@stylusnexus/work-plan 2026.6.9

package/skills/work-plan/tests/test_reconcile_wrappers.py

@@ -0,0 +1,55 @@
+"""Tests for git_mv + create_issue (mock subprocess; offline)."""
+import unittest
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+from unittest import mock
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from lib import git_state, github_state
+
+
+class GitMvTest(unittest.TestCase):
+    def test_creates_dest_dir_and_calls_git_mv(self):
+        calls = {}
+
+        def fake_run(cmd, **kw):
+            calls["cmd"] = cmd
+            return SimpleNamespace(returncode=0, stdout="", stderr="")
+
+        with mock.patch("lib.git_state.subprocess.run", side_effect=fake_run), \
+             mock.patch("lib.git_state.Path.exists", return_value=True), \
+             mock.patch("lib.git_state.Path.mkdir") as mkdir:
+            ok = git_state.git_mv("a/x.md", "a/archive/abandoned/x.md", Path("/repo"))
+        self.assertTrue(ok)
+        self.assertIn("mv", calls["cmd"])
+        self.assertIn("a/x.md", calls["cmd"])
+        self.assertIn("a/archive/abandoned/x.md", calls["cmd"])
+        mkdir.assert_called()
+
+    def test_returns_false_on_git_error(self):
+        fake = SimpleNamespace(returncode=1, stdout="", stderr="not under version control")
+        with mock.patch("lib.git_state.subprocess.run", return_value=fake), \
+             mock.patch("lib.git_state.Path.exists", return_value=True), \
+             mock.patch("lib.git_state.Path.mkdir"):
+            self.assertFalse(git_state.git_mv("a.md", "b.md", Path("/repo")))
+
+
+class CreateIssueTest(unittest.TestCase):
+    def test_returns_url_on_success(self):
+        fake = SimpleNamespace(returncode=0,
+                               stdout="https://github.com/o/r/issues/42\n", stderr="")
+        with mock.patch("lib.github_state.subprocess.run", return_value=fake):
+            url = github_state.create_issue("o/r", "Finish plan: x", "body")
+        self.assertEqual(url, "https://github.com/o/r/issues/42")
+
+    def test_returns_none_on_failure(self):
+        fake = SimpleNamespace(returncode=1, stdout="", stderr="gh: error")
+        with mock.patch("lib.github_state.subprocess.run", return_value=fake):
+            self.assertIsNone(github_state.create_issue("o/r", "t", "b"))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_refresh_md.py

@@ -0,0 +1,98 @@
+"""Tests for refresh-md row-append behavior (issue #77).
+
+Before #77, refresh-md only rewrote the *status cell* of rows already in the
+canonical table — it never appended rows for issues present in frontmatter but
+missing from the table, yet still printed "All tracks in sync." These tests
+pin the membership-aware behavior: missing frontmatter issues get appended in
+frontmatter order, and the "in sync" message only prints when nothing changed.
+"""
+import io
+import sys
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from commands import refresh_md
+from lib.status_table import find_canonical_status_tables, ISSUE_NUM_RE
+
+CANON_HEADER = (
+    "## Issues (canonical)\n\n"
+    "<!-- canonical-issue-table — auto-managed. -->\n\n"
+    "| # | Title | Assignee | Status |\n"
+    "|---|---|---|---|\n"
+)
+
+
+def _track(*, name, repo, issues, rows):
+    body = CANON_HEADER + "\n".join(rows) + "\n\n---\n\n## Notes\n\nnarrative\n"
+    return SimpleNamespace(
+        name=name,
+        path=Path(f"/tmp/fake/{name}.md"),
+        body=body,
+        meta={"track": name, "status": "active",
+              "github": {"repo": repo, "issues": list(issues)}},
+        has_frontmatter=True,
+        repo=repo,
+    )
+
+
+def _issue(num, title, state="OPEN", logins=()):
+    return {"number": num, "title": title, "state": state,
+            "assignees": [{"login": l} for l in logins]}
+
+
+class RefreshAppendTest(unittest.TestCase):
+    def _drive(self, track, issues, args):
+        cfg = {"notes_root": "/tmp/fake"}
+        with patch("commands.refresh_md.load_config", return_value=cfg), \
+             patch("commands.refresh_md.discover_tracks", return_value=[track]), \
+             patch("commands.refresh_md.fetch_issues", return_value=issues), \
+             patch("commands.refresh_md.write_file") as mw:
