@mestreyoda/fabrica 0.2.17 → 0.2.19

package/README.md

@@ -120,6 +120,8 @@ The plugin should load immediately after install, without manual remediation.
 openclaw plugins inspect fabrica
 ```
 
+If OpenClaw warns that `plugins.allow` is empty and non-bundled plugins may auto-load, that is a host trust-policy warning, not a Fabrica install failure. Fabrica can be installed and loadable while the OpenClaw operator still has to decide whether to keep open discovery or set an explicit trusted plugin list in `plugins.allow`.
+
 **4. Configure Fabrica for a workspace**:
 
 ```bash

package/defaults/fabrica/prompts/developer.md

@@ -24,20 +24,25 @@ Read the comments carefully — they often contain clarifications, decisions, or
 
 ### 1. Use the assigned worktree
 
-**NEVER work in the main checkout.** Use the assigned git worktree for this task. If it does not already exist, create it as a sibling to the repo:
+**NEVER work in the main checkout.** The task message includes a `Repo:` / `Execution path:` line with the canonical repository path for this project. Start there first. If that path is missing, inaccessible, or points somewhere unexpected, stop and return `Work result: BLOCKED` instead of creating the project under another workspace.
 
 ```bash
-# Example: repo is at ~/git/myproject
-# Worktree goes to ~/git/myproject.worktrees/feature/123-add-auth
-REPO_ROOT="$(git rev-parse --show-toplevel)"
+# Example: task message says Repo: /home/ubuntu/git/acme/myproject
+REPO_ROOT="/absolute/path/from-task-message"
+cd "$REPO_ROOT"
 BRANCH="feature/<issue-id>-<slug>"
 WORKTREE="${REPO_ROOT}.worktrees/${BRANCH}"
-git worktree add "$WORKTREE" -b "$BRANCH"
-cd "$WORKTREE"
+if git worktree list --porcelain | grep -Fq "worktree ${WORKTREE}"; then
+  cd "$WORKTREE"
+else
+  git worktree add "$WORKTREE" -b "$BRANCH"
+  cd "$WORKTREE"
+fi
 ```
 
 The `.worktrees/` directory sits NEXT TO the repo folder (not inside it). This keeps the main checkout clean for the orchestrator and other workers. If the assigned worktree already exists from a previous task on the same branch, verify it's clean and reuse it.
-Once you are in the assigned worktree, stay there for the rest of the task and do not switch back to the main checkout.
+
+Never create or implement the project under `~/.openclaw/workspace/<slug>` unless the task message explicitly says that directory is the canonical repo path. If the repo already contains scaffolded files, do not re-initialize the project with `npm init`, `uv init`, `cargo init`, or a second skeleton generator — keep the existing stack and modify the scaffold inside the assigned worktree. Once you are in the assigned worktree, stay there for the rest of the task and do not switch back to the main checkout.
 
 ### 2. Implement the changes
 
@@ -110,16 +115,16 @@ When your task message includes a **PR Feedback** section, it means a reviewer r
 
 1. Check out the existing branch from the PR (the branch name is in the feedback context)
 2. If a worktree already exists for that branch, `cd` into it
-3. If not, create a worktree from the existing remote branch:
+3. If not, create a local worktree that tracks the existing remote branch:
    ```bash
-   REPO_ROOT="$(git rev-parse --show-toplevel)"
+   REPO_ROOT="/absolute/path/from-task-message"
    BRANCH="<branch-from-pr>"
    WORKTREE="${REPO_ROOT}.worktrees/${BRANCH}"
    git fetch origin "$BRANCH"
-   git worktree add "$WORKTREE" "origin/$BRANCH"
+   git worktree add -b "$BRANCH" "$WORKTREE" "origin/$BRANCH"
    cd "$WORKTREE"
    ```
-4. Address **only** the reviewer's comments — do not re-implement the original issue from scratch
+4. Address **only** the reviewer's comments on that same PR branch — do not switch to a new canonical issue branch and do not re-implement the original issue from scratch
 5. Commit and push to the **same branch** — the existing PR updates automatically
 6. End your response with the canonical developer result line described below
 
@@ -133,9 +138,11 @@ PR_NUM=$(gh pr list --head "$BRANCH" --json number -q '.[0].number')
 QA_RAW=$(bash scripts/qa.sh 2>&1); QA_EXIT=$?
