karajan-code 2.34.0 → 3.1.0

package/packages/hu-board/public/utils/story-edit-form.js

@@ -0,0 +1,271 @@
+// KJC-TSK-0501 step 8c/8 — Story edit form (inline editor for the HU modal).
+//
+// Classic script (no exports). Loaded by index.html before app.js so the
+// top-level `function` declarations are hoisted into the shared realm and
+// `showStoryDetail` (story-detail-view.js) can call `renderStoryEditForm`
+// when the user hits ✎ on a story.
+//
+// Globals consumed from earlier scripts / app.js:
+//   - esc()                  (app.js)
+//   - shortStoryId()         (utils/formatters.js)
+//   - projectInitialsCache   (mutable in app.js — assignment crosses
+//                             scripts transparently)
+//   - showStoryDetail()      (utils/story-detail-view.js)
+//   - showError()            (utils/modals.js)
+//   - closeModal()           (app.js → window.closeModal, used by
+//                             inline onclick on the modal close button)
+//   - renderBoard()          (app.js)
+
+/**
+ * Swap the story modal into an inline edit form. Accepts the full story
+ * record that `showStoryDetail` just rendered so we don't re-fetch —
+ * the user's intent is "edit what I'm looking at".
+ *
+ * Cancel restores the read-only view via `showStoryDetail`; Save posts a
+ * PATCH and, on success, re-opens in read-only with the refreshed row.
+ *
+ * @param {object} story
+ */
+function renderStoryEditForm(story) {
+  const content = document.getElementById('modal-content');
+  const initials = projectInitialsCache[story.project_id] || 'kj';
+  const shortId = shortStoryId(story, initials);
+
+  const rawAc = story.acceptance_criteria ? JSON.parse(story.acceptance_criteria) : [];
+  // Represent AC as text: plain strings go verbatim, Gherkin objects
+  // collapse to "Given … | When … | Then …". On save we parse back —
+  // if the line matches the pattern we treat it as Gherkin, otherwise
+  // a free-form string.
+  const acInitial = rawAc
+    .map((c) => typeof c === 'string' ? c : (c.given ? `Given ${c.given} | When ${c.when} | Then ${c.then}` : JSON.stringify(c)))
+    .join('\n');
+
+  // Tests-first editor: one block per test with a type selector
+  // (shell | gherkin), the content textarea, optional file path, and
+  // a remove button. Save collects them into the structured v2.7.5
+  // array shape. Plain strings in the existing data are treated as
+  // legacy shell tests and auto-upgraded to the structured form.
+  const rawTests = story.acceptance_tests ? JSON.parse(story.acceptance_tests) : [];
+  const testsInitial = rawTests.map((t) => {
+    if (typeof t === 'string') return { type: 'shell', content: t, file: '' };
+    if (t && typeof t === 'object') {
+      return {
+        type: t.type === 'gherkin' ? 'gherkin' : 'shell',
+        content: typeof t.content === 'string' ? t.content : JSON.stringify(t),
+        file: typeof t.file === 'string' ? t.file : '',
+      };
+    }
+    return { type: 'shell', content: String(t ?? ''), file: '' };
+  });
+
+  const scopeInitial = story.original_text || story.certified_want || '';
+  const TASK_TYPES = ['sw', 'infra', 'doc', 'add-tests', 'refactor'];
+
+  content.innerHTML = `
+    <div class="modal__header">
+      <div>
+        <div class="modal__title" title="${esc(story.id)}">${esc(shortId)} <span style="font-size:0.75rem;color:var(--text-muted);font-weight:normal">(editing)</span></div>
+        <div class="modal__subtitle" style="font-size:0.75rem;color:var(--text-muted);font-family:monospace;margin-top:2px">${esc(story.id)}</div>
+      </div>
+      <button class="modal__close" onclick="closeModal()">&times;</button>
+    </div>
+
+    <form id="hu-edit-form" onsubmit="return false" style="display:flex;flex-direction:column;gap:14px;padding:8px 0">
+      <label style="display:flex;flex-direction:column;gap:4px;font-size:0.85rem">
+        <span style="color:var(--text-muted)">Title</span>
+        <input type="text" id="edit-title" value="${esc(story.title || '')}"
+               style="padding:8px;border:1px solid var(--border);background:var(--bg-primary);color:var(--text);border-radius:var(--radius-sm);font-size:0.95rem"
+               maxlength="200" required>
+      </label>
+
+      <label style="display:flex;flex-direction:column;gap:4px;font-size:0.85rem">
+        <span style="color:var(--text-muted)">Scope</span>
+        <textarea id="edit-scope" rows="4"
+                  style="padding:8px;border:1px solid var(--border);background:var(--bg-primary);color:var(--text);border-radius:var(--radius-sm);font-family:inherit;font-size:0.9rem;line-height:1.5;resize:vertical">${esc(scopeInitial)}</textarea>
+      </label>
