@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.5

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/adapters/qtest.js

@@ -30,6 +30,33 @@ const mapPriority = (priority) => {
     // qTest default priorities are P-prefixed; pass through verbatim.
     return priority;
 };
+// Build the qTest rows for a single candidate. One row per (step, expected) pair — the row count is
+// the longer of `steps`/`expectedResults` so a trailing expected result is never dropped (Issue
+// #283); a candidate with neither yields one empty-step row.
+function qtestRowsFor(candidate) {
+    const head = [
+        candidate.title,
+        buildDescription(candidate),
+        "Manual",
+        mapPriority(candidate.priority),
+        candidate.status,
+    ];
+    const rowCount = Math.max(candidate.steps.length, candidate.expectedResults.length);
+    if (rowCount === 0) {
+        return encodeSpreadsheetSafeRow([...head, "", "", ""]);
+    }
+    let rows = "";
+    for (let i = 0; i < rowCount; i += 1) {
+        const stepNumber = i < candidate.steps.length ? String(i + 1) : "";
+        rows += encodeSpreadsheetSafeRow([
+            ...head,
+            stepNumber,
+            candidate.steps[i] ?? "",
+            candidate.expectedResults[i] ?? "",
+        ]);
+    }
+    return rows;
+}
 export function adaptToQtest(bundle, candidates) {
     assertExportBundleInvariant(bundle);
     const byId = new Map();
@@ -43,35 +70,8 @@ export function adaptToQtest(bundle, candidates) {
     let body = encodeSpreadsheetSafeRow(QTEST_CSV_HEADERS);
     for (const id of sortedIds) {
         const candidate = byId.get(id);
-        if (candidate === undefined) {
-            continue;
-        }
-        if (candidate.steps.length === 0) {
-            body += encodeSpreadsheetSafeRow([
-                candidate.title,
-                buildDescription(candidate),
-                "Manual",
-                mapPriority(candidate.priority),
-                candidate.status,
-                "",
-                "",
-                "",
-            ]);
-            continue;
-        }
-        for (let i = 0; i < candidate.steps.length; i += 1) {
-            const action = candidate.steps[i] ?? "";
-            const expected = candidate.expectedResults[i] ?? "";
-            body += encodeSpreadsheetSafeRow([
-                candidate.title,
-                buildDescription(candidate),
-                "Manual",
-                mapPriority(candidate.priority),
-                candidate.status,
-                String(i + 1),
-                action,
-                expected,
-            ]);
+        if (candidate !== undefined) {
+            body += qtestRowsFor(candidate);
         }
     }
     return body;

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/adapters/spreadsheetSafeCsv.d.ts

@@ -7,7 +7,8 @@ import type { QualityIntelligenceTestCaseCandidate } from "@oscharko-dev/keiko-c
 export declare const SPREADSHEET_FORMULA_LEAD_CHARS: ReadonlySet<string>;
 /**
  * Returns `true` if `value` would be interpreted as a formula or DDE invocation
- * by a typical spreadsheet because of its leading character.
+ * by a typical spreadsheet because of its leading character — including the case where a leading
+ * whitespace run precedes a formula lead, which importers may trim before evaluating.
  */
 export declare function startsWithFormulaLead(value: string): boolean;
 /**

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/adapters/spreadsheetSafeCsv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spreadsheetSafeCsv.d.ts","sourceRoot":"","sources":["../../../src/export/adapters/spreadsheetSafeCsv.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAErF,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAQ7D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa/D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMzE;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAUxD,CAAC;AAIH;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,+BAA+B,EACvC,UAAU,EAAE,SAAS,oCAAoC,EAAE,GAC1D,MAAM,CA2BR"}
+{"version":3,"file":"spreadsheetSafeCsv.d.ts","sourceRoot":"","sources":["../../../src/export/adapters/spreadsheetSafeCsv.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAErF,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAQ7D,CAAC;AAuCH;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ5D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa/D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMzE;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAUxD,CAAC;AAIH;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,+BAA+B,EACvC,UAAU,EAAE,SAAS,oCAAoC,EAAE,GAC1D,MAAM,CA2BR"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/adapters/spreadsheetSafeCsv.js

