@mestreyoda/fabrica 0.2.18 → 0.2.20

package/defaults/fabrica/prompts/developer.md

@@ -42,7 +42,7 @@ fi
 
 The `.worktrees/` directory sits NEXT TO the repo folder (not inside it). This keeps the main checkout clean for the orchestrator and other workers. If the assigned worktree already exists from a previous task on the same branch, verify it's clean and reuse it.
 
-Never create or implement the project under `~/.openclaw/workspace/<slug>` unless the task message explicitly says that directory is the canonical repo path. Once you are in the assigned worktree, stay there for the rest of the task and do not switch back to the main checkout.
+Never create or implement the project under `~/.openclaw/workspace/<slug>` unless the task message explicitly says that directory is the canonical repo path. If the repo already contains scaffolded files, do not re-initialize the project with `npm init`, `uv init`, `cargo init`, or a second skeleton generator — keep the existing stack and modify the scaffold inside the assigned worktree. Once you are in the assigned worktree, stay there for the rest of the task and do not switch back to the main checkout.
 
 ### 2. Implement the changes
 
@@ -115,16 +115,16 @@ When your task message includes a **PR Feedback** section, it means a reviewer r
 
 1. Check out the existing branch from the PR (the branch name is in the feedback context)
 2. If a worktree already exists for that branch, `cd` into it
-3. If not, create a worktree from the existing remote branch:
+3. If not, create a local worktree that tracks the existing remote branch:
    ```bash
-   REPO_ROOT="$(git rev-parse --show-toplevel)"
+   REPO_ROOT="/absolute/path/from-task-message"
    BRANCH="<branch-from-pr>"
    WORKTREE="${REPO_ROOT}.worktrees/${BRANCH}"
    git fetch origin "$BRANCH"
-   git worktree add "$WORKTREE" "origin/$BRANCH"
+   git worktree add -b "$BRANCH" "$WORKTREE" "origin/$BRANCH"
    cd "$WORKTREE"
    ```
-4. Address **only** the reviewer's comments — do not re-implement the original issue from scratch
+4. Address **only** the reviewer's comments on that same PR branch — do not switch to a new canonical issue branch and do not re-implement the original issue from scratch
 5. Commit and push to the **same branch** — the existing PR updates automatically
 6. End your response with the canonical developer result line described below
 

package/dist/index.js

@@ -113905,8 +113905,8 @@ import fsSync from "node:fs";
 import path5 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getCurrentVersion() {
-  if ("0.2.18") {
-    return "0.2.18";
+  if ("0.2.20") {
+    return "0.2.20";
   }
   try {
     const pkgPath = path5.join(THIS_DIR, "..", "..", "package.json");
@@ -126282,6 +126282,25 @@ async function validatePrExistsForDeveloper(issueId, repoPath, provider, runComm
     const branchPrIsReviewable = !!branchPr?.url && branchPr.state !== PrState.MERGED && branchPr.state !== PrState.CLOSED;
     const prStatus = preferIssuePr ? issuePrIsReviewable ? issuePr : branchPr ?? issuePr : branchPrIsReviewable ? branchPr : issuePr;
     if (!prStatus.url || prStatus.state === PrState.MERGED || prStatus.state === PrState.CLOSED) {
+      if (preferIssuePr && isCurrentProjectBaseBranch(branchName, baseBranch)) {
+        const currentBase = branchName || baseBranch || "main";
+        const suggestedBranch = `feature/${issueId}-${projectSlug.replace(/[^a-z0-9]+/g, "-").slice(0, 40)}`;
+        throw new Error(
+          `Cannot mark work_finish(done) while on the base branch ("${currentBase}") without an open PR.
+
+You must implement changes on a feature branch and open a PR before calling work_finish.
+
+Steps to fix:
+  1. git worktree add ../${projectSlug}.worktrees/${suggestedBranch} -b ${suggestedBranch}
+  2. cd ../${projectSlug}.worktrees/${suggestedBranch}
+  3. Implement the changes there, commit, push, and create a PR:
+     git push -u origin ${suggestedBranch}
+     gh pr create --base ${baseBranch ?? "main"} --head ${suggestedBranch} --title "feat: ..." --body "Closes #${issueId}"
+  4. Then call work_finish again.
+
+If the worktree already exists, cd into it and continue from there.`
+        );
+      }
       const currentBranch = branchName || "current-branch";
       const reason = !prStatus.url ? `\u2717 No PR found for branch: ${currentBranch}` : prStatus.state === PrState.MERGED ? `\u2717 Last linked PR is already merged: ${prStatus.url}` : `\u2717 Last linked PR is closed and not reviewable: ${prStatus.url}`;
       throw new Error(
@@ -126290,7 +126309,7 @@ async function validatePrExistsForDeveloper(issueId, repoPath, provider, runComm
 ${reason}
 
