.en.md does not exist');
+  });
+
+  test('stack-rules.pt.md has size > 800 bytes', () => {
+    const stat = fs.statSync(ptFile);
+    assert.ok(stat.size > 800, `stack-rules.pt.md too small: ${stat.size} bytes`);
+  });
+
+  test('stack-rules.en.md has size > 800 bytes', () => {
+    const stat = fs.statSync(enFile);
+    assert.ok(stat.size > 800, `stack-rules.en.md too small: ${stat.size} bytes`);
+  });
+
+  test('stack-rules.pt.md contains Java 25 >= 3 times (various mandatory versions)', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    const count = (content.match(/Java 25|Spring Boot 4|Angular 21|React Native 0\.84/g) || []).length;
+    assert.ok(count >= 3, `Expected >= 3 mandatory version matches in stack-rules.pt.md, got ${count}. Ensure inline references like "Java 25+", "Spring Boot 4.0.x+", "Angular 21+", "React Native 0.84+" appear.`);
+  });
+
+  test('stack-rules.pt.md mentions Java 25', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(content.includes('Java 25'), 'Missing "Java 25" in stack-rules.pt.md');
+  });
+
+  test('stack-rules.pt.md mentions Spring Boot 4', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(content.includes('Spring Boot 4'), 'Missing "Spring Boot 4" in stack-rules.pt.md');
+  });
+
+  test('stack-rules.pt.md mentions Angular 21', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(content.includes('Angular 21'), 'Missing "Angular 21" in stack-rules.pt.md');
+  });
+
+  test('stack-rules.pt.md mentions React Native 0.84', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(content.includes('React Native 0.84'), 'Missing "React Native 0.84" in stack-rules.pt.md');
+  });
+
+  test('stack-rules.en.md contains Java 25, Spring Boot 4, Angular 21, React Native 0.84 (>= 3 matches)', () => {
+    const content = fs.readFileSync(enFile, 'utf8');
+    const count = (content.match(/Java 25|Spring Boot 4|Angular 21|React Native 0\.84/g) || []).length;
+    assert.ok(count >= 3, `Expected >= 3 mandatory version matches in stack-rules.en.md, got ${count}`);
+  });
+
+  test('stack-rules.pt.md mentions record DTO and ProblemDetail', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(
+      content.includes('record') || content.includes('ProblemDetail'),
+      'Missing record/ProblemDetail in stack-rules.pt.md'
+    );
+  });
+
+  test('stack-rules.pt.md mentions separate files rule', () => {
+    const content = fs.readFileSync(ptFile, 'utf8');
+    assert.ok(
+      content.includes('templateUrl') || content.includes('ARQUIVOS SEPARADOS') || content.includes('arquivos separados'),
+      'Missing separate files rule in stack-rules.pt.md'
+    );
+  });
+});
+
+// ── T-020: QA final ───────────────────────────────────────────────────────────
+
+describe('T-020: QA final — manifest paths, security, vendor fallback', () => {
+  test('all manifest paths resolve to existing files (PT + EN pairs)', () => {
+    const manifestPath = path.join(PUBLIC_DIR, 'content', 'manifest.json');
+    assert.ok(fs.existsSync(manifestPath), 'manifest.json does not exist');
+
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    assert.ok(manifest.manual, 'manifest missing .manual');
+    assert.ok(manifest.docs, 'manifest missing .docs');
+    assert.equal(manifest.manual.length, 5, 'manifest.manual must have 5 entries');
+    assert.equal(manifest.docs.length, 5, 'manifest.docs must have 5 entries');
+
+    const all = [...manifest.manual, ...manifest.docs];
+    for (const entry of all) {
+      const ptPath = path.join(REPO_ROOT, entry.path_template.replace('{lang}', 'pt'));
+      const enPath = path.join(REPO_ROOT, entry.path_template.replace('{lang}', 'en'));
+      assert.ok(fs.existsSync(ptPath), `PT file missing: ${ptPath}`);
+      assert.ok(fs.existsSync(enPath), `EN file missing: ${enPath}`);
+    }
+  });
+
+  test('vendor/marked.min.js fallback exists', () => {
+    const vendorPath = path.join(PUBLIC_DIR, 'vendor', 'marked.min.js');
