@stylusnexus/work-plan 2026.6.11 → 2026.6.13

package/skills/work-plan/tests/test_export_command.py

@@ -16,6 +16,8 @@ def _track(name, repo, issues, *, has_frontmatter=True, status="active"):
         name=name,
         repo=repo,
         tier="private",
+        path=Path(f"/tmp/notes/{name}.md"),
+        folder="myrepo",
         has_frontmatter=has_frontmatter,
         meta={
             "status": status,
@@ -71,6 +73,23 @@ class ExportRunJsonTest(unittest.TestCase):
         self.assertEqual(rc, 0)
         self.assertEqual(out["schema"], 1)
 
+    def test_track_file_path_is_emitted(self):
+        """The export carries each track's .md path end-to-end (#211)."""
+        tracks = [_track("alpha", _SHARED_REPO, [1])]
+        rc, out, _ = self._run_with_mocks(tracks, _EXPORT_MAP)
+        self.assertEqual(rc, 0)
+        # str(Path(...)) so the expected separator matches the platform (Windows
+        # backslashes). The path is whatever os.sep the fixture's Path produces.
+        self.assertEqual(out["tracks"][0]["path"], str(Path("/tmp/notes/alpha.md")))
+
+    def test_track_folder_key_is_emitted(self):
+        """The export carries each track's config folder key end-to-end for the
+        Plans view's `plan-status --repo=<key>` arg (#164)."""
+        tracks = [_track("alpha", _SHARED_REPO, [1])]
+        rc, out, _ = self._run_with_mocks(tracks, _EXPORT_MAP)
+        self.assertEqual(rc, 0)
+        self.assertEqual(out["tracks"][0]["folder"], "myrepo")
+
     def test_track_issues_assembled_in_declared_order(self):
         # Issues are milestone-sorted (#101): null-milestone group sorts by number.
         tracks = [_track("alpha", _SHARED_REPO, [2, 1])]

package/skills/work-plan/tests/test_init_repo.py

@@ -136,12 +136,55 @@ class InitRepoNonInteractiveTest(unittest.TestCase):
     # ------------------------------------------------------------------
 
     def test_repo_already_exists_returns_rc1(self):
-        """Key already in config.repos → rc 1, yq NOT called."""
+        """Key already in config.repos (no --update) → rc 1, yq NOT called,
+        and the message points at --update."""
         existing = {"mykey": {"github": "org/myrepo", "local": None}}
         rc, msub, out = _drive(["mykey", "--github=org/myrepo"], existing_repos=existing)
         self.assertEqual(rc, 1)
         msub.assert_not_called()
         self.assertIn("already exists", out)
+        self.assertIn("--update", out)
+
+    # ------------------------------------------------------------------
+    # --update on an existing key → updates its local path
+    # ------------------------------------------------------------------
+
+    def test_update_existing_sets_local(self):
+        """Existing key + --update --local=/new/path → yq merges local into the
+        existing block; rc 0; no 'already exists' error."""
+        existing = {"mykey": {"github": "org/myrepo"}}
+        rc, msub, out = _drive(
+            ["mykey", "--github=org/myrepo", "--local=/new/path", "--update"],
+            existing_repos=existing,
+        )
+        self.assertEqual(rc, 0)
+        msub.assert_called_once()
+        yq_args = msub.call_args[0][0]
+        self.assertEqual(yq_args[0], "yq")
+        self.assertEqual(yq_args[1], "-i")
+        # Merge expression preserves other keys via `* env(...)`.
+        expr = yq_args[2]
+        self.assertIn(".repos.mykey", expr)
+        self.assertIn("env(WP_REPO_UPDATES)", expr)
+        updates = json.loads(msub.call_args.kwargs["env"]["WP_REPO_UPDATES"])
+        self.assertEqual(updates["local"], "/new/path")
+        self.assertIn("Updated", out)
+        self.assertNotIn("already exists", out)
+
+    def test_update_nonexistent_key_falls_back_to_add(self):
+        """--update on a key NOT in config → behaves as a plain add (creates the
+        block via the add path), rc 0."""
+        rc, msub, out = _drive(
+            ["mykey", "--github=org/myrepo", "--local=/some/path", "--update"],
+            existing_repos={},
+        )
+        self.assertEqual(rc, 0)
+        msub.assert_called_once()
+        expr = msub.call_args[0][0][2]
+        # Add path uses the assignment form, not the merge form.
+        self.assertEqual(expr, ".repos.mykey = env(WP_REPO_BLOCK)")
+        block = json.loads(msub.call_args.kwargs["env"]["WP_REPO_BLOCK"])
+        self.assertEqual(block["local"], "/some/path")
 