 Please create a PR first:
-  gh pr create --base main --head ${currentBranch} --title "..." --body "..."
+  gh pr create --base ${baseBranch ?? "main"} --head ${currentBranch} --title "..." --body "Closes #${issueId}"
 
 Then call work_finish again.`
       );
@@ -128040,6 +128059,9 @@ async function resolveEffectiveModelForGateway(requested, runCommand) {
 
 // lib/dispatch/message-builder.ts
 init_roles();
+function toBranchSlug(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "task";
+}
 function buildTaskMessage(opts) {
   const {
     projectName,
@@ -128054,6 +128076,8 @@ function buildTaskMessage(opts) {
   } = opts;
   const repoDisplay = repo;
   const isFeedbackCycle = !!opts.prFeedback;
+  const branchName = opts.prFeedback?.branchName?.trim() ? opts.prFeedback.branchName.trim() : `feature/${issueId}-${toBranchSlug(projectName)}`;
+  const worktreePath = `${repoDisplay}.worktrees/${branchName}`;
   const parts = [
     `${role.toUpperCase()} task for project "${projectName}" \u2014 Issue #${issueId}`,
     ``,
@@ -128070,6 +128094,17 @@ ${issueDescription}` : ""
       `> When feedback conflicts with the original description, follow the PR feedback.`
     );
   }
+  parts.push(
+    ``,
+    `## Execution Setup (do this before editing files)`,
+    `Repo: ${repoDisplay} | Base branch: ${baseBranch} | ${issueUrl}`,
+    `Execution path: ${repoDisplay}`,
+    `Required branch: ${branchName}`,
+    `Required worktree: ${worktreePath}`,
+    `Before editing any file, create or reuse the required worktree above and work only there.`,
+    `Do not re-initialize or replace the scaffold in the main checkout (for example: do not run npm init, cargo init, uv init, or create a second project skeleton) when the repo already contains scaffolded files. Modify the existing scaffold inside the worktree instead.`,
+    `If the repo path is missing or inaccessible, return the canonical blocked result instead of improvising in ~/.openclaw/workspace.`
+  );
   if (opts.followUpPrRequired) {
     parts.push(
       ``,
@@ -128115,10 +128150,7 @@ ${issueDescription}` : ""
   if (opts.attachmentContext) parts.push(opts.attachmentContext);
   parts.push(
     ``,
-    `Repo: ${repoDisplay} | Branch: ${baseBranch} | ${issueUrl}`,
-    `Project: ${projectName} | Channel: ${channelId}`,
-    `Execution path: ${repoDisplay}`,
-    `Start by changing into the canonical repo path above before creating or reusing a worktree. Do not create or implement the project under ~/.openclaw/workspace unless the repo path itself points there.`
+    `Project: ${projectName} | Channel: ${channelId}`
   );
   parts.push(...buildCompletionContract(role));
   return parts.join("\n");
@@ -128136,6 +128168,8 @@ function buildConflictFixMessage(opts) {
     prFeedback
   } = opts;
   const repoDisplay = repo;
+  const branchName = prFeedback.branchName?.trim() ? prFeedback.branchName.trim() : `feature/${issueId}-${toBranchSlug(projectName)}`;
+  const worktreePath = `${repoDisplay}.worktrees/${branchName}`;
   const parts = [
     `${role.toUpperCase()} task for project "${projectName}" \u2014 Issue #${issueId}`,
     ``,
@@ -128146,10 +128180,12 @@ function buildConflictFixMessage(opts) {
   parts.push(...formatPrFeedback(prFeedback, baseBranch));
   parts.push(
     ``,
-    `Repo: ${repoDisplay} | Branch: ${baseBranch} | ${issueUrl}`,
+    `Repo: ${repoDisplay} | Base branch: ${baseBranch} | ${issueUrl}`,
     `Project: ${projectName} | Channel: ${channelId}`,
     `Execution path: ${repoDisplay}`,
-    `Start by changing into the canonical repo path above before reusing the PR branch or creating its worktree. Do not resolve the issue inside ~/.openclaw/workspace unless the repo path itself points there.`
+    `Required branch: ${branchName}`,
+    `Required worktree: ${worktreePath}`,
+    `Start by changing into the canonical repo path above before reusing the PR branch or creating its worktree. Reuse the exact PR branch named above; do not switch to a new canonical issue branch during a feedback cycle. Do not resolve the issue inside ~/.openclaw/workspace unless the repo path itself points there.`
   );
   parts.push(...buildCompletionContract(role));
   return parts.join("\n");
@@ -138138,7 +138174,7 @@ var EXPRESS_GATES = {
 };
 var NODE_CLI_GATES = {
   lint: "npm run lint",
-  types: "npm run build -- --noEmit",
+  types: "npm run typecheck",
   security: "npm audit --audit-level=moderate",
   tests: "npm test",
   coverage: "npm run coverage"
@@ -139047,7 +139083,6 @@ fi
 }
 
