@tuan_son.dinh/gsd 2.6.3 → 2.7.0

package/src/resources/extensions/gsd/tests/auto-secrets-gate.test.ts

@@ -0,0 +1,196 @@
+/**
+ * Integration tests for the secrets collection gate in startAuto().
+ *
+ * Exercises getManifestStatus() → collectSecretsFromManifest() composition
+ * end-to-end using real filesystem state. Proves the three gate paths:
+ *   1. No manifest exists — gate skips silently
+ *   2. Pending keys exist — gate triggers collection
+ *   3. No pending keys — gate skips silently
+ *
+ * Uses temp directories with real .gsd/milestones/M001/ structure, mirroring
+ * the pattern from manifest-status.test.ts.
+ */
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { getManifestStatus } from '../files.ts';
+import { collectSecretsFromManifest } from '../../get-secrets-from-user.ts';
+
+function makeTempDir(prefix: string): string {
+  const dir = join(tmpdir(), `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+/** Create the .gsd/milestones/M001/ directory structure and write a secrets manifest. */
+function writeManifest(base: string, content: string): void {
+  const mDir = join(base, '.gsd', 'milestones', 'M001');
+  mkdirSync(mDir, { recursive: true });
+  writeFileSync(join(mDir, 'M001-SECRETS.md'), content);
+}
+
+/** Stub ctx with hasUI: false — collectOneSecret returns null (skip), showSecretsSummary is a no-op. */
+function makeNoUICtx(cwd: string) {
+  return {
+    ui: {},
+    hasUI: false,
+    cwd,
+  };
+}
+
+// ─── Scenario 1: No manifest exists ──────────────────────────────────────────
+
+test('secrets gate: no manifest exists — getManifestStatus returns null', async () => {
+  const tmp = makeTempDir('gate-no-manifest');
+  try {
+    // No .gsd directory at all
+    const result = await getManifestStatus(tmp, 'M001');
+    assert.strictEqual(result, null, 'should return null when no manifest file exists');
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+// ─── Scenario 2: Pending keys exist ─────────────────────────────────────────
+
+test('secrets gate: pending keys exist — gate triggers collection, manifest updated on disk', async () => {
+  const tmp = makeTempDir('gate-pending');
+  const savedA = process.env.GSD_GATE_TEST_EXISTING;
+  try {
+    // Simulate one key already in env
+    process.env.GSD_GATE_TEST_EXISTING = 'already-here';
+
+    // Ensure pending keys are NOT in env
+    delete process.env.GSD_GATE_TEST_PEND_A;
+    delete process.env.GSD_GATE_TEST_PEND_B;
+
+    writeManifest(tmp, `# Secrets Manifest
+
+**Milestone:** M001
+**Generated:** 2025-06-20T10:00:00Z
+
+### GSD_GATE_TEST_PEND_A
+
+**Service:** ServiceA
+**Status:** pending
+**Destination:** dotenv
+
+1. Get key A from dashboard
+
+### GSD_GATE_TEST_PEND_B
+
+**Service:** ServiceB
+**Status:** pending
+**Destination:** dotenv
+
+1. Get key B from dashboard
+
+### GSD_GATE_TEST_EXISTING
+
+**Service:** ServiceC
+**Status:** pending
+**Destination:** dotenv
+
+1. Already in env
+`);
+
+    // (a) Verify getManifestStatus shows pending keys
+    const status = await getManifestStatus(tmp, 'M001');
+    assert.notStrictEqual(status, null, 'manifest should exist');
+    assert.ok(status!.pending.length > 0, 'should have pending keys');
+    assert.deepStrictEqual(status!.pending, ['GSD_GATE_TEST_PEND_A', 'GSD_GATE_TEST_PEND_B']);
+    assert.deepStrictEqual(status!.existing, ['GSD_GATE_TEST_EXISTING']);
+
+    // (b) Call collectSecretsFromManifest with no-UI context
+    // With hasUI: false, collectOneSecret returns null → pending keys become "skipped"
+    const result = await collectSecretsFromManifest(tmp, 'M001', makeNoUICtx(tmp));
+
+    // (c) Verify return shape
+    assert.deepStrictEqual(result.applied, [], 'no keys applied (no UI to enter values)');
+    assert.ok(result.skipped.includes('GSD_GATE_TEST_PEND_A'), 'PEND_A should be skipped');
+    assert.ok(result.skipped.includes('GSD_GATE_TEST_PEND_B'), 'PEND_B should be skipped');
+    assert.deepStrictEqual(result.existingSkipped, ['GSD_GATE_TEST_EXISTING']);
+
+    // (d) Verify manifest on disk was updated — pending entries that went through
+    // collection are now "skipped". The existing-in-env entry retains its manifest
+    // status ("pending") because collectSecretsFromManifest only updates entries
+    // that flow through collectOneSecret. At runtime, getManifestStatus overrides
+    // env-present entries to "existing" regardless of manifest status.
