@gr8ful/spf 0.5.1 → 0.6.0

package/dist/test/agent_cc.test.js

@@ -1,95 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { isKnownToolName, CcToolCallTracker } from "../core/agent_cc.js";
-test("isKnownToolName: SPF's lowercase vocabulary maps onto Claude Code's own tool names, ls is known-but-dropped, typos are unknown", () => {
-    for (const name of ["read", "write", "edit", "bash", "grep", "glob"]) {
-        assert.equal(isKnownToolName(name), true, name);
-    }
-    assert.equal(isKnownToolName("find"), true, "find aliases to glob");
-    assert.equal(isKnownToolName("ls"), true, "ls is a known name, just dropped");
-    assert.equal(isKnownToolName("harness_engineering_only"), false);
-    assert.equal(isKnownToolName("bogus"), false);
-});
-// Every message shape below is a real captured line from `claude -p
-// --output-format stream-json --verbose` (v2.1.237), not a guess — see
-// agent_cc.ts's module doc comment for the exact commands run.
-test("CcToolCallTracker: folds a real tool_use + tool_result pair into one record", () => {
-    const tracker = new CcToolCallTracker();
-    assert.equal(tracker.observe({
-        type: "assistant",
-        message: {
-            content: [{ type: "tool_use", id: "toolu_01ABC", name: "Read", input: { file_path: "/private/tmp/cc-probe/test.txt" } }],
-        },
-        timestamp: "2026-08-20T11:40:00.000Z",
-    }), null, "the assistant's tool_use alone produces no record");
-    const record = tracker.observe({
-        type: "user",
-        message: {
-            content: [{ type: "tool_result", tool_use_id: "toolu_01ABC", content: "1\thello world\n2\t" }],
-        },
-        timestamp: "2026-08-20T11:40:00.500Z",
-    });
-    assert.ok(record);
-    assert.equal(record.tool, "Read");
-    assert.equal(record.tool_call_id, "toolu_01ABC");
-    assert.deepEqual(record.args, { file_path: "/private/tmp/cc-probe/test.txt" });
-    assert.equal(record.ok, true);
-    assert.equal(record.label, "Read: /private/tmp/cc-probe/test.txt");
-    assert.equal(record.result_snippet, "1\thello world\n2\t");
-    assert.equal(record.duration_ms, 500);
-});
-test("CcToolCallTracker: a real StructuredOutput call folds like any other tool call, deliberately unfiltered", () => {
-    const tracker = new CcToolCallTracker();
-    tracker.observe({
-        type: "assistant",
-        message: {
-            content: [
-                {
-                    type: "tool_use",
-                    id: "toolu_01MPFgPqyPeEzWfqRE25JLzF",
-                    name: "StructuredOutput",
-                    input: { status: "success", summary: "hello from claude code" },
-                },
-            ],
-        },
-    });
-    const record = tracker.observe({
-        type: "user",
-        message: {
-            content: [{ type: "tool_result", tool_use_id: "toolu_01MPFgPqyPeEzWfqRE25JLzF", content: "Structured output provided successfully" }],
-        },
-    });
-    assert.ok(record);
-    assert.equal(record.tool, "StructuredOutput");
-    assert.equal(record.ok, true);
-    assert.equal(record.result_snippet, "Structured output provided successfully");
-});
-test("CcToolCallTracker: is_error:true on the tool_result folds to ok:false", () => {
-    const tracker = new CcToolCallTracker();
-    tracker.observe({
-        type: "assistant",
-        message: { content: [{ type: "tool_use", id: "toolu_err", name: "Bash", input: { command: "false" } }] },
-    });
-    const record = tracker.observe({
-        type: "user",
-        message: { content: [{ type: "tool_result", tool_use_id: "toolu_err", content: "command failed", is_error: true }] },
-    });
-    assert.ok(record);
-    assert.equal(record.ok, false);
-});
-test("CcToolCallTracker: non-tool message types (system, thinking-only assistant, result) produce no record", () => {
-    const tracker = new CcToolCallTracker();
-    assert.equal(tracker.observe({ type: "system", subtype: "init", cwd: "/tmp", session_id: "s1", tools: [] }), null);
-    assert.equal(tracker.observe({ type: "assistant", message: { content: [{ type: "thinking", thinking: "..." }] } }), null);
-    assert.equal(tracker.observe({ type: "result", subtype: "success", session_id: "s1" }), null);
-});
-test("CcToolCallTracker: a tool_result with no matching tool_use still produces a record (defensive)", () => {
-    const tracker = new CcToolCallTracker();
-    const record = tracker.observe({
-        type: "user",
-        message: { content: [{ type: "tool_result", tool_use_id: "orphan", content: "ok" }] },
-    });
-    assert.ok(record);
-    assert.equal(record.tool, "tool");
-    assert.deepEqual(record.args, {});
-});

package/dist/test/agent_flue.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/agent_flue.test.js