     # ------------------------------------------------------------------
     # No key → rc 2
@@ -153,6 +196,62 @@ class InitRepoNonInteractiveTest(unittest.TestCase):
         self.assertEqual(rc, 2)
         msub.assert_not_called()
 
+    # ------------------------------------------------------------------
+    # --clear-local: sets local to null on an existing key
+    # ------------------------------------------------------------------
+
+    def test_clear_local_sets_local_null(self):
+        """--update --clear-local on an existing key → yq merges {local: null};
+        rc 0; '✓ Cleared local path' printed."""
+        existing = {"mykey": {"github": "org/myrepo", "local": "/old/path"}}
+        rc, msub, out = _drive(
+            ["mykey", "--update", "--clear-local"],
+            existing_repos=existing,
+        )
+        self.assertEqual(rc, 0)
+        msub.assert_called_once()
+        expr = msub.call_args[0][0][2]
+        self.assertIn(".repos.mykey", expr)
+        self.assertIn("env(WP_REPO_UPDATES)", expr)
+        updates = json.loads(msub.call_args.kwargs["env"]["WP_REPO_UPDATES"])
+        self.assertIn("local", updates)
+        self.assertIsNone(updates["local"])
+        # github not passed → not in the merge (other fields preserved by yq).
+        self.assertNotIn("github", updates)
+        self.assertIn("Cleared local path", out)
+
+    def test_clear_local_with_local_is_mutually_exclusive(self):
+        """--clear-local + --local=<path> → rc 2, yq NOT called."""
+        existing = {"mykey": {"github": "org/myrepo", "local": "/old/path"}}
+        rc, msub, out = _drive(
+            ["mykey", "--update", "--clear-local", "--local=/new/path"],
+            existing_repos=existing,
+        )
+        self.assertEqual(rc, 2)
+        msub.assert_not_called()
+        self.assertIn("mutually exclusive", out)
+
+    def test_clear_local_without_update_returns_rc2(self):
+        """--clear-local without --update → rc 2, yq NOT called."""
+        existing = {"mykey": {"github": "org/myrepo", "local": "/old/path"}}
+        rc, msub, out = _drive(
+            ["mykey", "--clear-local"],
+            existing_repos=existing,
+        )
+        self.assertEqual(rc, 2)
+        msub.assert_not_called()
+        self.assertIn("requires --update", out)
+
+    def test_clear_local_nonexistent_key_returns_rc1(self):
+        """--update --clear-local on a key NOT in config → rc 1, yq NOT called."""
+        rc, msub, out = _drive(
+            ["mykey", "--update", "--clear-local"],
+            existing_repos={},
+        )
+        self.assertEqual(rc, 1)
+        msub.assert_not_called()
+        self.assertIn("not found", out)
+
     # ------------------------------------------------------------------
     # Invalid key format → rc 2
     # ------------------------------------------------------------------