 # MANDATORY: sanitize before embedding in PR — strip lines with tokens/keys/env vars/host paths
 QA_OUTPUT=$(printf '%s' "$QA_RAW" | grep -v -iE '(TOKEN|SECRET|_KEY|PASSWORD|CREDENTIAL|PRIVATE|AUTH)=' | grep -v -E '(ghp_|gho_|github_pat_|sk-|xox[bprs]-|AIza|AKIA|glpat-)' | grep -v -E '^declare -x ' | grep -v -E '(/home/|~/.openclaw/)' | head -200)
-CURRENT_BODY=$(gh pr view "$PR_NUM" --json body -q '.body')
+REPO_SLUG=$(gh repo view --json nameWithOwner -q '.nameWithOwner')
+CURRENT_BODY=$(gh api "repos/$REPO_SLUG/pulls/$PR_NUM" --jq '.body')
 BODY_NO_QA=$(printf '%s' "$CURRENT_BODY" | perl -0pe 's/\n## QA Evidence\b[\s\S]*?(?=\n##\s|\z)//g')
-gh pr edit "$PR_NUM" --body "$(printf '%s\n\n## QA Evidence\n\n```\n%s\n```\n\nExit code: %d\n' "$BODY_NO_QA" "$QA_OUTPUT" "$QA_EXIT")"
+NEW_BODY=$(printf '%s\n\n## QA Evidence\n\n```\n%s\n```\n\nExit code: %d\n' "$BODY_NO_QA" "$QA_OUTPUT" "$QA_EXIT")
+gh api --method PATCH "repos/$REPO_SLUG/pulls/$PR_NUM" -f body="$NEW_BODY" >/dev/null
 ```
 
 **NEVER bypass the sanitization step.** Never embed raw, unfiltered command output in PR descriptions.

package/dist/index.js

@@ -113905,8 +113905,8 @@ import fsSync from "node:fs";
 import path5 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getCurrentVersion() {
-  if ("0.2.17") {
-    return "0.2.17";
+  if ("0.2.19") {
+    return "0.2.19";
   }
   try {
     const pkgPath = path5.join(THIS_DIR, "..", "..", "package.json");
@@ -126233,6 +126233,13 @@ async function getCurrentBranch(repoPath, runCommand) {
   });
   return result.stdout.trim();
 }
+function isCurrentProjectBaseBranch(branchName, baseBranch) {
+  const normalizedBranch = branchName.trim().toLowerCase();
+  if (!normalizedBranch) return true;
+  const normalizedBaseBranch = baseBranch?.trim().toLowerCase();
+  if (normalizedBaseBranch) return normalizedBranch === normalizedBaseBranch;
+  return ["main", "master", "develop", "development", "trunk"].includes(normalizedBranch);
+}
 function throwInvalidQaEvidence(qaEvidence, actor) {
   throw new Error(formatQaEvidenceValidationFailure(qaEvidence, actor));
 }
@@ -126264,12 +126271,16 @@ async function isConflictResolutionCycle(workspaceDir, issueId, issueRuntime) {
   }
   return false;
 }
-async function validatePrExistsForDeveloper(issueId, repoPath, provider, runCommand, workspaceDir, projectSlug, issueRuntime) {
+async function validatePrExistsForDeveloper(issueId, repoPath, provider, runCommand, workspaceDir, projectSlug, issueRuntime, baseBranch) {
   const logger6 = getRootLogger().child({ issueId, phase: "work-finish" });
   const branchName = await getCurrentBranch(repoPath, runCommand).catch(() => "");
   try {
-    const branchPr = branchName ? await provider.findOpenPrForBranch(branchName) : null;
-    const prStatus = branchPr ?? await provider.getPrStatus(issueId);
+    const preferIssuePr = isCurrentProjectBaseBranch(branchName, baseBranch);
+    const branchPr = !preferIssuePr ? await provider.findOpenPrForBranch(branchName) : null;
+    const issuePr = await provider.getPrStatus(issueId);
+    const issuePrIsReviewable = !!issuePr.url && issuePr.state !== PrState.MERGED && issuePr.state !== PrState.CLOSED;
+    const branchPrIsReviewable = !!branchPr?.url && branchPr.state !== PrState.MERGED && branchPr.state !== PrState.CLOSED;
+    const prStatus = preferIssuePr ? issuePrIsReviewable ? issuePr : branchPr ?? issuePr : branchPrIsReviewable ? branchPr : issuePr;
     if (!prStatus.url || prStatus.state === PrState.MERGED || prStatus.state === PrState.CLOSED) {