@@ -1,83 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { isKnownToolName, resolveModel, ToolCallTracker } from "../core/agent_flue.js";
-test("resolveModel: accepts provider/model-id, rejects anything else", () => {
-    assert.deepEqual(resolveModel("openrouter/google/gemini-3.6-flash"), ["openrouter", "google/gemini-3.6-flash"]);
-    assert.deepEqual(resolveModel("openai/gpt-5.6-terra"), ["openai", "gpt-5.6-terra"]);
-    assert.throws(() => resolveModel("gpt-5.6-terra"), /must be written as provider\/model-id/);
-    assert.throws(() => resolveModel("/gpt-5.6-terra"), /must be written as provider\/model-id/);
-    assert.throws(() => resolveModel("openai/"), /must be written as provider\/model-id/);
-});
-test("isKnownToolName: pi vocabulary maps onto Flue's six builtins, ls is known-but-dropped, typos are unknown", () => {
-    for (const name of ["read", "write", "edit", "bash", "grep", "glob"]) {
-        assert.equal(isKnownToolName(name), true, name);
-    }
-    assert.equal(isKnownToolName("find"), true, "find aliases to glob");
-    assert.equal(isKnownToolName("ls"), true, "ls is a known name, just dropped");
-    assert.equal(isKnownToolName("subagent_create"), false, "harness_engineering-only names are unknown here");
-    assert.equal(isKnownToolName("bogus"), false);
-});
-test("ToolCallTracker: folds tool-input + tool-output into one record", () => {
-    const tracker = new ToolCallTracker();
-    assert.equal(tracker.observe({
-        type: "tool-input",
-        conversationId: "c1",
-        messageId: "m1",
-        toolCallId: "call1",
-        toolName: "bash",
-        input: { command: "ls -la src" },
-        position: { batch: 0, index: 0 },
-    }), null, "tool-input alone produces no record");
-    const record = tracker.observe({
-        type: "tool-output",
-        conversationId: "c1",
-        toolCallId: "call1",
-        output: "src/index.ts\nsrc/core",
-        durationMs: 12,
-        position: { batch: 0, index: 1 },
-    });
-    assert.ok(record);
-    assert.equal(record.tool, "bash");
-    assert.equal(record.tool_call_id, "call1");
-    assert.deepEqual(record.args, { command: "ls -la src" });
-    assert.equal(record.ok, true);
-    assert.equal(record.label, "bash: ls -la src");
-    assert.equal(record.result_snippet, "src/index.ts\nsrc/core");
-    assert.equal(record.duration_ms, 12);
-});
-test("ToolCallTracker: tool-output-error folds to ok:false with the error text as the snippet", () => {
-    const tracker = new ToolCallTracker();
-    tracker.observe({
-        type: "tool-input",
-        conversationId: "c1",
-        messageId: "m1",
-        toolCallId: "call2",
-        toolName: "read",
-        input: { path: "missing.txt" },
-        position: { batch: 0, index: 0 },
-    });
-    const record = tracker.observe({
-        type: "tool-output-error",
-        conversationId: "c1",
-        toolCallId: "call2",
-        errorText: "ENOENT: no such file",
-        position: { batch: 0, index: 1 },
-    });
-    assert.ok(record);
-    assert.equal(record.ok, false);
-    assert.equal(record.result_snippet, "ENOENT: no such file");
-    assert.equal(record.label, "read: missing.txt");
-});
-test("ToolCallTracker: a tool-output with no matching tool-input still produces a record (defensive)", () => {
-    const tracker = new ToolCallTracker();
-    const record = tracker.observe({
-        type: "tool-output",
-        conversationId: "c1",
-        toolCallId: "orphan",
-        output: "ok",
-        position: { batch: 0, index: 0 },
-    });
-    assert.ok(record);
-    assert.equal(record.tool, "tool");
-    assert.deepEqual(record.args, {});
-});

