@oscharko-dev/keiko-workflows 0.2.0

package/dist/unit-tests/prompt.js

@@ -0,0 +1,139 @@
+// Prompt construction (ADR-0008 D1/D7). Builds the system + user ChatMessage array for the single
+// generation call. PURE: no IO, no clock, no randomness — the same inputs always yield the same
+// messages. The system message specifies the model-output contract (a fenced ```diff block plus
+// optional labeled prose) that parse.ts consumes (steering note B). Context excerpts handed in are
+// already redacted by #5; this module does no redaction.
+const OUTPUT_CONTRACT = "Respond with the unified diff that adds the tests inside a single fenced code block opened " +
+    "with ```diff and closed with ```. After the block you MAY add `## Covered behavior` and " +
+    "`## Known gaps` sections in prose. Output ONLY a unified diff for test files — never modify " +
+    "source files. The first non-empty line inside the fence MUST be `--- /dev/null` for a new " +
+    "test file or `--- a/<existing-test-path>` for an existing test file, followed by " +
+    "`+++ b/<test-path>` and at least one `@@` hunk. Do not output `*** Begin Patch`, file trees, " +
+    "plain prose, markdown bullets, or escaped newline markers like `\\n+`/`\\n-` inside the diff " +
+    "fence; every diff line must be separated by a real newline.";
+// Per-style discipline (Issue #1203). The output contract is identical for every style — a reviewable
+// unified diff for test files — but the test idioms differ by the convention-driven style.
+const STYLE_DESCRIPTOR = {
+    unit: "rigorous, deterministic unit tests",
+    component: "rigorous React component tests",
+    interaction: "rigorous React component interaction tests",
+    "accessibility-smoke": "rigorous React component tests with an accessibility smoke check",
+    "browser-smoke": "a minimal Playwright browser smoke test",
+    unsupported: "unit tests",
+};
+const STYLE_GUIDANCE = {
+    unit: [
+        "Cover edge cases explicitly: null, undefined, empty, zero, boundary, negative, and error paths.",
+    ],
+    component: [
+        "Render the component with @testing-library/react render(), query through screen by accessible " +
+            "role/name or visible text, and assert user-visible output. Do not assert implementation details " +
+            "or internal state. Cover empty, loading, and error states where the component supports them.",
+    ],
+    interaction: [
+        "Render the component with @testing-library/react, drive interactions with @testing-library/" +
+            "user-event (const user = userEvent.setup(); await user.click(...) / user.type(...)), and assert " +
+            "the resulting accessible UI changes. Do not assert internal state.",
+    ],
+    "accessibility-smoke": [
+        "Render the component with @testing-library/react and query by accessible role/name so the test " +
+            "exercises the accessibility tree. Include at least one accessibility assertion: where the project " +
+            "provides an axe matcher, assert the rendered output has no detectable accessibility violations.",
+    ],
+    "browser-smoke": [
+        'Write a minimal Playwright browser smoke test: import { test, expect } from "@playwright/test", ' +
+            "navigate to the route under test, and assert that one key user-visible element is visible. Keep " +
+            "it a happy-path smoke test, not an exhaustive suite. Place it under the project's end-to-end test " +
+            "directory.",
+    ],
+    unsupported: [],
+};
+function systemContent(conventions, strategy) {
+    const lines = [
+        `You are a senior engineer writing ${STYLE_DESCRIPTOR[strategy.style]} for existing code.`,
+        runnerLine(conventions, strategy),
+        `Place new tests using the project's "${conventions.fileNamingStyle}" naming convention.`,
+        locationLine(conventions, strategy),
+        ...STYLE_GUIDANCE[strategy.style],
+        OUTPUT_CONTRACT,
+    ];
+    return `${lines.join("\n")}${assertionStyleBlock(conventions)}`;
+}
+function runnerLine(conventions, strategy) {
+    if (strategy.style === "browser-smoke" || strategy.verification === "playwright") {
+        return "Browser test runner: Playwright.";
+    }
+    return `Test framework: ${conventions.framework}.`;
+}
+function locationLine(conventions, strategy) {
+    if (strategy.style === "browser-smoke") {
+        return conventions.testDirs.length > 0
+            ? `Project test directories: ${conventions.testDirs.join(", ")}; place browser smoke tests under the project's Playwright/end-to-end test directory.`
+            : "No dedicated test directory detected; place browser smoke tests under the project's Playwright/end-to-end test directory.";
+    }
+    return conventions.testDirs.length > 0
+        ? `Project test directories: ${conventions.testDirs.join(", ")}.`
+        : "No dedicated test directory detected; place tests beside their source.";
+}
+function assertionStyleBlock(conventions) {
+    if (conventions.assertionStyleSamples.length === 0) {
+        return "";
+    }
+    const samples = conventions.assertionStyleSamples
+        .map((sample, idx) => `Example test ${String(idx + 1)}:\n${sample}`)
+        .join("\n\n");
+    return `\n\nMatch the assertion and structure style of these existing tests:\n${samples}`;
+}
+function targetAction(strategy) {
+    switch (strategy.style) {
+        case "component":
+            return "Write React component tests";
+        case "interaction":
+            return "Write React component interaction tests";
+        case "accessibility-smoke":
+            return "Write React component tests with an accessibility smoke check";
+        case "browser-smoke":
+            return "Write a minimal Playwright browser smoke test for the route or application entry point";
+        case "unit":
+        case "unsupported":
+            return "Write unit tests";
+    }
+}
+function targetDescription(target, strategy) {
+    const action = targetAction(strategy);
+    if (target.kind === "file") {
+        return target.targetFunction === undefined
+            ? `${action} for the public API in ${target.filePath}.`
+            : `${action} for the function ${target.targetFunction} in ${target.filePath}.`;
+    }
+    if (target.kind === "module") {
+        return `${action} for the source files in the module directory ${target.moduleDir}.`;
+    }
+    return `${action} for these changed files: ${target.filePaths.join(", ")}.`;
+}
+function contextBlock(pack) {
+    if (pack.selected.length === 0) {
+        return "";
+    }
+    const entries = pack.selected
+        .map((entry) => `--- ${entry.path} ---\n${entry.excerpt}`)
+        .join("\n\n");
+    return `\n\nRepository context:\n${entries}`;
+}
+function userContent(input, strategy, pack, rejectionReason) {
+    const retry = rejectionReason === undefined
+        ? ""
+        : `\n\nThe previous diff was rejected: ${rejectionReason}. Produce a corrected diff that ` +
+            "modifies ONLY test files.";
+    return `${targetDescription(input.target, strategy)}${contextBlock(pack)}${retry}`;
+}
+// rejectionReason is appended on a retry (D8) so the model can correct an invalid/out-of-scope
+// diff; it is undefined on the first attempt. The core signature is (input, conventions, strategy,
+// pack); the optional 5th argument carries retry state without breaking that contract. The strategy
+// (Issue #1203) drives the per-style test idioms in the system message.
+export function buildPrompt(input, conventions, strategy, pack, rejectionReason) {
+    return [
+        { role: "system", content: systemContent(conventions, strategy) },
+        { role: "user", content: userContent(input, strategy, pack, rejectionReason) },
+    ];
+}