 // lib/intake/steps/scaffold.ts
-var PYTHON_STACKS3 = /* @__PURE__ */ new Set(["python-cli", "fastapi", "flask", "django"]);
 var scaffoldStep = {
   name: "scaffold",
   shouldRun: (payload) => payload.impact?.is_greenfield === true && !payload.dry_run,
@@ -139073,7 +139108,7 @@ var scaffoldStep = {
           mode: "scaffold",
           runCommand: ctx.runCommand
         });
-        if (scaffold.stack && PYTHON_STACKS3.has(scaffold.stack) && payload.spec) {
+        if (scaffold.stack && payload.spec) {
           try {
             const contract = generateQaContract({
               spec: payload.spec,
@@ -139655,11 +139690,44 @@ var createTaskStep = {
 };
 
 // lib/intake/lib/triage-logic.ts
-function calculateEffort(filesChanged, acCount) {
-  if (filesChanged <= 3 && acCount <= 3) return "small";
-  if (filesChanged <= 10 && acCount <= 7) return "medium";
-  if (filesChanged <= 25 && acCount <= 15) return "large";
-  return "xlarge";
+function detectRawIdeaComplexity(rawIdea) {
+  const text = rawIdea.toLowerCase();
+  const signals = [];
+  const subsystemPatterns = [
+    [/\b(worker|background.?job|queue|celery|bull|sidekiq|task.?runner)\b/i, "background-worker"],
+    [/\b(websocket|server.?sent|sse|real.?time|realtime|socket\.io|push.?notif)\b/i, "realtime"],
+    [/\b(auth|oauth|jwt|login|register|session|user.?account|signup)\b/i, "auth"],
+    [/\b(notif|alert|email|sms|webhook|subscription|subscribe)\b/i, "notifications"],
+    [/\b(database|banco|db|postgres|mysql|mongodb|redis|sqlite|orm)\b/i, "database"],
+    [/\b(api\s+rest|rest\s+api|endpoint|rota|route|graphql|grpc)\b/i, "api-layer"],
+    [/\b(docker|kubernetes|k8s|deploy|ci|cd|pipeline)\b/i, "infra"],
+    [/\b(dashboard|frontend|interface|ui|tela|p[aá]gina)\b/i, "frontend"]
+  ];
+  for (const [regex, label] of subsystemPatterns) {
+    if (regex.test(text)) signals.push(label);
+  }
+  let floor = null;
+  if (signals.length >= 4) floor = "large";
+  else if (signals.length >= 3) floor = "medium";
+  else if (signals.length >= 2) floor = "medium";
+  return { floor, signals };
+}
+function calculateEffort(filesChanged, acCount, rawIdea) {
+  let effort;
+  if (filesChanged <= 3 && acCount <= 3) effort = "small";
+  else if (filesChanged <= 10 && acCount <= 7) effort = "medium";
+  else if (filesChanged <= 25 && acCount <= 15) effort = "large";
+  else effort = "xlarge";
+  if (rawIdea) {
