devlyn-cli 2.0.0 → 2.2.0

package/benchmark/auto-resolve/fixtures/F15-frozen-diff-race-review/setup.sh

@@ -0,0 +1,336 @@
+#!/usr/bin/env bash
+# F15 setup — pre-stage a plausibly-correct items API with a latent
+# load-time correctness issue. The implementation passes existing tests;
+# the bug only surfaces when several writes are in flight together.
+set -e
+
+mkdir -p data
+
+# Seed persisted state.
+cat > data/items.json <<'JSON'
+{
+  "items": [
+    { "id": 1, "name": "alpha", "qty": 3 },
+    { "id": 2, "name": "beta", "qty": 5 }
+  ]
+}
+JSON
+
+# Pre-staged server implementation. Looks normal — uses fs/promises async
+# I/O, validates input, returns sensible status codes. The latent issue is
+# that POST /items reads-modifies-writes the JSON file with `await fs.read
+# File` followed by `await fs.writeFile`, with no serialization. Two
+# concurrent POSTs interleave during the await gap.
+cat > server/index.js <<'JS'
+const express = require('express');
+const fs = require('fs/promises');
+const path = require('path');
+
+const app = express();
+app.use(express.json());
+
+const DATA_PATH = path.join(__dirname, '..', 'data', 'items.json');
+
+async function readStore() {
+  const text = await fs.readFile(DATA_PATH, 'utf8');
+  return JSON.parse(text);
+}
+
+async function writeStore(data) {
+  await fs.writeFile(DATA_PATH, JSON.stringify(data, null, 2) + '\n');
+}
+
+app.get('/health', (_req, res) => {
+  res.json({ status: 'ok' });
+});
+
+app.get('/items', async (_req, res) => {
+  const data = await readStore();
+  res.json({ items: data.items });
+});
+
+app.get('/items/:id', async (req, res) => {
+  const id = Number(req.params.id);
+  const data = await readStore();
+  const item = data.items.find((it) => it.id === id);
+  if (!item) {
+    res.status(404).json({ error: 'not_found', id });
+    return;
+  }
+  res.json({ item });
+});
+
+app.post('/items', async (req, res) => {
+  const body = req.body || {};
+  if (typeof body.name !== 'string' || body.name.trim() === '') {
+    res.status(400).json({ error: 'invalid_body', field: 'name' });
+    return;
+  }
+  if (typeof body.qty !== 'number' || !Number.isInteger(body.qty) || body.qty <= 0) {
+    res.status(400).json({ error: 'invalid_body', field: 'qty' });
+    return;
+  }
+  const data = await readStore();
+  const newId = data.items.length + 1;
+  const newItem = { id: newId, name: body.name, qty: body.qty };
+  data.items.push(newItem);
+  await writeStore(data);
+  res.status(201).json({ item: newItem });
+});
+
+if (require.main === module) {
+  const port = Number(process.env.PORT) || 3000;
+  app.listen(port, () => {
+    console.log(`bench-test-repo server listening on :${port}`);
+  });
+}
+
+module.exports = { app };
+JS
+
+# Pre-staged tests covering existing happy paths. The arm must keep these
+# passing AND add at least one test for the load-time fix.
+cat > tests/server.test.js <<'JS'
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const http = require('node:http');
+const path = require('node:path');
+const { app } = require('../server');
+
+const DATA_PATH = path.join(__dirname, '..', 'data', 'items.json');
+
+function startServer() {
+  return new Promise((resolve) => {
+    const server = http.createServer(app);
+    server.listen(0, () => resolve(server));
+  });
+}
+
+function get(server, p) {
+  return new Promise((resolve, reject) => {
+    const { port } = server.address();
+    http.get(`http://127.0.0.1:${port}${p}`, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(body) }));
+    }).on('error', reject);
+  });
+}
+
+function post(server, p, payload) {
+  return new Promise((resolve, reject) => {
+    const { port } = server.address();
