muonroi-cli 1.3.4 → 1.4.1

package/dist/src/lsp/manager.js

@@ -106,26 +106,39 @@ export function createWorkspaceLspManager(cwd, settings, options = {}) {
         }
         const lspDiagnostics = await touchFile(normalizedPath, true);
         const params = createOperationParams(input, normalizedPath);
+        const timeoutMs = settings.requestTimeoutMs;
         const results = (await Promise.all(records.map(async ({ key, client }) => {
+            const onError = (err) => {
+                // Timeout: the server is likely still loading its workspace (e.g. csharp-ls
+                // indexing an MSBuild solution). Return no results for this call but KEEP the
+                // client so a retry hits the warmed-up server instead of cold-starting again.
+                if (err instanceof LspRequestTimeoutError) {
+                    console.error(`[lsp:${client.serverId}] ${input.operation} timed out after ${timeoutMs}ms ` +
+                        `(server may still be loading the workspace); returning no results for this client`);
+                    return [];
+                }
+                // Hard error: drop the client so the next query re-spawns it.
+                clients.delete(key);
+                console.error(`[lsp:${client.serverId}] ${input.operation} request failed: ${err instanceof Error ? err.message : String(err)}`);
+                return [];
+            };
             if (input.operation === "incomingCalls" || input.operation === "outgoingCalls") {
                 try {
-                    const items = await client.sendRequest("textDocument/prepareCallHierarchy", params);
+                    const items = await withRequestTimeout(client.sendRequest("textDocument/prepareCallHierarchy", params), timeoutMs);
                     const firstItem = Array.isArray(items) ? items[0] : undefined;
                     if (!firstItem)
                         return [];
-                    return client.sendRequest(input.operation === "incomingCalls" ? "callHierarchy/incomingCalls" : "callHierarchy/outgoingCalls", { item: firstItem });
+                    return await withRequestTimeout(client.sendRequest(input.operation === "incomingCalls" ? "callHierarchy/incomingCalls" : "callHierarchy/outgoingCalls", { item: firstItem }), timeoutMs);
                 }
-                catch {
-                    clients.delete(key);
-                    return [];
+                catch (err) {
+                    return onError(err);
                 }
             }
             try {
-                return await client.sendRequest(getOperationMethod(input.operation), params);
+                return await withRequestTimeout(client.sendRequest(getOperationMethod(input.operation), params), timeoutMs);
             }
-            catch {
-                clients.delete(key);
-                return [];
+            catch (err) {
+                return onError(err);
             }
         })))
             .flatMap((result) => (Array.isArray(result) ? result : result ? [result] : []))
@@ -153,6 +166,24 @@ export function createWorkspaceLspManager(cwd, settings, options = {}) {
         close,
     };
 }
+class LspRequestTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`LSP request timed out after ${timeoutMs}ms`);
+        this.name = "LspRequestTimeoutError";
+    }
+}
+function withRequestTimeout(promise, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new LspRequestTimeoutError(timeoutMs)), timeoutMs);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
 function getOperationMethod(operation) {
     switch (operation) {
         case "goToDefinition":