+            buf = io.StringIO()
+            with redirect_stdout(buf):
+                rc = refresh_md.run(args)
+        return rc, mw, buf.getvalue()
+
+    def test_appends_missing_rows_in_frontmatter_order(self):
+        track = _track(
+            name="platform-health", repo="o/r",
+            issues=[1, 2, 30, 40],  # 30, 40 newly slotted, not yet in table
+            rows=["| #1 | first | — | 🔲 Open |",
+                  "| #2 | second | — | ✅ Shipped |"],
+        )
+        issues = [_issue(1, "first"), _issue(2, "second", "CLOSED"),
+                  _issue(30, "third", "OPEN", ["bob"]), _issue(40, "fourth", "CLOSED")]
+        rc, mw, out = self._drive(track, issues, ["platform-health", "--yes"])
+
+        self.assertEqual(rc, 0)
+        mw.assert_called_once()
+        new_body = mw.call_args[0][2]
+        table = find_canonical_status_tables(new_body)[0]
+        nums = [int(ISSUE_NUM_RE.search(r["cells"][0]).group(1)) for r in table["rows"]]
+        self.assertEqual(nums, [1, 2, 30, 40])
+        self.assertIn("| #30 | third | @bob | 🔲 Open |", new_body)
+        self.assertIn("| #40 | fourth | — | ✅ Shipped |", new_body)
+        self.assertNotIn("All tracks in sync.", out)
+        self.assertIn("row", out.lower())
+
+    def test_no_drift_reports_in_sync(self):
+        track = _track(
+            name="steady", repo="o/r", issues=[1, 2],
+            rows=["| #1 | first | — | 🔲 Open |",
+                  "| #2 | second | — | ✅ Shipped |"],
+        )
+        issues = [_issue(1, "first"), _issue(2, "second", "CLOSED")]
+        rc, mw, out = self._drive(track, issues, ["steady", "--yes"])
+
+        self.assertEqual(rc, 0)
+        mw.assert_not_called()
+        self.assertIn("All tracks in sync.", out)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_render.py

@@ -0,0 +1,110 @@
+"""Tests for render module."""
+import unittest
+import sys
+from pathlib import Path
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from lib.render import time_aware_framing, render_track_row
+
+
+class TimeAwareFramingTest(unittest.TestCase):
+    def test_long_gap(self):
+        self.assertIn("Fresh start", time_aware_framing(7 * 3600, 14))
+
+    def test_morning_says_fresh_start(self):
+        self.assertIn("Fresh start", time_aware_framing(1800, 9))
+
+    def test_medium_gap(self):
+        self.assertIn("Picking back up", time_aware_framing(2 * 3600, 14))
+
+    def test_short_gap(self):
+        self.assertIn("Continuing", time_aware_framing(30 * 60, 14))
+
+    def test_late_night_handoff_nudge(self):
+        f = time_aware_framing(1800, 23, handoff_today=False)
+        self.assertIn("handoff", f.lower())
+
+
+class RenderTrackRowTest(unittest.TestCase):
+    def _data(self, **overrides):
+        d = {
+            "name": "tabletop", "operational_status": "active",
+            "launch_priority": "P1", "milestone_alignment": "v1.0.0",
+            "last_touched_label": "5d ago", "last_handoff_label": "5d ago",
+            "next_up": [], "active_branches": [], "new_issues": [],
+            "blockers": [], "drift_items": [], "closure_ready": False,
+            "closure_signals_summary": None, "archived_reopen": [],
+        }
+        d.update(overrides); return d
+
+    def test_basic_row(self):
+        row = render_track_row(self._data())
+        for s in ["tabletop", "P1", "v1.0.0", "5d ago"]:
+            self.assertIn(s, row)
+
+    def test_in_progress_badge(self):
+        self.assertIn("in-progress", render_track_row(self._data(operational_status="in-progress")))
+
+    def test_active_branch_shown(self):
+        row = render_track_row(self._data(
+            active_branches=[{"name": "feat/4254", "ahead": 1, "uncommitted_files": 2}]
+        ))
+        self.assertIn("feat/4254", row)
+        self.assertIn("ahead 1", row)
+
+    def test_new_issues_shown(self):
+        row = render_track_row(self._data(new_issues=[{"number": 9, "title": "new"}]))
+        self.assertIn("#9", row)
+        self.assertIn("slot 9", row)
+
+    def test_drift_shown(self):
+        row = render_track_row(self._data(
+            drift_items=[{"issue": 1, "body_status": "open", "github_state": "CLOSED"}]
+        ))
+        self.assertIn("Drift:", row)