+
+      <label style="display:flex;flex-direction:column;gap:4px;font-size:0.85rem">
+        <span style="color:var(--text-muted)">Task type</span>
+        <select id="edit-task-type"
+                style="padding:8px;border:1px solid var(--border);background:var(--bg-primary);color:var(--text);border-radius:var(--radius-sm);font-size:0.9rem">
+          ${TASK_TYPES.map((t) => `<option value="${t}">${t}</option>`).join('')}
+        </select>
+      </label>
+
+      <label style="display:flex;flex-direction:column;gap:4px;font-size:0.85rem">
+        <span style="color:var(--text-muted)">
+          Acceptance criteria — one per line.
+          Gherkin: <code>Given X | When Y | Then Z</code>
+        </span>
+        <textarea id="edit-ac" rows="6"
+                  style="padding:8px;border:1px solid var(--border);background:var(--bg-primary);color:var(--text);border-radius:var(--radius-sm);font-family:var(--font-mono, monospace);font-size:0.85rem;line-height:1.5;resize:vertical">${esc(acInitial)}</textarea>
+      </label>
+
+      <fieldset style="border:1px solid var(--border);border-radius:var(--radius-sm);padding:10px 12px;margin:0">
+        <legend style="color:var(--text-muted);font-size:0.85rem;padding:0 6px">
+          Acceptance tests — the contract the coder must satisfy
+        </legend>
+        <div id="edit-tests-list" style="display:flex;flex-direction:column;gap:8px"></div>
+        <button type="button" id="edit-tests-add"
+                style="margin-top:8px;padding:4px 10px;font-size:0.8rem;background:var(--bg-primary);color:var(--text);border:1px solid var(--border);border-radius:var(--radius-sm);cursor:pointer">
+          + Add test
+        </button>
+      </fieldset>
+
+      <div style="display:flex;justify-content:flex-end;gap:8px;margin-top:8px;padding-top:12px;border-top:1px solid var(--border)">
+        <button type="button" id="edit-cancel" class="control-btn"
+                style="padding:6px 14px;border:1px solid var(--border);background:var(--bg-primary);color:var(--text);border-radius:var(--radius-sm);cursor:pointer">
+          Cancel
+        </button>
+        <button type="button" id="edit-save" class="control-btn"
+                style="padding:6px 14px;border:none;background:var(--color-green);color:#fff;border-radius:var(--radius-sm);cursor:pointer;font-weight:600">
+          Save
+        </button>
+      </div>
+    </form>
+  `;
+
+  // Tests editor state + renderers. Kept on the function scope (not
+  // on window) so reopening the form gives a fresh copy.
+  let testRows = [...testsInitial];
+  const listEl = document.getElementById('edit-tests-list');
+
+  function renderTestsEditor() {
+    listEl.innerHTML = testRows.map((t, i) => `
+      <div class="edit-test-row" data-idx="${i}"
+           style="display:grid;grid-template-columns:auto 1fr auto;gap:6px;align-items:start;padding:8px;border:1px solid var(--border);border-radius:var(--radius-sm);background:var(--bg-primary)">
+        <select data-field="type"
+                style="padding:4px 6px;border:1px solid var(--border);background:var(--bg-secondary);color:var(--text);border-radius:var(--radius-sm);font-size:0.8rem">
+          <option value="shell"${t.type === 'shell' ? ' selected' : ''}>shell</option>
+          <option value="gherkin"${t.type === 'gherkin' ? ' selected' : ''}>gherkin</option>
+        </select>
+        <div style="display:flex;flex-direction:column;gap:4px">
+          <textarea data-field="content" rows="${t.type === 'gherkin' ? 3 : 2}"
+                    placeholder="${t.type === 'gherkin' ? 'Given …\\nWhen …\\nThen …' : 'npx vitest run test/foo.test.js'}"
+                    style="padding:6px 8px;border:1px solid var(--border);background:var(--bg-secondary);color:var(--text);border-radius:var(--radius-sm);font-family:var(--font-mono, monospace);font-size:0.82rem;line-height:1.4;resize:vertical">${esc(t.content)}</textarea>
+          <input type="text" data-field="file" placeholder="Optional: file path (e.g. tests/login.test.ts)" value="${esc(t.file || '')}"
+                 style="padding:4px 8px;border:1px solid var(--border);background:var(--bg-secondary);color:var(--text);border-radius:var(--radius-sm);font-family:var(--font-mono, monospace);font-size:0.75rem">
+        </div>
+        <button type="button" data-field="remove" title="Remove this test"
+                style="align-self:start;padding:4px 8px;background:transparent;border:1px solid var(--border);color:var(--text-muted);border-radius:var(--radius-sm);cursor:pointer;font-size:0.8rem">✕</button>
+      </div>
+    `).join('');
+
+    // Bind the edit events. We re-bind on every render — cheap, and