+    const manifestPath = join(tmp, '.gsd', 'milestones', 'M001', 'M001-SECRETS.md');
+    const updatedContent = readFileSync(manifestPath, 'utf8');
+    assert.ok(
+      updatedContent.includes('**Status:** skipped'),
+      'formerly-pending entries should now have status "skipped" in the manifest file',
+    );
+    // Count: PEND_A → skipped, PEND_B → skipped, EXISTING stays pending on disk
+    const skippedMatches = updatedContent.match(/\*\*Status:\*\* skipped/g);
+    assert.strictEqual(skippedMatches?.length, 2, 'two entries should have status "skipped"');
+    const pendingMatches = updatedContent.match(/\*\*Status:\*\* pending/g);
+    assert.strictEqual(pendingMatches?.length, 1, 'one entry (existing-in-env) retains pending on disk');
+
+    // (e) Verify getManifestStatus now shows no pending
+    const statusAfter = await getManifestStatus(tmp, 'M001');
+    assert.notStrictEqual(statusAfter, null);
+    assert.deepStrictEqual(statusAfter!.pending, [], 'no pending keys after collection');
+  } finally {
+    delete process.env.GSD_GATE_TEST_EXISTING;
+    if (savedA !== undefined) process.env.GSD_GATE_TEST_EXISTING = savedA;
+    delete process.env.GSD_GATE_TEST_PEND_A;
+    delete process.env.GSD_GATE_TEST_PEND_B;
+    rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+// ─── Scenario 3: No pending keys — all collected or in env ──────────────────
+
+test('secrets gate: no pending keys — getManifestStatus shows pending.length === 0', async () => {
+  const tmp = makeTempDir('gate-no-pending');
+  const savedKey = process.env.GSD_GATE_TEST_ENVKEY;
+  try {
+    process.env.GSD_GATE_TEST_ENVKEY = 'some-value';
+
+    writeManifest(tmp, `# Secrets Manifest
+
+**Milestone:** M001
+**Generated:** 2025-06-20T10:00:00Z
+
+### ALREADY_COLLECTED
+
+**Service:** ServiceX
+**Status:** collected
+**Destination:** dotenv
+
+1. Was collected previously
+
+### ALREADY_SKIPPED
+
+**Service:** ServiceY
+**Status:** skipped
+**Destination:** dotenv
+
+1. Not needed
+
+### GSD_GATE_TEST_ENVKEY
+
+**Service:** ServiceZ
+**Status:** pending
+**Destination:** dotenv
+
+1. In env already
+`);
+
+    const result = await getManifestStatus(tmp, 'M001');
+    assert.notStrictEqual(result, null, 'manifest should exist');
+    assert.deepStrictEqual(result!.pending, [], 'no pending keys — gate would skip');
+    assert.deepStrictEqual(result!.collected, ['ALREADY_COLLECTED']);
+    assert.deepStrictEqual(result!.skipped, ['ALREADY_SKIPPED']);
+    assert.deepStrictEqual(result!.existing, ['GSD_GATE_TEST_ENVKEY']);
+  } finally {
+    delete process.env.GSD_GATE_TEST_ENVKEY;
+    if (savedKey !== undefined) process.env.GSD_GATE_TEST_ENVKEY = savedKey;
+    rmSync(tmp, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/collect-from-manifest.test.ts

@@ -0,0 +1,469 @@
+/**
+ * Tests for S02 Enhanced Collection TUI functions:
+ * - collectSecretsFromManifest() orchestrator categorization and flow
+ * - showSecretsSummary() render output
+ * - collectOneSecret() guidance rendering
+ *
+ * These tests import functions that don't exist yet (T02/T03 will build them).