package/dist/unit-tests/report.d.ts

@@ -0,0 +1,26 @@
+import type { PatchFileChange } from "@oscharko-dev/keiko-tools";
+import type { VerificationAuditSummary } from "@oscharko-dev/keiko-verification";
+import type { TestStyle, TestVerification } from "./frontend.js";
+import type { UnitTestWorkflowReport, WorkflowStatus } from "./types.js";
+export interface ReportParts {
+    readonly status: WorkflowStatus;
+    readonly modelId: string;
+    readonly durationMs: number;
+    readonly patchFiles: readonly PatchFileChange[];
+    readonly dryRunPreview: string | undefined;
+    readonly proposedDiff: string | undefined;
+    readonly coveredBehavior: string | undefined;
+    readonly knownGaps: string | undefined;
+    readonly nextActions: readonly string[];
+    readonly failureReason?: string | undefined;
+    readonly verificationSummary: VerificationAuditSummary | undefined;
+    readonly verificationSkipReason: string | undefined;
+    readonly modelCallCount: number;
+    readonly patchRetryCount: number;
+    readonly testStyle?: TestStyle | undefined;
+    readonly verification?: TestVerification | undefined;
+    readonly limitation?: string | undefined;
+}
+export declare function assembleReport(parts: ReportParts): UnitTestWorkflowReport;
+export declare function renderMarkdownReport(report: UnitTestWorkflowReport): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/unit-tests/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/unit-tests/report.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,KAAK,EAAiB,sBAAsB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA6BxF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAMD,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,sBAAsB,CAqBzE;AAuCD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAiB3E"}