+    assert.ok(fs.existsSync(vendorPath), 'vendor/marked.min.js does not exist');
+    const stat = fs.statSync(vendorPath);
+    assert.ok(stat.size > 10000, `vendor/marked.min.js too small: ${stat.size} bytes`);
+  });
+
+  test('all 10 docs files exist and have size > 800 bytes', () => {
+    const slugs = ['architecture-overview', 'autonomy-matrix', 'pipeline', 'quality-gate', 'stack-rules'];
+    for (const slug of slugs) {
+      for (const lang of ['pt', 'en']) {
+        const filePath = path.join(DOCS_DIR, `${slug}.${lang}.md`);
+        assert.ok(fs.existsSync(filePath), `${slug}.${lang}.md does not exist`);
+        const stat = fs.statSync(filePath);
+        assert.ok(stat.size > 800, `${slug}.${lang}.md too small: ${stat.size} bytes`);
+      }
+    }
+  });
+
+  test('path traversal check: server-app.js contains whitelist and 403 response', async () => {
+    // Static check: server-app.js must contain whitelist validation logic
+    const serverAppPath = path.join(REPO_ROOT, 'dashboard', 'server-app.js');
+    assert.ok(fs.existsSync(serverAppPath), 'server-app.js does not exist');
+    const serverAppJs = fs.readFileSync(serverAppPath, 'utf8');
+    assert.ok(
+      serverAppJs.includes('..') || serverAppJs.includes('normalize') || serverAppJs.includes('whitelist') || serverAppJs.includes('WHITELIST'),
+      'server-app.js missing path traversal protection'
+    );
+    assert.ok(
+      serverAppJs.includes('403') || serverAppJs.includes('Forbidden'),
+      'server-app.js missing 403 Forbidden response for blocked paths'
+    );
+  });
+
+  test('app.js has >= 4 api/docs/* references', () => {
+    const js = fs.readFileSync(path.join(PUBLIC_DIR, 'app.js'), 'utf8');
+    const count = (js.match(/api\/docs\/skills|api\/docs\/agents|api\/docs\/adrs|api\/docs\/file/g) || []).length;
+    assert.ok(count >= 4, `Expected >= 4 api/docs references in app.js, got ${count}`);
+  });
+
+  test('app.js has >= 1 sessionStorage reference', () => {
+    const js = fs.readFileSync(path.join(PUBLIC_DIR, 'app.js'), 'utf8');
+    const count = (js.match(/sessionStorage/g) || []).length;
+    assert.ok(count >= 1, `Expected >= 1 sessionStorage reference in app.js, got ${count}`);
+  });
+
+  test('index.html references vendor/marked.min.js (offline fallback)', () => {
+    const html = fs.readFileSync(path.join(PUBLIC_DIR, 'index.html'), 'utf8');
+    assert.ok(html.includes('marked.min.js'), 'index.html missing marked.min.js reference');
+    const markedCount = (html.match(/marked\.min\.js/g) || []).length;
+    assert.ok(markedCount >= 2, `Expected >= 2 marked.min.js references in index.html (CDN + vendor), got ${markedCount}`);
+  });
+});
+
+// ── T-020: HTTP endpoint smoke tests ─────────────────────────────────────────
+
+describe('T-020: HTTP endpoint smoke tests', () => {
+  let request;
+
+  before(async () => {
+    const appPath = path.join(REPO_ROOT, 'dashboard', 'server-app.js');
+    assert.ok(fs.existsSync(appPath), 'server-app.js must exist');
+    const supertest = require('supertest');
+    const { app } = require(appPath);
+    request = supertest(app);
+  });
+
+  test('GET /api/docs/skills returns 200 with array', async () => {
+    const res = await request.get('/api/docs/skills');
+    assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
+    assert.ok(Array.isArray(res.body), 'Expected array response from /api/docs/skills');
+  });
+
+  test('GET /api/docs/skills returns >= 10 entries', async () => {
+    const res = await request.get('/api/docs/skills');
+    assert.ok(res.body.length >= 10, `Expected >= 10 skills, got ${res.body.length}`);
+  });
+
+  test('GET /api/docs/skills entries have name and path fields', async () => {
+    const res = await request.get('/api/docs/skills');
+    const first = res.body[0];
+    assert.ok(first.name, 'Skills entry missing name field');
+    assert.ok(first.path, 'Skills entry missing path field');
+  });
+
+  test('GET /api/docs/agents returns 200 with array', async () => {