+ * They are expected to fail until implementation is complete.
+ *
+ * Uses dynamic imports so individual tests fail with clear messages
+ * instead of the entire file crashing at import time.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import type { SecretsManifest, SecretsManifestEntry } from "../types.ts";
+
+// Dynamic imports for files.ts functions to avoid cascading failure
+// when paths.js isn't available (files.ts statically imports paths.js)
+async function loadFilesExports(): Promise<{
+	formatSecretsManifest: (m: SecretsManifest) => string;
+	parseSecretsManifest: (content: string) => SecretsManifest;
+}> {
+	const mod = await import("../files.ts");
+	return {
+		formatSecretsManifest: mod.formatSecretsManifest,
+		parseSecretsManifest: mod.parseSecretsManifest,
+	};
+}
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+function makeTempDir(prefix: string): string {
+	const dir = join(tmpdir(), `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+	mkdirSync(dir, { recursive: true });
+	return dir;
+}
+
+function makeManifest(entries: Partial<SecretsManifestEntry>[]): SecretsManifest {
+	return {
+		milestone: "M001",
+		generatedAt: "2026-03-12T00:00:00Z",
+		entries: entries.map((e) => ({
+			key: e.key ?? "TEST_KEY",
+			service: e.service ?? "TestService",
+			dashboardUrl: e.dashboardUrl ?? "",
+			guidance: e.guidance ?? [],
+			formatHint: e.formatHint ?? "",
+			status: e.status ?? "pending",
+			destination: e.destination ?? "dotenv",
+		})),
+	};
+}
+
+async function writeManifestFile(dir: string, manifest: SecretsManifest): Promise<string> {
+	const { formatSecretsManifest } = await loadFilesExports();
+	const milestoneDir = join(dir, ".gsd", "milestones", "M001");
+	mkdirSync(milestoneDir, { recursive: true });
+	const filePath = join(milestoneDir, "M001-SECRETS.md");
+	writeFileSync(filePath, formatSecretsManifest(manifest));
+	return filePath;
+}
+
+async function loadOrchestrator(): Promise<{
+	collectSecretsFromManifest: Function;
+	showSecretsSummary: Function;
+}> {
+	const mod = await import("../../get-secrets-from-user.ts");
+	if (typeof mod.collectSecretsFromManifest !== "function") {
+		throw new Error("collectSecretsFromManifest is not exported from get-secrets-from-user.ts — T03 will implement this");
+	}
+	if (typeof mod.showSecretsSummary !== "function") {
+		throw new Error("showSecretsSummary is not exported from get-secrets-from-user.ts — T03 will implement this");
+	}
+	return {
+		collectSecretsFromManifest: mod.collectSecretsFromManifest,
+		showSecretsSummary: mod.showSecretsSummary,
+	};
+}
+
+async function loadGuidanceExport(): Promise<{ collectOneSecretWithGuidance: Function }> {
+	const mod = await import("../../get-secrets-from-user.ts");
+	if (typeof mod.collectOneSecretWithGuidance !== "function") {
+		throw new Error("collectOneSecretWithGuidance is not exported from get-secrets-from-user.ts — T02 will implement this");
+	}
+	return { collectOneSecretWithGuidance: mod.collectOneSecretWithGuidance };
+}
+
+// ─── collectSecretsFromManifest: categorization ───────────────────────────────
+
+test("collectSecretsFromManifest: categorizes entries — pending keys need collection, existing keys are skipped", async () => {
+	const { collectSecretsFromManifest } = await loadOrchestrator();
+
+	const tmp = makeTempDir("manifest-collect");
+	const savedA = process.env.EXISTING_KEY_A;
+	try {
+		process.env.EXISTING_KEY_A = "already-set";