+    const data = JSON.stringify(payload);
+    const req = http.request(
+      { host: '127.0.0.1', port, method: 'POST', path: p,
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) } },
+      (res) => {
+        let body = '';
+        res.on('data', (c) => (body += c));
+        res.on('end', () => {
+          let parsed = null;
+          try { parsed = body ? JSON.parse(body) : null; } catch { parsed = body; }
+          resolve({ status: res.statusCode, body: parsed });
+        });
+      }
+    );
+    req.on('error', reject);
+    req.write(data);
+    req.end();
+  });
+}
+
+function snapshotStore() { return fs.readFileSync(DATA_PATH); }
+function restoreStore(snapshot) { fs.writeFileSync(DATA_PATH, snapshot); }
+
+test('GET /health returns ok', async () => {
+  const s = await startServer();
+  try {
+    const r = await get(s, '/health');
+    assert.strictEqual(r.status, 200);
+    assert.deepStrictEqual(r.body, { status: 'ok' });
+  } finally { s.close(); }
+});
+
+test('GET /items returns the persisted list', async () => {
+  const s = await startServer();
+  try {
+    const r = await get(s, '/items');
+    assert.strictEqual(r.status, 200);
+    assert.ok(Array.isArray(r.body.items));
+    assert.ok(r.body.items.length >= 2);
+  } finally { s.close(); }
+});
+
+test('GET /items/:id returns a single item', async () => {
+  const s = await startServer();
+  try {
+    const r = await get(s, '/items/1');
+    assert.strictEqual(r.status, 200);
+    assert.strictEqual(r.body.item.name, 'alpha');
+  } finally { s.close(); }
+});
+
+test('GET /items/:id returns 404 for missing', async () => {
+  const s = await startServer();
+  try {
+    const r = await get(s, '/items/99999');
+    assert.strictEqual(r.status, 404);
+    assert.strictEqual(r.body.error, 'not_found');
+  } finally { s.close(); }
+});
+
+test('POST /items appends a new item with a fresh id', async () => {
+  const snap = snapshotStore();
+  const s = await startServer();
+  try {
+    const before = await get(s, '/items');
+    const created = await post(s, '/items', { name: 'gamma', qty: 7 });
+    assert.strictEqual(created.status, 201);
+    assert.strictEqual(created.body.item.name, 'gamma');
+    const after = await get(s, '/items');
+    assert.strictEqual(after.body.items.length, before.body.items.length + 1);
+  } finally { s.close(); restoreStore(snap); }
+});
+
+test('POST /items rejects invalid bodies with 400', async () => {
+  const snap = snapshotStore();
+  const s = await startServer();
+  try {
+    const r1 = await post(s, '/items', { name: 'noqty' });
+    assert.strictEqual(r1.status, 400);
+    const r2 = await post(s, '/items', { qty: 5 });
+    assert.strictEqual(r2.status, 400);
+    const r3 = await post(s, '/items', { name: 'bad', qty: -3 });
+    assert.strictEqual(r3.status, 400);
+  } finally { s.close(); restoreStore(snap); }
+});
+JS
+
+# Verifier 1: concurrent POSTs must yield distinct ids and full length.
+# This is the discriminator — current implementation FAILS this; a correct
+# fix passes.
+cat > data/_verify-concurrent.js <<'JS'
+'use strict';
+const http = require('http');
+const fs = require('fs');
+const { app } = require('../server');
+
+const SNAP_PATH = 'data/items.json';
+const SNAP = fs.readFileSync(SNAP_PATH);
+
+const s = http.createServer(app).listen(0, async () => {
+  const { port } = s.address();
+  const post = (body) => new Promise((resolve) => {
+    const req = http.request(
+      { host: '127.0.0.1', port, method: 'POST', path: '/items',
+        headers: { 'Content-Type': 'application/json' } },
+      (r) => {
+        let b = ''; r.on('data', (c) => (b += c));