+    // keeps the state → DOM mapping simple.
+    listEl.querySelectorAll('.edit-test-row').forEach((row) => {
+      const idx = Number(row.dataset.idx);
+      row.querySelector('[data-field="type"]').addEventListener('change', (e) => {
+        testRows[idx].type = e.target.value;
+        renderTestsEditor();            // re-render so placeholder updates
+      });
+      row.querySelector('[data-field="content"]').addEventListener('input', (e) => {
+        testRows[idx].content = e.target.value;
+      });
+      row.querySelector('[data-field="file"]').addEventListener('input', (e) => {
+        testRows[idx].file = e.target.value;
+      });
+      row.querySelector('[data-field="remove"]').addEventListener('click', () => {
+        testRows.splice(idx, 1);
+        renderTestsEditor();
+      });
+    });
+  }
+
+  renderTestsEditor();
+
+  document.getElementById('edit-tests-add').addEventListener('click', () => {
+    testRows.push({ type: 'shell', content: '', file: '' });
+    renderTestsEditor();
+  });
+
+  document.getElementById('edit-cancel').addEventListener('click', () => showStoryDetail(story.id));
+  document.getElementById('edit-save').addEventListener('click', () => saveStoryEdits(story, () => testRows));
+}
+
+/**
+ * Collect the form values, compute the diff against the story as it
+ * was on modal open, and PATCH only the changed fields. Empty diff is
+ * a no-op (close out of edit mode without an API call).
+ * @param {object} story
+ */
+async function saveStoryEdits(story, getTestRows) {
+  const title = document.getElementById('edit-title').value.trim();
+  const scope = document.getElementById('edit-scope').value;
+  const taskType = document.getElementById('edit-task-type').value;
+  const acRaw = document.getElementById('edit-ac').value;
+
+  if (!title) {
+    await showError('Title cannot be empty.', { title: 'Invalid input' });
+    return;
+  }
+
+  // Parse AC: one per line; a line with "Given X | When Y | Then Z"
+  // (case-insensitive) becomes Gherkin; everything else stays a string.
+  // Blank lines are dropped.
+  const acceptance_criteria = acRaw.split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const m = /^Given\s+(.*?)\s*\|\s*When\s+(.*?)\s*\|\s*Then\s+(.*)$/i.exec(line);
+      if (m) return { given: m[1].trim(), when: m[2].trim(), then: m[3].trim() };
+      return line;
+    });
+
+  // Collect the structured acceptance_tests from the editor state,
+  // dropping rows the user left empty.
+  const testRows = typeof getTestRows === 'function' ? getTestRows() : [];
+  const acceptance_tests = testRows
+    .map((t) => ({
+      type: t.type === 'gherkin' ? 'gherkin' : 'shell',
+      content: (t.content || '').trim(),
+      file: (t.file || '').trim(),
+    }))
+    .filter((t) => t.content.length > 0)
+    .map((t) => (t.file ? t : { type: t.type, content: t.content }));
+
+  // Diff against the original so we don't send untouched fields and
+  // let the server's COALESCE keep existing values.
+  const patch = {};
+  const originalScope = story.original_text || story.certified_want || '';
+  if (title !== (story.title || '')) patch.title = title;
+  if (scope !== originalScope) patch.scope = scope;
+  if (taskType && taskType !== 'sw') patch.task_type = taskType;
+  const prevAcStr = story.acceptance_criteria || '[]';
+  const nextAcStr = JSON.stringify(acceptance_criteria);
+  if (nextAcStr !== prevAcStr) patch.acceptance_criteria = acceptance_criteria;
+  const prevTestsStr = story.acceptance_tests || '[]';
+  const nextTestsStr = JSON.stringify(acceptance_tests);
+  if (nextTestsStr !== prevTestsStr) patch.acceptance_tests = acceptance_tests;
+
+  if (Object.keys(patch).length === 0) {
+    showStoryDetail(story.id);
+    return;
+  }
+
+  try {
+    const res = await fetch(`/api/stories/${encodeURIComponent(story.id)}`, {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(patch),
+    });
+    if (!res.ok) {
+      if (res.status === 404) {
+        await showError(
+          'The board server does not recognise the extended PATCH endpoint.\n\n'
+          + 'Restart it to pick up v2.7.5+:\n\n'
+          + '    kj board stop && kj board start',
+          { title: 'Board out of date' }
+        );
+        return;
+      }
+      const msg = (await res.json().catch(() => ({}))).error || `HTTP ${res.status}`;
+      await showError(msg, { title: 'Could not save HU' });
+      return;
+    }
+    await renderBoard();               // card shows new title/counts
+    await showStoryDetail(story.id);   // reopen modal with fresh data
+  } catch (err) {
+    await showError(err.message, { title: 'Could not save HU' });
+  }
+}