package/skills/work-plan/tests/test_list_open_issues.py

@@ -0,0 +1,83 @@
+"""Tests for the list-open-issues subcommand (#282).
+
+Mocks fetch_open_issues — runs offline, never touches the network.
+"""
+import io
+import json
+import sys
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+from unittest.mock import patch
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from commands import list_open_issues
+
+
+def _row(number, title="t", state="OPEN", logins=(), milestone=None):
+    """A raw gh issue row as fetch_open_issues returns."""
+    d = {"number": number, "title": title, "state": state,
+         "assignees": [{"login": l} for l in logins]}
+    if milestone:
+        d["milestone"] = {"title": milestone}
+    return d
+
+
+def _run(args, rows):
+    with patch("commands.list_open_issues.fetch_open_issues", return_value=rows):
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            rc = list_open_issues.run(args)
+    out = buf.getvalue()
+    try:
+        parsed = json.loads(out)
+    except json.JSONDecodeError:
+        parsed = None
+    return rc, parsed
+
+
+class ListOpenIssuesTest(unittest.TestCase):
+    def test_emits_repo_and_normalized_issues(self):
+        rows = [_row(91, "Rate-limit login", "OPEN", ["eve"], "v0.6"),
+                _row(87, "Fix auth", "OPEN")]
+        rc, out = _run(["--repo=o/r"], rows)
+        self.assertEqual(rc, 0)
+        self.assertEqual(out["repo"], "o/r")
+        # Same Issue shape as the export (number/title/state/assignee/milestone).
+        self.assertEqual(
+            out["issues"][0],
+            {"number": 91, "title": "Rate-limit login", "state": "open",
+             "assignee": "@eve", "milestone": "v0.6"},
+        )
+        self.assertEqual(out["issues"][1],
+                         {"number": 87, "title": "Fix auth", "state": "open",
+                          "assignee": "—", "milestone": None})
+
+    def test_exclude_filters_given_numbers(self):
+        rows = [_row(1), _row(2), _row(3)]
+        rc, out = _run(["--repo=o/r", "--exclude=1,3"], rows)
+        self.assertEqual(rc, 0)
+        self.assertEqual([i["number"] for i in out["issues"]], [2])
+
+    def test_exclude_tolerates_blanks_and_nonnumeric(self):
+        rows = [_row(1), _row(2)]
+        rc, out = _run(["--repo=o/r", "--exclude=1, ,x,"], rows)
+        self.assertEqual(rc, 0)
+        self.assertEqual([i["number"] for i in out["issues"]], [2])
+
+    def test_missing_repo_is_usage_error(self):
+        rc, out = _run([], [])
+        self.assertEqual(rc, 2)
+        self.assertIn("error", out)
+
+    def test_empty_fetch_yields_empty_issue_list(self):
+        # fetch_open_issues returns [] on a bad/unreachable repo — not an error.
+        rc, out = _run(["--repo=o/r"], [])
+        self.assertEqual(rc, 0)
+        self.assertEqual(out, {"repo": "o/r", "issues": []})
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_notes_vcs_command.py

@@ -308,5 +308,82 @@ class DispatcherHookTest(unittest.TestCase):
             self.assertIsNone(work_plan._notes_precommit_state("slot"))
 