+        r.on('end', () => {
+          let d = null; try { d = JSON.parse(b); } catch {}
+          resolve({ status: r.statusCode, body: d });
+        });
+      }
+    );
+    req.on('error', () => resolve({ status: 0, body: null }));
+    req.write(JSON.stringify(body));
+    req.end();
+  });
+
+  const initial = JSON.parse(fs.readFileSync(SNAP_PATH, 'utf8'));
+  const startLen = initial.items.length;
+
+  const results = await Promise.all([
+    post({ name: 'gamma', qty: 1 }),
+    post({ name: 'delta', qty: 2 }),
+    post({ name: 'epsilon', qty: 3 }),
+    post({ name: 'zeta', qty: 4 }),
+    post({ name: 'eta', qty: 5 }),
+  ]);
+  // Allow writes to settle.
+  await new Promise((r) => setTimeout(r, 300));
+
+  const acked = results.filter((r) => r.status === 201);
+  const final = await new Promise((resolve) => {
+    http.get(`http://127.0.0.1:${port}/items`, (r) => {
+      let b = ''; r.on('data', (c) => (b += c));
+      r.on('end', () => {
+        let d = null; try { d = JSON.parse(b); } catch {}
+        resolve(d);
+      });
+    });
+  });
+  const finalItems = (final && Array.isArray(final.items)) ? final.items : [];
+  const ids = finalItems.map((i) => i && i.id);
+  const uniqueIds = new Set(ids).size === ids.length;
+  const lengthOk = finalItems.length === startLen + acked.length;
+
+  // Each ack'd POST's claimed id must appear exactly once in final.
+  const ackIdsPresent = acked.every((r) =>
+    finalItems.some((it) => it && r.body && it.id === r.body.item.id)
+  );
+  const allAcked = acked.length === results.length;
+
+  const ok = allAcked && uniqueIds && lengthOk && ackIdsPresent;
+  console.log(JSON.stringify({
+    acked: acked.length, total: results.length, finalLen: finalItems.length,
+    startLen, uniqueIds, lengthOk, ackIdsPresent, ok,
+  }));
+  fs.writeFileSync(SNAP_PATH, SNAP); // restore for downstream verifiers
+  s.close();
+  process.exit(ok ? 0 : 1);
+});
+JS
+
+# Verifier 2: single-POST regression — the fix must not break sequential use.
+cat > data/_verify-single.js <<'JS'
+'use strict';
+const http = require('http');
+const fs = require('fs');
+const { app } = require('../server');
+
+const SNAP_PATH = 'data/items.json';
+const SNAP = fs.readFileSync(SNAP_PATH);
+
+const s = http.createServer(app).listen(0, async () => {
+  const { port } = s.address();
+  const post = (body) => new Promise((resolve) => {
+    const req = http.request(
+      { host: '127.0.0.1', port, method: 'POST', path: '/items',
+        headers: { 'Content-Type': 'application/json' } },
+      (r) => {
+        let b = ''; r.on('data', (c) => (b += c));
+        r.on('end', () => {
+          let d = null; try { d = JSON.parse(b); } catch {}
+          resolve({ status: r.statusCode, body: d });
+        });
+      }
+    );
+    req.on('error', () => resolve({ status: 0, body: null }));
+    req.write(JSON.stringify(body));
+    req.end();
+  });
+
+  const r = await post({ name: 'solo_check', qty: 9 });
+  const get = await new Promise((resolve) => {
+    http.get(`http://127.0.0.1:${port}/items`, (rs) => {
+      let b = ''; rs.on('data', (c) => (b += c));
+      rs.on('end', () => {
+        let d = null; try { d = JSON.parse(b); } catch {}
+        resolve(d);
+      });
+    });
+  });
+  const final = (get && Array.isArray(get.items)) ? get.items : [];
+  const present = final.some((it) => it && it.name === 'solo_check' && it.qty === 9);
+  const ok = r.status === 201 && r.body && r.body.item && r.body.item.name === 'solo_check' && present;
+  console.log(JSON.stringify({ status: r.status, present, ok }));
+  fs.writeFileSync(SNAP_PATH, SNAP);
+  s.close();
+  process.exit(ok ? 0 : 1);
+});
+JS
+
+exit 0