package/dist/test/chains.test.d.ts

@@ -1,12 +0,0 @@
-/**
- * Regression net for the chain registry. Chains used to each be a hand-written
- * module; now every one but `simple-sdlc` is a `steps` list whose
- * `phases`/`requiredAgents`/`requiredSuites` are DERIVED (see
- * `chains/steps.ts`'s `derivePhases`/`deriveRequiredAgents`/
- * `deriveRequiredSuites`). These tests pin what that derivation produces
- * today, so a step-factory change that silently alters a chain's shape (an
- * agent dropped from `requiredAgents`, a suite no longer required, a phase
- * missing from the display string) fails here instead of only showing up as
- * a `spf list` diff nobody happened to read.
- */
-export {};

package/dist/test/chains.test.js

@@ -1,92 +0,0 @@
-/**
- * Regression net for the chain registry. Chains used to each be a hand-written
- * module; now every one but `simple-sdlc` is a `steps` list whose
- * `phases`/`requiredAgents`/`requiredSuites` are DERIVED (see
- * `chains/steps.ts`'s `derivePhases`/`deriveRequiredAgents`/
- * `deriveRequiredSuites`). These tests pin what that derivation produces
- * today, so a step-factory change that silently alters a chain's shape (an
- * agent dropped from `requiredAgents`, a suite no longer required, a phase
- * missing from the display string) fails here instead of only showing up as
- * a `spf list` diff nobody happened to read.
- */
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { CHAINS, findChain, resolveRequiredAgents, resolveRequiredSuites } from "../chains/index.js";
-// name -> [phases, requiredAgents (with no options), requiredSuites]
-const EXPECTED = {
-    prompt: { phases: "engineer(request) -> <agent>", agents: ["builder"], suites: [] },
-    scout: { phases: "engineer(request) -> scout", agents: ["scout"], suites: [] },
-    plan: { phases: "engineer(request) -> planner", agents: ["planner"], suites: [] },
-    build: { phases: "engineer(request) -> builder", agents: ["builder"], suites: [] },
-    "plan-build": { phases: "engineer(request) -> planner -> builder -> git(commit)", agents: ["planner", "builder"], suites: [] },
-    "build-test": {
-        phases: "engineer(request) -> builder -> code(test) [-> builder(fix) -> code(test) ...] bounded",
-        agents: ["builder"],
-        suites: ["test"],
-    },
-    "plan-build-test": {
-        phases: "engineer(request) -> planner -> builder -> code(test) [-> builder(fix) -> code(test) ...] bounded -> git(commit)",
-        agents: ["planner", "builder"],
-        suites: ["test"],
-    },
-    "plan-build-test-quality": {
-        phases: "engineer(request) -> planner -> builder -> code(verify) [-> builder(fix) -> code(verify) ...] bounded -> git(commit)",
-        agents: ["planner", "builder"],
-        suites: ["all"],
-    },
-    "build-review": {
-        phases: "engineer(request) -> builder -> reviewer [-> builder(revise) -> reviewer ...] bounded",
-        agents: ["builder", "reviewer"],
-        suites: [],
-    },