package/dist/unit-tests/report.js

@@ -0,0 +1,104 @@
+// Report assembly and Markdown rendering (ADR-0008 D3, steering note A). assembleReport composes
+// the JSON-serializable UnitTestWorkflowReport from pipeline stage outputs; renderMarkdownReport
+// produces the CLI text path. ALL prose (coveredBehavior, knownGaps, nextActions), the dry-run
+// preview, the proposed diff, verificationSkipReason, and addedTestFiles[].path are redacted via
+// redact() here so nothing the report carries can leak a secret — defence in depth on top of the
+// redaction already applied upstream. Pure: no IO, no clock; the caller injects durationMs and counters.
+import { redact } from "@oscharko-dev/keiko-security";
+const TEST_CASE_PREFIXES = ["test(", "it(", "describe("];
+// Best-effort count of added test cases: added (`+`) lines whose trimmed text begins with a known
+// test-case opener. Not authoritative — purely informational for the report.
+function estimateTestCount(file) {
+    let count = 0;
+    for (const hunk of file.hunks) {
+        for (const line of hunk.lines) {
+            if (!line.startsWith("+")) {
+                continue;
+            }
+            const trimmed = line.slice(1).trimStart();
+            if (TEST_CASE_PREFIXES.some((prefix) => trimmed.startsWith(prefix))) {
+                count += 1;
+            }
+        }
+    }
+    return count;
+}
+function toAddedTestFiles(files) {
+    return files.map((file) => ({
+        path: redact(file.path),
+        estimatedTestCount: estimateTestCount(file),
+    }));
+}
+function redactOptional(value) {
+    return value === undefined ? undefined : redact(value);
+}
+export function assembleReport(parts) {
+    return {
+        workflowId: "unit-test-generation",
+        status: parts.status,
+        modelId: parts.modelId,
+        durationMs: parts.durationMs,
+        dryRunPreview: redactOptional(parts.dryRunPreview),
+        proposedDiff: redactOptional(parts.proposedDiff),
+        addedTestFiles: toAddedTestFiles(parts.patchFiles),
+        coveredBehavior: redactOptional(parts.coveredBehavior),
+        knownGaps: redactOptional(parts.knownGaps),
+        nextActions: parts.nextActions.map((action) => redact(action)),
+        failureReason: redactOptional(parts.failureReason),
+        verificationSummary: parts.verificationSummary,
+        verificationSkipReason: redactOptional(parts.verificationSkipReason),
+        modelCallCount: parts.modelCallCount,
+        patchRetryCount: parts.patchRetryCount,
+        testStyle: parts.testStyle,
+        verification: parts.verification,
+        limitation: redactOptional(parts.limitation),
+    };
+}
+function sectionIf(heading, body) {
+    return body === undefined ? [] : [`## ${heading}`, body, ""];
+}
+function fileLines(report) {
+    if (report.addedTestFiles.length === 0) {
+        return [];
+    }
+    const rows = report.addedTestFiles.map((f) => `- ${f.path} (~${String(f.estimatedTestCount)} test case(s))`);
+    return ["## Test files", ...rows, ""];
+}
+function verificationLine(report) {
+    if (report.verificationSummary !== undefined) {
+        return [`## Verification`, `Status: ${report.verificationSummary.overallStatus}`, ""];
+    }
+    if (report.verificationSkipReason !== undefined) {
+        return [`## Verification`, report.verificationSkipReason, ""];
+    }
+    return [];
+}
+function styleLine(report) {
+    if (report.testStyle === undefined) {
+        return [];
+    }
+    const verification = report.verification === undefined || report.verification === "none"
+        ? ""
+        : ` · verification: ${report.verification}`;
+    return [`Test style: ${report.testStyle}${verification}`, ""];
+}
+// A human-readable Markdown report for the CLI text path. Every field is already redacted by
+// assembleReport, so rendering is plain string composition.
+export function renderMarkdownReport(report) {
+    return [
+        `# Unit-test generation: ${report.status}`,
+        `Model: ${report.modelId} · ${String(report.durationMs)}ms · ` +
+            `${String(report.modelCallCount)} model call(s) · ${String(report.patchRetryCount)} retry(ies)`,
+        "",
+        ...styleLine(report),
+        ...sectionIf("Limitation", report.limitation),
+        ...fileLines(report),
+        ...sectionIf("Covered behavior", report.coveredBehavior),
+        ...sectionIf("Known gaps", report.knownGaps),
+        ...sectionIf("Failure", report.failureReason),
+        ...verificationLine(report),
+        ...(report.nextActions.length > 0
+            ? ["## Next actions", ...report.nextActions.map((a) => `- ${a}`), ""]
+            : []),
+    ].join("\n");
+}