package/packages/hu-board/src/config-yaml.js

@@ -349,11 +349,19 @@ function getDeep(obj, path) {
   return cur;
 }
 
+// KJC-BUG-0076: never walk into Object.prototype via crafted YAML keys
+// (`__proto__.x`, `constructor.prototype.y`, `prototype.z`). Silent skip
+// over a poisoned segment — the rest of the path is untouched.
+const UNSAFE_KEY_RE = /^(?:__proto__|constructor|prototype)$/;
+
 function setDeep(obj, path, value) {
+  if (typeof path !== 'string') return;
   const parts = path.split('.');
   const last = parts.pop();
+  if (UNSAFE_KEY_RE.test(last)) return;
   let cur = obj;
   for (const p of parts) {
+    if (UNSAFE_KEY_RE.test(p)) return;
     if (cur[p] == null || typeof cur[p] !== 'object') cur[p] = {};
     cur = cur[p];
   }
@@ -361,10 +369,13 @@ function setDeep(obj, path, value) {
 }
 
 function deleteDeep(obj, path) {
+  if (typeof path !== 'string') return;
   const parts = path.split('.');
   const last = parts.pop();
+  if (UNSAFE_KEY_RE.test(last)) return;
   let cur = obj;
   for (const p of parts) {
+    if (UNSAFE_KEY_RE.test(p)) return;
     if (cur == null || typeof cur !== 'object') return;
     cur = cur[p];
   }
@@ -516,3 +527,6 @@ export function writeConfigPatch(patch, { scope = 'global' } = {}) {
   renameSync(tmpFile, p);
   return { path: p, scope, written: true, applied, errors: [] };
 }
+
+// Exposed for prototype-pollution regression tests (KJC-BUG-0076).
+export const __pollutionInternals = { setDeep, deleteDeep };