+        self.assertIn("#1", row)
+
+    def test_closure_ready_shown(self):
+        self.assertIn("Closure?:   YES", render_track_row(self._data(closure_ready=True)))
+
+    def test_empty_next_up_default_message(self):
+        row = render_track_row(self._data(next_up=[]))
+        self.assertIn("<empty — set 'next_up:'", row)
+
+    def test_next_up_all_closed_message(self):
+        row = render_track_row(self._data(
+            next_up=[],
+            next_up_stale_closed_count=2,
+            track_slug="ux-redesign",
+        ))
+        self.assertIn("all 2 items have shipped", row)
+        self.assertIn("/work-plan handoff ux-redesign", row)
+
+    def test_next_up_single_closed_uses_singular(self):
+        row = render_track_row(self._data(
+            next_up=[],
+            next_up_stale_closed_count=1,
+            track_slug="ux-redesign",
+        ))
+        self.assertIn("all 1 item has shipped", row)
+
+    def test_next_up_includes_milestone_when_present(self):
+        row = render_track_row(self._data(next_up=[
+            {"number": 4155, "title": "Armory batch multi-select",
+             "priority": "P3", "state": "open", "milestone": "v0.4.0"},
+        ]))
+        self.assertIn("(P3, open, v0.4.0)", row)
+
+    def test_next_up_omits_milestone_when_absent(self):
+        row = render_track_row(self._data(next_up=[
+            {"number": 4155, "title": "Armory batch multi-select",
+             "priority": "P3", "state": "open", "milestone": ""},
+        ]))
+        self.assertIn("(P3, open)", row)
+        self.assertNotIn("(P3, open, ", row)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_repo_filter.py

@@ -0,0 +1,52 @@
+"""Tests for the --repo=<key> filter shared by brief / refresh-md / reconcile / hygiene."""
+import unittest
+import sys
+from pathlib import Path
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from lib.tracks import discover_tracks, filter_tracks_by_repo
+
+FIXTURES = Path(__file__).parent / "fixtures" / "notes_root"
+
+
+class FilterTracksByRepoTest(unittest.TestCase):
+    def setUp(self):
+        self.cfg = {
+            "notes_root": str(FIXTURES),
+            "repos": {"critforge": {"github": "stylusnexus/CritForge", "local": None}},
+        }
+        self.tracks = discover_tracks(self.cfg)
+
+    def test_matches_folder_key(self):
+        scoped = filter_tracks_by_repo(self.tracks, "critforge")
+        names = {t.name for t in scoped}
+        self.assertIn("example", names)
+        self.assertNotIn("loose_at_root", names)
+
+    def test_matches_github_slug(self):
+        scoped = filter_tracks_by_repo(self.tracks, "stylusnexus/CritForge")
+        names = {t.name for t in scoped}
+        self.assertIn("example", names)
+
+    def test_case_insensitive(self):
+        scoped = filter_tracks_by_repo(self.tracks, "CRITFORGE")
+        names = {t.name for t in scoped}
+        self.assertIn("example", names)
+
+    def test_unknown_key_returns_empty(self):
+        self.assertEqual(filter_tracks_by_repo(self.tracks, "nonexistent"), [])
+
+    def test_excludes_loose_filing_track(self):
+        scoped = filter_tracks_by_repo(self.tracks, "critforge")
+        for t in scoped:
+            self.assertFalse(t.needs_filing)
+
+    def test_track_folder_field_populated(self):
+        ex = next(t for t in self.tracks if t.name == "example")
+        self.assertEqual(ex.folder, "critforge")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_security_hardening.py

@@ -0,0 +1,117 @@
+"""Regression tests for the /tmp planting hardening (#18).
+
+Covers:
+- lib.scratch.cache_dir() creates ~/.claude/work-plan/cache/ with mode 0700.
+- commands.group._apply() rejects a batch whose `folder` is not in cfg.
+- commands.suggest_priorities._apply() rejects a batch whose `repo` is not in cfg.
+"""
+import json
+import os
+import stat
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from lib import scratch
+from commands import group, suggest_priorities
+
+
+# POSIX file mode bits aren't honored on Windows NTFS — os.chmod(0o700) is a
+# no-op for directories there and stat.S_IMODE reports 0o777 regardless. The
+# /tmp planting hardening these tests cover is itself a POSIX concern.