-    quality: { phases: "engineer(request) -> code(quality)", agents: [], suites: ["all"] },
-    document: { phases: "engineer(request) -> code(changes) -> documenter", agents: ["documenter"], suites: [] },
-    refine: { phases: "engineer(request) -> refiner -> code(publish)", agents: ["refiner"], suites: [] },
-    "simple-sdlc": {
-        phases: "engineer(request) -> planner -> git(commit_plan) -> builder -> code(test) [-> builder(fix) -> code(test) ...] " +
-            "-> reviewer [-> builder(revise) -> reviewer ...] -> code(retest, if revised) -> engineer(signoff) -> git(commit_build) " +
-            "-> code(changes) -> documenter -> git(commit_docs)",
-        agents: ["planner", "builder", "reviewer", "documenter"],
-        suites: ["test"],
-    },
-};
-test("every chain in the registry has an expectation pinned here", () => {
-    const names = CHAINS.map((c) => c.name).sort();
-    assert.deepEqual(names, Object.keys(EXPECTED).sort(), "a chain was added/removed/renamed without updating this test");
-});
-for (const chain of CHAINS) {
-    const expected = EXPECTED[chain.name];
-    test(`${chain.name}: derived phases/requiredAgents/requiredSuites match what was hand-verified against \`spf list\``, () => {
-        assert.equal(chain.phases, expected.phases);
-        assert.deepEqual(resolveRequiredAgents(chain, {}), expected.agents);
-        assert.deepEqual(resolveRequiredSuites(chain, {}), expected.suites);
-    });
-}
-test("prompt: requiredAgents depends on --agent, not a fixed list — the one dynamic case", () => {
-    const chain = findChain("prompt");
-    assert.deepEqual(resolveRequiredAgents(chain, {}), ["builder"], "no --agent -> falls back to builder");
-    assert.deepEqual(resolveRequiredAgents(chain, { agent: "planner" }), ["planner"], "--agent overrides the default");
-});
-test("plan-build-test: requiredSuites depends on --suite, the same way prompt's agent does", () => {
-    const chain = findChain("plan-build-test");
-    assert.deepEqual(resolveRequiredSuites(chain, {}), ["test"], "no --suite -> falls back to the compiled-in default");
-    assert.deepEqual(resolveRequiredSuites(chain, { suite: "custom" }), ["custom"], "--suite overrides the default");
-});
-test("every chain but simple-sdlc is a steps list; simple-sdlc alone uses the imperative run() escape hatch", () => {
-    for (const chain of CHAINS) {
-        if (chain.name === "simple-sdlc") {
-            assert.ok(chain.run, "simple-sdlc should still be the one hand-written chain");
-            assert.equal(chain.steps, undefined);
-        }
-        else {
-            assert.ok(chain.steps && chain.steps.length > 0, `${chain.name} should be a steps list`);
-            assert.equal(chain.run, undefined, `${chain.name} should not also define run()`);
-        }
-    }
-});
-test("findChain resolves every registered name and nothing else", () => {
-    for (const chain of CHAINS) {
-        assert.equal(findChain(chain.name)?.name, chain.name);
-    }
-    assert.equal(findChain("not-a-real-chain"), undefined);
-});