package/packages/hu-board/src/db.js

@@ -1,6 +1,6 @@
 import Database from 'better-sqlite3';
-import { join } from 'node:path';
-import { mkdirSync, renameSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { mkdirSync, renameSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 
 /** @type {import('better-sqlite3').Database | null} */
@@ -23,6 +23,19 @@ function vitestTmpKjHome() {
     `karajan-vitest-${process.pid}-${Math.random().toString(36).slice(2, 10)}`,
     '.karajan'
   );
+  // KJC-BUG-0075: clean up on clean exit so /tmp doesn't accumulate one
+  // dir per fork × run. We rm the *parent* (the `karajan-vitest-<pid>-<rand>`
+  // wrapper), not the `.karajan` segment, so the whole tmp tree goes.
+  // Only fires on graceful exit; SIGKILL leaks are caught by the
+  // global-setup mtime purge at the start of the next run.
+  const parent = dirname(_vitestKjHome);
+  process.on('exit', () => {
+    try {
+      rmSync(parent, { recursive: true, force: true });
+    } catch {
+      // best-effort: never crash a test process on cleanup failure
+    }
+  });
   return _vitestKjHome;
 }
 

package/packages/hu-board/src/routes/api.js

@@ -545,15 +545,27 @@ router.post('/tombstones/:type/:id/restore', (req, res) => {
  * rewritten before we ack, then re-synced into SQLite, so a reload
  * renders the committed state.
  */
-// Status que el USUARIO puede setear manualmente vía el dropdown del
-// modal. NO incluimos coding/reviewing/running — esos son lifecycle
-// del orquestador (settearlos a mano genera zombies). Tampoco
-// incluimos los canonicales (`running`) por la misma razón. `failed`
-// y `blocked` son útiles para que el usuario marque manualmente HUs
-// que no quiere correr ahora.
-// KJC-TSK-0403: 'failed' eliminado — el orquestador estampa result=fail
-// dejando status=pending. Setearlo a mano vía PATCH ya no tiene sentido.
-const ALLOWED_STORY_STATUSES = new Set(['pending', 'certified', 'done', 'blocked', 'needs_context']);
+// KJC-TSK-0394 PR6 (AC 6): el PATCH endpoint sólo acepta el modelo
+// canónico {pending, running, done}. Status legacy (`certified`,
+// `coding`, `reviewing`, `failed`, `blocked`, `needs_context`) siguen
+// vivos en plans existentes y los traduce la UI con canonicalStatus(),
+// pero NO pueden ser seteados por escrituras nuevas — devolvemos 400
+// con `suggestion` apuntando al mapping correcto. `running` queda fuera
+// del dropdown del modal (lifecycle del orquestador), pero el endpoint
+// lo acepta por si un programa externo lo necesita.
+const ALLOWED_STORY_STATUSES = new Set(['pending', 'running', 'done']);
+// Mapping canónico para la sugerencia del 400 cuando el caller manda
+// un valor legacy. Mantenemos la regla viva en src/plan/plan-schema.js
+// (mapLegacyStatusToResult) — esta tabla es sólo el subset accionable
+// desde el endpoint (status + result).
+const LEGACY_STATUS_SUGGESTION = {
+  certified: { status: 'done', result: 'pass' },
+  failed: { status: 'pending', result: 'fail' },
+  coding: { status: 'running', result: null },
+  reviewing: { status: 'running', result: null },
+  blocked: { status: 'pending', result: null },
+  needs_context: { status: 'pending', result: null },
+};
 // KJC-TSK-0406: coder_model y reviewer_model son editables desde el
 // modal del board. Independientes — el usuario puede subir el reviewer
 // y bajar el coder sin afectar al resto del plan.
@@ -579,8 +591,14 @@ router.patch('/stories/:id', (req, res) => {
       });
     }
     if (hasStatus && !ALLOWED_STORY_STATUSES.has(body.status)) {
+      // KJC-TSK-0394 PR6 (AC 6): si el caller manda un status legacy,
+      // devolvemos un 400 con `suggestion` apuntando al mapping canónico.
+      // Una herramienta externa puede leer el body, aplicar el mapeo y
+      // re-intentar — sin tener que descubrir la tabla por ensayo y error.
+      const suggestion = LEGACY_STATUS_SUGGESTION[body.status] || null;
       return res.status(400).json({
         error: `status must be one of: ${[...ALLOWED_STORY_STATUSES].join(', ')}`,
+        suggestion,
       });
     }
 