package/dist/unit-tests/stages.d.ts

@@ -0,0 +1,12 @@
+import type { WorkspaceInfo } from "@oscharko-dev/keiko-workspace";
+import { type AcceptedPatch, type ModelLoopResult, type RunState } from "./internal.js";
+import type { TestStrategy } from "./frontend.js";
+import type { UnitTestWorkflowReport } from "./types.js";
+export declare function rejectedReport(state: RunState, loop: ModelLoopResult, strategy: TestStrategy): UnitTestWorkflowReport;
+export declare function unsupportedReport(state: RunState, strategy: TestStrategy): UnitTestWorkflowReport;
+export declare function dryRunReport(state: RunState, loop: ModelLoopResult, accepted: AcceptedPatch, strategy: TestStrategy): UnitTestWorkflowReport;
+export declare function cancelledReport(state: RunState, loop: ModelLoopResult, accepted: AcceptedPatch | undefined, strategy?: TestStrategy): UnitTestWorkflowReport;
+export declare function failedReport(state: RunState, error: unknown): UnitTestWorkflowReport;
+export declare function emitCompleted(state: RunState, report: UnitTestWorkflowReport): UnitTestWorkflowReport;
+export declare function finishPipeline(state: RunState, workspace: WorkspaceInfo, loop: ModelLoopResult, strategy: TestStrategy): Promise<UnitTestWorkflowReport>;
+//# sourceMappingURL=stages.d.ts.map

package/dist/unit-tests/stages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.d.ts","sourceRoot":"","sources":["../../src/unit-tests/stages.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAInE,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,QAAQ,EACd,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAWzD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,YAAY,GACrB,sBAAsB,CAoBxB;AAKD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,GAAG,sBAAsB,CAsBjG;AAED,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,YAAY,GACrB,sBAAsB,CAmBxB;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,aAAa,GAAG,SAAS,EACnC,QAAQ,CAAC,EAAE,YAAY,GACtB,sBAAsB,CAkBxB;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAoBpF;AA+ED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,sBAAsB,GAC7B,sBAAsB,CAOxB;AAID,wBAAsB,cAAc,CAClC,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,aAAa,EACxB,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAWjC"}