+    const { floor } = detectRawIdeaComplexity(rawIdea);
+    if (floor) {
+      const ORDER = ["small", "medium", "large", "xlarge"];
+      if (ORDER.indexOf(floor) > ORDER.indexOf(effort)) {
+        effort = floor;
+      }
+    }
+  }
+  return effort;
 }
 function calculatePriority(type, effort, totalRisks, matrix) {
   for (const rule of matrix.priority_rules_v2) {
@@ -139726,7 +139794,7 @@ function determineLevel(effort, targetState) {
   return level;
 }
 function runTriageLogic(input, matrix) {
-  const effort = calculateEffort(input.filesChanged, input.acCount);
+  const effort = calculateEffort(input.filesChanged, input.acCount, input.rawIdea);
   const { priority, label: priorityLabel } = calculatePriority(input.type, effort, input.totalRisks, matrix);
   const effortLabel = matrix.effort_rules[effort]?.label ?? `effort:${effort}`;
   const typeLabel = matrix.auto_labels[input.type] ?? "";
@@ -140980,6 +141048,22 @@ var BOOTSTRAP_MESSAGES = {
     pt: "Como voc\xEA quer chamar o projeto? Se preferir, posso escolher um nome.",
     en: "What do you want to name the project? If you prefer, I can pick one."
   },
+  clarifyScope: {
+    pt: (idea) => `Recebi! Seu pedido envolve v\xE1rios subsistemas (autentica\xE7\xE3o, notifica\xE7\xF5es, worker, banco de dados...). Para montar uma spec de qualidade, preciso de algumas defini\xE7\xF5es:
+
+1. **Stack/linguagem**: qual prefere? (Python/FastAPI, Node.js/Express, Go...)
+2. **Banco de dados**: PostgreSQL, MongoDB, Redis, outro?
+3. **Autentica\xE7\xE3o**: JWT, OAuth2, sess\xE3o?
+
+Se preferir deixar a escolha comigo, responda "livre" e eu decido.`,
+    en: (idea) => `Got it! Your request involves multiple subsystems (auth, notifications, background worker, DB...). To produce a quality spec, I need a few decisions:
+
+1. **Stack/language**: which do you prefer? (Python/FastAPI, Node.js/Express, Go...)
+2. **Database**: PostgreSQL, MongoDB, Redis, other?
+3. **Auth**: JWT, OAuth2, session?
+
+If you want me to choose, reply "your call" and I'll decide.`
+  },
   registered: {
     pt: (name, link) => `Projeto "${name}" registrado.
 Vou continuar o fluxo em ${link}`,
@@ -140987,6 +141071,28 @@ Vou continuar o fluxo em ${link}`,
 I'll continue the flow at ${link}`
   }
 };
+function detectScopeAmbiguity(rawIdea, stackHint) {
+  const text = rawIdea.toLowerCase();
+  if (/\b(livre|free.?choice|your.?call|pode.?escolher|voc[eê].?decide|qualquer)\b/i.test(text)) {