       const currentBranch = branchName || "current-branch";
       const reason = !prStatus.url ? `\u2717 No PR found for branch: ${currentBranch}` : prStatus.state === PrState.MERGED ? `\u2717 Last linked PR is already merged: ${prStatus.url}` : `\u2717 Last linked PR is closed and not reviewable: ${prStatus.url}`;
@@ -126553,7 +126564,16 @@ function createWorkFinishTool(ctx) {
       const pluginConfig = ctx.pluginConfig;
       let developerPrStatus;
       if (role === "developer" && result === "done") {
-        developerPrStatus = await validatePrExistsForDeveloper(issueId, repoPath, provider, ctx.runCommand, workspaceDir, project.slug, project.issueRuntime?.[String(issueId)]);
+        developerPrStatus = await validatePrExistsForDeveloper(
+          issueId,
+          repoPath,
+          provider,
+          ctx.runCommand,
+          workspaceDir,
+          project.slug,
+          project.issueRuntime?.[String(issueId)],
+          project.baseBranch
+        );
         await updateIssueRuntime(workspaceDir, project.slug, issueId, {
           currentPrNodeId: developerPrStatus.nodeId ?? null,
           currentPrNumber: developerPrStatus.number ?? null,
@@ -128020,8 +128040,10 @@ async function resolveEffectiveModelForGateway(requested, runCommand) {
 
 // lib/dispatch/message-builder.ts
 init_roles();
+function toBranchSlug(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "task";
+}
 function buildTaskMessage(opts) {
-  const sanitizeRepoContext = (value) => value.startsWith("/") || value.startsWith("~/") ? "[repository workspace hidden]" : value;
   const {
     projectName,
     channelId,
@@ -128033,8 +128055,10 @@ function buildTaskMessage(opts) {
     repo,
     baseBranch
   } = opts;
-  const repoDisplay = sanitizeRepoContext(repo);
+  const repoDisplay = repo;
   const isFeedbackCycle = !!opts.prFeedback;
+  const branchName = opts.prFeedback?.branchName?.trim() ? opts.prFeedback.branchName.trim() : `feature/${issueId}-${toBranchSlug(projectName)}`;
+  const worktreePath = `${repoDisplay}.worktrees/${branchName}`;
   const parts = [
     `${role.toUpperCase()} task for project "${projectName}" \u2014 Issue #${issueId}`,
     ``,
@@ -128051,6 +128075,17 @@ ${issueDescription}` : ""
       `> When feedback conflicts with the original description, follow the PR feedback.`
     );
   }
+  parts.push(
+    ``,
+    `## Execution Setup (do this before editing files)`,
+    `Repo: ${repoDisplay} | Base branch: ${baseBranch} | ${issueUrl}`,
+    `Execution path: ${repoDisplay}`,
+    `Required branch: ${branchName}`,
+    `Required worktree: ${worktreePath}`,
+    `Before editing any file, create or reuse the required worktree above and work only there.`,
+    `Do not re-initialize or replace the scaffold in the main checkout (for example: do not run npm init, cargo init, uv init, or create a second project skeleton) when the repo already contains scaffolded files. Modify the existing scaffold inside the worktree instead.`,
+    `If the repo path is missing or inaccessible, return the canonical blocked result instead of improvising in ~/.openclaw/workspace.`
+  );
   if (opts.followUpPrRequired) {
     parts.push(
       ``,
@@ -128096,14 +128131,12 @@ ${issueDescription}` : ""
   if (opts.attachmentContext) parts.push(opts.attachmentContext);
   parts.push(
     ``,
-    `Repo: ${repoDisplay} | Branch: ${baseBranch} | ${issueUrl}`,
     `Project: ${projectName} | Channel: ${channelId}`