package/scripts/audit-test-diet.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+/**
+ * scripts/audit-test-diet.mjs — semantic loss-of-meaning auditor (KJC-TSK-0345).
+ * Categories: empty-no-expect, skipped-pending, imports-orphan, deprecated-export,
+ * subsumed-candidate. Each finding carries confidence (high|low). Complements
+ * tests/_diet/audit.mjs (which classifies by LOC bucket only).
+ */
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_ROOT = resolve(HERE, "..");
+const SKIP_DIRS = new Set(["_diet", "fixtures", "node_modules"]);
+
+export function walkTests(rootDir, testsSubdir = "tests") {
+  const out = [];
+  const base = join(rootDir, testsSubdir);
+  if (!existsSync(base)) return out;
+  const stack = [base];
+  while (stack.length) {
+    for (const e of readdirSync(stack.pop(), { withFileTypes: true })) {
+      const p = join(e.parentPath ?? base, e.name);
+      if (e.isDirectory() && !SKIP_DIRS.has(e.name)) stack.push(p);
+      else if (e.isFile() && /\.test\.(m?js|ts)$/.test(e.name)) out.push(p);
+    }
+  }
+  return out;
+}
+
+export function parseImports(source) {
+  const imports = [];
+  const re = /^[ \t]*import\s+(?:([\w*\s{},]+?)\s+from\s+)?['"]([^'"]+)['"]/gm;
+  let m;
+  while ((m = re.exec(source)) !== null) {
+    const named = [];
+    const braced = (m[1] || "").match(/\{([^}]+)\}/);
+    if (braced) for (const part of braced[1].split(",")) {
+      const name = part.trim().split(/\s+as\s+/)[0].trim();
+      if (name) named.push(name);
+    }
+    imports.push({ specifier: m[2], named });
+  }
+  return imports;
+}
+
+export function resolveSrcImport(testFile, specifier, rootDir) {
+  if (!specifier.startsWith(".") && !specifier.startsWith("#")) return null;
+  const base = specifier.startsWith("#") ? resolve(rootDir, specifier.replace(/^#/, "src/")) : resolve(dirname(testFile), specifier);
+  for (const c of [base, `${base}.js`, `${base}.mjs`, join(base, "index.js")]) {
+    if (existsSync(c) && statSync(c).isFile()) return c;
+  }
+  return null;
+}
+
+export function extractItNames(source) {
+  const names = new Set();
+  for (const m of source.matchAll(/\b(?:it|test)(?:\.(?:only|skip|todo))?\s*\(\s*['"`]([^'"`]+)['"`]/g)) names.add(m[1]);
+  return names;
+}
+
+export function extractExports(source) {
+  const names = new Set();
+  for (const m of source.matchAll(/export\s+(?:async\s+)?(?:function|class|const|let|var)\s+([A-Za-z_$][\w$]*)/g)) names.add(m[1]);
+  for (const m of source.matchAll(/export\s*\{([^}]+)\}/g)) for (const part of m[1].split(",")) {
+    const name = part.trim().split(/\s+as\s+/).pop().trim();
+    if (name) names.add(name);
+  }
+  if (/export\s+default\b/.test(source)) names.add("default");
+  return names;
+}
+
+export function auditFile(testFile, rootDir) {
+  const source = readFileSync(testFile, "utf-8");
+  const rel = relative(rootDir, testFile);
+  const findings = [];
+  const hasIt = /\b(?:it|test)\s*\(/.test(source);
+  if (hasIt && !/\bexpect\s*\(/.test(source)) findings.push({ category: "empty-no-expect", confidence: "high", detail: "it()/test() blocks with no expect()" });
+  if (/\b(?:it|test|describe)\.skip\s*\(|\bxit\s*\(|\bxtest\s*\(|\b(?:it|test)\.todo\s*\(/.test(source)) {
+    findings.push({ category: "skipped-pending", confidence: "high", detail: "uses .skip / xit / xtest / .todo" });
+  }
+  const srcImports = [];
+  for (const imp of parseImports(source)) {
+    if (!imp.specifier.startsWith(".") && !imp.specifier.startsWith("#")) continue;
+    const resolved = resolveSrcImport(testFile, imp.specifier, rootDir);