+    return false;
+  }
+  const subsystems = [
+    /\b(worker|background.?job|queue|task.?runner|celery|bull)\b/i,
+    /\b(websocket|sse|real.?time|realtime|push.?notif)\b/i,
+    /\b(auth|oauth|jwt|login|register|signup|autenticac)\b/i,
+    /\b(notif|alert|assinatura|subscription|subscribe|email|sms)\b/i,
+    /\b(banco|database|db|postgres|mysql|mongodb|redis|sqlite)\b/i,
+    /\b(api\s+rest|rest\s+api|endpoint|graphql|grpc)\b/i,
+    /\b(dashboard|frontend|interface|ui|tela)\b/i
+  ];
+  const matchedSubsystems = subsystems.filter((r2) => r2.test(text)).length;
+  if (matchedSubsystems < 3) return false;
+  const hasExplicitDB = /\b(postgres(ql)?|mysql|mongodb|mongo|redis|sqlite|supabase|dynamodb|cockroach)\b/i.test(text);
+  const hasExplicitAuth = /\b(jwt|oauth2?|basic.?auth|api.?key|session.?based|cookie.?auth)\b/i.test(text);
+  const hasExplicitStack = !!stackHint && !["api", "rest-api", "backend"].includes(stackHint);
+  const unspecifiedDimensions = [!hasExplicitDB, !hasExplicitAuth, !hasExplicitStack].filter(Boolean).length;
+  return unspecifiedDimensions >= 2;
+}
 function inferProjectSlug(text) {
   let cleaned = text.replace(/^(create|build|crie|cria|criar|fazer?|quero|i need|i want)\s+(uma|um|me\s+a?|an|a)?\s*/i, "").replace(/\s+(that|which|que|para|for|pra)\s+.*/i, "").trim();
   if (!cleaned) cleaned = text;
@@ -141455,6 +141561,27 @@ async function handleTelegramBootstrapDmMessage(ctx, rawConversationId, content)
     ));
     return;
   }
+  if (detectScopeAmbiguity(content, parsed.stackHint)) {
+    const existingSession2 = await readTelegramBootstrapSession(workspaceDir, conversationId);
+    const alreadyAskedScope = existingSession2?.pendingClarification === "scope";
+    if (!alreadyAskedScope) {
+      await upsertTelegramBootstrapSession(workspaceDir, {
+        conversationId,
+        rawIdea: content,
+        stackHint: parsed.stackHint ?? void 0,
+        projectName: parsed.projectSlug ?? void 0,
+        status: "clarifying",
+        pendingClarification: "scope",
+        language
+      });
+      const clarifyMsg = BOOTSTRAP_MESSAGES.clarifyScope[language](content);
+      await sendTelegramText(ctx, rawConversationId, clarifyMsg);
+      return;
+    }
+    if (existingSession2?.stackHint) {
+      incomingRequest.stackHint = existingSession2.stackHint;
+    }
+  }
   const handled = await runBootstrapPreflightOrFail(
     ctx,
     conversationId,