   );
   parts.push(...buildCompletionContract(role));
   return parts.join("\n");
 }
 function buildConflictFixMessage(opts) {
-  const sanitizeRepoContext = (value) => value.startsWith("/") || value.startsWith("~/") ? "[repository workspace hidden]" : value;
   const {
     projectName,
     channelId,
@@ -128115,7 +128148,9 @@ function buildConflictFixMessage(opts) {
     baseBranch,
     prFeedback
   } = opts;
-  const repoDisplay = sanitizeRepoContext(repo);
+  const repoDisplay = repo;
+  const branchName = prFeedback.branchName?.trim() ? prFeedback.branchName.trim() : `feature/${issueId}-${toBranchSlug(projectName)}`;
+  const worktreePath = `${repoDisplay}.worktrees/${branchName}`;
   const parts = [
     `${role.toUpperCase()} task for project "${projectName}" \u2014 Issue #${issueId}`,
     ``,
@@ -128126,8 +128161,12 @@ function buildConflictFixMessage(opts) {
   parts.push(...formatPrFeedback(prFeedback, baseBranch));
   parts.push(
     ``,
-    `Repo: ${repoDisplay} | Branch: ${baseBranch} | ${issueUrl}`,
-    `Project: ${projectName} | Channel: ${channelId}`
+    `Repo: ${repoDisplay} | Base branch: ${baseBranch} | ${issueUrl}`,
+    `Project: ${projectName} | Channel: ${channelId}`,
+    `Execution path: ${repoDisplay}`,
+    `Required branch: ${branchName}`,
+    `Required worktree: ${worktreePath}`,
+    `Start by changing into the canonical repo path above before reusing the PR branch or creating its worktree. Reuse the exact PR branch named above; do not switch to a new canonical issue branch during a feedback cycle. Do not resolve the issue inside ~/.openclaw/workspace unless the repo path itself points there.`
   );
   parts.push(...buildCompletionContract(role));
   return parts.join("\n");
@@ -128717,7 +128756,7 @@ async function dispatchTask(opts) {
   const securityChecklist = await loadSecurityChecklist(workspaceDir, project.name).catch(() => "");
   const primaryChannelId = project.slug;
   const isConflictFix = prFeedback?.reason === "merge_conflict";
-  const repoContext = project.repoRemote?.replace(/\.git$/, "") ?? project.slug;
+  const repoContext = project.repo ? resolveRepoPath(project.repo) : project.repoRemote?.replace(/\.git$/, "") || project.slug;
   const taskMessage = isConflictFix && prFeedback ? buildConflictFixMessage({
     projectName: project.name,
     channelId: primaryChannelId,
@@ -130417,6 +130456,7 @@ init_labels();
 // lib/services/worker-completion.ts
 init_audit();
 import fs24 from "node:fs/promises";
+init_workflow();
 
 // lib/services/worker-result.ts
 var ROLE_PREFIX = {
@@ -130823,7 +130863,8 @@ async function defaultValidateDeveloperDone(opts) {
       opts.runCommand,
       opts.workspaceDir,
       opts.projectSlug,
-      opts.issueRuntime
+      opts.issueRuntime,
+      opts.baseBranch
     );
     return { ok: true, prStatus };
   } catch (error48) {
@@ -130915,19 +130956,68 @@ async function applyWorkerResult(opts) {
       runCommand: opts.runCommand,
       workspaceDir: opts.workspaceDir,
       projectSlug: context2.projectSlug,
-      issueRuntime: context2.issueRuntime
+      issueRuntime: context2.issueRuntime,
+      baseBranch: context2.project.baseBranch
     });
     if (!validation.ok) {
+      const validationReason = validation.reason ?? "developer_validation_failed";
+      const feedbackQueueLabel = getQueueLabels(workflow, "developer").find((label) => isFeedbackState(workflow, label)) ?? "To Improve";
       await log(opts.workspaceDir, "worker_completion_skipped", {