+    if (!resolved) { findings.push({ category: "imports-orphan", confidence: "high", detail: `cannot resolve '${imp.specifier}'` }); continue; }
+    if (imp.named.length) {
+      const missing = imp.named.filter((n) => !extractExports(readFileSync(resolved, "utf-8")).has(n));
+      if (missing.length) findings.push({ category: "deprecated-export", confidence: "low", detail: `${imp.specifier} no longer exports: ${missing.join(", ")}` });
+    }
+    srcImports.push({ resolved: relative(rootDir, resolved), named: imp.named });
+  }
+  return { path: rel, srcImports, findings, itNames: extractItNames(source) };
+}
+
+export function findSubsumed(perFile) {
+  const bySrc = new Map();
+  for (const f of perFile) for (const imp of f.srcImports) {
+    if (!bySrc.has(imp.resolved)) bySrc.set(imp.resolved, []);
+    bySrc.get(imp.resolved).push({ path: f.path, named: new Set(imp.named), itNames: f.itNames });
+  }
+  const out = [];
+  for (const [src, consumers] of bySrc) {
+    if (consumers.length < 2) continue;
+    const sorted = [...consumers].sort((a, b) => a.named.size - b.named.size);
+    const narrow = sorted[0]; const broad = sorted[sorted.length - 1];
+    if (narrow.path === broad.path || narrow.named.size === 0 || broad.named.size === 0) continue;
+    if (!(narrow.named.size < broad.named.size && [...narrow.named].every((n) => broad.named.has(n)))) continue;
+    // Require ≥50% of narrow's it() names to also appear in broad's. Imports
+    // alone are a false-positive trap: two tests can share helpers and assert
+    // on disjoint behavior (e.g. tests/budget.test.js vs tests/utils/budget.test.js).
+    if (narrow.itNames.size === 0) continue;
+    const overlap = [...narrow.itNames].filter((n) => broad.itNames.has(n)).length;
+    if (overlap / narrow.itNames.size < 0.5) continue;
+    out.push({ category: "subsumed-candidate", confidence: "low", path: narrow.path, detail: `${overlap}/${narrow.itNames.size} it() names also in ${broad.path}; subset of imports from ${src}` });
+  }
+  return out;
+}
+
+export function auditTestDiet(rootDir = DEFAULT_ROOT) {
+  const files = walkTests(rootDir);
+  const perFile = files.map((f) => auditFile(f, rootDir));
+  const findings = [];
+  for (const f of perFile) for (const x of f.findings) findings.push({ path: f.path, ...x });
+  for (const s of findSubsumed(perFile)) findings.push(s);
+  return { generatedAt: new Date().toISOString(), rootDir, totals: { filesAudited: files.length, findings: findings.length }, findings };
+}
+
+export function renderMarkdown(report) {
+  const byCat = new Map();
+  for (const f of report.findings) {
+    if (!byCat.has(f.category)) byCat.set(f.category, []);
+    byCat.get(f.category).push(f);
+  }
+  const lines = [`# Semantic test-diet audit`, ``, `Generated: ${report.generatedAt}`, `Files audited: ${report.totals.filesAudited}`, `Findings: ${report.totals.findings}`, ``];
+  for (const [cat, items] of byCat) {
+    lines.push(`## ${cat} (${items.length})`, ``);
+    for (const it of items) lines.push(`- \`${it.path}\` — ${it.detail} (confidence: ${it.confidence})`);
+    lines.push(``);
+  }
+  return lines.join("\n");
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const report = auditTestDiet(DEFAULT_ROOT);
+  const outDir = join(DEFAULT_ROOT, "audit");
+  if (!existsSync(outDir)) mkdirSync(outDir, { recursive: true });
+  writeFileSync(join(outDir, "test-diet-semantic.json"), JSON.stringify(report, null, 2));
+  writeFileSync(join(outDir, "test-diet-semantic.md"), renderMarkdown(report));
+  console.log(`audit: ${report.totals.filesAudited} files, ${report.totals.findings} findings -> audit/test-diet-semantic.{json,md}`);
+}