package/dist/unit-tests/stages.js

@@ -0,0 +1,202 @@
+// Terminal-report stages (ADR-0008 D3/D5). Each function maps a pipeline outcome — rejected,
+// dry-run, applied+verified, cancelled, or failed — to the redacted UnitTestWorkflowReport via
+// assembleReport. applyPatch (apply mode) is the one IO boundary here and is fail-closed in #6
+// (applyEnabled gates the write). finishPipeline selects the branch; emitCompleted stamps the
+// terminal event. All prose/diff redaction happens inside assembleReport.
+import { redact } from "@oscharko-dev/keiko-security";
+import { applyPatch, CommandCancelledError, renderDryRun, } from "@oscharko-dev/keiko-tools";
+import { nodeWorkspaceWriter } from "@oscharko-dev/keiko-tools/internal/writer";
+import { nodeWorkspaceFs } from "@oscharko-dev/keiko-workspace/internal/fs";
+import { createScopedWriter } from "../governed-handoff.js";
+import { assembleReport } from "./report.js";
+import { runWorkflowVerification } from "./verify-stage.js";
+import { nextActionsFor, } from "./internal.js";
+// The content-free strategy fields surfaced on every report assembled after strategy selection
+// (Issue #1203). `undefined` strategy (an early failure before selection) leaves them absent.
+function strategyFields(strategy) {
+    return { testStyle: strategy?.style, verification: strategy?.verification };
+}
+export function rejectedReport(state, loop, strategy) {
+    return assembleReport({
+        status: "rejected",
+        modelId: state.input.modelId,
+        durationMs: state.now() - state.startedAt,
+        patchFiles: [],
+        dryRunPreview: undefined,
+        proposedDiff: undefined,
+        coveredBehavior: undefined,
+        knownGaps: undefined,
+        nextActions: [
+            `The model did not produce an in-scope test patch (${loop.lastRejectionCode ?? "unknown"})`,
+        ],
+        failureReason: undefined,
+        verificationSummary: undefined,
+        verificationSkipReason: undefined,
+        modelCallCount: loop.modelCallCount,
+        patchRetryCount: loop.patchRetryCount,
+        ...strategyFields(strategy),
+    });
+}
+// The target's frontend stack is unsupported (Issue #1203 AC5): a clear, reviewable limitation is
+// reported BEFORE any model call, so no fabricated browser/component test is produced. The status is
+// "rejected" (no patch was produced) and `modelCallCount` is 0.
+export function unsupportedReport(state, strategy) {
+    return assembleReport({
+        status: "rejected",
+        modelId: state.input.modelId,
+        durationMs: state.now() - state.startedAt,
+        patchFiles: [],
+        dryRunPreview: undefined,
+        proposedDiff: undefined,
+        coveredBehavior: undefined,
+        knownGaps: undefined,
+        nextActions: [
+            "No test was generated: the target's frontend test stack is unsupported. " +
+                "Add a supported test stack (for React components, @testing-library/react) and retry.",
+        ],
+        failureReason: undefined,
+        verificationSummary: undefined,
+        verificationSkipReason: "verification skipped: unsupported frontend stack, no test generated",
+        modelCallCount: 0,
+        patchRetryCount: 0,
+        limitation: strategy.reason,
+        ...strategyFields(strategy),
+    });
+}
+export function dryRunReport(state, loop, accepted, strategy) {
+    const files = accepted.validation.files.map((f) => f.path);
+    return assembleReport({
+        status: "dry-run",
+        modelId: state.input.modelId,
+        durationMs: state.now() - state.startedAt,
+        patchFiles: accepted.validation.files,
+        dryRunPreview: renderDryRun(accepted.validation),
+        proposedDiff: accepted.diff,
+        coveredBehavior: accepted.coveredBehavior,
+        knownGaps: accepted.knownGaps,
+        nextActions: nextActionsFor(false, files),
+        failureReason: undefined,
+        verificationSummary: undefined,
+        verificationSkipReason: "verification skipped: dry-run, no files written",
+        modelCallCount: loop.modelCallCount,
+        patchRetryCount: loop.patchRetryCount,
+        ...strategyFields(strategy),
+    });
+}
+export function cancelledReport(state, loop, accepted, strategy) {
+    return assembleReport({
+        status: "cancelled",
+        modelId: state.input.modelId,
+        durationMs: state.now() - state.startedAt,
+        patchFiles: accepted?.validation.files ?? [],
+        dryRunPreview: accepted === undefined ? undefined : renderDryRun(accepted.validation),
