@principles/pd-cli 1.133.0 → 1.134.0

package/tests/commands/candidate-audit-repair.test.ts

@@ -96,6 +96,18 @@ vi.mock('@principles/core/runtime-v2', () => ({
   }),
   resolveOutputLanguage: vi.fn().mockReturnValue({ outputLanguage: 'zh-CN' }),
   PrincipleTreeLedgerAdapter: MockPrincipleTreeLedgerAdapter,
+  evaluateCandidateAdmissionFromRecord: vi.fn((candidate: { recommendationKind: string; confidence: number | null }) => {
+    if (candidate.recommendationKind === 'defer') {
+      return { decision: 'deferred', reason: 'recommendation_kind_defer_not_actionable', nextAction: 'review_defer_disposition_manually', evidenceStatus: 'unknown' };
+    }
+    if (candidate.confidence === null) {
+      return { decision: 'needs_evidence', reason: 'confidence_missing_on_candidate_record', nextAction: 're_run_diagnosis_to_populate_confidence_or_manual_review', evidenceStatus: 'unknown' };
+    }
+    if (candidate.confidence !== undefined && candidate.confidence < 0.5) {
+      return { decision: 'needs_evidence', reason: `confidence_below_threshold:${candidate.confidence.toFixed(2)}<0.5`, nextAction: 'provide_additional_evidence_or_manual_review', evidenceStatus: 'unknown' };
+    }
+    return { decision: 'admitted', reason: 'cli_partial_check_passed_confidence_and_kind', nextAction: 'none', evidenceStatus: 'unknown' };
+  }),
 }));
 
 // PRI-443 Phase 5: loadLedger and getLedgerFilePathPublic now imported from
@@ -341,4 +353,69 @@ describe('pd candidate repair', () => {
     );
     expect(exitSpy).toHaveBeenCalledWith(1);
   });
+
+  // PRI-442 Stage 4: admission gate bypass prevention for repair
+  describe('admission gate bypass prevention (PRI-442 Stage 4)', () => {
+    it('refuses repair when recommendationKind is defer', async () => {
+      mockStateManager.getCandidate.mockResolvedValue({
+        candidateId: 'c-defer',
+        status: 'consumed',
+        artifactId: 'a1',
+        title: 'Deferred',
+        description: 'desc',
+        recommendationKind: 'defer',
+        confidence: 0.9,
+      });
+
+      await handleCandidateRepair({ candidateId: 'c-defer', workspace: '/tmp/test-workspace', json: true });
+
+      expect(consoleLogSpy).toHaveBeenCalledWith(
+        expect.stringContaining('"status": "refused"'),
+      );
+      expect(consoleLogSpy).toHaveBeenCalledWith(
+        expect.stringContaining('"admissionDecision": "deferred"'),
+      );
+      expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+
+    it('refuses repair when confidence is null (rc-3 fail loud)', async () => {
+      mockStateManager.getCandidate.mockResolvedValue({
+        candidateId: 'c-null',
+        status: 'consumed',
+        artifactId: 'a1',
+        title: 'Null conf',
+        description: 'desc',
+        recommendationKind: 'principle',
+        confidence: null,
+      });
+
+      await handleCandidateRepair({ candidateId: 'c-null', workspace: '/tmp/test-workspace', json: false });
+
+      expect(consoleErrorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('Admission gate refused'),
+      );
+      expect(consoleErrorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('needs_evidence'),
+      );
+      expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+
+    it('allows repair when candidate passes admission gate', async () => {
+      mockStateManager.getCandidate.mockResolvedValue({
+        candidateId: 'c-ok',
+        status: 'consumed',
+        artifactId: 'a1',
+        title: 'OK',
+        description: 'desc',
+        recommendationKind: 'principle',
+        confidence: 0.8,
+      });
+      mockAdapter.existsForCandidate.mockReturnValue(null);
+      mockService.intake.mockResolvedValue({ id: 'entry-1', title: 'OK', text: 'text', status: 'probation' });
+
+      await handleCandidateRepair({ candidateId: 'c-ok', workspace: '/tmp/test-workspace', json: true });
+
+      expect(mockService.intake).toHaveBeenCalledWith('c-ok');
+    });
+  });
 });

