@planu/cli 0.89.0 → 0.90.1

package/dist/tools/challenge-spec.test.js

@@ -0,0 +1,782 @@
+// Tests for handleChallengeSpec
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+vi.mock('../i18n/index.js', () => ({
+    t: (key) => key,
+    ti: (key, vars) => `${key}:${JSON.stringify(vars)}`,
+}));
+vi.mock('../storage/index.js', () => ({
+    specStore: { getSpec: vi.fn() },
+    knowledgeStore: { getKnowledge: vi.fn() },
+}));
+vi.mock('node:fs/promises', () => ({
+    readFile: vi.fn(),
+}));
+import { handleChallengeSpec } from './challenge-spec.js';
+import { specStore, knowledgeStore } from '../storage/index.js';
+import { readFile } from 'node:fs/promises';
+const mockGetSpec = vi.mocked(specStore.getSpec);
+const mockGetKnowledge = vi.mocked(knowledgeStore.getKnowledge);
+const mockReadFile = vi.mocked(readFile);
+const baseSpec = {
+    id: 'SPEC-001',
+    title: 'Payment Integration',
+    type: 'feature',
+    scope: 'feature',
+    target: 'fullstack',
+    tags: ['payment', 'stripe'],
+    status: 'approved',
+    risk: 'high',
+    difficulty: 4,
+    estimation: { devHours: 16, reviewHours: 4, totalCostUsd: 400 },
+    dependencies: [],
+    huPath: null,
+    fichaTecnicaPath: null,
+};
+const baseKnowledge = {
+    language: 'typescript',
+    framework: 'next',
+    projectPath: '/test',
+    stack: [],
+    conventions: {},
+    architecture: { primary: 'monolith', secondary: [], layers: [] },
+    database: 'postgresql',
+    testCommand: null,
+    buildCommand: null,
+    linting: { detectedLinters: [] },
+    apiContracts: [],
+    layers: [],
+};
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockReadFile.mockRejectedValue(new Error('not found'));
+});
+describe('handleChallengeSpec', () => {
+    it('should return error when spec not found', async () => {
+        mockGetSpec.mockResolvedValue(null);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-999',
+            projectId: 'proj-1',
+        });
+        expect(result.isError).toBe(true);
+    });
+    it('should return error when knowledge not found', async () => {
+        mockGetSpec.mockResolvedValue(baseSpec);
+        mockGetKnowledge.mockResolvedValue(null);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+        });
+        expect(result.isError).toBe(true);
+    });
+    it('should analyze all focus areas by default', async () => {
+        mockGetSpec.mockResolvedValue(baseSpec);
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+        });
+        expect(result.isError).toBeUndefined();
+        expect(result.content).toHaveLength(2);
+        const data = JSON.parse(result.content[1].text);
+        expect(data.failureScenarios.length).toBeGreaterThan(0);
+        expect(data.concurrencyAnalysis).toBeDefined();
+        expect(data.scalabilityAssessment).toBeDefined();
+        expect(data.overallRisk).toBeDefined();
+        expect(data.summary.focusAreas).toHaveLength(5);
+    });
+    it('should filter to specific focus area: failures', async () => {
+        mockGetSpec.mockResolvedValue(baseSpec);
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['failures'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        expect(data.summary.focusAreas).toEqual(['failures']);
+        expect(data.failureScenarios.length).toBeGreaterThan(0);
+        // No concurrency analysis when not focused
+        expect(data.concurrencyAnalysis.hotPaths).toHaveLength(0);
+    });
+    it('should focus on security scenarios', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            title: 'Auth login user permission role',
+            tags: ['auth', 'security'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['security'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const hasAuthBypass = data.failureScenarios.some((s) => s.scenario.includes('authentication bypass'));
+        expect(hasAuthBypass).toBe(true);
+    });
+    it('should generate scale scenarios', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec, scope: 'architectural',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['scale'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const hasTraffic = data.failureScenarios.some((s) => s.scenario.includes('Traffic spike'));
+        expect(hasTraffic).toBe(true);
+    });
+    it('should generate data-consistency scenarios', async () => {
+        mockGetSpec.mockResolvedValue(baseSpec);
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['data-consistency'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const hasDuplicate = data.failureScenarios.some((s) => s.scenario.includes('double-clicks'));
+        expect(hasDuplicate).toBe(true);
+    });
+    it('should generate concurrency analysis', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            title: 'Cart counter login submit update status',
+            tags: ['session', 'counter'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['concurrency'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        expect(data.concurrencyAnalysis.hotPaths.length).toBeGreaterThan(0);
+        expect(data.concurrencyAnalysis.raceConditions.length).toBeGreaterThan(0);
+    });
+    it('should calculate overall risk correctly', async () => {
+        mockGetSpec.mockResolvedValue(baseSpec);
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+        });
+        const data = JSON.parse(result.content[1].text);
+        expect(['low', 'medium', 'high', 'critical']).toContain(data.overallRisk);
+    });
+    it('should handle scalability assessment for cross-module scope', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec, scope: 'cross-module',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+        });
+        const data = JSON.parse(result.content[1].text);
+        expect(data.scalabilityAssessment).toContain('phased rollout');
+    });
+    // --- Coverage for uncovered lines: readSpecContent catch blocks (lines 566-577) ---
+    it('should read huPath file content when available', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            huPath: '/test/hu.md',
+            fichaTecnicaPath: null,
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('login auth user validation timeout retry');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+        });