package/dist/src/lsp/manager.test.js

@@ -8,6 +8,7 @@ const BASE_SETTINGS = {
     tool: true,
     autoInstall: false,
     startupTimeoutMs: 5_000,
+    requestTimeoutMs: 5_000,
     diagnosticsDebounceMs: 0,
     builtins: {
         typescript: {
@@ -28,7 +29,7 @@ const BASE_SETTINGS = {
 };
 const tempDirs = [];
 afterEach(async () => {
-    await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+    await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 })));
 });
 describe("createWorkspaceLspManager", () => {
     it("routes queries through the matching LSP client", async () => {
@@ -94,6 +95,27 @@ describe("createWorkspaceLspManager", () => {
         expect(client.waitForDiagnostics).toHaveBeenCalledWith(filePath);
         await manager.close();
     });
+    it("times out a hanging request without dropping the client", async () => {
+        const root = await createTempWorkspace();
+        const filePath = path.join(root, "src", "demo.ts");
+        await mkdir(path.dirname(filePath), { recursive: true });
+        await writeFile(filePath, "const demo = 1;\n");
+        // sendRequest never resolves — simulates a server still loading its workspace.
+        const client = createFakeClient({ sendRequest: () => new Promise(() => { }) });
+        const manager = createWorkspaceLspManager(root, { ...BASE_SETTINGS, requestTimeoutMs: 50 }, {
+            createClient: async () => client,
+        });
+        const result = await manager.query({
+            operation: "documentSymbol",
+            filePath,
+        });
+        // Degrades gracefully instead of hanging forever.
+        expect(result.success).toBe(true);
+        expect(result.output).toContain("No results found");
+        // Client is retained (not dropped) so a retry hits the warmed-up server.
+        await manager.close();
+        expect(client.stop).toHaveBeenCalled();
+    });
     it("reports when no matching server exists", async () => {
         const root = await createTempWorkspace();
         const filePath = path.join(root, "demo.rb");

package/dist/src/lsp/npm-cache.js

@@ -40,7 +40,8 @@ export async function lspNpmWhich(pkg) {
         await rm(path.join(dir, "package-lock.json"), { force: true });
         await lspNpmAdd(pkg);
     }
-    catch {
+    catch (err) {
+        console.error(`[lsp:npm-cache] auto-install of "${pkg}" into ${dir} failed: ${err instanceof Error ? err.message : String(err)}`);
         return null;
     }
     const resolved = await pick();

package/dist/src/lsp/npm-cache.test.js

@@ -5,7 +5,7 @@ import { afterEach, describe, expect, it } from "vitest";
 import { lspNpmWhich } from "./npm-cache.js";
 const tempDirs = [];
 afterEach(async () => {
-    await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+    await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 })));
 });
 describe("lspNpmWhich", () => {
     it("resolves a single binary from a pre-populated cache", async () => {

package/dist/src/lsp/smoke.test.js

@@ -24,7 +24,7 @@ beforeAll(() => {
 });
 afterAll(() => {
     try {
-        rmSync(tmpDir, { recursive: true, force: true });
+        rmSync(tmpDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 });
     }
     catch {
         // Best-effort cleanup

package/dist/src/lsp/types.d.ts

@@ -1,6 +1,6 @@
 export declare const LSP_TOOL_OPERATIONS: readonly ["goToDefinition", "findReferences", "hover", "documentSymbol", "workspaceSymbol", "goToImplementation", "prepareCallHierarchy", "incomingCalls", "outgoingCalls"];
 export type LspToolOperation = (typeof LSP_TOOL_OPERATIONS)[number];
-export type LspBuiltInServerId = "typescript" | "pyright" | "gopls" | "rust-analyzer" | "bash-language-server" | "yaml-language-server" | "clangd" | "jdtls" | "sourcekit-lsp";
+export type LspBuiltInServerId = "typescript" | "pyright" | "gopls" | "rust-analyzer" | "bash-language-server" | "yaml-language-server" | "clangd" | "jdtls" | "sourcekit-lsp" | "csharp-ls";
 export interface LspPosition {
     line: number;
     character: number;
@@ -56,6 +56,7 @@ export interface LspSettings {
     tool?: boolean;
     autoInstall?: boolean;
     startupTimeoutMs?: number;
+    requestTimeoutMs?: number;
     diagnosticsDebounceMs?: number;
     builtins?: Partial<Record<LspBuiltInServerId, LspBuiltInServerSettings>>;
     servers?: LspCustomServerConfig[];
@@ -65,6 +66,7 @@ export interface NormalizedLspSettings {
     tool: boolean;
     autoInstall: boolean;
     startupTimeoutMs: number;
+    requestTimeoutMs: number;
     diagnosticsDebounceMs: number;
     builtins: Partial<Record<LspBuiltInServerId, LspBuiltInServerSettings>>;
     servers: LspCustomServerConfig[];

package/dist/src/maintain/__tests__/codebase-intel.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * codebase-intel.test.ts — Unit tests for gatherCodebaseIntel + helpers.
+ * Uses tmpdir for all fs operations — never touches the real workspace.
+ */
+export {};