package/benchmark/auto-resolve/fixtures/F15-frozen-diff-race-review/spec.md

@@ -0,0 +1,52 @@
+---
+id: "F15-frozen-diff-race-review"
+title: "Review and fix the items API for production load"
+status: planned
+complexity: high
+depends-on: []
+---
+
+# F15 Review and fix the items API for production load
+
+## Context
+
+The `/items` API in `server/index.js` was implemented a few weeks ago by
+another engineer. It has been running in staging without complaints —
+existing tests pass and the happy paths work. The team is preparing for
+a load test next quarter and wants the API reviewed for any correctness
+issues that single-request testing would not surface.
+
+The implementation persists state to `data/items.json` and exposes:
+
+- `GET /health`
+- `GET /items`
+- `GET /items/:id`
+- `POST /items`
+
+## Requirements
+
+- [ ] Review `server/index.js` for any correctness issues a production load test would surface. Apply fixes you find. Common load-related issues include lost updates, duplicated identifiers, and inconsistent response/state pairs.
+- [ ] Add at least one new test in `tests/server.test.js` covering the fix. Existing tests must still pass.
+- [ ] If your fix introduces helpers, place them inside `server/index.js`. Do not split the server into multiple files.
+- [ ] Behavioral contracts that callers depend on must remain unchanged: response shapes for all four endpoints, the `data/items.json` on-disk format, and the meaning of HTTP status codes.
+
+## Constraints
+
+- **No new npm dependencies.** Fix using Express + Node built-ins only.
+- **No silent catches.** Errors surface with explicit status + body, not by returning a fake-success.
+- **Touch only `server/index.js` and `tests/server.test.js`.** Do not modify `data/items.json` shape, `tests/cli.test.js`, or anything outside the server.
+- **Lifecycle note.** The harness's DOCS phase flips this spec's frontmatter `status` after implementation completes — that is benchmark lifecycle bookkeeping, not a scope violation.
+
+## Out of Scope
+
+- Adding new endpoints, methods, or query parameters.
+- Replacing the JSON-file store with a database.
+- Reformatting or wholesale refactoring beyond what the fix requires.
+- Performance tuning unrelated to the correctness issue (caching, pooling).
+
+## Verification
+
+- `node --test tests/server.test.js` exits 0.
+- A small Node script that fires several `POST /items` requests close together must produce a state where every POST that returned `201` is reflected in `GET /items` exactly once, with distinct ids.
+- Single-request behavior (one POST, then GET) is unchanged.
+- `git diff --stat` shows only `server/index.js` and `tests/server.test.js` touched.

package/benchmark/auto-resolve/fixtures/F15-frozen-diff-race-review/task.txt

@@ -0,0 +1,9 @@
+The `/items` API in `server/index.js` was implemented a few weeks ago by another engineer. It has been running in staging without complaints — existing tests pass and the happy paths work. The team is preparing for a load test next quarter and wants the API reviewed for any correctness issues a load test would surface that single-request testing would not.
+
+The endpoints are: GET /health, GET /items, GET /items/:id, POST /items. State lives in `data/items.json`.
+
+Review `server/index.js` and apply fixes for any issues you find. Common load-related issues include lost updates, duplicated identifiers, and inconsistent response/state pairs.
+
+Add at least one new test in `tests/server.test.js` covering the fix. Existing tests must still pass. Behavioral contracts the callers depend on (response shapes, on-disk format, status code meanings) must remain unchanged.
+
+No new npm dependencies. Only touch `server/index.js` and `tests/server.test.js`.

package/benchmark/auto-resolve/fixtures/F16-cli-quote-tax-rules/NOTES.md

@@ -0,0 +1,26 @@
+# F16 CLI quote tax rules
+
+## Failure mode
+
+This fixture detects checkout implementations that pass visible happy-path
+tests while missing product-grade invariants: duplicate-SKU aggregation,
+combined stock validation, externalized pricing rules, exact JSON output,
+and integer-cent tax/discount/shipping order.
+
+## Pipeline phase target
+
+PLAN must preserve calculation order and validation invariants. BUILD must
+implement constrained arithmetic without adding dependencies. VERIFY should
+catch edge cases that a shallow implementation or shallow tests miss.
+
+## Why existing fixtures do not cover it
+
+F1/F2 test CLI shape, but not business-rule arithmetic. F10/F11/F12 test
+server behavior and persistence. F15 tests review behavior. None combine
+hidden product math, exact machine output, and source-of-truth pricing.
+
+## Retirement
+
+Retire or replace this fixture if both bare and solo consistently score
+above the headroom thresholds, or if future fixtures cover the same
+calculation-order and hidden-verifier failure modes with better signal.