@@ -29,15 +29,53 @@ export const SPREADSHEET_FORMULA_LEAD_CHARS = new Set([
     "\r",
     "\n",
 ]);
+// Whitespace code points a spreadsheet import may strip BEFORE formula detection. Several importers
+// (Excel/LibreOffice/Sheets) trim a leading whitespace run, so a cell like " =1+1" or a NBSP/tab-
+// prefixed formula can still evaluate even though its literal first char is not a lead char.
+const LEADING_WHITESPACE_CODE_POINTS = new Set([
+    0x09, // tab
+    0x0a, // line feed
+    0x0b, // vertical tab
+    0x0c, // form feed
+    0x0d, // carriage return
+    0x20, // space
+    0xa0, // no-break space
+    0x2007, // figure space
+    0x2028, // line separator
+    0x2029, // paragraph separator
+    0x202f, // narrow no-break space
+    0xfeff, // zero-width no-break space / BOM
+]);
+// The formula/DDE lead characters that remain dangerous once a leading whitespace run is stripped.
+// The whitespace leads themselves (TAB/CR/LF) stay covered by the literal first-char check.
+const FORMULA_LEAD_AFTER_WHITESPACE = new Set(["=", "+", "-", "@"]);
+// Scan past a leading whitespace run; return true when the first non-whitespace character is a
+// formula lead. Pure, no regex — scans UTF-16 code units (every listed whitespace point is BMP).
+function firstNonWhitespaceIsFormulaLead(value) {
+    let index = 0;
+    while (index < value.length && LEADING_WHITESPACE_CODE_POINTS.has(value.charCodeAt(index))) {
+        index += 1;
+    }
+    // index === 0 → no leading whitespace (the literal first-char check already handled it);
+    // index >= length → the cell is all whitespace.
+    if (index === 0 || index >= value.length) {
+        return false;
+    }
+    return FORMULA_LEAD_AFTER_WHITESPACE.has(value.charAt(index));
+}
 /**
  * Returns `true` if `value` would be interpreted as a formula or DDE invocation
- * by a typical spreadsheet because of its leading character.
+ * by a typical spreadsheet because of its leading character — including the case where a leading
+ * whitespace run precedes a formula lead, which importers may trim before evaluating.
  */
 export function startsWithFormulaLead(value) {
     if (value.length === 0) {
         return false;
     }
-    return SPREADSHEET_FORMULA_LEAD_CHARS.has(value.charAt(0));
+    if (SPREADSHEET_FORMULA_LEAD_CHARS.has(value.charAt(0))) {
+        return true;
+    }
+    return firstNonWhitespaceIsFormulaLead(value);
 }
 /**
  * Encodes a single cell value as RFC-4180 CSV with formula-injection

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/adapters/xray.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xray.d.ts","sourceRoot":"","sources":["../../../src/export/adapters/xray.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,+BAA+B,EAC/B,oCAAoC,EACrC,MAAM,+BAA+B,CAAC;AAIvC,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAQ5C,CAAC;AASH,wBAAgB,WAAW,CACzB,MAAM,EAAE,+BAA+B,EACvC,UAAU,EAAE,SAAS,oCAAoC,EAAE,GAC1D,MAAM,CA2CR"}
+{"version":3,"file":"xray.d.ts","sourceRoot":"","sources":["../../../src/export/adapters/xray.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,+BAA+B,EAC/B,oCAAoC,EACrC,MAAM,+BAA+B,CAAC;AAIvC,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAQ5C,CAAC;AASH,wBAAgB,WAAW,CACzB,MAAM,EAAE,+BAA+B,EACvC,UAAU,EAAE,SAAS,oCAAoC,EAAE,GAC1D,MAAM,CA+CR"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/adapters/xray.js