+        proposedDiff: accepted?.diff,
+        coveredBehavior: undefined,
+        knownGaps: undefined,
+        nextActions: ["The workflow was cancelled before completion"],
+        failureReason: undefined,
+        verificationSummary: undefined,
+        verificationSkipReason: "verification skipped: cancelled",
+        modelCallCount: loop.modelCallCount,
+        patchRetryCount: loop.patchRetryCount,
+        ...strategyFields(strategy),
+    });
+}
+export function failedReport(state, error) {
+    const message = redact(error instanceof Error ? error.message : "unexpected workflow failure");
+    const errorCode = error instanceof Error ? error.name : "UNKNOWN";
+    state.emitter.emit({ type: "workflow:failed", errorCode, message });
+    return assembleReport({
+        status: "failed",
+        modelId: state.input.modelId,
+        durationMs: state.now() - state.startedAt,
+        patchFiles: [],
+        dryRunPreview: undefined,
+        proposedDiff: undefined,
+        coveredBehavior: undefined,
+        knownGaps: undefined,
+        nextActions: [`Inspect the error and retry: ${message}`],
+        failureReason: message,
+        verificationSummary: undefined,
+        verificationSkipReason: undefined,
+        modelCallCount: state.progress.modelCallCount,
+        patchRetryCount: state.progress.patchRetryCount,
+    });
+}
+function resolveApplyWriter(state, workspace) {
+    if (state.deps.workflowHandoff === undefined) {
+        return state.deps.writer;
+    }
+    return createScopedWriter(state.deps.writer ?? nodeWorkspaceWriter, workspace.root, state.deps.workflowHandoff.patchScope.editablePaths);
+}
+function completedReport(state, loop, accepted, applyResult, verification, strategy) {
+    return assembleReport({
+        status: "completed",
+        modelId: state.input.modelId,
+        durationMs: state.now() - state.startedAt,
+        patchFiles: accepted.validation.files,
+        dryRunPreview: renderDryRun(accepted.validation),
+        proposedDiff: accepted.diff,
+        coveredBehavior: accepted.coveredBehavior,
+        knownGaps: accepted.knownGaps,
+        nextActions: nextActionsFor(true, applyResult.changedFiles),
+        failureReason: undefined,
+        verificationSummary: verification.summary,
+        verificationSkipReason: verification.skipReason,
+        modelCallCount: loop.modelCallCount,
+        patchRetryCount: loop.patchRetryCount,
+        ...strategyFields(strategy),
+    });
+}
+async function applyAndVerify(state, workspace, loop, accepted, strategy) {
+    const fs = state.deps.fs ?? nodeWorkspaceFs;
+    const writer = resolveApplyWriter(state, workspace);
+    let applyResult;
+    try {
+        applyResult = applyPatch(workspace, accepted.diff, {
+            applyEnabled: true,
+            signal: state.signal,
+            fs,
+            ...(writer === undefined ? {} : { writer }),
+        });
+    }
+    catch (error) {
+        if (error instanceof CommandCancelledError) {
+            return cancelledReport(state, loop, accepted, strategy);
+        }
+        throw error;
+    }
+    state.emitter.emit({
+        type: "workflow:patch:applied",
+        changedFiles: applyResult.changedFiles.length,
+        created: applyResult.created.length,
+        deleted: applyResult.deleted.length,
+    });
+    if (state.signal.aborted) {
+        return cancelledReport(state, loop, accepted, strategy);
+    }
+    const verification = await runWorkflowVerification(state, workspace, fs);
+    return completedReport(state, loop, accepted, applyResult, verification, strategy);
+}
+export function emitCompleted(state, report) {
+    state.emitter.emit({
+        type: "workflow:completed",
+        status: report.status,
+        durationMs: report.durationMs,
+    });
+    return report;
+}
+// Selects the terminal branch from the model-loop result: rejected (no patch), cancelled (abort
+// before apply), apply+verify (apply mode), or dry-run (default).
+export async function finishPipeline(state, workspace, loop, strategy) {
+    if (loop.accepted === undefined) {
+        return rejectedReport(state, loop, strategy);
+    }
+    if (state.signal.aborted) {
+        return cancelledReport(state, loop, loop.accepted, strategy);
+    }
+    if (state.input.apply === true) {
+        return applyAndVerify(state, workspace, loop, loop.accepted, strategy);
+    }
+    return dryRunReport(state, loop, loop.accepted, strategy);
+}