+_POSIX_MODE_ONLY = unittest.skipIf(
+    sys.platform == "win32", "POSIX file mode bits not honored on Windows"
+)
+
+
+class CacheDirTest(unittest.TestCase):
+    @_POSIX_MODE_ONLY
+    def test_creates_with_mode_0700(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch.object(scratch.Path, "home", return_value=Path(td)):
+                p = scratch.cache_dir()
+            self.assertTrue(p.is_dir())
+            self.assertEqual(p, Path(td) / ".claude" / "work-plan" / "cache")
+            mode = stat.S_IMODE(os.stat(p).st_mode)
+            self.assertEqual(mode, 0o700)
+
+    @_POSIX_MODE_ONLY
+    def test_tightens_existing_loose_perms(self):
+        with tempfile.TemporaryDirectory() as td:
+            existing = Path(td) / ".claude" / "work-plan" / "cache"
+            existing.mkdir(parents=True, mode=0o755)
+            self.assertEqual(stat.S_IMODE(os.stat(existing).st_mode), 0o755)
+            with mock.patch.object(scratch.Path, "home", return_value=Path(td)):
+                scratch.cache_dir()
+            self.assertEqual(stat.S_IMODE(os.stat(existing).st_mode), 0o700)
+
+
+class GroupApplyValidationTest(unittest.TestCase):
+    def test_rejects_folder_not_in_cfg(self):
+        with tempfile.TemporaryDirectory() as td:
+            cache = Path(td) / "cache"
+            cache.mkdir()
+            (cache / "groups.json").write_text(json.dumps({
+                "repo": "x/y", "folder": "../../etc",
+                "milestone": "v1", "issues": [],
+            }))
+            (cache / "groups.answers.json").write_text("[]")
+            with mock.patch.object(group, "_batch_path", return_value=cache / "groups.json"), \
+                 mock.patch.object(group, "_answers_path", return_value=cache / "groups.answers.json"):
+                cfg = {"notes_root": td, "repos": {"legitrepo": {"github": "ok/ok"}}}
+                rc = group._apply(cfg)
+            self.assertEqual(rc, 1)
+
+    def test_accepts_folder_in_cfg(self):
+        with tempfile.TemporaryDirectory() as td:
+            cache = Path(td) / "cache"
+            cache.mkdir()
+            notes = Path(td) / "notes"
+            (notes / "legitrepo").mkdir(parents=True)
+            (cache / "groups.json").write_text(json.dumps({
+                "repo": "ok/ok", "folder": "legitrepo",
+                "milestone": "v1", "issues": [],
+            }))
+            (cache / "groups.answers.json").write_text("[]")
+            with mock.patch.object(group, "_batch_path", return_value=cache / "groups.json"), \
+                 mock.patch.object(group, "_answers_path", return_value=cache / "groups.answers.json"):
+                cfg = {"notes_root": str(notes), "repos": {"legitrepo": {"github": "ok/ok"}}}
+                rc = group._apply(cfg)
+            self.assertEqual(rc, 0)
+
+
+class SuggestPrioritiesApplyValidationTest(unittest.TestCase):
+    def test_rejects_repo_not_in_cfg(self):
+        with tempfile.TemporaryDirectory() as td:
+            cache = Path(td) / "cache"
+            cache.mkdir()
+            (cache / "priorities.json").write_text(json.dumps({
+                "repo": "attacker/target", "issues": [],
+            }))
+            (cache / "priorities.answers.json").write_text("[]")
+            with mock.patch.object(suggest_priorities, "_batch_path", return_value=cache / "priorities.json"):
+                cfg = {"repos": {"legitrepo": {"github": "ok/ok"}}}
+                rc = suggest_priorities._apply(cfg)
+            self.assertEqual(rc, 1)
+
+    def test_accepts_repo_in_cfg(self):
+        with tempfile.TemporaryDirectory() as td:
+            cache = Path(td) / "cache"
+            cache.mkdir()
+            (cache / "priorities.json").write_text(json.dumps({
+                "repo": "ok/ok", "issues": [],
+            }))
+            (cache / "priorities.answers.json").write_text("[]")
+            with mock.patch.object(suggest_priorities, "_batch_path", return_value=cache / "priorities.json"):
+                cfg = {"repos": {"legitrepo": {"github": "ok/ok"}}}
+                rc = suggest_priorities._apply(cfg)
+            self.assertEqual(rc, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_session_log.py

@@ -0,0 +1,39 @@
+"""Tests for session_log."""