package/dist/test/data_types.test.d.ts

@@ -1,10 +0,0 @@
-/**
- * Regression tests for the zod -> Valibot conversion. Not exhaustive schema
- * tests — these guard the three specific things that conversion could get
- * wrong: the three-state writes/tools semantics that hard rule 9 depends on,
- * default-value reference freshness (verified NOT to be a live bug in
- * valibot 1.4.2 — see the comment below — kept as a tripwire against a
- * future version regressing it), and toJsonSchema staying convertible now
- * that it backs the sf_report tool wiring landing in the Flue phase.
- */
-export {};

package/dist/test/data_types.test.js

@@ -1,220 +0,0 @@
-/**
- * Regression tests for the zod -> Valibot conversion. Not exhaustive schema
- * tests — these guard the three specific things that conversion could get
- * wrong: the three-state writes/tools semantics that hard rule 9 depends on,
- * default-value reference freshness (verified NOT to be a live bug in
- * valibot 1.4.2 — see the comment below — kept as a tripwire against a
- * future version regressing it), and toJsonSchema staying convertible now
- * that it backs the sf_report tool wiring landing in the Flue phase.
- */
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import * as v from "valibot";
-import { toJsonSchema } from "@valibot/to-json-schema";
-import { AgentConfigSchema, BuildOutput, ChangesOutput, DocumentOutput, EventRecordTypeSchema, GenericOutput, NotificationsConfigSchema, PhaseParamsSchema, PlanOutput, ReviewConfigSchema, ReviewOutput, ScoutOutput, VerifyOutput, makePhaseParams, } from "../core/data_types.js";
-import { agentEnv, loadConfig } from "../core/agents.js";
-test("writes: three-state semantics — absent, null, and [] all mean something different", () => {
-    const base = { name: "builder", prompt_engineering: { system: "s.md", user: "u.md" } };
-    const unrestricted = v.parse(AgentConfigSchema, base);
-    assert.equal(unrestricted.writes, undefined, "key absent -> undefined (unrestricted)");
-    const explicitNull = v.parse(AgentConfigSchema, { ...base, writes: null });
-    assert.equal(explicitNull.writes, null, "explicit null -> null (also unrestricted)");
-    const readOnly = v.parse(AgentConfigSchema, { ...base, writes: [] });
-    assert.deepEqual(readOnly.writes, [], "explicit [] -> read-only, must stay an empty array, not undefined/null");
-    const allowlisted = v.parse(AgentConfigSchema, { ...base, writes: ["specs/"] });
-    assert.deepEqual(allowlisted.writes, ["specs/"]);
-    assert.throws(() => v.parse(AgentConfigSchema, { ...base, writes: "specs/" }), "a bare string must not be silently accepted as an allowlist");
-});
-test("array defaults never alias across parses (tripwire, not a fix — see module comment)", () => {
-    const first = v.parse(BuildOutput.schema, { status: "success" });
-    const second = v.parse(BuildOutput.schema, { status: "success" });
-    first.artifacts.push("should-not-leak");
-    first.changed_files.push("should-not-leak");
-    assert.deepEqual(second.artifacts, [], "a later parse must not see an earlier parse's push");
-    assert.deepEqual(second.changed_files, []);
-    assert.notEqual(first.artifacts, second.artifacts, "distinct array references");
-});
-test("PhaseParamsSchema rejects a blank description and an echo of the name, with the exact messages", () => {
-    assert.throws(() => makePhaseParams({ name: "commit_plan", kind: "code", owner: "git", description: "   " }), /description is required/);
-    assert.throws(() => makePhaseParams({ name: "commit_plan", kind: "code", owner: "git", description: "Commit Plan" }), /only restates the phase name/);
-    const ok = makePhaseParams({ name: "commit_plan", kind: "code", owner: "git", description: "  Commit the plan file to the repo  " });
-    assert.equal(ok.description, "Commit the plan file to the repo", "whitespace is collapsed, not just trimmed");
-});
-test("every envelope type still converts to JSON Schema (the sf_report tool wiring depends on this)", () => {
-    for (const envelope of [GenericOutput, PlanOutput, BuildOutput, ScoutOutput, ReviewOutput, DocumentOutput, ChangesOutput, VerifyOutput]) {
-        assert.doesNotThrow(() => toJsonSchema(envelope.schema), `${envelope.name} must stay convertible — no rawTransform allowed on an envelope schema`);
-    }
-});
-test("PhaseParamsSchema itself (the one schema WITH a rawTransform) correctly refuses JSON Schema conversion", () => {
-    assert.throws(() => toJsonSchema(PhaseParamsSchema), /raw_transform/);
-});
-test("NotificationsConfigSchema defaults to off, no channels", () => {
-    const parsed = v.parse(NotificationsConfigSchema, {});
-    assert.equal(parsed.events, "off");
-    assert.equal(parsed.timeout_ms, 5_000);
-    assert.deepEqual(parsed.channels, []);
-});
-test("a channel's own `events` overrides the top-level scope; unset inherits it", () => {
-    const parsed = v.parse(NotificationsConfigSchema, {
-        events: "errors",
-        channels: [{ kind: "slack" }, { kind: "teams", events: "all" }],
-    });