package/tests/commands/candidate-intake.test.ts

@@ -72,6 +72,19 @@ vi.mock('@principles/core/runtime-v2', () => ({
   RuntimeStateManager: MockRuntimeStateManager,
   resolveOutputLanguage: vi.fn().mockReturnValue({ outputLanguage: 'zh-CN' }),
   PrincipleTreeLedgerAdapter: MockPrincipleTreeLedgerAdapter,
+  evaluateCandidateAdmissionFromRecord: vi.fn((candidate: { recommendationKind: string; confidence: number | null }) => {
+    // Mirror the real implementation for test purposes
+    if (candidate.recommendationKind === 'defer') {
+      return { decision: 'deferred', reason: 'recommendation_kind_defer_not_actionable', nextAction: 'review_defer_disposition_manually', evidenceStatus: 'unknown' };
+    }
+    if (candidate.confidence === null) {
+      return { decision: 'needs_evidence', reason: 'confidence_missing_on_candidate_record', nextAction: 're_run_diagnosis_to_populate_confidence_or_manual_review', evidenceStatus: 'unknown' };
+    }
+    if (candidate.confidence < 0.5) {
+      return { decision: 'needs_evidence', reason: `confidence_below_threshold:${candidate.confidence.toFixed(2)}<0.5`, nextAction: 'provide_additional_evidence_or_manual_review', evidenceStatus: 'unknown' };
+    }
+    return { decision: 'admitted', reason: 'cli_partial_check_passed_confidence_and_kind', nextAction: 'none', evidenceStatus: 'unknown' };
+  }),
 }));
 
 vi.mock('../../src/resolve-workspace.js', () => ({
@@ -348,29 +361,37 @@ describe('pd candidate intake', () => {
 
   // Test 4: Non-existent candidate
   it('Test 4 (non-existent candidate): throws CANDIDATE_NOT_FOUND error', async () => {
-    // Setup: service.intake throws CANDIDATE_NOT_FOUND when candidate doesn't exist
-    mockService.intake.mockImplementation(() => {
-      throw new MockCandidateIntakeError(
-        `Candidate invalid-id not found`,
-        'CANDIDATE_NOT_FOUND',
-        { candidateId: 'invalid-id' }
-      );
-    });
+    // PRI-442 Stage 4: getCandidate now returns null before service.intake is called.
+    // The CLI exits with "Candidate not found" instead of relying on service.intake
+    // to throw CANDIDATE_NOT_FOUND.
+    mockStateManager.getCandidate.mockResolvedValue(null);
 
     await handleCandidateIntake({
       candidateId: 'invalid-id',
       workspace: '/tmp/test-workspace',
     });
 
-    // Verify error output contains CANDIDATE_NOT_FOUND
+    // Verify error output contains "Candidate not found"
     expect(consoleErrorSpy).toHaveBeenCalledWith(
-      expect.stringContaining('CANDIDATE_NOT_FOUND')
+      expect.stringContaining('Candidate not found')
     );
     expect(exitSpy).toHaveBeenCalledWith(1);
   });
 
   // Test 5: Invalid candidateId (empty string)
   it('Test 5 (invalid candidateId): empty string throws INPUT_INVALID error', async () => {
+    // PRI-442 Stage 4: getCandidate is called before service.intake, so we need
+    // to mock it to return a valid candidate so service.intake is reached.
+    const mockCandidate = {
+      candidateId: '',
+      artifactId: 'artifact-1',
+      taskId: 'task-1',
+      title: 'Test',
+      description: 'Test',
+      status: 'pending',
+    };
+    mockStateManager.getCandidate.mockResolvedValue(mockCandidate);
+
     // Setup: service.intake throws INPUT_INVALID for empty candidateId
     mockService.intake.mockImplementation(() => {
       throw new MockCandidateIntakeError(
@@ -475,6 +496,18 @@ describe('pd candidate intake', () => {
 
