@stylusnexus/work-plan 2026.6.13 → 2026.6.14

package/skills/work-plan/tests/test_in_progress_command.py

@@ -0,0 +1,166 @@
+"""in-progress label write (#271). Offline — gh subprocess mocked."""
+import io
+import sys
+import unittest
+from contextlib import redirect_stdout, redirect_stderr
+from pathlib import Path
+from types import SimpleNamespace
+from unittest import mock
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from lib import github_state
+
+
+def _proc(rc, stdout="", stderr=""):
+    return SimpleNamespace(returncode=rc, stdout=stdout, stderr=stderr)
+
+
+class SetIssueInProgressHelperTest(unittest.TestCase):
+    def test_add_creates_label_then_adds_with_repo(self):
+        calls = []
+        def fake_run(args, **kw):
+            calls.append(args)
+            return _proc(0)
+        with mock.patch("lib.github_state.subprocess.run", side_effect=fake_run):
+            ok, msg = github_state.set_issue_in_progress("o/r", 271)
+        self.assertTrue(ok)
+        self.assertEqual(calls[0], [
+            "gh", "label", "create", "work-plan:in-progress", "--repo", "o/r",
+            "--color", "FBCA04", "--description", "Actively being worked (work-plan)",
+            "--force"])
+        self.assertEqual(calls[1], [
+            "gh", "issue", "edit", "271", "--repo", "o/r",
+            "--add-label", "work-plan:in-progress"])
+
+    def test_clear_removes_label_without_creating(self):
+        calls = []
+        with mock.patch("lib.github_state.subprocess.run",
+                        side_effect=lambda args, **kw: calls.append(args) or _proc(0)):
+            ok, msg = github_state.set_issue_in_progress("o/r", 271, clear=True)
+        self.assertTrue(ok)
+        self.assertEqual(calls, [[
+            "gh", "issue", "edit", "271", "--repo", "o/r",
+            "--remove-label", "work-plan:in-progress"]])
+
+    def test_invalid_repo_rejected(self):
+        ok, msg = github_state.set_issue_in_progress("not-a-slug", 5)
+        self.assertFalse(ok)
+        self.assertIn("invalid repo", msg)
+
+    def test_gh_failure_surfaces_stderr(self):
+        with mock.patch("lib.github_state.subprocess.run",
+                        return_value=_proc(1, stderr="no write access")):
+            ok, msg = github_state.set_issue_in_progress("o/r", 5)
+        self.assertFalse(ok)
+        self.assertIn("no write access", msg)
+
+    def test_never_raises(self):
+        with mock.patch("lib.github_state.subprocess.run", side_effect=OSError("boom")):
+            ok, msg = github_state.set_issue_in_progress("o/r", 5)
+        self.assertFalse(ok)
+
+
+from commands import in_progress as inprog_cmd
+
+
+def _track(name, repo, issues):
+    return SimpleNamespace(name=name, repo=repo, folder=name,
+                           has_frontmatter=True,
+                           meta={"github": {"issues": issues}, "track": name})
+
+
+class InProgressCommandTest(unittest.TestCase):
+    def _drive(self, args, tracks, vis="PRIVATE", write_ret=(True, "ok")):
+        with mock.patch("commands.in_progress.load_config", return_value={"repos": {}}), \
+             mock.patch("commands.in_progress.discover_tracks", return_value=tracks), \
+             mock.patch("commands.in_progress.needs_confirm", return_value=(vis != "PRIVATE")), \
+             mock.patch("commands.in_progress.set_issue_in_progress",
+                        return_value=write_ret) as mw:
+            out, err = io.StringIO(), io.StringIO()
+            with redirect_stdout(out), redirect_stderr(err):
+                rc = inprog_cmd.run(args)
+        return rc, out.getvalue(), err.getvalue(), mw
+
+    def test_marks_resolving_repo_from_single_track(self):
+        rc, out, err, mw = self._drive(["271"], [_track("alpha", "o/r", [271])])
+        self.assertEqual(rc, 0)
+        mw.assert_called_once_with("o/r", 271, clear=False)
+
+    def test_clear_flag(self):
+        rc, out, err, mw = self._drive(["271", "--clear"], [_track("alpha", "o/r", [271])])
+        self.assertEqual(rc, 0)
+        mw.assert_called_once_with("o/r", 271, clear=True)
+
+    def test_ambiguous_number_across_repos_rejected(self):
+        rc, out, err, mw = self._drive(
+            ["271"], [_track("a", "o/r1", [271]), _track("b", "o/r2", [271])])
+        self.assertEqual(rc, 1)
+        mw.assert_not_called()
+        self.assertIn("ambiguous", (out + err).lower())
+
+    def test_repo_flag_disambiguates(self):
+        rc, out, err, mw = self._drive(
+            ["271", "--repo=o/r2"],
+            [_track("a", "o/r1", [271]), _track("b", "o/r2", [271])])
+        self.assertEqual(rc, 0)
+        mw.assert_called_once_with("o/r2", 271, clear=False)
+
+    def test_public_repo_without_token_emits_needs_confirm(self):
+        rc, out, err, mw = self._drive(["271"], [_track("alpha", "o/r", [271])], vis="PUBLIC")
+        self.assertEqual(rc, 0)
+        self.assertIn("needs_confirm", out)
+        mw.assert_not_called()
+
+    def test_public_repo_with_valid_token_writes(self):
+        from lib.write_guard import make_token
+        token = make_token("o/r", "271")
+        rc, out, err, mw = self._drive(
+            [f"--confirm={token}", "271"], [_track("alpha", "o/r", [271])], vis="PUBLIC")
+        self.assertEqual(rc, 0)
+        mw.assert_called_once_with("o/r", 271, clear=False)
+
+    def test_non_integer_rejected(self):
+        rc, out, err, mw = self._drive(["abc"], [_track("alpha", "o/r", [271])])
+        self.assertEqual(rc, 2)
+        mw.assert_not_called()
+
+    def test_unresolvable_number_returns_1(self):
+        rc, out, err, mw = self._drive(["999"], [_track("alpha", "o/r", [271])])
+        self.assertEqual(rc, 1)
+        mw.assert_not_called()
+
+    # --- _resolve_repo --repo validation tests ---
+
+    def test_repo_flag_matching_tracked_repo_allowed(self):
+        """--repo=o/r2 when 271 is tracked in o/r2 → allowed (legit disambiguation)."""
+        rc, out, err, mw = self._drive(
+            ["271", "--repo=o/r2"],
+            [_track("a", "o/r1", []), _track("b", "o/r2", [271])])
+        self.assertEqual(rc, 0)
+        mw.assert_called_once_with("o/r2", 271, clear=False)
+
+    def test_repo_flag_pointing_to_untracked_repo_rejected(self):
+        """--repo=o/r2 when 271 is tracked only in o/r1 → rejected (typo guard)."""
+        rc, out, err, mw = self._drive(
+            ["271", "--repo=o/r2"],
+            [_track("a", "o/r1", [271]), _track("b", "o/r2", [])])
+        self.assertEqual(rc, 1)
+        mw.assert_not_called()
+        combined = (out + err).lower()
+        self.assertTrue(
+            "refusing" in combined or "not" in combined,
+            f"expected 'refusing' or 'not' in stderr/stdout, got: {out!r} {err!r}")
+
+    def test_repo_flag_for_issue_tracked_nowhere_allowed(self):
+        """--repo=o/r9 when 271 is not in any track → allowed (explicit target)."""
+        rc, out, err, mw = self._drive(
+            ["271", "--repo=o/r9"],
+            [_track("a", "o/r1", [99])])
+        self.assertEqual(rc, 0)
+        mw.assert_called_once_with("o/r9", 271, clear=False)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_list_open_issues.py