         sessionKey: context2.project.workers[context2.parsed.role]?.levels?.[context2.slotLevel]?.[context2.slotIndex]?.sessionKey ?? null,
         projectSlug: context2.projectSlug,
         issueId: context2.issueId,
         role: context2.parsed.role,
         result: opts.result.value,
-        reason: validation.reason ?? "developer_validation_failed"
+        reason: validationReason
+      }).catch(() => {
+      });
+      await updateIssueRuntime(opts.workspaceDir, context2.projectSlug, context2.issueId, {
+        inconclusiveCompletionAt: (/* @__PURE__ */ new Date()).toISOString(),
+        inconclusiveCompletionReason: validationReason
+      }).catch(() => {
+      });
+      await executeCompletion({
+        workspaceDir: opts.workspaceDir,
+        projectSlug: context2.projectSlug,
+        role: context2.parsed.role,
+        result: "blocked",
+        issueId: context2.issueId,
+        summary: `Automatic recovery: developer reported DONE but completion validation failed.
+
+${validationReason}`,
+        provider,
+        repoPath,
+        projectName: context2.project.name,
+        channels: context2.project.channels,
+        runtime: opts.runtime,
+        workflow,
+        level: context2.slotLevel,
+        slotIndex: context2.slotIndex,
+        overrideToLabel: feedbackQueueLabel,
+        overrideReason: validationReason,
+        runCommand: opts.runCommand
+      });
+      await recordIssueLifecycle({
+        workspaceDir: opts.workspaceDir,
+        slug: context2.projectSlug,
+        issueId: context2.issueId,
+        stage: "session_completed",
+        sessionKey: context2.sessionKey,
+        details: { role: context2.parsed.role, result: "blocked", source: "agent_end_recovery", reason: validationReason }
+      }).catch(() => {
+      });
+      await log(opts.workspaceDir, "worker_completion_applied", {
+        sessionKey: context2.sessionKey,
+        projectSlug: context2.projectSlug,
+        issueId: context2.issueId,
+        role: context2.parsed.role,
+        result: "BLOCKED",
+        source: "agent_end_recovery",
+        recoveredTo: "To Improve",
+        reason: validationReason
       }).catch(() => {
       });
-      return { applied: false, reason: validation.reason ?? "developer_validation_failed" };
+      return { applied: true };
     }
     validatedPrStatus = validation.prStatus;
     await persistDeveloperPrBinding({
@@ -138065,7 +138155,7 @@ var EXPRESS_GATES = {
 };
 var NODE_CLI_GATES = {
   lint: "npm run lint",
-  types: "npm run build -- --noEmit",
+  types: "npm run typecheck",
   security: "npm audit --audit-level=moderate",
   tests: "npm test",
   coverage: "npm run coverage"
@@ -138974,7 +139064,6 @@ fi
 }
 
 // lib/intake/steps/scaffold.ts
-var PYTHON_STACKS3 = /* @__PURE__ */ new Set(["python-cli", "fastapi", "flask", "django"]);
 var scaffoldStep = {
   name: "scaffold",
   shouldRun: (payload) => payload.impact?.is_greenfield === true && !payload.dry_run,
@@ -139000,7 +139089,7 @@ var scaffoldStep = {
           mode: "scaffold",
           runCommand: ctx.runCommand
         });
-        if (scaffold.stack && PYTHON_STACKS3.has(scaffold.stack) && payload.spec) {
+        if (scaffold.stack && payload.spec) {
           try {
             const contract = generateQaContract({
               spec: payload.spec,

package/genesis/scripts/scaffold-project.sh

@@ -348,7 +348,7 @@ $objective
 
 \`\`\`bash
 $(case "$stack" in