-    assert.equal(parsed.channels[0].events, undefined, "unset per-channel scope stays undefined, not defaulted to the top-level value — the caller inherits at read time");
-    assert.equal(parsed.channels[1].events, "all");
-});
-test("notifications survives loadConfig's merge — key-by-key like observability/quality, channels replaced wholesale on override", () => {
-    const dir = mkdtempSync(join(tmpdir(), "spf-notify-merge-test-"));
-    try {
-        const base = join(dir, "base.yaml");
-        const override = join(dir, "override.yaml");
-        writeFileSync(base, "notifications:\n  events: off\n  channels:\n    - {kind: webhook, webhook_url_env: BASE_HOOK}\n");
-        writeFileSync(override, "notifications:\n  events: all\n  channels:\n    - {kind: slack, webhook_url_env: SLACK_WEBHOOK_URL}\n");
-        const cfg = loadConfig([base, override]);
-        assert.equal(cfg.notifications.events, "all", "events: key-by-key, override wins");
-        assert.deepEqual(cfg.notifications.channels.map((c) => c.kind), ["slack"], "channels: a whole-array replace, not an append — same semantics as quality.checks");
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test("ReviewConfigSchema: defaults to require_human_signoff=false, signoff_timeout_seconds=300", () => {
-    const parsed = v.parse(ReviewConfigSchema, {});
-    assert.equal(parsed.require_human_signoff, false, "this release fails OPEN by default — see the schema's own doc comment");
-    assert.equal(parsed.signoff_timeout_seconds, 300);
-});
-// The silent-drop trap: mergeRawConfig (core/agents.ts) is a FIXED-SHAPE
-// object literal, so a `review:` key in a real config file that isn't named
-// on both sides of that literal is dropped before SFConfigSchema ever sees
-// it — parsing would then succeed anyway, quietly, on the schema default.
-// This is adversarial history on this branch, not a hypothetical: it is
-// exactly the bug `observability`/`notifications` already guard against, and
-// `review` gets the same guard the day it is added.
-test("review survives loadConfig's merge — the silent-drop trap mergeRawConfig's fixed-shape literal sets, for a single config file", () => {
-    const dir = mkdtempSync(join(tmpdir(), "spf-review-merge-test-"));
-    try {
-        const configPath = join(dir, "spf.config.yaml");
-        writeFileSync(configPath, "review:\n  require_human_signoff: true\n  signoff_timeout_seconds: 45\n");
-        const cfg = loadConfig([configPath]);
-        assert.equal(cfg.review.require_human_signoff, true, "a review: value from a real config file must reach SFConfig, not be dropped by mergeRawConfig's object literal");
-        assert.equal(cfg.review.signoff_timeout_seconds, 45);
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test("review merges key-by-key across two layered config files, like observability/notifications", () => {
-    const dir = mkdtempSync(join(tmpdir(), "spf-review-merge-layered-test-"));
-    try {
-        const base = join(dir, "base.yaml");
-        const override = join(dir, "override.yaml");
-        writeFileSync(base, "review:\n  require_human_signoff: false\n  signoff_timeout_seconds: 120\n");
-        writeFileSync(override, "review:\n  require_human_signoff: true\n");
-        const cfg = loadConfig([base, override]);
-        assert.equal(cfg.review.require_human_signoff, true, "override wins for the key it names");
-        assert.equal(cfg.review.signoff_timeout_seconds, 120, "unset in the override -> the base's value survives, key-by-key, not a whole-block replace");
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-// observability.otel is the one nested OBJECT under a top-level key that
-// mergeRawConfig spreads field-by-field, so its merge semantics differ from its
-// siblings' and are worth pinning: `otel:` is replaced as a WHOLE OBJECT by an
-// override that names it (you never want a half-merged endpoint/headers pair —
-// that is how an auth token gets POSTed to the wrong collector), while
-// `observability`'s other keys still merge key-by-key around it. Also the
-// activation contract: absent by default, so no repo starts exporting because
-// it upgraded.
-test("observability.otel survives loadConfig's merge — absent by default, whole-object replace on override", () => {
-    const dir = mkdtempSync(join(tmpdir(), "spf-otel-merge-test-"));
-    try {
-        const bare = join(dir, "bare.yaml");
-        writeFileSync(bare, "observability:\n  poll_ms: 250\n");
-        assert.equal(loadConfig([bare]).observability.otel, undefined, "no otel: block -> export stays off, the default for every repo");
-        const base = join(dir, "base.yaml");
-        const override = join(dir, "override.yaml");
-        writeFileSync(base, "observability:\n  poll_ms: 250\n  otel:\n    endpoint: http://base-collector:4318/v1/traces\n    headers: {authorization: base-token}\n    service_name: base\n");
-        writeFileSync(override, "observability:\n  otel:\n    endpoint: http://override-collector:4318/v1/traces\n");
-        const cfg = loadConfig([base, override]);
-        assert.equal(cfg.observability.poll_ms, 250, "observability's other keys still merge key-by-key around otel");