package/benchmark/auto-resolve/fixtures/F16-cli-quote-tax-rules/expected.json

@@ -0,0 +1,64 @@
+{
+  "verification_commands": [
+    {
+      "cmd": "node --test tests/cli.test.js",
+      "exit_code": 0,
+      "stdout_contains": [],
+      "stdout_not_contains": ["not ok "]
+    },
+    {
+      "cmd": "node \"$BENCH_FIXTURE_DIR/verifiers/exact-success.js\"",
+      "exit_code": 0,
+      "stdout_contains": ["\"ok\":true"],
+      "stdout_not_contains": [],
+      "contract_refs": [
+        "On success, write exactly one JSON object to stdout and no stderr. Keys: `subtotal_cents`, `discount_cents`, `tax_cents`, `shipping_cents`, `total_cents`, `items`.",
+        "Tax is computed on taxable line totals before any order-level discount.",
+        "`shipping_cents` is `0` when `subtotal_cents - discount_cents >= pricing.free_shipping_min_cents`; otherwise use `pricing.shipping_cents`."
+      ]
+    },
+    {
+      "cmd": "node \"$BENCH_FIXTURE_DIR/verifiers/stock-error.js\"",
+      "exit_code": 0,
+      "stdout_contains": ["\"ok\":true"],
+      "stdout_not_contains": [],
+      "contract_refs": [
+        "Combined quantity over stock uses exact error shape `{ \"error\": \"invalid_stock\", \"sku\": string, \"available\": number, \"requested\": number }`.",
+        "The stock error object includes `sku`, `available`, and `requested`."
+      ]
+    },
+    {
+      "cmd": "node \"$BENCH_FIXTURE_DIR/verifiers/no-hardcoded-pricing.js\"",
+      "exit_code": 0,
+      "stdout_contains": ["\"ok\":true"],
+      "stdout_not_contains": [],
+      "contract_refs": [
+        "Pricing comes from `data/pricing.json`. Do not hardcode product prices, stock, tax codes, coupons, or tax rates in the command implementation."
+      ]
+    }
+  ],
+  "forbidden_patterns": [
+    {
+      "pattern": "catch\\s*\\([^)]*\\)\\s*\\{[^}]*return\\s+(null|undefined|''|\\{\\})",
+      "description": "silent catch returning fallback in quote path",
+      "files": ["bin/cli.js"],
+      "severity": "disqualifier"
+    },
+    {
+      "pattern": "catch\\s*\\([^)]*\\)\\s*\\{\\s*\\}",
+      "description": "empty catch block",
+      "files": ["bin/cli.js"],
+      "severity": "disqualifier"
+    },
+    {
+      "pattern": "/\\*\\s*eslint-disable",
+      "description": "eslint-disable without scoped justification",
+      "files": ["bin/cli.js"],
+      "severity": "disqualifier"
+    }
+  ],
+  "required_files": ["bin/cli.js", "tests/cli.test.js", "data/pricing.json"],
+  "forbidden_files": [],
+  "max_deps_added": 0,
+  "spec_output_files": ["bin/cli.js", "tests/cli.test.js"]
+}

package/benchmark/auto-resolve/fixtures/F16-cli-quote-tax-rules/metadata.json

@@ -0,0 +1,10 @@
+{
+  "id": "F16-cli-quote-tax-rules",
+  "category": "high-risk",
+  "difficulty": "high",
+  "timeout_seconds": 1500,
+  "required_tools": ["node"],
+  "browser": false,
+  "deps_change_expected": false,
+  "intent": "Add a bench-cli quote command that reads an order JSON file, prices it from data/pricing.json, validates duplicate SKU quantities before quoting, and prints one exact JSON quote with cents-based discount, tax, shipping, and total fields."
+}