package/dist/unit-tests/strategy.d.ts

@@ -0,0 +1,6 @@
+import type { ContextPack, WorkspaceFs, WorkspaceInfo } from "@oscharko-dev/keiko-workspace";
+import { type TestStrategy } from "./frontend.js";
+import type { TestConventions, UnitTestTarget } from "./types.js";
+export declare function strategyAnchorPath(target: UnitTestTarget): string;
+export declare function resolveTestStrategy(workspace: WorkspaceInfo, target: UnitTestTarget, conventions: TestConventions, pack: ContextPack, fs?: WorkspaceFs): TestStrategy;
+//# sourceMappingURL=strategy.d.ts.map

package/dist/unit-tests/strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../../src/unit-tests/strategy.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQlE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAQjE;AAQD,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,eAAe,EAC5B,IAAI,EAAE,WAAW,EACjB,EAAE,GAAE,WAA6B,GAChC,YAAY,CASd"}

package/dist/unit-tests/strategy.js

@@ -0,0 +1,36 @@
+// Resolves the convention-driven test strategy for a workflow target (Issue #1203). Bridges the pure
+// frontend detector/selector (frontend.ts) to the workflow's UnitTestTarget and the already-assembled
+// ContextPack: it derives the anchor source path, detects the project's frontend test stack from local
+// manifests/config, samples the target's redacted source excerpt from the pack, and selects the style.
+// The only effect is the manifest/config read delegated to the injected WorkspaceFs.
+import { nodeWorkspaceFs } from "@oscharko-dev/keiko-workspace/internal/fs";
+import { detectFrontendStack, selectTestStrategy } from "./frontend.js";
+function toPosix(path) {
+    return path.split("\\").join("/");
+}
+// The single source path the strategy is anchored on: the file under test, the first changed file, or
+// the module directory. Used both for stack detection (walk-up) and component classification.
+export function strategyAnchorPath(target) {
+    if (target.kind === "file") {
+        return toPosix(target.filePath);
+    }
+    if (target.kind === "changedFiles") {
+        return toPosix(target.filePaths[0] ?? "");
+    }
+    return toPosix(target.moduleDir);
+}
+// The target file's redacted source excerpt, if it was selected into the ContextPack. A secondary
+// classification signal for non-`.tsx` modules; absent when the target was dropped for budget.
+function targetSourceExcerpt(pack, anchorPath) {
+    return pack.selected.find((entry) => toPosix(entry.path) === anchorPath)?.excerpt;
+}
+export function resolveTestStrategy(workspace, target, conventions, pack, fs = nodeWorkspaceFs) {
+    const anchorPath = strategyAnchorPath(target);
+    const stack = detectFrontendStack(workspace, fs, anchorPath);
+    return selectTestStrategy({
+        targetPath: anchorPath,
+        targetSource: targetSourceExcerpt(pack, anchorPath),
+        framework: conventions.framework,
+        stack,
+    });
+}

package/dist/unit-tests/target-guard.d.ts

@@ -0,0 +1,5 @@
+import { type WorkspaceFs, type WorkspaceInfo } from "@oscharko-dev/keiko-workspace";
+import type { UnitTestTarget } from "./types.js";
+export declare function targetInputPaths(target: UnitTestTarget): readonly string[];
+export declare function assertTargetWithinWorkspace(workspace: WorkspaceInfo, target: UnitTestTarget, fs: WorkspaceFs): void;
+//# sourceMappingURL=target-guard.d.ts.map

package/dist/unit-tests/target-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-guard.d.ts","sourceRoot":"","sources":["../../src/unit-tests/target-guard.ts"],"names":[],"mappings":"AAOA,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,MAAM,EAAE,CAQ1E;AAED,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,cAAc,EACtB,EAAE,EAAE,WAAW,GACd,IAAI,CASN"}

package/dist/unit-tests/target-guard.js

@@ -0,0 +1,29 @@
+// Workspace-containment guard for the unit-test workflow input target (issue #641 / ADR-0005 D2).
+// Runs BEFORE any model call so escaped, denied, or realpath-escape targets fail closed with
+// modelCallCount=0 and no diff. Mirrors the discovery boundary rules: lexical containment via
+// resolveWithinWorkspace, denylist via isDenied on the normalized relative path, and realpath
+// containment via assertContainedRealPath for existing targets. Pure with respect to non-FS state.
+import { relative } from "node:path";
+import { PathDeniedError, assertContainedRealPath, isDenied, resolveWithinWorkspace, } from "@oscharko-dev/keiko-workspace";
+function toPosix(path) {
+    return path.split("\\").join("/");
+}
+export function targetInputPaths(target) {
+    if (target.kind === "file") {
+        return [target.filePath];
+    }
+    if (target.kind === "module") {
+        return [target.moduleDir];
+    }
+    return target.filePaths;
+}
+export function assertTargetWithinWorkspace(workspace, target, fs) {
+    for (const candidate of targetInputPaths(target)) {
+        const absolute = resolveWithinWorkspace(workspace.root, candidate);
+        const normalizedRelative = toPosix(relative(workspace.root, absolute));
+        if (normalizedRelative !== "" && isDenied(normalizedRelative)) {
+            throw new PathDeniedError(`path is denied by workspace policy: ${candidate}`, candidate);
+        }
+        assertContainedRealPath(fs, workspace.root, absolute, "unit-test-target");
+    }
+}