   // Test 7: Generic error (non-CandidateIntakeError, covers line 247)
   it('Test 7 (generic error): handles non-CandidateIntakeError errors', async () => {
+    // PRI-442 Stage 4: getCandidate is called before service.intake, so we need
+    // to mock it to return a valid candidate so service.intake is reached.
+    const mockCandidate = {
+      candidateId: 'valid-id',
+      artifactId: 'artifact-1',
+      taskId: 'task-1',
+      title: 'Test',
+      description: 'Test',
+      status: 'pending',
+    };
+    mockStateManager.getCandidate.mockResolvedValue(mockCandidate);
+
     // Setup: service.intake throws a generic Error (not CandidateIntakeError)
     mockService.intake.mockImplementation(() => {
       throw new Error('Some unexpected error');
@@ -584,4 +617,116 @@ describe('pd candidate intake', () => {
       mockStateManager.connection = originalConnection;
     }
   });
+
+  // PRI-442 Stage 4: admission gate bypass tests
+  describe('admission gate bypass prevention (PRI-442 Stage 4)', () => {
+    it('refuses intake when recommendationKind is defer', async () => {
+      const mockCandidate = {
+        candidateId: 'defer-cand',
+        artifactId: 'artifact-1',
+        taskId: 'task-1',
+        title: 'Deferred candidate',
+        description: 'Should not be intakeable',
+        status: 'pending',
+        recommendationKind: 'defer',
+        confidence: 0.9,
+      };
+      mockStateManager.getCandidate.mockResolvedValue(mockCandidate);
+
+      await handleCandidateIntake({
+        candidateId: 'defer-cand',
+        workspace: '/tmp/test-workspace',
+        json: true,
+      });
+
+      // Should NOT call service.intake
+      expect(mockService.intake).not.toHaveBeenCalled();
+      // Should output refused status
+      expect(consoleLogSpy).toHaveBeenCalledWith(
+        expect.stringContaining('"status": "refused"')
+      );
+      expect(consoleLogSpy).toHaveBeenCalledWith(
+        expect.stringContaining('"admissionDecision": "deferred"')
+      );
+      expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+
+    it('refuses intake when confidence is below threshold', async () => {
+      const mockCandidate = {
+        candidateId: 'low-conf-cand',
+        artifactId: 'artifact-1',
+        taskId: 'task-1',
+        title: 'Low confidence candidate',
+        description: 'Should not be intakeable',
+        status: 'pending',
+        recommendationKind: 'principle',
+        confidence: 0.3,
+      };
+      mockStateManager.getCandidate.mockResolvedValue(mockCandidate);
+
+      await handleCandidateIntake({
+        candidateId: 'low-conf-cand',
+        workspace: '/tmp/test-workspace',
+        json: false,
+      });
+
+      expect(mockService.intake).not.toHaveBeenCalled();
+      expect(consoleErrorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('Admission gate refused')
+      );
+      expect(consoleErrorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('needs_evidence')
+      );
+      expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+
+    it('refuses intake when confidence is null (rc-3 fail loud)', async () => {
+      const mockCandidate = {
+        candidateId: 'null-conf-cand',
+        artifactId: 'artifact-1',
+        taskId: 'task-1',
+        title: 'Null confidence candidate',
+        description: 'Should not be intakeable',
+        status: 'pending',
+        recommendationKind: 'principle',
+        confidence: null,
+      };
+      mockStateManager.getCandidate.mockResolvedValue(mockCandidate);
+
+      await handleCandidateIntake({
+        candidateId: 'null-conf-cand',
+        workspace: '/tmp/test-workspace',
+        json: true,
+      });
+
+      expect(mockService.intake).not.toHaveBeenCalled();
+      expect(consoleLogSpy).toHaveBeenCalledWith(
+        expect.stringContaining('confidence_missing_on_candidate_record')
+      );
+      expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+
+    it('allows intake when candidate passes admission gate', async () => {
+      const mockCandidate = {
+        candidateId: 'admitted-cand',
+        artifactId: 'artifact-1',
+        taskId: 'task-1',
+        title: 'Admitted candidate',
+        description: 'Should be intakeable',
+        status: 'pending',
+        recommendationKind: 'principle',
+        confidence: 0.8,
+      };
+      mockStateManager.getCandidate.mockResolvedValue(mockCandidate);
+      mockService.intake.mockResolvedValue({ id: 'entry-1', title: 'Test', text: 'Test', status: 'probation' });
+
+      await handleCandidateIntake({
+        candidateId: 'admitted-cand',
+        workspace: '/tmp/test-workspace',
+        json: true,
+      });
+
+      expect(mockService.intake).toHaveBeenCalledWith('admitted-cand');
+    });
+  });
 });

package/tests/commands/candidate-internalization-backfill.test.ts

@@ -477,6 +477,36 @@ describe('Commander wiring for backfill --include-pending', () => {
     expect(output.details.totalPending).toBe(1);
   });
 