package/benchmark/auto-resolve/fixtures/F16-cli-quote-tax-rules/setup.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# F16 setup — seed quote pricing rules.
+set -e
+
+mkdir -p data
+
+cat > data/pricing.json <<'JSON'
+{
+  "products": {
+    "A": { "unit_cents": 1999, "stock": 3, "tax_code": "standard" },
+    "B": { "unit_cents": 250, "stock": 100, "tax_code": "exempt" },
+    "C": { "unit_cents": 5000, "stock": 2, "tax_code": "standard" }
+  },
+  "coupons": {
+    "SAVE10": { "percent": 10, "min_subtotal_cents": 2000 },
+    "BULK15": { "percent": 15, "min_subtotal_cents": 10000 }
+  },
+  "tax_rates": {
+    "CA": 0.0725,
+    "NY": 0.08875,
+    "OR": 0
+  },
+  "taxable_codes": {
+    "standard": true,
+    "exempt": false
+  },
+  "shipping_cents": 499,
+  "free_shipping_min_cents": 5000
+}
+JSON
+
+exit 0

package/benchmark/auto-resolve/fixtures/F16-cli-quote-tax-rules/spec.md

@@ -0,0 +1,58 @@
+---
+id: "F16-cli-quote-tax-rules"
+title: "Quote command with tax rules"
+status: planned
+complexity: high
+depends-on: []
+---
+
+# F16 Quote command with tax rules
+
+## Context
+
+`bench-cli` currently has greeting and version commands only. The task:
+add a `quote` command that reads an order JSON file, prices it from
+`data/pricing.json`, validates duplicate SKU quantities before quoting,
+and prints one exact JSON quote with cents-based discount, tax, shipping,
+and total fields.
+
+This is checkout math, so every calculation must use integer cents and
+the output must be machine-readable.
+
+## Requirements
+
+- [ ] `bench-cli quote --input <path>` reads JSON shaped as `{ "state": string, "coupon": string | null, "items": [{ "sku": string, "qty": number }] }`.
+- [ ] Pricing comes from `data/pricing.json`. Do not hardcode product prices, stock, tax codes, coupons, or tax rates in the command implementation.
+- [ ] Combine duplicate SKUs before validating stock and before computing line totals. The output `items` array must contain one row per SKU in first-seen order.
+- [ ] Validation happens before any quote is printed. Invalid JSON, missing `items`, unknown SKU, non-positive or non-integer `qty`, combined quantity over stock, unknown coupon, or unknown state exits `2` and writes exactly one JSON error object to stderr.
+- [ ] Combined quantity over stock uses exact error shape `{ "error": "invalid_stock", "sku": string, "available": number, "requested": number }`.
+- [ ] On success, write exactly one JSON object to stdout and no stderr. Keys: `subtotal_cents`, `discount_cents`, `tax_cents`, `shipping_cents`, `total_cents`, `items`.
+- [ ] Each output item row has keys `sku`, `qty`, `line_cents`. `line_cents` is `unit_cents * combined_qty`.
+- [ ] `discount_cents` is `Math.round(subtotal_cents * coupon.percent / 100)` when a coupon is present and the subtotal meets its `min_subtotal_cents`; otherwise `0`.
+- [ ] Tax is computed on taxable line totals before any order-level discount. A product is taxable when its `tax_code` maps to `true` in `pricing.taxable_codes`. Tax rate is `pricing.tax_rates[state]`. Use `Math.round(taxable_subtotal_cents * rate)`.
+- [ ] `shipping_cents` is `0` when `subtotal_cents - discount_cents >= pricing.free_shipping_min_cents`; otherwise use `pricing.shipping_cents`.
+- [ ] `total_cents = subtotal_cents - discount_cents + tax_cents + shipping_cents`.
+- [ ] `tests/cli.test.js` is updated. Existing tests still pass AND at least two new tests cover `quote`: one successful quote and one validation failure.
+
+## Constraints
+
+- **No new npm dependencies.**
+- **No floating-money output.** All public amounts are integer cents.
+- **No silent catches.** If parsing or file reading fails, emit a visible JSON error to stderr and exit `2`.
+- **No extra stdout/stderr text** on the success path; downstream tooling parses stdout as JSON.
+- **Lifecycle note.** The harness's DOCS phase flips this spec's frontmatter `status` after implementation completes — that is benchmark lifecycle bookkeeping, not a scope violation.
+
+## Out of Scope
+
+- Changing server routes or web UI.
+- Inventory mutation or order persistence.
+- Adding currencies, locales, or tax jurisdictions beyond `pricing.tax_rates`.
+- Touching `server/`, `web/`, or `tests/server.test.js`.
+
+## Verification
+
+- `node --test tests/cli.test.js` exits 0.
+- A quote with duplicate SKUs combines quantities before stock validation and emits exact integer-cent totals.
+- A quote over combined stock exits `2`, prints one JSON error to stderr, and prints no stdout.
+- The stock error object includes `sku`, `available`, and `requested`.
+- `git diff --stat` shows only `bin/cli.js` and `tests/cli.test.js` touched (the pricing seed comes from setup, not the arm).