package/dist/src/maintain/__tests__/codebase-intel.test.js

@@ -0,0 +1,237 @@
+/**
+ * codebase-intel.test.ts — Unit tests for gatherCodebaseIntel + helpers.
+ * Uses tmpdir for all fs operations — never touches the real workspace.
+ */
+import { promises as fs } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { extractKeywords, gatherCodebaseIntel } from "../codebase-intel.js";
+let tmpDir;
+beforeEach(async () => {
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "muonroi-codebase-intel-test-"));
+});
+afterEach(async () => {
+    await fs.rm(tmpDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 });
+});
+// ---------------------------------------------------------------------------
+// extractKeywords
+// ---------------------------------------------------------------------------
+describe("extractKeywords", () => {
+    it("strips English stopwords", () => {
+        const kws = extractKeywords("fix the login redirect bug in the auth module");
+        expect(kws).not.toContain("the");
+        expect(kws).not.toContain("in");
+        expect(kws).toContain("login");
+        expect(kws).toContain("redirect");
+        expect(kws).toContain("auth");
+        expect(kws).toContain("module");
+    });
+    it("strips Vietnamese stopwords", () => {
+        const kws = extractKeywords("sửa lỗi không redirect đúng trong module đăng nhập");
+        expect(kws).not.toContain("không");
+        expect(kws).not.toContain("trong");
+        // meaningful words should survive
+        expect(kws.length).toBeGreaterThan(0);
+    });
+    it("drops tokens shorter than 3 chars", () => {
+        const kws = extractKeywords("fix ui db api bug");
+        expect(kws).not.toContain("ui");
+        expect(kws).not.toContain("db");
+        // api is 3 chars — exactly at the threshold, should be kept
+        expect(kws).toContain("api"); // length exactly 3 — not dropped
+        // "fix" is 3 chars — kept (threshold is < 3, so 3 is allowed)
+        expect(kws).toContain("fix");
+    });
+    it("drops pure numbers", () => {
+        const kws = extractKeywords("issue 12345 on line 99 fix");
+        expect(kws).not.toContain("12345");
+        expect(kws).not.toContain("99");
+    });
+    it("deduplicates tokens", () => {
+        const kws = extractKeywords("login login login redirect login");
+        const loginCount = kws.filter((k) => k === "login").length;
+        expect(loginCount).toBe(1);
+    });
+    it("caps at 10 keywords", () => {
+        // 15 distinct meaningful words
+        const text = "authentication redirect session cookie token header payload signature expiry validation middleware interceptor pipeline router controller";
+        const kws = extractKeywords(text);
+        expect(kws.length).toBeLessThanOrEqual(10);
+    });
+    it("sorts by length descending for determinism (longer first)", () => {
+        const kws = extractKeywords("authentication redirect session");
+        // "authentication" is longest — should come first
+        expect(kws[0]).toBe("authentication");
+    });
+});
+// ---------------------------------------------------------------------------
+// gatherCodebaseIntel — candidate ranking
+// ---------------------------------------------------------------------------
+describe("gatherCodebaseIntel — candidate ranking", () => {
+    it("prefers filename match over body match", async () => {
+        // File whose name matches the keyword
+        await fs.mkdir(path.join(tmpDir, "src"), { recursive: true });
+        await fs.writeFile(path.join(tmpDir, "src", "auth.ts"), `export function noop() {}`, // no keyword in body
+        "utf8");
+        // File with keyword only in body (not in name)
+        await fs.writeFile(path.join(tmpDir, "src", "utils.ts"), `// auth logic here\nexport function auth() {}\n// auth auth auth auth auth auth auth`, // many body hits
+        "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix auth bug", description: "the auth module is broken", kind: "bug" },
+        });
+        const paths = intel.candidateFiles.map((c) => c.path);
+        expect(paths[0]).toContain("auth.ts"); // filename match wins
+    });
+    it("includes path-based match when keyword appears in directory name", async () => {