+
+		const manifest = makeManifest([
+			{ key: "EXISTING_KEY_A", status: "pending" },
+			{ key: "PENDING_KEY_B", status: "pending", guidance: ["Step 1: Go to dashboard", "Step 2: Click create key"] },
+			{ key: "SKIPPED_KEY_C", status: "skipped" },
+		]);
+		await writeManifestFile(tmp, manifest);
+
+		let callIndex = 0;
+		const mockCtx = {
+			cwd: tmp,
+			hasUI: true,
+			ui: {
+				custom: async (_factory: any) => {
+					callIndex++;
+					if (callIndex <= 1) return null; // summary screen dismiss
+					return "mock-secret-value"; // collect pending key
+				},
+			},
+		};
+
+		const result = await collectSecretsFromManifest(tmp, "M001", mockCtx as any);
+
+		// EXISTING_KEY_A should be in existingSkipped (it's in process.env)
+		assert.ok(result.existingSkipped?.includes("EXISTING_KEY_A"),
+			"EXISTING_KEY_A should be in existingSkipped");
+
+		// PENDING_KEY_B should have been collected (applied)
+		assert.ok(result.applied.includes("PENDING_KEY_B"),
+			"PENDING_KEY_B should be in applied");
+
+		// SKIPPED_KEY_C should remain skipped
+		assert.ok(result.skipped.includes("SKIPPED_KEY_C"),
+			"SKIPPED_KEY_C should be in skipped");
+	} finally {
+		delete process.env.EXISTING_KEY_A;
+		if (savedA !== undefined) process.env.EXISTING_KEY_A = savedA;
+		rmSync(tmp, { recursive: true, force: true });
+	}
+});
+
+test("collectSecretsFromManifest: existing keys are excluded from the collection list — not prompted", async () => {
+	const { collectSecretsFromManifest } = await loadOrchestrator();
+
+	const tmp = makeTempDir("manifest-collect-skip");
+	const savedA = process.env.ALREADY_SET_KEY;
+	try {
+		process.env.ALREADY_SET_KEY = "present";
+
+		const manifest = makeManifest([
+			{ key: "ALREADY_SET_KEY", status: "pending" },
+			{ key: "NEEDS_COLLECTION", status: "pending" },
+		]);
+		await writeManifestFile(tmp, manifest);
+
+		const collectedKeyNames: string[] = [];
+		let summaryShown = false;
+		const mockCtx = {
+			cwd: tmp,
+			hasUI: true,
+			ui: {
+				custom: async (factory: any) => {
+					// Intercept the factory to check what key is being collected
+					if (!summaryShown) {
+						summaryShown = true;
+						return null; // dismiss summary
+					}
+					collectedKeyNames.push("prompted");
+					return "mock-value";
+				},
+			},
+		};
+
+		const result = await collectSecretsFromManifest(tmp, "M001", mockCtx as any);
+
+		// ALREADY_SET_KEY should not have been prompted — only NEEDS_COLLECTION should
+		assert.ok(!result.applied.includes("ALREADY_SET_KEY"),
+			"ALREADY_SET_KEY should not be in applied (it was auto-skipped)");
+		assert.ok(result.existingSkipped?.includes("ALREADY_SET_KEY"),
+			"ALREADY_SET_KEY should be in existingSkipped");
+	} finally {
+		delete process.env.ALREADY_SET_KEY;
+		if (savedA !== undefined) process.env.ALREADY_SET_KEY = savedA;
+		rmSync(tmp, { recursive: true, force: true });
+	}
+});
+
+test("collectSecretsFromManifest: manifest statuses are updated after collection", async () => {
+	const { collectSecretsFromManifest } = await loadOrchestrator();
+
+	const tmp = makeTempDir("manifest-update");
+	try {
+		const manifest = makeManifest([
+			{ key: "KEY_TO_COLLECT", status: "pending" },
+			{ key: "KEY_TO_SKIP", status: "pending" },
+		]);
+		const manifestPath = await writeManifestFile(tmp, manifest);
+
+		let callIndex = 0;
+		const mockCtx = {
+			cwd: tmp,
+			hasUI: true,
+			ui: {