package/dist/unit-tests/types.d.ts

@@ -0,0 +1,74 @@
+import type { MemoryWorkflowPort } from "@oscharko-dev/keiko-contracts";
+import type { WorkflowHandoffRequest } from "@oscharko-dev/keiko-contracts/workflow-handoff";
+import type { ModelPort } from "@oscharko-dev/keiko-harness";
+import type { SpawnFn, WorkspaceWriter } from "@oscharko-dev/keiko-tools";
+import type { TestFramework, WorkspaceFs } from "@oscharko-dev/keiko-workspace";
+import type { VerificationAuditSummary } from "@oscharko-dev/keiko-verification";
+import type { WorkflowEventSink } from "./events.js";
+import type { TestStyle, TestVerification } from "./frontend.js";
+import type { FileNamingStyle, WorkflowLimits, WorkflowStatus } from "@oscharko-dev/keiko-contracts";
+export type { WorkflowStatus, FileNamingStyle, WorkflowLimits, } from "@oscharko-dev/keiko-contracts";
+export { DEFAULT_WORKFLOW_LIMITS } from "@oscharko-dev/keiko-contracts";
+export type { ComponentFramework, FrontendTestStack, TestStrategy, TestStyle, TestVerification, } from "./frontend.js";
+export type UnitTestTarget = {
+    readonly kind: "file";
+    readonly filePath: string;
+    readonly targetFunction?: string | undefined;
+} | {
+    readonly kind: "module";
+    readonly moduleDir: string;
+} | {
+    readonly kind: "changedFiles";
+    readonly filePaths: readonly string[];
+};
+export interface TestConventions {
+    readonly framework: TestFramework;
+    readonly testDirs: readonly string[];
+    readonly fileNamingStyle: FileNamingStyle;
+    readonly assertionStyleSamples: readonly string[];
+}
+export interface UnitTestWorkflowInput {
+    readonly workspaceRoot: string;
+    readonly target: UnitTestTarget;
+    readonly apply?: boolean | undefined;
+    readonly modelId: string;
+    readonly limits?: Partial<WorkflowLimits> | undefined;
+}
+export interface UnitTestWorkflowDeps {
+    readonly model: ModelPort;
+    readonly fs?: WorkspaceFs | undefined;
+    readonly writer?: WorkspaceWriter | undefined;
+    readonly spawn?: SpawnFn | undefined;
+    readonly now?: (() => number) | undefined;
+    readonly idSource?: (() => string) | undefined;
+    readonly sink?: WorkflowEventSink | undefined;
+    readonly processEnv?: NodeJS.ProcessEnv | undefined;
+    readonly signal?: AbortSignal | undefined;
+    readonly memoryPort?: MemoryWorkflowPort | undefined;
+    readonly workflowHandoff?: WorkflowHandoffRequest | undefined;
+}
+export interface AddedTestFile {
+    readonly path: string;
+    readonly estimatedTestCount: number;
+}
+export interface UnitTestWorkflowReport {
+    readonly workflowId: "unit-test-generation";
+    readonly status: WorkflowStatus;
+    readonly modelId: string;
+    readonly durationMs: number;
+    readonly dryRunPreview?: string | undefined;
+    readonly proposedDiff?: string | undefined;
+    readonly addedTestFiles: readonly AddedTestFile[];
+    readonly coveredBehavior?: string | undefined;
+    readonly knownGaps?: string | undefined;
+    readonly nextActions: readonly string[];
+    readonly failureReason?: string | undefined;
+    readonly verificationSummary?: VerificationAuditSummary | undefined;
+    readonly verificationSkipReason?: string | undefined;
+    readonly modelCallCount: number;
+    readonly patchRetryCount: number;
+    readonly testStyle?: TestStyle | undefined;
+    readonly verification?: TestVerification | undefined;
+    readonly limitation?: string | undefined;
+}
+//# sourceMappingURL=types.d.ts.map