-  nextjs|express) echo "npm install" ;;
+  nextjs|express|node-cli) echo "npm install" ;;
   fastapi|flask|django) echo "python -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt" ;;
   python-cli) echo "python -m venv .venv && source .venv/bin/activate && pip install -e '.[dev]'" ;;
 esac)
@@ -360,6 +360,7 @@ esac)
 $(case "$stack" in
   nextjs) echo "npm run dev" ;;
   express) echo "npm run dev" ;;
+  node-cli) echo "npm run dev -- \"Hello World CLI\"" ;;
   fastapi) echo "uvicorn app.main:app --reload" ;;
   flask) echo "flask run --debug" ;;
   django) echo "python manage.py runserver" ;;
@@ -460,21 +461,26 @@ scaffold_node_cli() {
   "scripts": {
     "dev": "tsx src/index.ts",
     "build": "tsc",
+    "typecheck": "tsc --noEmit",
     "start": "node dist/index.js",
-    "lint": "eslint src/",
+    "lint": "eslint .",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "coverage": "vitest run --coverage --coverage.thresholds.lines=80"
   },
   "dependencies": {
     "commander": "^14.0.0"
   },
   "devDependencies": {
+    "@eslint/js": "^9.0.0",
     "@types/node": "^22.0.0",
+    "@vitest/coverage-v8": "^3.0.0",
     "eslint": "^9.0.0",
-    "typescript": "^5.7.0",
+    "globals": "^15.0.0",
     "tsx": "^4.0.0",
-    "vitest": "^3.0.0",
-    "@vitest/coverage-v8": "^3.0.0"
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.0.0",
+    "vitest": "^3.0.0"
   }
 }
 EOF
@@ -489,62 +495,127 @@ EOF
     "module": "ESNext",
     "moduleResolution": "bundler",
     "outDir": "dist",
-    "rootDir": "src",
+    "rootDir": ".",
     "strict": true,
     "esModuleInterop": true,
     "skipLibCheck": true,
     "resolveJsonModule": true,
-    "declaration": true
+    "declaration": true,
+    "types": ["node"]
   },
-  "include": ["src"],
-  "exclude": ["node_modules", "dist", "tests"]
+  "include": ["src", "tests"],
+  "exclude": ["node_modules", "dist"]
 }
 EOF
   FILES_CREATED+=("tsconfig.json")
 
+  cat > eslint.config.mjs <<'EOF'
+import js from '@eslint/js';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    files: ['src/**/*.ts', 'tests/**/*.ts'],
+    languageOptions: {
+      globals: {
+        ...globals.node,
+      },
+    },
+    rules: {
+      'no-console': 'off',
+    },
+  },
+);
+EOF
+  FILES_CREATED+=("eslint.config.mjs")
+
   mkdir -p src
   cat > src/index.ts <<'EOF'
 #!/usr/bin/env node
 import { Command } from 'commander';
+import { pathToFileURL } from 'node:url';
+
+export function toKebabCase(input: string): string {
+  return input
+    .trim()
+    .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+    .replace(/[\s_]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '')
+    .toLowerCase();
+}
+
+export function createProgram(): Command {
+  return new Command()
+    .name(process.env.npm_package_name ?? 'cli')
+    .version(process.env.npm_package_version ?? '0.1.0')
+    .description('Convert a text argument to kebab-case')
+    .argument('<text>', 'text to convert')
+    .action((text: string) => {
+      console.log(toKebabCase(text));
+    });
+}
 
-const program = new Command();
+export function main(argv = process.argv): void {
+  createProgram().parse(argv);
+}
 
-program
-  .name(process.env.npm_package_name ?? 'cli')
-  .version(process.env.npm_package_version ?? '0.1.0')
-  .description('CLI tool')
-  .argument('[args...]', 'arguments')
-  .action((args: string[]) => {
-    console.log('Hello from CLI', args.length ? args.join(' ') : '');
-  });
+const isDirectRun = process.argv[1]