+        expect(result.isError).toBeUndefined();
+        const data = JSON.parse(result.content[1].text);
+        expect(data.failureScenarios.length).toBeGreaterThan(0);
+    });
+    it('should read fichaTecnicaPath file content when available', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            huPath: null,
+            fichaTecnicaPath: '/test/ficha.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/ficha.md') {
+                return Promise.resolve('counter increment balance stock vote status transition');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['concurrency'],
+        });
+        expect(result.isError).toBeUndefined();
+        const data = JSON.parse(result.content[1].text);
+        expect(data.concurrencyAnalysis.raceConditions.length).toBeGreaterThan(0);
+    });
+    it('should handle readFile errors for both huPath and fichaTecnicaPath gracefully', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            huPath: '/test/missing-hu.md',
+            fichaTecnicaPath: '/test/missing-ficha.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockRejectedValue(new Error('ENOENT'));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+        });
+        // Should not error out - catch blocks swallow file read errors
+        expect(result.isError).toBeUndefined();
+    });
+    // --- Coverage for generateScaleScenarios (line 324): non-architectural scope ---
+    it('should generate scale scenarios with low probability for non-architectural scope', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            scope: 'feature',
+            title: 'Database query search list',
+            tags: ['database'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['scale'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const trafficScenario = data.failureScenarios.find((s) => s.scenario.includes('Traffic spike'));
+        expect(trafficScenario.probability).toBe('low');
+        // Also should have data growth scenario since content has 'database' and 'query' and 'search' and 'list'
+        const dataGrowth = data.failureScenarios.find((s) => s.scenario.includes('Database grows'));
+        expect(dataGrowth).toBeDefined();
+    });
+    // --- Coverage for calculateOverallRisk (line 551): critical risk branch ---
+    it('should return critical overall risk when >= 3 critical impacts', async () => {
+        // Create a spec that triggers many critical-impact scenarios
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'fullstack',
+            title: 'auth login user permission role input form query search payment stripe webhook upload file stream batch counter increment balance stock vote status update transition session cart draft cache global config',
+            tags: ['auth', 'payment', 'security'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+        });
+        const data = JSON.parse(result.content[1].text);
+        const criticalCount = data.failureScenarios.filter((s) => s.impact === 'critical').length;
+        // With all focus areas and auth+payment+injection, we should get multiple critical scenarios
+        expect(criticalCount).toBeGreaterThanOrEqual(2);
+    });
+    // --- Coverage for low risk path (line 559) ---
+    it('should return low overall risk for minimal spec with no high-risk scenarios', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'frontend',
+            title: 'Simple page',
+            tags: [],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['data-consistency'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        // With only data-consistency focus on a minimal frontend spec, should be low-medium risk
+        expect(['low', 'medium']).toContain(data.overallRisk);
+    });
+    // --- Coverage for empty focus array ---
+    it('should use all focus areas when focus is an empty array', async () => {
+        mockGetSpec.mockResolvedValue(baseSpec);
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: [],
+        });
+        const data = JSON.parse(result.content[1].text);
+        expect(data.summary.focusAreas).toHaveLength(5);
+    });
+    // --- Coverage for scalabilityAssessment with 0 critical scenarios ---
+    it('should show no critical concerns when zero critical scenarios', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'frontend',
+            scope: 'trivial',
+            title: 'Simple button',
+            tags: [],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['scale'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        expect(data.scalabilityAssessment).toContain('No critical scalability concerns');
+    });
+    // --- Coverage for concurrency with file/upload/resource and no race conditions ---
+    it('should detect file-related race conditions in concurrency analysis', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            title: 'File upload resource manager',
+            tags: ['file', 'upload'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['concurrency'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const hasFileRace = data.concurrencyAnalysis.raceConditions.some((r) => r.includes('file'));
+        expect(hasFileRace).toBe(true);
+    });
+    // --- Coverage for concurrency: list/search/feed hot paths ---
+    it('should detect list/search/feed hot paths', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            title: 'Search feed list endpoint',
+            tags: ['search'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['concurrency'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const hasListPath = data.concurrencyAnalysis.hotPaths.some((p) => p.includes('List/search'));
+        expect(hasListPath).toBe(true);
+    });
+    // --- Coverage for shared state: cache/global/config ---
+    it('should detect cache/global shared state', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            title: 'Global cache config manager',
+            tags: ['cache'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['concurrency'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const hasCacheState = data.concurrencyAnalysis.sharedState.some((s) => s.includes('Global cache'));