+				custom: async (_factory: any) => {
+					callIndex++;
+					if (callIndex <= 1) return null; // summary screen dismiss
+					if (callIndex === 2) return "secret-value"; // KEY_TO_COLLECT
+					return null; // KEY_TO_SKIP — user skips
+				},
+			},
+		};
+
+		await collectSecretsFromManifest(tmp, "M001", mockCtx as any);
+
+		// Read back the manifest file and verify statuses were updated
+		const { parseSecretsManifest } = await loadFilesExports();
+		const updatedContent = readFileSync(manifestPath, "utf8");
+		const updatedManifest = parseSecretsManifest(updatedContent);
+
+		const keyToCollect = updatedManifest.entries.find(e => e.key === "KEY_TO_COLLECT");
+		const keyToSkip = updatedManifest.entries.find(e => e.key === "KEY_TO_SKIP");
+
+		assert.equal(keyToCollect?.status, "collected",
+			"KEY_TO_COLLECT should have status 'collected' after providing a value");
+		assert.equal(keyToSkip?.status, "skipped",
+			"KEY_TO_SKIP should have status 'skipped' after user skipped it");
+	} finally {
+		rmSync(tmp, { recursive: true, force: true });
+	}
+});
+
+// ─── showSecretsSummary: render output ────────────────────────────────────────
+
+test("showSecretsSummary: produces lines with correct status glyphs for each entry status", async () => {
+	const { showSecretsSummary } = await loadOrchestrator();
+
+	const entries: SecretsManifestEntry[] = [
+		{ key: "PENDING_KEY", service: "Svc", dashboardUrl: "", guidance: [], formatHint: "", status: "pending", destination: "dotenv" },
+		{ key: "COLLECTED_KEY", service: "Svc", dashboardUrl: "", guidance: [], formatHint: "", status: "collected", destination: "dotenv" },
+		{ key: "SKIPPED_KEY", service: "Svc", dashboardUrl: "", guidance: [], formatHint: "", status: "skipped", destination: "dotenv" },
+	];
+
+	// showSecretsSummary renders a ctx.ui.custom screen. We capture the render output.
+	let renderFn: ((width: number) => string[]) | undefined;
+	const mockCtx = {
+		hasUI: true,
+		ui: {
+			custom: async (factory: any) => {
+				const mockTheme = {
+					fg: (_color: string, text: string) => text,
+					bold: (text: string) => text,
+				};
+				const mockTui = { requestRender: () => {}, terminal: { rows: 24, columns: 80 } };
+				const component = factory(mockTui, mockTheme, {}, () => {});
+				renderFn = component.render;
+				// Simulate immediate dismiss
+				component.handleInput("\x1b"); // escape
+			},
+		},
+	};
+
+	await showSecretsSummary(mockCtx as any, entries, []);
+
+	assert.ok(renderFn, "render function should have been captured from factory");
+	const lines = renderFn!(80);
+
+	// Verify each key appears in the output
+	const output = lines.join("\n");
+	assert.ok(output.includes("PENDING_KEY"), "should include PENDING_KEY");
+	assert.ok(output.includes("COLLECTED_KEY"), "should include COLLECTED_KEY");
+	assert.ok(output.includes("SKIPPED_KEY"), "should include SKIPPED_KEY");
+
+	// Verify we have at least one line per entry plus header/footer
+	assert.ok(lines.length >= 5, `should have at least 5 lines (got ${lines.length})`);
+});
+
+test("showSecretsSummary: existing keys shown with distinct status indicator", async () => {
+	const { showSecretsSummary } = await loadOrchestrator();
+
+	const entries: SecretsManifestEntry[] = [
+		{ key: "NEW_KEY", service: "Svc", dashboardUrl: "", guidance: [], formatHint: "", status: "pending", destination: "dotenv" },
+		{ key: "OLD_KEY", service: "Svc", dashboardUrl: "", guidance: [], formatHint: "", status: "collected", destination: "dotenv" },