 
+class SharedDispatcherHookTest(unittest.TestCase):
+    """The shared-tier (#260) auto-commit hook mirrors the notes one: snapshot
+    each plan_branch repo's dirty .work-plan/ paths BEFORE the command, then
+    commit only that repo's delta — never another repo's pre-existing edits.
+    """
+
+    @staticmethod
+    def _cfg_two():
+        return {"notes_root": "/tmp/notes", "repos": {
+            "alpha": {"github": "o/alpha", "local": "/tmp/alpha", "plan_branch": "wp-plan"},
+            "beta":  {"github": "o/beta",  "local": "/tmp/beta",  "plan_branch": "wp-plan"},
+            "gamma": {"github": "o/gamma", "local": "/tmp/gamma"},  # legacy, no plan_branch
+        }}
+
+    def test_commits_only_the_touched_repo(self):
+        cfg = self._cfg_two()
+        # alpha gains a file; beta has a pre-existing dirty file that must NOT
+        # be committed; gamma has no plan_branch so it's never visited. Keyed by
+        # Path.name (not str) so the test is OS path-separator agnostic.
+        dirty = {
+            "alpha": [[], [".work-plan/x.md"]],   # before, after
+            "beta":  [[".work-plan/stale.md"], [".work-plan/stale.md"]],
+        }
+        def fake_ensure(local, branch):
+            return Path(local)  # use the repo's local path as the worktree handle
+        def fake_dirty(wt):
+            return dirty[Path(wt).name].pop(0)
+        commits = []
+        def fake_commit(wt, msg, paths):
+            commits.append((Path(wt).name, tuple(paths)))
+            return "deadbee"
+        with patch("lib.config.load_config", return_value=cfg), \
+             patch("lib.plan_worktree.ensure_worktree", side_effect=fake_ensure), \
+             patch("lib.plan_worktree.dirty_work_plan_paths", side_effect=fake_dirty), \
+             patch("lib.plan_worktree.commit_shared_tier", side_effect=fake_commit):
+            err = io.StringIO()
+            with redirect_stderr(err):
+                pre = work_plan._shared_precommit_state("slot")
+                work_plan._commit_shared_writes(pre, ["slot", "1", "x"])
+            out = err.getvalue()
+        # Only alpha committed, and only its new path.
+        self.assertEqual(commits, [("alpha", (".work-plan/x.md",))])
+        self.assertIn("alpha", out)
+        self.assertNotIn("beta", out)
+
+    def test_skips_read_only_command(self):
+        with patch("lib.config.load_config", return_value=self._cfg_two()) as mload:
+            self.assertIsNone(work_plan._shared_precommit_state("brief"))
+            mload.assert_not_called()
+
+    def test_none_when_no_plan_branch_repos(self):
+        cfg = {"notes_root": "/tmp/n", "repos": {
+            "gamma": {"github": "o/gamma", "local": "/tmp/gamma"}}}
+        with patch("lib.config.load_config", return_value=cfg):
+            self.assertIsNone(work_plan._shared_precommit_state("slot"))
+
+    def test_precommit_never_raises_on_failure(self):
+        with patch("lib.config.load_config", side_effect=RuntimeError("boom")):
+            self.assertIsNone(work_plan._shared_precommit_state("slot"))
+
+    def test_warns_when_changes_present_but_commit_refused(self):
+        cfg = {"notes_root": "/tmp/n", "repos": {
+            "alpha": {"github": "o/alpha", "local": "/tmp/alpha", "plan_branch": "wp"}}}
+        seq = {"alpha": [[], [".work-plan/x.md"]]}
+        with patch("lib.config.load_config", return_value=cfg), \
+             patch("lib.plan_worktree.ensure_worktree",
+                   side_effect=lambda l, b: Path(l)), \
+             patch("lib.plan_worktree.dirty_work_plan_paths",
+                   side_effect=lambda wt: seq[Path(wt).name].pop(0)), \
+             patch("lib.plan_worktree.commit_shared_tier", return_value=None):
+            err = io.StringIO()
+            with redirect_stderr(err):
+                pre = work_plan._shared_precommit_state("slot")
+                work_plan._commit_shared_writes(pre, ["slot", "1", "x"])
+            self.assertIn("NOT", err.getvalue())
+
+
 if __name__ == "__main__":
     unittest.main()