package/genesis/scripts/scaffold-project.sh

@@ -348,7 +348,7 @@ $objective
 
 \`\`\`bash
 $(case "$stack" in
-  nextjs|express) echo "npm install" ;;
+  nextjs|express|node-cli) echo "npm install" ;;
   fastapi|flask|django) echo "python -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt" ;;
   python-cli) echo "python -m venv .venv && source .venv/bin/activate && pip install -e '.[dev]'" ;;
 esac)
@@ -360,6 +360,7 @@ esac)
 $(case "$stack" in
   nextjs) echo "npm run dev" ;;
   express) echo "npm run dev" ;;
+  node-cli) echo "npm run dev -- \"Hello World CLI\"" ;;
   fastapi) echo "uvicorn app.main:app --reload" ;;
   flask) echo "flask run --debug" ;;
   django) echo "python manage.py runserver" ;;
@@ -460,21 +461,26 @@ scaffold_node_cli() {
   "scripts": {
     "dev": "tsx src/index.ts",
     "build": "tsc",
+    "typecheck": "tsc --noEmit",
     "start": "node dist/index.js",
-    "lint": "eslint src/",
+    "lint": "eslint .",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "coverage": "vitest run --coverage --coverage.thresholds.lines=80"
   },
   "dependencies": {
     "commander": "^14.0.0"
   },
   "devDependencies": {
+    "@eslint/js": "^9.0.0",
     "@types/node": "^22.0.0",
+    "@vitest/coverage-v8": "^3.0.0",
     "eslint": "^9.0.0",
-    "typescript": "^5.7.0",
+    "globals": "^15.0.0",
     "tsx": "^4.0.0",
-    "vitest": "^3.0.0",
-    "@vitest/coverage-v8": "^3.0.0"
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.0.0",
+    "vitest": "^3.0.0"
   }
 }
 EOF
@@ -489,62 +495,127 @@ EOF
     "module": "ESNext",
     "moduleResolution": "bundler",
     "outDir": "dist",
-    "rootDir": "src",
+    "rootDir": ".",
     "strict": true,
     "esModuleInterop": true,
     "skipLibCheck": true,
     "resolveJsonModule": true,
-    "declaration": true
+    "declaration": true,
+    "types": ["node"]
   },
-  "include": ["src"],
-  "exclude": ["node_modules", "dist", "tests"]
+  "include": ["src", "tests"],
+  "exclude": ["node_modules", "dist"]
 }
 EOF
   FILES_CREATED+=("tsconfig.json")
 
+  cat > eslint.config.mjs <<'EOF'
+import js from '@eslint/js';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    files: ['src/**/*.ts', 'tests/**/*.ts'],
+    languageOptions: {
+      globals: {
+        ...globals.node,
+      },
+    },
+    rules: {
+      'no-console': 'off',
+    },
+  },
+);
+EOF
+  FILES_CREATED+=("eslint.config.mjs")
+
   mkdir -p src
   cat > src/index.ts <<'EOF'
 #!/usr/bin/env node
 import { Command } from 'commander';
+import { pathToFileURL } from 'node:url';
+
+export function toKebabCase(input: string): string {
+  return input
+    .trim()
+    .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+    .replace(/[\s_]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '')
+    .toLowerCase();
+}
+
+export function createProgram(): Command {
+  return new Command()
+    .name(process.env.npm_package_name ?? 'cli')
+    .version(process.env.npm_package_version ?? '0.1.0')
+    .description('Convert a text argument to kebab-case')
+    .argument('<text>', 'text to convert')
+    .action((text: string) => {
+      console.log(toKebabCase(text));
+    });
+}
 
-const program = new Command();
+export function main(argv = process.argv): void {
+  createProgram().parse(argv);
+}
 
-program
-  .name(process.env.npm_package_name ?? 'cli')
-  .version(process.env.npm_package_version ?? '0.1.0')
-  .description('CLI tool')
-  .argument('[args...]', 'arguments')
-  .action((args: string[]) => {
-    console.log('Hello from CLI', args.length ? args.join(' ') : '');
-  });
+const isDirectRun = process.argv[1]
+  ? import.meta.url === pathToFileURL(process.argv[1]).href
+  : false;
 
-program.parse();
+if (isDirectRun) {
+  main();
+}
 EOF
   FILES_CREATED+=("src/index.ts")
 
   mkdir -p tests
   cat > tests/main.test.ts <<'EOF'
-import { describe, it, expect } from 'vitest';
 import { execFileSync } from 'node:child_process';
-import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createProgram, main, toKebabCase } from '../src/index.js';
 