@@ -45,15 +45,20 @@ class ListOpenIssuesTest(unittest.TestCase):
         rc, out = _run(["--repo=o/r"], rows)
         self.assertEqual(rc, 0)
         self.assertEqual(out["repo"], "o/r")
-        # Same Issue shape as the export (number/title/state/assignee/milestone).
+        # Same Issue shape as the export (number/title/state/assignee/milestone,
+        # plus the always-present in_progress flag — #271 keeps the two surfaces
+        # identical, so list-open-issues carries it too, default False here since
+        # this command has no track/branch context).
         self.assertEqual(
             out["issues"][0],
             {"number": 91, "title": "Rate-limit login", "state": "open",
-             "assignee": "@eve", "milestone": "v0.6"},
+             "assignee": "@eve", "milestone": "v0.6", "in_progress": False,
+             "in_progress_label": False, "blocked_by": [], "blocking": []},
         )
         self.assertEqual(out["issues"][1],
                          {"number": 87, "title": "Fix auth", "state": "open",
-                          "assignee": "—", "milestone": None})
+                          "assignee": "—", "milestone": None, "in_progress": False,
+                          "in_progress_label": False, "blocked_by": [], "blocking": []})
 
     def test_exclude_filters_given_numbers(self):
         rows = [_row(1), _row(2), _row(3)]

package/skills/work-plan/tests/test_manifest.py

@@ -11,7 +11,7 @@ from lib.manifest import (
     DeclaredPath, strip_range, parse_declared_paths,
     count_checkboxes, plan_date_from_filename,
     ManifestScore, score_manifest,
-    is_in_tree, out_of_tree_ratio,
+    is_in_tree, out_of_tree_ratio, offtree_declared_paths,
 )
 