+  ? import.meta.url === pathToFileURL(process.argv[1]).href
+  : false;
 
-program.parse();
+if (isDirectRun) {
+  main();
+}
 EOF
   FILES_CREATED+=("src/index.ts")
 
   mkdir -p tests
   cat > tests/main.test.ts <<'EOF'
-import { describe, it, expect } from 'vitest';
 import { execFileSync } from 'node:child_process';
-import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createProgram, main, toKebabCase } from '../src/index.js';
 
-const cli = resolve(__dirname, '../src/index.ts');
+const cli = fileURLToPath(new URL('../src/index.ts', import.meta.url));
 
-function run(...args: string[]): string {
-  return execFileSync('npx', ['tsx', cli, ...args], {
-    encoding: 'utf-8',
-    env: { ...process.env, NODE_NO_WARNINGS: '1' },
-  }).trim();
-}
+describe('toKebabCase', () => {
+  it('converts text with spaces and casing', () => {
+    expect(toKebabCase('Hello World CLI')).toBe('hello-world-cli');
+    expect(toKebabCase('Some_Mixed Case Text')).toBe('some-mixed-case-text');
+    expect(toKebabCase('  already-kebab  ')).toBe('already-kebab');
+  });
+});
+
+describe('main', () => {
+  const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+
+  afterEach(() => {
+    logSpy.mockClear();
+  });
+
+  it('prints the kebab-case output', () => {
+    main(['node', 'hyphenator-cli', 'Hello World Example']);
+    expect(logSpy).toHaveBeenCalledWith('hello-world-example');
+  });
 
-describe('CLI', () => {
-  it('should print hello message', () => {
-    const output = run();
-    expect(output).toContain('Hello from CLI');
+  it('builds a command with metadata', () => {
+    const program = createProgram();
+    expect(program.name()).toBeTruthy();
+    expect(program.description()).toContain('kebab-case');
   });
+});
+
+describe('CLI smoke', () => {
+  it('shows version with --version', () => {
+    const output = execFileSync('npx', ['tsx', cli, '--version'], {
+      encoding: 'utf-8',
+      env: { ...process.env, NODE_NO_WARNINGS: '1' },
+    }).trim();
 
-  it('should show version with --version', () => {
-    const output = run('--version');
     expect(output).toMatch(/\d+\.\d+\.\d+/);
   });
 });
@@ -559,23 +630,19 @@ echo "=== QA Gate ==="
 FAIL=0
 
 echo "--- Lint ---"
-npx eslint src/ 2>&1 || { echo "LINT FAILED"; FAIL=1; }
+npm run lint 2>&1 || { echo "LINT FAILED"; FAIL=1; }
 
 echo "--- TypeScript ---"
-npx tsc --noEmit 2>&1 || { echo "TSC FAILED"; FAIL=1; }
+npm run typecheck 2>&1 || { echo "TSC FAILED"; FAIL=1; }
 
 echo "--- Tests ---"
-npx vitest run 2>&1 || { echo "TESTS FAILED"; FAIL=1; }
+npm test 2>&1 || { echo "TESTS FAILED"; FAIL=1; }
 
 echo "--- Coverage (>=80%) ---"
-npx vitest run --coverage --coverage.thresholds.lines=80 2>&1 || { echo "COVERAGE FAILED"; FAIL=1; }
+npm run coverage 2>&1 || { echo "COVERAGE FAILED"; FAIL=1; }
 
-echo "--- Secrets scan ---"
-if grep -rn 'password\s*=\s*"[^"]\+"\|api_key\s*=\s*"[^"]\+"\|secret\s*=\s*"[^"]\+"' --include="*.ts" --include="*.js" src/ 2>/dev/null; then
-  echo "SECRETS FOUND — FAIL"; FAIL=1
-else
-  echo "No hardcoded secrets found"
-fi
+echo "--- Security audit ---"
+npm audit --audit-level=moderate 2>&1 || { echo "AUDIT FAILED"; FAIL=1; }
 
 exit $FAIL
 QAEOF

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mestreyoda/fabrica",
-  "version": "0.2.17",
+  "version": "0.2.19",
   "description": "Autonomous software engineering pipeline for OpenClaw. Turns ideas into deployed code via intake, dispatch, review, test, and merge.",
   "type": "module",
   "main": "./dist/index.js",