package/skills/work-plan/tests/test_plan_branch.py

@@ -0,0 +1,279 @@
+"""Tests for the plan-branch command (#260 Phase 3). All git + config writes
+are mocked — offline, no real repo or yq touched.
+"""
+import io
+import json
+import sys
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+from unittest.mock import patch, MagicMock
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from commands import plan_branch as pb
+
+
+def _cfg(plan_branch=None, local="/tmp/repo", github="o/r", visibility=None):
+    entry = {"github": github}
+    if local is not None:
+        entry["local"] = local
+    if plan_branch is not None:
+        entry["plan_branch"] = plan_branch
+    return {"notes_root": "/tmp/notes", "repos": {"myrepo": entry}}
+
+
+def _run(args, *, cfg, pw=None, needs=False, valid=True, repo_ok=True,
+         set_ok=True):
+    """Drive plan_branch.run with the lib + guards mocked. `pw` is a dict of
+    plan_worktree function-name → MagicMock/return overrides."""
+    pwmod = MagicMock()
+    # sensible defaults
+    pwmod._branch_exists.return_value = False
+    pwmod.local_branch_exists.return_value = True
+    pwmod.is_published.return_value = False
+    pwmod.unpushed_oneline.return_value = []
+    pwmod.fetch_branch.return_value = True
+    pwmod.ensure_worktree.return_value = Path("/wt")
+    pwmod.create_orphan_worktree.return_value = Path("/wt")
+    pwmod.dirty_work_plan_paths.return_value = [".work-plan/README.md"]
+    pwmod.commit_shared_tier.return_value = "abc1234"
+    pwmod.push_plan_branch.return_value = MagicMock(returncode=0, stderr="")
+    # Overrides set each function's return_value (the function stays a MagicMock
+    # so call-count assertions still work).
+    for k, v in (pw or {}).items():
+        getattr(pwmod, k).return_value = v
+    with patch("commands.plan_branch.load_config", return_value=cfg), \
+         patch("commands.plan_branch.is_valid_git_repo", return_value=repo_ok), \
+         patch("commands.plan_branch.seed_readme", return_value=True), \
+         patch("commands.plan_branch.needs_confirm", return_value=needs), \
+         patch("commands.plan_branch.valid_token", return_value=valid), \
+         patch("commands.plan_branch.make_token", return_value="tok123"), \
+         patch("commands.plan_branch._set_plan_branch", return_value=set_ok), \
+         patch("commands.plan_branch.pw", pwmod):
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            rc = pb.run(args)
+    return rc, buf.getvalue(), pwmod
+
+
+class UsageTest(unittest.TestCase):
+    def test_bad_action_rc2(self):
+        rc, out, _ = _run(["frobnicate", "myrepo"], cfg=_cfg())
+        self.assertEqual(rc, 2)
+        self.assertIn("usage", out)
+
+    def test_no_action_rc2(self):
+        rc, out, _ = _run([], cfg=_cfg())
+        self.assertEqual(rc, 2)
+
+
+class ResolveRepoTest(unittest.TestCase):
+    def test_unconfigured_repo_errs(self):
+        rc, out, _ = _run(["status", "nope"], cfg=_cfg())
+        self.assertEqual(rc, 1)
+        self.assertIn("not a configured repo", out)
+
+    def test_missing_local_path_errs(self):
+        rc, out, _ = _run(["status", "myrepo"], cfg=_cfg(local=None))
+        self.assertEqual(rc, 1)
+        self.assertIn("no local clone path", out)
+
+    def test_not_a_git_repo_errs(self):
+        rc, out, _ = _run(["status", "myrepo"], cfg=_cfg(), repo_ok=False)
+        self.assertEqual(rc, 1)
+        self.assertIn("not a git repository", out)
+
+    def test_single_repo_inferred_when_arg_omitted(self):
+        rc, out, _ = _run(["status"], cfg=_cfg(plan_branch="work-plan/plan"))
+        self.assertEqual(rc, 0)
+
+    def test_ambiguous_repo_requires_arg(self):
+        cfg = _cfg(plan_branch="x")
+        cfg["repos"]["other"] = {"github": "o/o", "local": "/tmp/o"}
+        rc, out, _ = _run(["status"], cfg=cfg)
+        self.assertEqual(rc, 1)
+        self.assertIn("specify which repo", out)
+
+
+class InitTest(unittest.TestCase):
+    def test_create_orphan_when_branch_absent(self):
+        rc, out, pwmod = _run(["init", "myrepo"], cfg=_cfg(),