-const cli = resolve(__dirname, '../src/index.ts');
+const cli = fileURLToPath(new URL('../src/index.ts', import.meta.url));
 
-function run(...args: string[]): string {
-  return execFileSync('npx', ['tsx', cli, ...args], {
-    encoding: 'utf-8',
-    env: { ...process.env, NODE_NO_WARNINGS: '1' },
-  }).trim();
-}
+describe('toKebabCase', () => {
+  it('converts text with spaces and casing', () => {
+    expect(toKebabCase('Hello World CLI')).toBe('hello-world-cli');
+    expect(toKebabCase('Some_Mixed Case Text')).toBe('some-mixed-case-text');
+    expect(toKebabCase('  already-kebab  ')).toBe('already-kebab');
+  });
+});
+
+describe('main', () => {
+  const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+
+  afterEach(() => {
+    logSpy.mockClear();
+  });
+
+  it('prints the kebab-case output', () => {
+    main(['node', 'hyphenator-cli', 'Hello World Example']);
+    expect(logSpy).toHaveBeenCalledWith('hello-world-example');
+  });
 
-describe('CLI', () => {
-  it('should print hello message', () => {
-    const output = run();
-    expect(output).toContain('Hello from CLI');
+  it('builds a command with metadata', () => {
+    const program = createProgram();
+    expect(program.name()).toBeTruthy();
+    expect(program.description()).toContain('kebab-case');
   });
+});
+
+describe('CLI smoke', () => {
+  it('shows version with --version', () => {
+    const output = execFileSync('npx', ['tsx', cli, '--version'], {
+      encoding: 'utf-8',
+      env: { ...process.env, NODE_NO_WARNINGS: '1' },
+    }).trim();
 
-  it('should show version with --version', () => {
-    const output = run('--version');
     expect(output).toMatch(/\d+\.\d+\.\d+/);
   });
 });
@@ -559,23 +630,19 @@ echo "=== QA Gate ==="
 FAIL=0
 
 echo "--- Lint ---"
-npx eslint src/ 2>&1 || { echo "LINT FAILED"; FAIL=1; }
+npm run lint 2>&1 || { echo "LINT FAILED"; FAIL=1; }
 
 echo "--- TypeScript ---"
-npx tsc --noEmit 2>&1 || { echo "TSC FAILED"; FAIL=1; }
+npm run typecheck 2>&1 || { echo "TSC FAILED"; FAIL=1; }
 
 echo "--- Tests ---"
-npx vitest run 2>&1 || { echo "TESTS FAILED"; FAIL=1; }
+npm test 2>&1 || { echo "TESTS FAILED"; FAIL=1; }
 
 echo "--- Coverage (>=80%) ---"
-npx vitest run --coverage --coverage.thresholds.lines=80 2>&1 || { echo "COVERAGE FAILED"; FAIL=1; }
+npm run coverage 2>&1 || { echo "COVERAGE FAILED"; FAIL=1; }
 
-echo "--- Secrets scan ---"
-if grep -rn 'password\s*=\s*"[^"]\+"\|api_key\s*=\s*"[^"]\+"\|secret\s*=\s*"[^"]\+"' --include="*.ts" --include="*.js" src/ 2>/dev/null; then
-  echo "SECRETS FOUND — FAIL"; FAIL=1
-else
-  echo "No hardcoded secrets found"
-fi
+echo "--- Security audit ---"
+npm audit --audit-level=moderate 2>&1 || { echo "AUDIT FAILED"; FAIL=1; }
 
 exit $FAIL
 QAEOF

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mestreyoda/fabrica",
-  "version": "0.2.18",
+  "version": "0.2.20",
   "description": "Autonomous software engineering pipeline for OpenClaw. Turns ideas into deployed code via intake, dispatch, review, test, and merge.",
   "type": "module",
   "main": "./dist/index.js",