@@ -38,7 +38,11 @@ export function adaptToXray(bundle, candidates) {
         if (candidate === undefined) {
             continue;
         }
-        if (candidate.steps.length === 0) {
+        // `steps` and `expectedResults` are independent arrays with no co-length contract invariant, so
+        // the row count is the longer of the two — bounding the loop by `steps.length` alone would
+        // silently drop trailing expected results (and ALL of them when there are zero steps).
+        const rowCount = Math.max(candidate.steps.length, candidate.expectedResults.length);
+        if (rowCount === 0) {
             body += encodeSpreadsheetSafeRow([
                 candidate.id,
                 candidate.title,
@@ -50,7 +54,7 @@ export function adaptToXray(bundle, candidates) {
             ]);
             continue;
         }
-        for (let i = 0; i < candidate.steps.length; i += 1) {
+        for (let i = 0; i < rowCount; i += 1) {
             const action = candidate.steps[i] ?? "";
             const result = candidate.expectedResults[i] ?? "";
             body += encodeSpreadsheetSafeRow([

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/ingestion/untrustedContentNormalisation.d.ts

@@ -12,7 +12,7 @@ export interface NormaliseUntrustedContentResult {
 /**
  * Normalise an untrusted free-text payload:
  *   1. NFKC normalise.
- *   2. Strip C0/C1/DEL control characters.
+ *   2. Strip C0/C1/DEL control characters (keeping TAB/LF/CR text whitespace).
  *   3. Escape Markdown-injection vectors (heading, fenced code, image, link).
  *   4. Clamp to `maxBytes` UTF-8 bytes (default 64 KiB).
  *

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/ingestion/untrustedContentNormalisation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"untrustedContentNormalisation.d.ts","sourceRoot":"","sources":["../../src/ingestion/untrustedContentNormalisation.ts"],"names":[],"mappings":"AAgBA,yCAAyC;AACzC,MAAM,WAAW,gCAAgC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AAoFD;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GACpC,KAAK,MAAM,EACX,UAAS,gCAAqC,KAC7C,+BAYF,CAAC;AAEF,eAAO,MAAM,mCAAmC,QAAoB,CAAC"}
+{"version":3,"file":"untrustedContentNormalisation.d.ts","sourceRoot":"","sources":["../../src/ingestion/untrustedContentNormalisation.ts"],"names":[],"mappings":"AAgBA,yCAAyC;AACzC,MAAM,WAAW,gCAAgC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AA2FD;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GACpC,KAAK,MAAM,EACX,UAAS,gCAAqC,KAC7C,+BAYF,CAAC;AAEF,eAAO,MAAM,mCAAmC,QAAoB,CAAC"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/ingestion/untrustedContentNormalisation.js

@@ -19,6 +19,14 @@ const FENCED_CODE = /```/gu;
 const IMAGE_OPEN = /!\[/gu;
 const LINK_OPEN = /(?<!!)\[([^\]]*)\]\(/gu;
 const isControlCodePoint = (code) => {
+    // TAB (0x09), LF (0x0A), and CR (0x0D) are C0 code points but are legitimate
+    // text whitespace: stripping them would collapse multi-line content (e.g. a
+    // code block or a multi-line document excerpt) into a single run-on line. They
+    // must survive normalisation. This mirrors the prompt-boundary scrubber and the
+    // single-file binary guard (keiko-server isControlChar), so every layer treats
+    // the same code points as text.
+    if (code === 0x09 || code === 0x0a || code === 0x0d)
+        return false;
     // C0 controls 0x00–0x1F, DEL 0x7F, C1 controls 0x80–0x9F.
     if (code <= 0x1f)
         return true;
@@ -91,7 +99,7 @@ const clampToBytes = (value, maxBytes) => {
 /**
  * Normalise an untrusted free-text payload:
  *   1. NFKC normalise.
- *   2. Strip C0/C1/DEL control characters.
+ *   2. Strip C0/C1/DEL control characters (keeping TAB/LF/CR text whitespace).
  *   3. Escape Markdown-injection vectors (heading, fenced code, image, link).
  *   4. Clamp to `maxBytes` UTF-8 bytes (default 64 KiB).
  *

package/node_modules/@oscharko-dev/keiko-quality-intelligence/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko-quality-intelligence",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.5",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",
@@ -15,7 +15,7 @@
   },
   "scripts": {
     "build": "tsc -b tsconfig.json",
-    "typecheck": "tsc -b tsconfig.json --noEmit",
+    "typecheck": "tsc -b tsconfig.json",
     "test": "vitest run"
   },
   "files": [