+                              pw={"_branch_exists": False})
+        self.assertEqual(rc, 0)
+        pwmod.create_orphan_worktree.assert_called_once()
+        pwmod.commit_shared_tier.assert_called_once()
+        pwmod.ensure_worktree.assert_not_called()
+        self.assertIn("Created orphan branch 'work-plan/plan'", out)
+        self.assertIn("Recorded plan_branch", out)
+
+    def test_connect_when_branch_exists(self):
+        rc, out, pwmod = _run(["init", "myrepo"], cfg=_cfg(),
+                              pw={"_branch_exists": True})
+        self.assertEqual(rc, 0)
+        pwmod.ensure_worktree.assert_called_once()
+        pwmod.create_orphan_worktree.assert_not_called()
+        self.assertIn("Connected", out)
+
+    def test_custom_branch_name(self):
+        rc, out, pwmod = _run(["init", "myrepo", "--branch=wp/custom"],
+                              cfg=_cfg(), pw={"_branch_exists": False})
+        self.assertEqual(rc, 0)
+        self.assertIn("wp/custom", out)
+
+    def test_invalid_branch_rc2(self):
+        for bad in ["--branch=-evil", "--branch=a..b", "--branch=/lead",
+                    "--branch=trail/", "--branch=a//b"]:
+            rc, out, _ = _run(["init", "myrepo", bad], cfg=_cfg())
+            self.assertEqual(rc, 2, bad)
+            self.assertIn("not a valid branch", out)
+
+    def test_refuses_switching_existing_plan_branch(self):
+        rc, out, _ = _run(["init", "myrepo", "--branch=work-plan/other"],
+                          cfg=_cfg(plan_branch="work-plan/plan"))
+        self.assertEqual(rc, 1)
+        self.assertIn("already has plan_branch", out)
+
+    def test_commit_failure_errs(self):
+        rc, out, _ = _run(["init", "myrepo"], cfg=_cfg(),
+                          pw={"_branch_exists": False, "commit_shared_tier": None})
+        self.assertEqual(rc, 1)
+        self.assertIn("initial commit failed", out)
+
+    def test_orphan_creation_failure_errs(self):
+        rc, out, _ = _run(["init", "myrepo"], cfg=_cfg(),
+                          pw={"_branch_exists": False,
+                              "create_orphan_worktree": None})
+        self.assertEqual(rc, 1)
+        self.assertIn("could not create the plan worktree", out)
+
+    def test_public_repo_push_warning_shown(self):
+        rc, out, _ = _run(["init", "myrepo"], cfg=_cfg(),
+                          pw={"_branch_exists": False}, needs=True)
+        self.assertEqual(rc, 0)
+        self.assertIn("public", out.lower())
+
+
+class StatusTest(unittest.TestCase):
+    def test_no_plan_branch(self):
+        rc, out, _ = _run(["status", "myrepo"], cfg=_cfg())
+        self.assertEqual(rc, 0)
+        self.assertIn("no plan_branch configured", out)
+
+    def test_no_plan_branch_json(self):
+        rc, out, _ = _run(["status", "myrepo", "--json"], cfg=_cfg())
+        self.assertEqual(rc, 0)
+        self.assertEqual(json.loads(out)["configured"], False)
+
+    def test_published_with_unpushed(self):
+        rc, out, _ = _run(["status", "myrepo"], cfg=_cfg(plan_branch="work-plan/plan"),
+                          pw={"is_published": True,
+                              "unpushed_oneline": ["a1 one", "b2 two"]})
+        self.assertEqual(rc, 0)
+        self.assertIn("on origin", out)
+        self.assertIn("2 commit(s)", out)
+
+    def test_local_only_json_shape(self):
+        rc, out, _ = _run(["status", "myrepo", "--json"],
+                          cfg=_cfg(plan_branch="work-plan/plan"),
+                          pw={"is_published": False, "local_branch_exists": True,
+                              "unpushed_oneline": ["a1 x"]})
+        d = json.loads(out)
+        self.assertEqual(d["plan_branch"], "work-plan/plan")
+        self.assertTrue(d["configured"])
+        self.assertFalse(d["published"])
+        self.assertEqual(d["unpushed_count"], 1)
+
+
+class PushTest(unittest.TestCase):
+    def test_no_plan_branch_errs(self):
+        rc, out, _ = _run(["push", "myrepo"], cfg=_cfg())
+        self.assertEqual(rc, 1)
+        self.assertIn("no plan_branch", out)
+
+    def test_local_branch_missing_errs(self):