+        await fs.mkdir(path.join(tmpDir, "src", "auth"), { recursive: true });
+        await fs.writeFile(path.join(tmpDir, "src", "auth", "handler.ts"), `export function handle() {}`, "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix auth handler", description: "fix auth", kind: "bug" },
+        });
+        const paths = intel.candidateFiles.map((c) => c.path);
+        expect(paths.some((p) => p.includes("auth/handler.ts") || p.includes("auth\\handler.ts"))).toBe(true);
+    });
+    it("matchScore is between 0 and 1", async () => {
+        await fs.mkdir(path.join(tmpDir, "src"), { recursive: true });
+        await fs.writeFile(path.join(tmpDir, "src", "login.ts"), `// login handler\nexport function login() {}`, "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix login redirect", description: "login page redirects incorrectly", kind: "bug" },
+        });
+        for (const cf of intel.candidateFiles) {
+            expect(cf.matchScore).toBeGreaterThanOrEqual(0);
+            expect(cf.matchScore).toBeLessThanOrEqual(1);
+        }
+    });
+    it("returns empty candidateFiles when keywords produce no matches", async () => {
+        // Only a file with totally unrelated content
+        await fs.mkdir(path.join(tmpDir, "src"), { recursive: true });
+        await fs.writeFile(path.join(tmpDir, "src", "xyz.ts"), "export const x = 1;", "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "qwertyuiop zzz yyy xxx", description: "asdfghjkl", kind: "chore" },
+        });
+        expect(intel.candidateFiles.length).toBe(0);
+    });
+});
+// ---------------------------------------------------------------------------
+// Impact radius
+// ---------------------------------------------------------------------------
+describe("gatherCodebaseIntel — impact radius", () => {
+    it("finds JS/TS files that import a candidate", async () => {
+        await fs.mkdir(path.join(tmpDir, "src"), { recursive: true });
+        // Candidate file — keyword in name so it scores highest
+        await fs.writeFile(path.join(tmpDir, "src", "auth.ts"), "export function auth() {}", "utf8");
+        // Importer — neutral name, body only contains the import path (which has "auth")
+        // Use maxCandidates:1 so only auth.ts is a candidate and bootstrapper.ts
+        // is therefore eligible for impact radius detection.
+        await fs.writeFile(path.join(tmpDir, "src", "bootstrapper.ts"), `import { auth } ${"from"} './auth';\nexport const boot = auth;`, "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix auth bug", description: "auth module broken", kind: "bug" },
+            maxCandidates: 1, // only auth.ts is a candidate; bootstrapper.ts goes to impact radius
+        });
+        // bootstrapper.ts imports auth.ts via from './auth' — should appear in impact radius
+        expect(intel.impactRadius.some((f) => f.includes("bootstrapper"))).toBe(true);
+        // The candidate itself must not be listed in impactRadius
+        expect(intel.impactRadius.every((f) => !f.includes("auth.ts"))).toBe(true);
+    });
+    it("finds C# files that 'using' a candidate", async () => {
+        await fs.mkdir(path.join(tmpDir, "src"), { recursive: true });
+        // Candidate — keyword in name
+        await fs.writeFile(path.join(tmpDir, "src", "AuthService.cs"), "public class AuthService {}", "utf8");
+        // Importer — neutral name that won't match any task keyword
+        // Note: must NOT contain "authservice" in its body beyond the using statement
+        // to avoid becoming a candidate itself. The using statement alone scores low
+        // but the file name "Bootstrapper" has no keyword overlap so it won't rank
+        // as a candidate (maxCandidates=1 to ensure only AuthService is candidate).
+        await fs.writeFile(path.join(tmpDir, "src", "Bootstrapper.cs"), `using MyApp.AuthService;\npublic class Bootstrapper {}`, "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix AuthService bug", description: "AuthService crashes on null input", kind: "bug" },
+            maxCandidates: 1, // ensure only AuthService.cs is a candidate
+        });
+        expect(intel.impactRadius.some((f) => f.includes("Bootstrapper"))).toBe(true);