 
@@ -158,5 +158,34 @@ class ScoreManifestTest(unittest.TestCase):
         self.assertIsNone(score.pct)
 
 
+class OfftreeDeclaredPathsTest(unittest.TestCase):
+    ROOT = "/repo"
+
+    def _decls(self, *paths):
+        return [DeclaredPath(kind="create", path=p) for p in paths]
+
+    def test_in_tree_paths_are_not_flagged(self):
+        decls = self._decls("src/a.ts", "src/b.ts")
+        self.assertEqual(offtree_declared_paths(decls, self.ROOT), [])
+
+    def test_flags_absolute_tilde_and_escape(self):
+        decls = self._decls("src/ok.ts", "/etc/passwd", "~/secrets.txt", "../sibling/x.ts")
+        self.assertEqual(
+            offtree_declared_paths(decls, self.ROOT),
+            ["/etc/passwd", "~/secrets.txt", "../sibling/x.ts"],
+        )
+
+    def test_flags_junk_root_slash(self):
+        # The literal `/` #164's smoke caught — resolves to the filesystem root.
+        self.assertEqual(offtree_declared_paths(self._decls("/x/y"), self.ROOT), ["/x/y"])
+
+    def test_dedups_preserving_first_seen_order(self):
+        decls = self._decls("../x.ts", "src/ok.ts", "../x.ts")
+        self.assertEqual(offtree_declared_paths(decls, self.ROOT), ["../x.ts"])
+
+    def test_empty_decls(self):
+        self.assertEqual(offtree_declared_paths([], self.ROOT), [])
+
+
 if __name__ == "__main__":
     unittest.main()

package/skills/work-plan/tests/test_plan_ack.py

@@ -0,0 +1,104 @@
+"""plan-ack (#286 slice 1): durable, frontmatter-only acknowledgment. Real temp
+repo so the write round-trips through real yq; config + visibility are mocked."""
+import io
+import json
+import unittest
+import sys
+import tempfile
+from contextlib import redirect_stdout, redirect_stderr
+from pathlib import Path
+from unittest import mock
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from commands import plan_ack
+from lib import frontmatter
+from lib.write_guard import make_token
+
+REL = "docs/superpowers/plans/p.md"
+BODY = "# Plan\n\nbody the writer must never touch\n"
+
+
+class PlanAckTest(unittest.TestCase):
+    def _repo(self, d, doc_text=BODY):
+        root = Path(d)
+        (root / "docs/superpowers/plans").mkdir(parents=True)
+        (root / REL).write_text(doc_text)
+        return root
+
+    def _drive(self, root, args, slug=None, vis="PRIVATE"):
+        cfg = {"notes_root": str(root), "repos": {}}
+        with mock.patch("commands.plan_ack.config_mod.load_config", return_value=cfg), \
+             mock.patch("commands.plan_ack.config_mod.resolve_local_path_for_folder",
+                        return_value=root), \
+             mock.patch("commands.plan_ack.config_mod.resolve_github_for_folder",
+                        return_value=slug), \
+             mock.patch("lib.write_guard.repo_visibility", return_value=vis):
+            out, err = io.StringIO(), io.StringIO()
+            with redirect_stdout(out), redirect_stderr(err):
+                rc = plan_ack.run(args)
+        return rc, out.getvalue(), err.getvalue()
+
+    def test_writes_acknowledged_preserving_body(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            rc, out, err = self._drive(root, ["--repo=k", "--", REL])
+            self.assertEqual(rc, 0)
+            meta, body = frontmatter.parse_file(root / REL)
+            self.assertIs(meta["acknowledged"], True)
+            self.assertEqual(body, BODY)
+            self.assertIn("frontmatter only", out)
+
+    def test_clear_removes_acknowledged(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d, f"---\nacknowledged: true\n---\n{BODY}")
+            rc, out, err = self._drive(root, ["--repo=k", "--clear", "--", REL])
+            self.assertEqual(rc, 0)
+            meta, body = frontmatter.parse_file(root / REL)
+            self.assertNotIn("acknowledged", meta)
+            self.assertEqual(body, BODY)
+
+    def test_clear_when_absent_is_noop(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            rc, out, err = self._drive(root, ["--repo=k", "--clear", "--", REL])
+            self.assertEqual(rc, 0)
+            self.assertIn("nothing to clear", out)
+
+    def test_public_repo_no_token_returns_needs_confirm(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            rc, out, err = self._drive(root, ["--repo=k", "--", REL],
+                                       slug="org/pub", vis="PUBLIC")
+            self.assertEqual(rc, 0)
+            data = json.loads(out)
+            self.assertTrue(data["needs_confirm"])
+            self.assertEqual(data["token"], make_token("org/pub", REL))
+            meta, _ = frontmatter.parse_file(root / REL)
+            self.assertNotIn("acknowledged", meta)   # no write happened
+
+    def test_public_repo_with_valid_token_writes(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            token = make_token("org/pub", REL)
+            rc, out, err = self._drive(root, ["--repo=k", f"--confirm={token}", "--", REL],
+                                       slug="org/pub", vis="PUBLIC")
+            self.assertEqual(rc, 0)
+            meta, _ = frontmatter.parse_file(root / REL)
+            self.assertIs(meta["acknowledged"], True)
+
+    def test_path_escape_rejected(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            rc, out, err = self._drive(root, ["--repo=k", "--", "../../etc/passwd"])
+            self.assertEqual(rc, 1)
+            self.assertIn("not a file inside", err)
+
+    def test_missing_repo_flag_rejected(self):
+        rc, out, err = self._drive(Path("/tmp"), ["--", REL])
+        self.assertEqual(rc, 2)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_plan_baseline.py