+	];
+	const existingKeys = ["OLD_KEY"];
+
+	let renderFn: ((width: number) => string[]) | undefined;
+	const mockCtx = {
+		hasUI: true,
+		ui: {
+			custom: async (factory: any) => {
+				const mockTheme = {
+					fg: (_color: string, text: string) => text,
+					bold: (text: string) => text,
+				};
+				const mockTui = { requestRender: () => {}, terminal: { rows: 24, columns: 80 } };
+				const component = factory(mockTui, mockTheme, {}, () => {});
+				renderFn = component.render;
+				component.handleInput("\x1b");
+			},
+		},
+	};
+
+	await showSecretsSummary(mockCtx as any, entries, existingKeys);
+
+	assert.ok(renderFn, "render function should have been captured");
+	const lines = renderFn!(80);
+	const output = lines.join("\n");
+
+	assert.ok(output.includes("NEW_KEY"), "should include NEW_KEY");
+	assert.ok(output.includes("OLD_KEY"), "should include OLD_KEY");
+});
+
+// ─── collectOneSecret: guidance rendering ─────────────────────────────────────
+
+test("collectOneSecret: guidance lines appear in render output when guidance is provided", async () => {
+	const { collectOneSecretWithGuidance } = await loadGuidanceExport();
+
+	const guidanceSteps = [
+		"Navigate to https://platform.openai.com/api-keys",
+		"Click 'Create new secret key'",
+		"Copy the key value",
+	];
+
+	// Use the exported test helper to capture render output with guidance
+	let renderFn: ((width: number) => string[]) | undefined;
+	const mockCtx = {
+		hasUI: true,
+		ui: {
+			custom: async (factory: any) => {
+				const mockTheme = {
+					fg: (_color: string, text: string) => text,
+					bold: (text: string) => text,
+				};
+				const mockTui = { requestRender: () => {}, terminal: { rows: 24, columns: 80 } };
+				const component = factory(mockTui, mockTheme, {}, () => {});
+				renderFn = component.render;
+				component.handleInput("\x1b"); // escape to dismiss
+			},
+		},
+	};
+
+	await collectOneSecretWithGuidance(mockCtx, 0, 1, "OPENAI_API_KEY", "starts with sk-", guidanceSteps);
+
+	assert.ok(renderFn, "render function should have been captured");
+	const lines = renderFn!(80);
+	const output = lines.join("\n");
+
+	// Verify guidance steps appear in the output
+	assert.ok(output.includes("Navigate to"), "should include first guidance step");
+	assert.ok(output.includes("Create new secret key"), "should include second guidance step");
+	assert.ok(output.includes("Copy the key value"), "should include third guidance step");
+});
+
+test("collectOneSecret: guidance lines wrap long URLs instead of truncating", async () => {
+	const { collectOneSecretWithGuidance } = await loadGuidanceExport();
+
+	const longGuidance = [
+		"Navigate to https://platform.openai.com/account/api-keys and click 'Create new secret key'",
+	];
+
+	let renderFn: ((width: number) => string[]) | undefined;
+	const mockCtx = {
+		hasUI: true,
+		ui: {
+			custom: async (factory: any) => {
+				const mockTheme = {
+					fg: (_color: string, text: string) => text,
+					bold: (text: string) => text,
+				};
+				const mockTui = { requestRender: () => {}, terminal: { rows: 24, columns: 80 } };
+				const component = factory(mockTui, mockTheme, {}, () => {});
+				renderFn = component.render;
+				component.handleInput("\x1b");
+			},
+		},
+	};
+
+	await collectOneSecretWithGuidance(mockCtx, 0, 1, "TEST_KEY", undefined, longGuidance);
+