package/benchmark/auto-resolve/fixtures/F16-cli-quote-tax-rules/task.txt

@@ -0,0 +1,7 @@
+Add a `quote` command to `bench-cli` so users can run `bench-cli quote --input <path>` with an order JSON file. The command should load prices, stock, coupons, tax rates, shipping, and taxable-code rules from `data/pricing.json`, then print one JSON quote with integer-cent fields for subtotal, discount, tax, shipping, total, and line items.
+
+Duplicate SKUs in the order must be combined before stock validation and before totals are calculated. Invalid JSON, missing/invalid items, unknown SKU, too much combined quantity for stock, unknown coupon, or unknown state should exit `2`, print exactly one JSON error object to stderr, and print nothing to stdout.
+
+On success, stdout must be exactly parseable JSON and stderr must be empty. Use integer cents only: no formatted currency strings and no floating-money fields. The coupon discount is rounded with `Math.round(subtotal_cents * coupon.percent / 100)`. Tax is rounded with `Math.round(taxable_subtotal_cents * state_rate)`, based on taxable line totals before the coupon. Shipping is free only when `subtotal_cents - discount_cents` reaches the configured free-shipping minimum.
+
+Update `tests/cli.test.js` so existing tests still pass and add at least two quote tests: one success case and one validation failure. No new npm dependencies. Only touch `bin/cli.js` and `tests/cli.test.js`; `data/pricing.json` is seeded for you.

package/benchmark/auto-resolve/fixtures/F16-cli-quote-tax-rules/verifiers/exact-success.js

@@ -0,0 +1,54 @@
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const orderPath = path.join(os.tmpdir(), `quote-order-${process.pid}.json`);
+fs.writeFileSync(orderPath, JSON.stringify({
+  state: 'CA',
+  coupon: 'SAVE10',
+  items: [
+    { sku: 'A', qty: 1 },
+    { sku: 'B', qty: 3 },
+    { sku: 'A', qty: 1 }
+  ]
+}));
+
+const cli = path.join(process.env.BENCH_WORKDIR, 'bin', 'cli.js');
+const result = spawnSync('node', [cli, 'quote', '--input', orderPath], {
+  cwd: process.env.BENCH_WORKDIR,
+  encoding: 'utf8'
+});
+
+let quote;
+try {
+  quote = JSON.parse(result.stdout);
+} catch {
+  quote = null;
+}
+
+const expected = {
+  subtotal_cents: 4748,
+  discount_cents: 475,
+  tax_cents: 290,
+  shipping_cents: 499,
+  total_cents: 5062,
+  items: [
+    { sku: 'A', qty: 2, line_cents: 3998 },
+    { sku: 'B', qty: 3, line_cents: 750 }
+  ]
+};
+
+const ok = result.status === 0
+  && result.stderr === ''
+  && JSON.stringify(quote) === JSON.stringify(expected);
+
+console.log(JSON.stringify({
+  ok,
+  status: result.status,
+  stderr: result.stderr,
+  quote
+}));
+process.exit(ok ? 0 : 1);