+import unittest
+import sys
+from pathlib import Path
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from lib.session_log import append_session_log, SESSION_LOG_HEADER
+
+
+class AppendSessionLogTest(unittest.TestCase):
+    def test_appends_under_existing_section(self):
+        body = (
+            "# Track\n\nProse.\n\n"
+            f"{SESSION_LOG_HEADER}\n\n"
+            "### Session — 2026-04-23 22:14\n\n- Touched: prior\n"
+        )
+        new = append_session_log(
+            body, timestamp="2026-04-28 18:30",
+            touched=["#4254 polls"], next_up=["#925 wmsr"], blockers=[],
+        )
+        self.assertIn("### Session — 2026-04-28 18:30", new)
+        self.assertIn("### Session — 2026-04-23 22:14", new)
+        self.assertIn("- Touched: #4254 polls", new)
+
+    def test_creates_section_when_missing(self):
+        body = "# Track\n\nProse.\n"
+        new = append_session_log(
+            body, timestamp="2026-04-28 18:30",
+            touched=["#1 foo"], next_up=["#2 bar"],
+            blockers=[{"number": 3, "reason": "waiting"}],
+        )
+        self.assertIn(SESSION_LOG_HEADER, new)
+        self.assertIn("- Blocker: #3 — waiting", new)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_set_field.py

@@ -0,0 +1,77 @@
+# tests/test_set_field.py
+import io, sys, unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+SKILL_ROOT = Path(__file__).resolve().parents[1]; sys.path.insert(0, str(SKILL_ROOT))
+from commands import set_field
+from lib.write_guard import make_token
+
+def _t(name="ph", repo="o/r"):
+    return SimpleNamespace(name=name, repo=repo, path=Path(f"/tmp/{name}.md"),
+        has_frontmatter=True, meta={"status":"active","github":{"repo":repo}}, body="# b")
+
+def _drive(args, vis="PRIVATE", cfg=None):
+    base_cfg = {"notes_root": "/tmp"}
+    if cfg is not None:
+        base_cfg.update(cfg)
+    with patch("commands.set_field.load_config", return_value=base_cfg), \
+         patch("commands.set_field.discover_tracks", return_value=[_t()]), \
+         patch("lib.write_guard.repo_visibility", return_value=vis), \
+         patch("commands.set_field.write_file") as mw:
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            rc = set_field.run(args)
+    return rc, mw, buf.getvalue()
+
+class SetFieldTest(unittest.TestCase):
+    def test_sets_status_private(self):
+        rc, mw, out = _drive(["ph", "status=parked"])
+        self.assertEqual(rc, 0); mw.assert_called_once()
+        self.assertEqual(mw.call_args[0][1]["status"], "parked")
+    def test_public_blocks_without_confirm(self):
+        rc, mw, out = _drive(["ph", "status=parked"], vis="PUBLIC")
+        self.assertEqual(rc, 0); mw.assert_not_called()
+        self.assertIn("needs_confirm", out)
+    def test_public_with_valid_confirm_writes(self):
+        tok = make_token("o/r", "ph")
+        rc, mw, out = _drive(["ph", "status=parked", f"--confirm={tok}"], vis="PUBLIC")
+        self.assertEqual(rc, 0); mw.assert_called_once()
+        self.assertEqual(mw.call_args[0][1]["status"], "parked")
+    def test_rejects_unknown_field(self):
+        rc, mw, out = _drive(["ph", "bogus=x"])
+        self.assertEqual(rc, 2); mw.assert_not_called()
+    def test_rejects_invalid_status(self):
+        rc, mw, out = _drive(["ph", "status=nonsense"])
+        self.assertEqual(rc, 2); mw.assert_not_called()
+    def test_rejects_non_integer_blockers(self):
+        rc, mw, out = _drive(["ph", "blockers=abc"])
+        self.assertEqual(rc, 2); mw.assert_not_called()
+    def test_repoless_track_writes_without_confirm(self):
+        with patch("commands.set_field.load_config", return_value={"notes_root":"/tmp"}), \
+             patch("commands.set_field.discover_tracks", return_value=[_t(repo=None)]), \
+             patch("commands.set_field.write_file") as mw:
+            buf = io.StringIO()
+            with redirect_stdout(buf):
+                rc = set_field.run(["ph", "status=parked"])
+        self.assertEqual(rc, 0); mw.assert_called_once()
+
+    # --- assume_private_when_unknown: caller-level integration ---
+    def test_unknown_vis_with_flag_writes(self):
+        """Unknown visibility + assume_private_when_unknown=True → write proceeds."""
+        rc, mw, out = _drive(
+            ["ph", "status=parked"],
+            vis=None,
+            cfg={"assume_private_when_unknown": True},
+        )
+        self.assertEqual(rc, 0)
+        mw.assert_called_once()
+        self.assertNotIn("needs_confirm", out)
+
+    def test_unknown_vis_without_flag_emits_needs_confirm(self):
+        """Unknown visibility + no flag → still emits needs_confirm JSON."""
+        rc, mw, out = _drive(["ph", "status=parked"], vis=None)
+        self.assertEqual(rc, 0)
+        mw.assert_not_called()
+        self.assertIn("needs_confirm", out)