+        expect(hasCacheState).toBe(true);
+    });
+    // --- Coverage for data-consistency: stale data with cache/real-time ---
+    it('should detect stale data scenario for specs mentioning cache', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            title: 'Real-time cache update transaction modify save',
+            tags: ['cache', 'real-time'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['data-consistency'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const hasStale = data.failureScenarios.some((s) => s.scenario.includes('Stale data'));
+        expect(hasStale).toBe(true);
+        const hasPartialWrite = data.failureScenarios.some((s) => s.scenario.includes('Partial write'));
+        expect(hasPartialWrite).toBe(true);
+    });
+    // --- Coverage for memory/resource exhaustion scenarios in failures ---
+    it('should detect memory exhaustion for specs with upload/file/stream', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            title: 'Bulk upload file stream processing',
+            target: 'backend',
+            tags: ['upload'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['failures'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const hasMemory = data.failureScenarios.some((s) => s.scenario.includes('Memory exhaustion'));
+        expect(hasMemory).toBe(true);
+    });
+    // --- Coverage for injection scenarios in security ---
+    it('should detect injection scenarios for specs with input/form/query', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            title: 'Search input form query processor',
+            tags: ['form', 'input'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['security'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const hasInjection = data.failureScenarios.some((s) => s.scenario.includes('injection'));
+        expect(hasInjection).toBe(true);
+    });
+    // --- Coverage for false branch: database failures block skipped for frontend-only spec ---
+    it('should skip database failure scenarios for frontend spec with no DB keywords', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'frontend',
+            title: 'Simple UI component',
+            tags: ['ui'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['failures'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const hasDbPool = data.failureScenarios.some((s) => s.scenario.includes('connection pool'));
+        expect(hasDbPool).toBe(false);
+        const hasMigration = data.failureScenarios.some((s) => s.scenario.includes('Migration fails'));
+        expect(hasMigration).toBe(false);
+        // But should still have input validation (always pushed) and network (frontend target matches)
+        const hasNetwork = data.failureScenarios.some((s) => s.scenario.includes('network timeout'));
+        expect(hasNetwork).toBe(true);
+    });
+    // --- Coverage for contentMentions true branches in generateFailureScenarios ---
+    it('should report "Partially addressed" for network failures when content mentions timeout/retry', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'fullstack',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('The API uses timeout and retry with fallback logic');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['failures'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const networkScenario = data.failureScenarios.find((s) => s.scenario.includes('network timeout'));
+        expect(networkScenario).toBeDefined();
+        expect(networkScenario.currentHandling).toBe('Partially addressed in spec');
+    });
+    it('should report "Partially addressed" for migration when content mentions rollback', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'database',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('migration with rollback for database schema changes');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['failures'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const migrationScenario = data.failureScenarios.find((s) => s.scenario.includes('Migration fails'));
+        expect(migrationScenario).toBeDefined();
+        expect(migrationScenario.currentHandling).toBe('Partially addressed');
+    });
+    it('should report "Validation mentioned" when content mentions validation keywords', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'frontend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('All inputs validated with zod schema validation');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['failures'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const inputScenario = data.failureScenarios.find((s) => s.scenario.includes('Malformed or oversized'));
+        expect(inputScenario).toBeDefined();
+        expect(inputScenario.currentHandling).toBe('Validation mentioned in spec');
+    });
+    it('should report "Partially addressed" for third-party when content mentions circuit breaker', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('stripe payment webhook with circuit breaker and retry queue fallback');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['failures'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const thirdPartyScenario = data.failureScenarios.find((s) => s.scenario.includes('Third-party service'));
+        expect(thirdPartyScenario).toBeDefined();
+        expect(thirdPartyScenario.currentHandling).toBe('Partially addressed');
+    });
+    it('should report "Partially addressed" for memory exhaustion when content mentions streaming/pagination', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('bulk upload file with stream chunk pagination limit');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['failures'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const memoryScenario = data.failureScenarios.find((s) => s.scenario.includes('Memory exhaustion'));
+        expect(memoryScenario).toBeDefined();
+        expect(memoryScenario.currentHandling).toBe('Partially addressed');
+    });
+    // --- Coverage for contentMentions true branches in generateSecurityScenarios ---