+    const res = await request.get('/api/docs/agents');
+    assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
+    assert.ok(Array.isArray(res.body), 'Expected array response from /api/docs/agents');
+  });
+
+  test('GET /api/docs/agents returns >= 15 entries', async () => {
+    const res = await request.get('/api/docs/agents');
+    assert.ok(res.body.length >= 15, `Expected >= 15 agents, got ${res.body.length}`);
+  });
+
+  test('GET /api/docs/agents entries have model field', async () => {
+    const res = await request.get('/api/docs/agents');
+    const first = res.body[0];
+    assert.ok(first.model, 'Agents entry missing model field');
+  });
+
+  test('GET /api/docs/adrs returns 200 with array', async () => {
+    const res = await request.get('/api/docs/adrs');
+    assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
+    assert.ok(Array.isArray(res.body), 'Expected array response from /api/docs/adrs');
+  });
+
+  test('GET /api/docs/adrs returns >= 10 entries', async () => {
+    const res = await request.get('/api/docs/adrs');
+    assert.ok(res.body.length >= 10, `Expected >= 10 ADRs, got ${res.body.length}`);
+  });
+
+  test('GET /api/docs/adrs entries are sorted ascending by number', async () => {
+    const res = await request.get('/api/docs/adrs');
+    const nums = res.body.map((x) => x.number);
+    assert.ok(nums[0] < nums[nums.length - 1], 'ADRs not sorted ascending by number');
+  });
+
+  test('GET /api/docs/adrs entries have status field', async () => {
+    const res = await request.get('/api/docs/adrs');
+    const first = res.body[0];
+    assert.ok(first.status !== undefined, 'ADR entry missing status field');
+  });
+
+  test('GET /api/docs/file with path traversal ../../package.json returns 403', async () => {
+    const res = await request.get('/api/docs/file?path=../../package.json');
+    assert.equal(res.status, 403, `Expected 403 for path traversal, got ${res.status}`);
+  });
+
+  test('GET /api/docs/file with absolute path /etc/passwd returns 403', async () => {
+    const res = await request.get('/api/docs/file?path=/etc/passwd');
+    assert.equal(res.status, 403, `Expected 403 for absolute path, got ${res.status}`);
+  });
+
+  test('GET /api/docs/file with out-of-whitelist path bin/cli.js returns 403', async () => {
+    const res = await request.get('/api/docs/file?path=bin/cli.js');
+    assert.equal(res.status, 403, `Expected 403 for out-of-whitelist path, got ${res.status}`);
+  });
+
+  test('GET /api/docs/file with valid whitelist path returns 200', async () => {
+    const res = await request.get('/api/docs/file?path=dashboard/public/content/manifest.json');
+    assert.equal(res.status, 200, `Expected 200 for valid path, got ${res.status}`);
+  });
+
+  test('GET /api/stats still returns 200', async () => {
+    const res = await request.get('/api/stats');
+    assert.equal(res.status, 200, `Expected 200 for /api/stats, got ${res.status}`);
+  });
+});

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@eltonssouza/development-utility-kit",
+  "version": "1.0.0",
+  "description": "npx installer for the development-utility-kit harness",
+  "bin": {
+    "duk": "bin/cli.js"
+  },
+  "files": [
+    "bin",
+    "bin/lib",
+    "dashboard",
+    "scripts/hooks",
+    "scripts/latest-versions.json",
+    ".claude",
+    "CLAUDE.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/eltonssouza/development-utility-kit.git"
+  },
+  "keywords": [
+    "harness",
+    "installer",
+    "devtools"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/hooks/subagent-telemetry.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# SubagentStop hook — forwards stdin JSON to the telemetry writer.
+# Fails silently: if node or the writer is missing the hook exits 0.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WRITER="${SCRIPT_DIR}/telemetry-writer.js"
+
+if [ ! -f "$WRITER" ]; then
+  exit 0
+fi
+
+node "$WRITER" || exit 0