-        assert.equal(cfg.observability.otel?.endpoint, "http://override-collector:4318/v1/traces");
-        assert.equal(cfg.observability.otel?.headers, undefined, "whole-object replace: the base's auth header does NOT follow the override's endpoint");
-        assert.equal(cfg.observability.otel?.service_name, "spf", "and the base's service_name doesn't either — the schema default applies");
-        // A single config file must reach SFConfig at all — the silent-drop trap
-        // mergeRawConfig's fixed-shape object literal sets for any new key.
-        const single = join(dir, "single.yaml");
-        writeFileSync(single, "observability:\n  otel:\n    endpoint: https://collector.example.com/v1/traces\n");
-        assert.equal(loadConfig([single]).observability.otel?.endpoint, "https://collector.example.com/v1/traces");
-        // A typo fails at config load, not as a silent per-run export failure.
-        const bad = join(dir, "bad.yaml");
-        writeFileSync(bad, "observability:\n  otel:\n    endpoint: not-a-url\n");
-        assert.throws(() => loadConfig([bad]), /invalid config/, "endpoint is URL-validated");
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test("EventRecordTypeSchema accepts every observed event type and rejects an unknown one", () => {
-    for (const type of ["phase_start", "agent_start", "tool_call", "handoff", "gate_pass", "gate_fail", "log", "agent_end", "phase_end", "error"]) {
-        assert.equal(v.parse(EventRecordTypeSchema, type), type);
-    }
-    assert.throws(() => v.parse(EventRecordTypeSchema, "bogus_type"), "an event type outside the observed set must be rejected, not silently stored");
-});
-test("AgentConfigSchema: env_allowlist is optional and defaults to undefined (byte-identical to before this field existed)", () => {
-    const base = { name: "builder", prompt_engineering: { system: "s.md", user: "u.md" } };
-    const unset = v.parse(AgentConfigSchema, base);
-    assert.equal(unset.env_allowlist, undefined);
-    const allowlisted = v.parse(AgentConfigSchema, { ...base, env_allowlist: ["MY_API_KEY"] });
-    assert.deepEqual(allowlisted.env_allowlist, ["MY_API_KEY"]);
-    const nulled = v.parse(AgentConfigSchema, { ...base, env_allowlist: null });
-    assert.equal(nulled.env_allowlist, null, "null must parse (the 'unrestricted' spelling config.md teaches for writes)");
-});
-// This is the load-bearing half of the field: the schema merely declares
-// the shape, agentEnv() is what actually filters the operator's own
-// environment down to the allowlist. A test that only exercised the schema
-// (as the previous version of this test did) would never notice agentEnv
-// silently failing to filter anything.
-test("agentEnv: filters the operator environment down to the allowlist plus the baseline keys", () => {
-    const base = { name: "builder", prompt_engineering: { system: "s.md", user: "u.md" } };
-    const savedApiKey = process.env["MY_API_KEY"];
-    const savedSecret = process.env["SECRET_TOKEN"];
-    try {
-        process.env["MY_API_KEY"] = "abc123";
-        process.env["SECRET_TOKEN"] = "should-never-appear";
-        // unset -> undefined: both backends fall back to `request.env ?? operatorEnv()`,
-        // so this is byte-identical to the unfiltered behavior that predates the field.
-        const unset = v.parse(AgentConfigSchema, base);
-        assert.equal(agentEnv(unset), undefined);
-        // [] -> baseline-only: every ENV_BASELINE_KEYS entry actually present in
-        // process.env, and nothing else — SECRET_TOKEN must not leak through.
-        const empty = v.parse(AgentConfigSchema, { ...base, env_allowlist: [] });
-        const baselineOnly = agentEnv(empty);
-        const baselineKeys = ["PATH", "HOME", "USER", "LANG", "TERM", "TMPDIR"];
-        for (const key of Object.keys(baselineOnly)) {
-            assert.ok(baselineKeys.includes(key), `${key} is not a baseline key — [] must yield baseline-only`);
-        }
-        assert.equal(baselineOnly["SECRET_TOKEN"], undefined);
-        assert.equal(baselineOnly["MY_API_KEY"], undefined);
-        // ["MY_API_KEY"] -> baseline + MY_API_KEY, with SECRET_TOKEN provably absent.
-        const allowlisted = v.parse(AgentConfigSchema, { ...base, env_allowlist: ["MY_API_KEY"] });
-        const filtered = agentEnv(allowlisted);
-        assert.equal(filtered["MY_API_KEY"], "abc123");
-        assert.equal(filtered["SECRET_TOKEN"], undefined, "an unrelated secret must not survive the filter");
-        for (const key of Object.keys(filtered)) {
-            assert.ok(baselineKeys.includes(key) || key === "MY_API_KEY", `${key} leaked through the allowlist unexpectedly`);
-        }
-    }
-    finally {
-        if (savedApiKey === undefined)
-            delete process.env["MY_API_KEY"];
-        else
-            process.env["MY_API_KEY"] = savedApiKey;
-        if (savedSecret === undefined)
-            delete process.env["SECRET_TOKEN"];
-        else
-            process.env["SECRET_TOKEN"] = savedSecret;
-    }
-});