+  // PRI-442 Stage 4: admission gate bypass prevention for backfill --include-pending
+  it('--include-pending refuses deferred candidate (admission gate bypass prevention)', async () => {
+    mockPrepareAll.mockImplementation((sql: string) => {
+      if (sql.includes("'consumed'")) return [];
+      if (sql.includes("'pending'")) return [{ candidate_id: 'cand-defer-1' }];
+      return [];
+    });
+    mockGetCandidate.mockResolvedValue({
+      candidateId: 'cand-defer-1',
+      taskId: 'diag-task-cand-defer-1',
+      description: 'deferred candidate',
+      recommendationKind: 'defer',
+      confidence: 0.9,
+      sourceRecommendationJson: JSON.stringify({ kind: 'defer', description: 'deferred' }),
+    });
+
+    const program = createBackfillTestProgram();
+    await program.parseAsync(['node', 'pd', 'candidate', 'internalization', 'backfill', '--workspace', WS, '--include-pending', '--confirm', '--json']);
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    // Should NOT have called intake for the deferred candidate
+    expect(mockIntake).not.toHaveBeenCalled();
+    // Should have an intake_failed result with admission gate reason
+    const failedResult = output.details.results.find(
+      (r: { status: string; reason: string }) => r.status === 'intake_failed' && r.reason.includes('Admission gate refused'),
+    );
+    expect(failedResult).toBeDefined();
+    expect(output.details.intakeFailed).toBe(1);
+  });
+
   it('--dry-run -> RuntimeStateManager readonly=true', async () => {
     const program = createBackfillTestProgram();
     await program.parseAsync(['node', 'pd', 'candidate', 'internalization', 'backfill', '--workspace', WS, '--dry-run', '--json']);

package/tests/commands/cli-help-snapshot.test.ts

@@ -86,7 +86,6 @@ describe('PRI-455: pd runtime --help shows only MVP owner subcommands', () => {
     'canary',
     'synthetic',
     'uat',
-    'internalization',
     'recovery',
     'pruning',
     'diagnostics',
@@ -133,3 +132,18 @@ describe('PRI-455: hidden commands still function (de-surface, not delete)', ()
     expect(output).toContain('--apply');
   });
 });
+
+describe('pd demo first-principle alias (Fix-24)', () => {
+  // cli-7-test-wiring: verify the alias resolves to the same command as story-a.
+  it('pd demo first-principle --help works and matches story-a', () => {
+    const aliasOutput = runPdHelp(['demo', 'first-principle', '--help']);
+    const storyAOutput = runPdHelp(['demo', 'story-a', '--help']);
+
+    // Both should show the same options
+    expect(aliasOutput).toContain('--workspace');
+    expect(aliasOutput).toContain('--json');
+    expect(aliasOutput).toContain('--channels');
+    // Alias output should be identical to story-a output
+    expect(aliasOutput).toBe(storyAOutput);
+  });
+});

package/tests/commands/console-open.test.ts

@@ -499,6 +499,9 @@ describe('CLI command wiring (pd console open)', () => {
     // Fake a console install: create dir + dist/server.js with a minimal HTTP server
     const consoleDir = path.join(os.homedir(), '.openclaw', 'extensions', 'principles-disciple', 'console');
     fs.mkdirSync(path.join(consoleDir, 'dist'), { recursive: true });
+    // EP-06 regression guard: dist/web/index.html must exist (PR #1169 fix)
+    fs.mkdirSync(path.join(consoleDir, 'dist', 'web'), { recursive: true });
+    fs.writeFileSync(path.join(consoleDir, 'dist', 'web', 'index.html'), '<!DOCTYPE html><html></html>');
     fs.writeFileSync(path.join(consoleDir, 'dist', 'server.js'), `
       const http = require('http');
       const args = process.argv.slice(2);
@@ -759,6 +762,22 @@ describe('CLI command wiring (pd console open)', () => {
       expect(parsed.host).toBe('::1');
     }, 10_000);
   });
+
+  describe('EP-06 regression guard: dist/web/index.html check (PR #1169)', () => {
+    it('returns console_web_ui_missing when dist/web/index.html does not exist', () => {
+      // beforeEach creates the fake console dir WITH dist/web/index.html.
+      // Remove it to simulate a corrupted install (the PR #1169 regression).
+      const consoleDir = path.join(os.homedir(), '.openclaw', 'extensions', 'principles-disciple', 'console');
+      const webIndex = path.join(consoleDir, 'dist', 'web', 'index.html');
+      fs.rmSync(webIndex, { force: true });
+
+      const out = runPd(['console', 'open', '--workspace', tmp, '--json', '--no-browser'], workspaceRoot, 5_000);
+      const parsed = JSON.parse(out);
+      expect(parsed.status).toBe('failed');
+      expect(parsed.reason).toBe('console_web_ui_missing');
+      expect(parsed.nextAction).toMatch(/create-principles-disciple/);
+    }, 10_000);
+  });
 });
 
 function runPd(args: string[], cwd: string, timeoutMs?: number): string {