+    it('should report "Authentication mentioned" when content mentions jwt/session', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('auth login user with jwt session middleware permission role');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['security'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const authScenario = data.failureScenarios.find((s) => s.scenario.includes('authentication bypass'));
+        expect(authScenario).toBeDefined();
+        expect(authScenario.currentHandling).toBe('Authentication mentioned');
+    });
+    it('should report "Some sanitization mentioned" when content mentions parameterized/escaping', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('input form query search user sanitized escaped parameterized prepared statements');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['security'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const injectionScenario = data.failureScenarios.find((s) => s.scenario.includes('injection'));
+        expect(injectionScenario).toBeDefined();
+        expect(injectionScenario.currentHandling).toBe('Some sanitization mentioned');
+    });
+    it('should report "Some protection mentioned" for CSRF when content mentions rate limit/csrf', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('csrf token protection with rate limit and throttle captcha');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['security'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const csrfScenario = data.failureScenarios.find((s) => s.scenario.includes('CSRF'));
+        expect(csrfScenario).toBeDefined();
+        expect(csrfScenario.currentHandling).toBe('Some protection mentioned');
+    });
+    // --- Coverage for memory exhaustion false branch: upload without stream/limit/chunk/pagination ---
+    it('should report "Not addressed" for memory exhaustion when content has upload but no streaming keywords', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            title: 'Batch upload processor',
+            tags: ['batch'],
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['failures'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const memoryScenario = data.failureScenarios.find((s) => s.scenario.includes('Memory exhaustion'));
+        expect(memoryScenario).toBeDefined();
+        expect(memoryScenario.currentHandling).toBe('Not addressed');
+    });
+    // --- Coverage for generateScaleScenarios true branch: cache/cdn/queue mentioned ---
+    it('should report "Some scaling strategy mentioned" when content mentions cache/scale', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('auto-scale with cache cdn queue for high traffic');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['scale'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const trafficScenario = data.failureScenarios.find((s) => s.scenario.includes('Traffic spike'));
+        expect(trafficScenario).toBeDefined();
+        expect(trafficScenario.currentHandling).toBe('Some scaling strategy mentioned');
+    });
+    // --- Coverage for contentMentions true branch on line 358 (scale: pagination/index) ---
+    it('should report "Some query optimization mentioned" when content mentions pagination/index', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('database table query list search with index pagination cursor partition');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['scale'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const dataGrowthScenario = data.failureScenarios.find((s) => s.scenario.includes('Database grows'));
+        expect(dataGrowthScenario).toBeDefined();
+        expect(dataGrowthScenario.currentHandling).toBe('Some query optimization mentioned');
+    });
+    // --- Coverage for data-consistency: partial writes with transaction/atomic mentioned ---
+    it('should report "Transactions mentioned" for partial writes when content mentions atomic/transaction', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('transaction atomic rollback update create modify save');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['data-consistency'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const partialWriteScenario = data.failureScenarios.find((s) => s.scenario.includes('Partial write'));
+        expect(partialWriteScenario).toBeDefined();
+        expect(partialWriteScenario.currentHandling).toBe('Transactions mentioned');
+    });
+    // --- Coverage for data-consistency: stale data with invalidation/ttl mentioned ---
+    it('should report "Some cache strategy mentioned" when content mentions invalidation/ttl', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('cache invalidation with ttl websocket real-time concurrent updates');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['data-consistency'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const staleScenario = data.failureScenarios.find((s) => s.scenario.includes('Stale data'));
+        expect(staleScenario).toBeDefined();
+        expect(staleScenario.currentHandling).toBe('Some cache strategy mentioned');
+    });
+    // --- Coverage for contentMentions true branch on line 423 (data-consistency: idempotent/debounce) ---
+    it('should report "Some prevention mentioned" for duplicates when content mentions idempotency/debounce', async () => {
+        mockGetSpec.mockResolvedValue({
+            ...baseSpec,
+            target: 'backend',
+            huPath: '/test/hu.md',
+        });
+        mockGetKnowledge.mockResolvedValue(baseKnowledge);
+        mockReadFile.mockImplementation(((path) => {
+            if (path === '/test/hu.md') {
+                return Promise.resolve('idempotent operations with debounce and disable lock on submit');
+            }
+            return Promise.reject(new Error('not found'));
+        }));
+        const result = await handleChallengeSpec({
+            specId: 'SPEC-001',
+            projectId: 'proj-1',
+            focus: ['data-consistency'],
+        });
+        const data = JSON.parse(result.content[1].text);
+        const duplicateScenario = data.failureScenarios.find((s) => s.scenario.includes('double-clicks'));
+        expect(duplicateScenario).toBeDefined();
+        expect(duplicateScenario.currentHandling).toBe('Some prevention mentioned');
+    });
+});
+//# sourceMappingURL=challenge-spec.test.js.map