package/src/audit/deterministic-summary.js

@@ -14,6 +14,7 @@ import { groupVulnerabilitiesBySeverity } from "./osv-findings.js";
 import { groupFindingsBySeverity as groupSemgrepBySeverity } from "./semgrep-findings.js";
 import { groupCyclesBySeverity } from "./circular-deps.js";
 import { groupDeadExportsBySeverity } from "./dead-exports.js";
+import { groupInjectionBySeverity } from "./injection-findings.js";
 
 const MAX_SAMPLE_DEAD_EXPORTS = 10;
 const MAX_SAMPLE_SONAR_PER_SEVERITY = 5;
@@ -21,6 +22,7 @@ const MAX_SAMPLE_OSV_PER_SEVERITY = 5;
 const MAX_SAMPLE_SEMGREP_PER_SEVERITY = 5;
 const MAX_SAMPLE_CYCLES_PER_SEVERITY = 5;
 const MAX_SAMPLE_KNIP_PER_SEVERITY = 5;
+const MAX_SAMPLE_INJECTION_PER_SEVERITY = 5;
 
 /**
  * @param {{basalCost?: object, growthDelta?: object, stack?: object, sonarFindings?: object, webperf?: object, osvFindings?: object}} ctx
@@ -38,11 +40,29 @@ export function formatDeterministicSummary(ctx) {
   if (ctx.semgrepFindings) lines.push(...formatSemgrepBlock(ctx.semgrepFindings));
   if (ctx.circularDeps) lines.push(...formatCircularDepsBlock(ctx.circularDeps));
   if (ctx.deadExports) lines.push(...formatDeadExportsBlock(ctx.deadExports));
+  if (ctx.injectionFindings) lines.push(...formatInjectionBlock(ctx.injectionFindings));
   if (ctx.webperf) lines.push(...formatWebperfBlock(ctx.webperf));
 
   return lines.join("\n");
 }
 
+function formatInjectionBlock(inj) {
+  if (!inj.available) return ["### Prompt-injection scan", `- Status: not available — ${inj.reason || "scan failed"}`, ""];
+  const lines = ["### Prompt-injection scan (specs / domain / onboarding)", `- Files scanned: ${inj.scanned ?? 0}`, `- Findings: ${inj.total ?? 0}`];
+  if ((inj.total ?? 0) > 0) {
+    for (const [severity, items] of Object.entries(groupInjectionBySeverity(inj.findings || []))) {
+      if (items.length === 0) continue;
+      lines.push(`  - ${severity} (${items.length}):`);
+      for (const f of items.slice(0, MAX_SAMPLE_INJECTION_PER_SEVERITY)) {
+        lines.push(`    - ${f.file || "(unknown)"}${f.line ? `:${f.line}` : ""} [${f.type}] ${f.pattern}`);
+      }
+      if (items.length > MAX_SAMPLE_INJECTION_PER_SEVERITY) lines.push(`    - ... and ${items.length - MAX_SAMPLE_INJECTION_PER_SEVERITY} more in ${severity}`);
+    }
+  }
+  lines.push("");
+  return lines;
+}
+
 function formatCircularDepsBlock(circularDeps) {
   if (!circularDeps.available) {
     return ["### Circular Dependencies (architecture)", `- Status: not available — ${circularDeps.reason || "madge not available"}`, ""];