+        rc, out, _ = _run(["push", "myrepo"], cfg=_cfg(plan_branch="work-plan/plan"),
+                          pw={"local_branch_exists": False})
+        self.assertEqual(rc, 1)
+        self.assertIn("doesn't exist locally", out)
+
+    def test_nothing_to_push(self):
+        rc, out, pwmod = _run(["push", "myrepo"],
+                             cfg=_cfg(plan_branch="work-plan/plan"),
+                             pw={"unpushed_oneline": []})
+        self.assertEqual(rc, 0)
+        self.assertIn("Nothing to push", out)
+        pwmod.push_plan_branch.assert_not_called()
+
+    def test_dry_run_lists_without_pushing(self):
+        rc, out, pwmod = _run(["push", "myrepo", "--dry-run"],
+                             cfg=_cfg(plan_branch="work-plan/plan"),
+                             pw={"unpushed_oneline": ["a1 one", "b2 two"]})
+        self.assertEqual(rc, 0)
+        self.assertIn("Would push 2 commit(s)", out)
+        pwmod.push_plan_branch.assert_not_called()
+
+    def test_public_repo_blocks_without_confirm(self):
+        rc, out, pwmod = _run(["push", "myrepo"],
+                             cfg=_cfg(plan_branch="work-plan/plan"),
+                             pw={"unpushed_oneline": ["a1 x"]},
+                             needs=True, valid=False)
+        self.assertEqual(rc, 0)
+        d = json.loads(out)
+        self.assertTrue(d["needs_confirm"])
+        self.assertEqual(d["token"], "tok123")
+        self.assertIn("visible to anyone on the internet", d["reason"])
+        pwmod.push_plan_branch.assert_not_called()
+
+    def test_public_repo_pushes_with_valid_confirm(self):
+        rc, out, pwmod = _run(["push", "myrepo", "--confirm=tok123"],
+                             cfg=_cfg(plan_branch="work-plan/plan"),
+                             pw={"unpushed_oneline": ["a1 x"]},
+                             needs=True, valid=True)
+        self.assertEqual(rc, 0)
+        pwmod.push_plan_branch.assert_called_once()
+        self.assertIn("Pushed", out)
+
+    def test_empty_github_still_gated(self):
+        # Regression: a config entry with an empty/unknown github must NOT skip
+        # the gate. needs_confirm fails CLOSED on unknown visibility; the old
+        # `github and needs_confirm(...)` short-circuit defeated that and pushed
+        # unguarded. With the guard removed the gate fires.
+        rc, out, pwmod = _run(["push", "myrepo"],
+                             cfg=_cfg(plan_branch="work-plan/plan", github=""),
+                             pw={"unpushed_oneline": ["a1 x"]},
+                             needs=True, valid=False)
+        self.assertEqual(rc, 0)
+        self.assertIn("needs_confirm", out)
+        pwmod.push_plan_branch.assert_not_called()
+
+    def test_private_repo_pushes_without_gate(self):
+        rc, out, pwmod = _run(["push", "myrepo"],
+                             cfg=_cfg(plan_branch="work-plan/plan"),
+                             pw={"unpushed_oneline": ["a1 x"]}, needs=False)
+        self.assertEqual(rc, 0)
+        pwmod.push_plan_branch.assert_called_once()
+
+    def test_protected_branch_failure_actionable(self):
+        proc = MagicMock(returncode=1, stderr="remote: protected branch hook declined")
+        rc, out, _ = _run(["push", "myrepo"],
+                          cfg=_cfg(plan_branch="work-plan/plan"),
+                          pw={"unpushed_oneline": ["a1 x"],
+                              "push_plan_branch": proc}, needs=False)
+        self.assertEqual(rc, 1)
+        self.assertIn("protected", out.lower())
+        self.assertIn("work-plan/**", out)
+
+    def test_generic_push_failure(self):
+        proc = MagicMock(returncode=1, stderr="fatal: unable to access")
+        rc, out, _ = _run(["push", "myrepo"],
+                          cfg=_cfg(plan_branch="work-plan/plan"),
+                          pw={"unpushed_oneline": ["a1 x"],
+                              "push_plan_branch": proc}, needs=False)
+        self.assertEqual(rc, 1)
+        self.assertIn("push failed", out)
+
+
+if __name__ == "__main__":
+    unittest.main()