+	assert.ok(renderFn, "render function should have been captured");
+	// Render at narrow width to force wrapping
+	const lines = renderFn!(50);
+	const output = lines.join("\n");
+
+	// The full URL should be present (wrapped, not truncated)
+	assert.ok(output.includes("platform.openai.com"), "URL should not be truncated");
+	assert.ok(output.includes("Create new secret key"), "text after URL should not be truncated");
+});
+
+test("collectOneSecret: no guidance provided — render output has no guidance section", async () => {
+	const { collectOneSecretWithGuidance } = await loadGuidanceExport();
+
+	let renderFn: ((width: number) => string[]) | undefined;
+	const mockCtx = {
+		hasUI: true,
+		ui: {
+			custom: async (factory: any) => {
+				const mockTheme = {
+					fg: (_color: string, text: string) => text,
+					bold: (text: string) => text,
+				};
+				const mockTui = { requestRender: () => {}, terminal: { rows: 24, columns: 80 } };
+				const component = factory(mockTui, mockTheme, {}, () => {});
+				renderFn = component.render;
+				component.handleInput("\x1b");
+			},
+		},
+	};
+
+	// Call without guidance (undefined)
+	await collectOneSecretWithGuidance(mockCtx, 0, 1, "SOME_KEY", "hint text", undefined);
+
+	assert.ok(renderFn, "render function should have been captured");
+	const lines = renderFn!(80);
+	const output = lines.join("\n");
+
+	// Should include the key name and hint but no numbered guidance steps
+	assert.ok(output.includes("SOME_KEY"), "should include key name");
+	assert.ok(output.includes("hint text"), "should include hint");
+	// Should NOT have numbered step indicators (1., 2., etc.) for guidance
+	assert.ok(!output.match(/^\s*1\.\s/m), "should not have numbered guidance steps when no guidance provided");
+});
+
+// ─── collectSecretsFromManifest: returns structured result ────────────────────
+
+test("collectSecretsFromManifest: returns result with applied, skipped, and existingSkipped arrays", async () => {
+	const { collectSecretsFromManifest } = await loadOrchestrator();
+
+	const tmp = makeTempDir("manifest-result");
+	const savedKey = process.env.RESULT_TEST_EXISTING;
+	try {
+		process.env.RESULT_TEST_EXISTING = "already-here";
+
+		const manifest = makeManifest([
+			{ key: "RESULT_TEST_EXISTING", status: "pending" },
+			{ key: "RESULT_TEST_NEW", status: "pending" },
+		]);
+		await writeManifestFile(tmp, manifest);
+
+		let callIndex = 0;
+		const mockCtx = {
+			cwd: tmp,
+			hasUI: true,
+			ui: {
+				custom: async (_factory: any) => {
+					callIndex++;
+					if (callIndex <= 1) return null; // summary dismiss
+					return "secret-value"; // collect the pending key
+				},
+			},
+		};
+
+		const result = await collectSecretsFromManifest(tmp, "M001", mockCtx as any);
+
+		// Verify result shape
+		assert.ok(Array.isArray(result.applied), "result should have applied array");
+		assert.ok(Array.isArray(result.skipped), "result should have skipped array");
+		assert.ok(Array.isArray(result.existingSkipped), "result should have existingSkipped array");
+
+		assert.ok(result.existingSkipped.includes("RESULT_TEST_EXISTING"),
+			"existing key should be in existingSkipped");
+		assert.ok(result.applied.includes("RESULT_TEST_NEW"),
+			"collected key should be in applied");
+	} finally {
+		delete process.env.RESULT_TEST_EXISTING;
+		if (savedKey !== undefined) process.env.RESULT_TEST_EXISTING = savedKey;
+		rmSync(tmp, { recursive: true, force: true });
+	}
+});