@@ -0,0 +1,86 @@
+"""plan-baseline (#286 slice 2): stamp the computed verdict to frontmatter as a
+drift baseline. Real temp repo (real yq); config + git date mocked."""
+import io
+import json
+import unittest
+import sys
+import tempfile
+from contextlib import redirect_stdout, redirect_stderr
+from pathlib import Path
+from unittest import mock
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from commands import plan_baseline
+from lib import frontmatter
+from lib.write_guard import make_token
+
+REL = "docs/superpowers/plans/p.md"
+# A plan whose one declared file exists → mechanical verdict "shipped".
+BODY = "# Plan\n\n**Files:**\n- Create: `src/new.ts`\n- [ ] Step 1\n"
+
+
+class PlanBaselineTest(unittest.TestCase):
+    def _repo(self, d, with_file=True, doc_text=BODY):
+        root = Path(d)
+        (root / "docs/superpowers/plans").mkdir(parents=True)
+        (root / REL).write_text(doc_text)
+        if with_file:
+            (root / "src").mkdir()
+            (root / "src/new.ts").write_text("export const x = 1")
+        return root
+
+    def _drive(self, root, args, slug=None, vis="PRIVATE"):
+        cfg = {"notes_root": str(root), "repos": {}}
+        with mock.patch("commands.plan_baseline.config_mod.load_config", return_value=cfg), \
+             mock.patch("commands.plan_baseline.config_mod.resolve_local_path_for_folder",
+                        return_value=root), \
+             mock.patch("commands.plan_baseline.config_mod.resolve_github_for_folder",
+                        return_value=slug), \
+             mock.patch("commands.plan_status.git_state.path_last_commit_date",
+                        return_value=None), \
+             mock.patch("lib.write_guard.repo_visibility", return_value=vis):
+            out, err = io.StringIO(), io.StringIO()
+            with redirect_stdout(out), redirect_stderr(err):
+                rc = plan_baseline.run(args)
+        return rc, out.getvalue(), err.getvalue()
+
+    def test_stamps_computed_verdict(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)               # file present → shipped
+            rc, out, err = self._drive(root, ["--repo=k", "--", REL])
+            self.assertEqual(rc, 0)
+            meta, body = frontmatter.parse_file(root / REL)
+            self.assertEqual(meta["verdict_baseline"], "shipped")
+            self.assertIn("shipped", out)
+
+    def test_clear_removes_baseline(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d, doc_text=f"---\nverdict_baseline: shipped\n---\n{BODY}")
+            rc, out, err = self._drive(root, ["--repo=k", "--clear", "--", REL])
+            self.assertEqual(rc, 0)
+            meta, _ = frontmatter.parse_file(root / REL)
+            self.assertNotIn("verdict_baseline", meta)
+
+    def test_public_repo_no_token_returns_needs_confirm(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            rc, out, err = self._drive(root, ["--repo=k", "--", REL],
+                                       slug="org/pub", vis="PUBLIC")
+            self.assertEqual(rc, 0)
+            data = json.loads(out)
+            self.assertEqual(data["token"], make_token("org/pub", REL))
+            meta, _ = frontmatter.parse_file(root / REL)
+            self.assertNotIn("verdict_baseline", meta)
+
+    def test_path_escape_rejected(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            rc, out, err = self._drive(root, ["--repo=k", "--", "../../etc/passwd"])
+            self.assertEqual(rc, 1)
+            self.assertIn("not a file inside", err)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_plan_confirm.py