+    });
+});
+// ---------------------------------------------------------------------------
+// Regression tests
+// ---------------------------------------------------------------------------
+describe("gatherCodebaseIntel — regression tests", () => {
+    it("picks up .test.ts files that reference candidate basenames", async () => {
+        await fs.mkdir(path.join(tmpDir, "src"), { recursive: true });
+        await fs.mkdir(path.join(tmpDir, "tests"), { recursive: true });
+        await fs.writeFile(path.join(tmpDir, "src", "auth.ts"), "export function auth() {}", "utf8");
+        await fs.writeFile(path.join(tmpDir, "tests", "auth.test.ts"), `import { auth } ${"from"} '../src/auth';\nit('works', () => auth());`, "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix auth", description: "auth is broken", kind: "bug" },
+        });
+        expect(intel.regressionTests.some((f) => f.includes("auth.test.ts"))).toBe(true);
+    });
+    it("picks up .spec.ts files", async () => {
+        await fs.mkdir(path.join(tmpDir, "src"), { recursive: true });
+        await fs.mkdir(path.join(tmpDir, "__tests__"), { recursive: true });
+        await fs.writeFile(path.join(tmpDir, "src", "session.ts"), "export function session() {}", "utf8");
+        await fs.writeFile(path.join(tmpDir, "__tests__", "session.spec.ts"), `describe('session', () => { it('ok', () => session()) });`, "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix session expiry", description: "session does not expire correctly", kind: "bug" },
+        });
+        expect(intel.regressionTests.some((f) => f.includes("session.spec.ts"))).toBe(true);
+    });
+});
+// ---------------------------------------------------------------------------
+// Framework detection
+// ---------------------------------------------------------------------------
+describe("gatherCodebaseIntel — framework detection", () => {
+    it("detects next + node from package.json with next dependency", async () => {
+        await fs.writeFile(path.join(tmpDir, "package.json"), JSON.stringify({ dependencies: { next: "14.0.0", react: "18.0.0" } }), "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix page", description: "page load fails", kind: "bug" },
+        });
+        expect(intel.detectedFrameworks).toContain("next");
+        expect(intel.detectedFrameworks).toContain("node");
+        expect(intel.detectedFrameworks).toContain("react");
+    });
+    it("detects dotnet from .csproj file", async () => {
+        await fs.writeFile(path.join(tmpDir, "MyApp.csproj"), '<Project Sdk="Microsoft.NET.Sdk" />', "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix null ref", description: "null reference exception in service", kind: "bug" },
+        });
+        expect(intel.detectedFrameworks).toContain("dotnet");
+    });
+    it("detects python from requirements.txt", async () => {
+        await fs.writeFile(path.join(tmpDir, "requirements.txt"), "fastapi\nuvicorn\n", "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix endpoint", description: "api endpoint returns 500", kind: "bug" },
+        });
+        expect(intel.detectedFrameworks).toContain("python");
+    });
+    it("detects rust from Cargo.toml", async () => {
+        await fs.writeFile(path.join(tmpDir, "Cargo.toml"), '[package]\nname = "myapp"\n', "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix panic", description: "unwrap panic in main", kind: "bug" },
+        });
+        expect(intel.detectedFrameworks).toContain("rust");
+    });
+    it("returns sorted framework list", async () => {
+        await fs.writeFile(path.join(tmpDir, "package.json"), JSON.stringify({ dependencies: { next: "14.0.0" } }), "utf8");
+        await fs.writeFile(path.join(tmpDir, "requirements.txt"), "flask\n", "utf8");
+        const intel = await gatherCodebaseIntel({
+            cwd: tmpDir,
+            task: { title: "fix something", description: "something is broken", kind: "bug" },
+        });
+        // Result should be sorted
+        const sorted = [...intel.detectedFrameworks].sort();
+        expect(intel.detectedFrameworks).toEqual(sorted);
+    });
+});
+//# sourceMappingURL=codebase-intel.test.js.map