package/dist/test/env_file.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/env_file.test.js

@@ -1,74 +0,0 @@
-/**
- * `.env` upsert (`cli/env_file.ts`) — the write-side counterpart of
- * `process.loadEnvFile()` in `cli/index.ts`, which every command already
- * uses to load `<repo_root>/.env`. Mirrors `ensureGitignore`'s idempotent
- * shape: preserve everything unrelated, touch only the keys asked for.
- */
-import { test, beforeEach, afterEach } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, readFileSync, existsSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { maskSecret, readEnvFile, upsertEnvFile, writeEnvExample } from "../cli/env_file.js";
-let dir;
-// Each test gets its own scratch directory with no .env yet — cheap, and
-// avoids one test's leftover .env leaking into the next.
-beforeEach(() => {
-    dir = mkdtempSync(join(tmpdir(), "spf-env-file-test-"));
-});
-afterEach(() => {
-    rmSync(dir, { recursive: true, force: true });
-});
-test("upsertEnvFile creates a fresh .env with the given keys", () => {
-    const result = upsertEnvFile(dir, { GITHUB_TOKEN: "ghp_abc" });
-    assert.deepEqual(result, { added: ["GITHUB_TOKEN"], updated: [], unchanged: [] });
-    assert.equal(readEnvFile(join(dir, ".env")).get("GITHUB_TOKEN"), "ghp_abc");
-});
-test("upsertEnvFile preserves unrelated lines and comments verbatim, appends new keys under its own header", () => {
-    writeFileSync(join(dir, ".env"), "# a hand-written comment\nFOO=bar\n\nBAZ=qux\n");
-    upsertEnvFile(dir, { GITHUB_TOKEN: "ghp_abc" });
-    const raw = readFileSync(join(dir, ".env"), "utf-8");
-    assert.match(raw, /# a hand-written comment/);
-    assert.match(raw, /FOO=bar/);
-    assert.match(raw, /BAZ=qux/);
-    assert.match(raw, /GITHUB_TOKEN=ghp_abc/);
-});
-test("upsertEnvFile rewrites an existing key in place — never a duplicate line", () => {
-    writeFileSync(join(dir, ".env"), "GITHUB_TOKEN=ghp_old\nOTHER=1\n");
-    const result = upsertEnvFile(dir, { GITHUB_TOKEN: "ghp_new" });
-    assert.deepEqual(result, { added: [], updated: ["GITHUB_TOKEN"], unchanged: [] });
-    const raw = readFileSync(join(dir, ".env"), "utf-8");
-    assert.equal((raw.match(/GITHUB_TOKEN=/g) || []).length, 1);
-    assert.match(raw, /GITHUB_TOKEN=ghp_new/);
-    assert.match(raw, /OTHER=1/);
-});
-test("upsertEnvFile is a no-op the second time with the same values", () => {
-    upsertEnvFile(dir, { GITHUB_TOKEN: "ghp_abc" });
-    const before = readFileSync(join(dir, ".env"), "utf-8");
-    const result = upsertEnvFile(dir, { GITHUB_TOKEN: "ghp_abc" });
-    assert.deepEqual(result, { added: [], updated: [], unchanged: ["GITHUB_TOKEN"] });
-    assert.equal(readFileSync(join(dir, ".env"), "utf-8"), before);
-});
-test("readEnvFile ignores blank lines and comments, and returns an empty map for a missing file", () => {
-    writeFileSync(join(dir, ".env"), "# comment\n\nA=1\n  # indented comment\nB=2\n");
-    const values = readEnvFile(join(dir, ".env"));
-    assert.deepEqual([...values.entries()], [["A", "1"], ["B", "2"]]);
-    assert.equal(readEnvFile(join(dir, "nope.env")).size, 0);
-});
-test("maskSecret keeps only the last 4 characters; short values are fully masked", () => {
-    const value = "ghp_1234567890abcdef"; // 20 chars, last 4 = "cdef"
-    const masked = maskSecret(value);
-    assert.equal(masked.length, value.length);
-    assert.match(masked, /^•+cdef$/);
-    assert.equal(maskSecret("abcd"), "••••");
-    assert.equal(maskSecret("ab"), "••");
-});
-test("writeEnvExample writes key names with empty values, sorted and de-duplicated", () => {
-    writeEnvExample(dir, ["GITHUB_TOKEN", "JIRA_EMAIL", "GITHUB_TOKEN"]);
-    const raw = readFileSync(join(dir, ".env.example"), "utf-8");
-    assert.equal(raw, "# spf — keys required by this repo's spf.config.yaml; fill in real values in .env (gitignored)\nGITHUB_TOKEN=\nJIRA_EMAIL=\n");
-});
-test("writeEnvExample writes nothing when there are no keys", () => {
-    writeEnvExample(dir, []);
-    assert.equal(existsSync(join(dir, ".env.example")), false);
-});

package/dist/test/fake_asker.d.ts

@@ -1,23 +0,0 @@
-/**
- * Shared test double for `cli/ask.ts`'s `Asker` interface — the seam
- * `runInterview` (`cli/interview.ts`) exists to be driven through, the same
- * way `FakeProvider`/`FakeCodeHost` (`watch.test.ts`) stand in for
- * `IssueProvider`/`CodeHostProvider`.
- *
- * Answers are keyed by a SUBSTRING of the question's label, not by call
- * order — `runInterview` asks a different number of questions depending on
- * earlier answers (skip a quality check, skip watch entirely, ...), so a
- * positional queue would silently misalign the moment a test changes one
- * answer. Substring matching keeps each scenario's script self-documenting
- * and immune to that.
- */
-import type { Asker } from "../cli/ask.js";
-export interface AskerScript {
-    text?: Record<string, string>;
-    select?: Record<string, string>;
-    confirm?: Record<string, boolean>;
-    secret?: Record<string, string>;
-    /** Used when a confirm's label matches nothing in `confirm` above. Defaults to the caller's own default. */
-    defaultConfirm?: boolean;
-}
-export declare function createFakeAsker(script: AskerScript): Asker;