@@ -0,0 +1,109 @@
+"""plan-confirm (#286): frontmatter-only verdict_override writes, with the
+public-repo confirm-token gate. Uses a real temp repo so the frontmatter write
+round-trips through real yq; config + visibility are mocked (offline)."""
+import io
+import json
+import unittest
+import sys
+import tempfile
+from contextlib import redirect_stdout, redirect_stderr
+from pathlib import Path
+from unittest import mock
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from commands import plan_confirm
+from lib import frontmatter
+from lib.write_guard import make_token
+
+REL = "docs/superpowers/plans/p.md"
+BODY = "# Idea Mode UI\n\nbody text the writer must never touch\n"
+
+
+class PlanConfirmTest(unittest.TestCase):
+    def _repo(self, d, doc_text=BODY):
+        root = Path(d)
+        (root / "docs/superpowers/plans").mkdir(parents=True)
+        (root / REL).write_text(doc_text)
+        return root
+
+    def _drive(self, root, args, slug=None, vis="PRIVATE"):
+        cfg = {"notes_root": str(root), "repos": {}}
+        with mock.patch("commands.plan_confirm.config_mod.load_config", return_value=cfg), \
+             mock.patch("commands.plan_confirm.config_mod.resolve_local_path_for_folder",
+                        return_value=root), \
+             mock.patch("commands.plan_confirm.config_mod.resolve_github_for_folder",
+                        return_value=slug), \
+             mock.patch("lib.write_guard.repo_visibility", return_value=vis):
+            out, err = io.StringIO(), io.StringIO()
+            with redirect_stdout(out), redirect_stderr(err):
+                rc = plan_confirm.run(args)
+        # stdout carries the machine surfaces (needs_confirm JSON, success line);
+        # stderr carries usage/validation errors. Tests assert on either.
+        return rc, out.getvalue(), err.getvalue()
+
+    def test_writes_override_to_frontmatter_preserving_body(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            rc, out, err = self._drive(root, ["--repo=k", "--verdict=shipped", "--", REL])
+            self.assertEqual(rc, 0)
+            meta, body = frontmatter.parse_file(root / REL)
+            self.assertEqual(meta["verdict_override"], "shipped")
+            self.assertEqual(body, BODY)        # body byte-preserved
+            self.assertIn("frontmatter only", out)
+
+    def test_clear_removes_override(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d, f"---\nverdict_override: shipped\n---\n{BODY}")
+            rc, out, err = self._drive(root, ["--repo=k", "--clear", "--", REL])
+            self.assertEqual(rc, 0)
+            meta, body = frontmatter.parse_file(root / REL)
+            self.assertNotIn("verdict_override", meta)
+            self.assertEqual(body, BODY)
+
+    def test_public_repo_no_token_returns_needs_confirm(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            rc, out, err = self._drive(root, ["--repo=k", "--verdict=shipped", "--", REL],
+                                  slug="org/pub", vis="PUBLIC")
+            self.assertEqual(rc, 0)
+            data = json.loads(out)
+            self.assertTrue(data["needs_confirm"])
+            self.assertEqual(data["token"], make_token("org/pub", REL))
+            # NO write happened.
+            meta, _ = frontmatter.parse_file(root / REL)
+            self.assertNotIn("verdict_override", meta)
+
+    def test_public_repo_with_valid_token_writes(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            token = make_token("org/pub", REL)
+            rc, out, err = self._drive(
+                root, ["--repo=k", "--verdict=shipped", f"--confirm={token}", "--", REL],
+                slug="org/pub", vis="PUBLIC")
+            self.assertEqual(rc, 0)
+            meta, _ = frontmatter.parse_file(root / REL)
+            self.assertEqual(meta["verdict_override"], "shipped")
+
+    def test_path_escape_rejected(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            rc, out, err = self._drive(root, ["--repo=k", "--verdict=shipped", "--",
+                                         "../../etc/passwd"])
+            self.assertEqual(rc, 1)
+            self.assertIn("not a file inside", err)
+
+    def test_invalid_verdict_rejected(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo(d)
+            rc, out, err = self._drive(root, ["--repo=k", "--verdict=done", "--", REL])
+            self.assertEqual(rc, 2)
+
+    def test_missing_repo_flag_rejected(self):
+        rc, out, err = self._drive(Path("/tmp"), ["--verdict=shipped", "--", REL])
+        self.assertEqual(rc, 2)
+
+
+if __name__ == "__main__":
+    unittest.main()