package/dist/src/maintain/__tests__/gh-create-pr.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * gh-create-pr.test.ts — P16 unit tests.
+ *
+ * Covers:
+ *   1. ok=true with URL parsed from gh stdout.
+ *   2. gh not installed → ok=false with clear reason.
+ *   3. gh not authed → ok=false with auth error message.
+ *   4. git push fails → ok=false with push error.
+ *   5. branch name with invalid chars → ok=false immediately (no git/gh calls).
+ */
+export {};

package/dist/src/maintain/__tests__/gh-create-pr.test.js

@@ -0,0 +1,156 @@
+/**
+ * gh-create-pr.test.ts — P16 unit tests.
+ *
+ * Covers:
+ *   1. ok=true with URL parsed from gh stdout.
+ *   2. gh not installed → ok=false with clear reason.
+ *   3. gh not authed → ok=false with auth error message.
+ *   4. git push fails → ok=false with push error.
+ *   5. branch name with invalid chars → ok=false immediately (no git/gh calls).
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+// ── Mocks ──────────────────────────────────────────────────────────────────
+// vi.hoisted ensures the factory variable is available when vi.mock is hoisted.
+const { mockExecFile } = vi.hoisted(() => ({ mockExecFile: vi.fn() }));
+vi.mock("node:child_process", () => ({
+    execFile: mockExecFile,
+}));
+vi.mock("node:fs", async (importOriginal) => {
+    const actual = (await importOriginal());
+    return {
+        ...actual,
+        writeFileSync: vi.fn(),
+        unlinkSync: vi.fn(),
+    };
+});
+// execFileMock alias → mockExecFile defined above via vi.mock hoisting
+import { ghCreatePr } from "../gh-create-pr.js";
+/**
+ * Sets up a sequence of execFile responses in call order.
+ * Each entry matches the next invocation.
+ */
+function setupSequence(responses) {
+    let callIndex = 0;
+    mockExecFile.mockImplementation((_cmd, _args, _opts, cb) => {
+        const resp = responses[callIndex] ?? { stdout: "" };
+        callIndex++;
+        if (resp.fail) {
+            const err = new Error(resp.stderr ?? "command failed");
+            err.stderr = resp.stderr ?? "";
+            err.stdout = "";
+            cb(err, { stdout: "", stderr: resp.stderr ?? "" });
+        }
+        else {
+            cb(null, { stdout: resp.stdout ?? "", stderr: "" });
+        }
+    });
+}
+function makeInput(overrides = {}) {
+    return {
+        branch: "claude/bug-01hx1234",
+        title: "Fix null pointer in login handler",
+        body: "## Summary\nFix the null pointer.",
+        cwd: "/tmp/proj",
+        ...overrides,
+    };
+}
+// ─── Tests ────────────────────────────────────────────────────────────────────
+describe("ghCreatePr — happy path (ok=true with URL)", () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        vi.clearAllMocks();
+    });
+    it("returns ok=true and the PR URL on full success", async () => {
+        setupSequence([
+            { stdout: "gh version 2.x.x" }, // gh --version
+            { stdout: "Logged in to github.com as user" }, // gh auth status
+            { fail: true }, // git rev-parse --verify branch (doesn't exist)
+            { stdout: "" }, // git checkout -b
+            { stdout: "" }, // git push -u origin
+            { stdout: "main" }, // gh repo view --json ...
+            { stdout: "https://github.com/owner/repo/pull/42\n" }, // gh pr create
+        ]);
+        const input = makeInput();
+        const output = await ghCreatePr(input);
+        expect(output.ok).toBe(true);
+        expect(output.url).toBe("https://github.com/owner/repo/pull/42");
+    });
+});
+describe("ghCreatePr — gh not installed", () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        vi.clearAllMocks();
+    });
+    it("returns ok=false with 'not installed' message when gh --version fails", async () => {
+        setupSequence([
+            { fail: true, stderr: "command not found: gh" }, // gh --version
+        ]);
+        const output = await ghCreatePr(makeInput());
+        expect(output.ok).toBe(false);
+        expect(output.reason).toMatch(/not installed/i);
+    });
+});
+describe("ghCreatePr — gh not authed", () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        vi.clearAllMocks();
+    });
+    it("returns ok=false with 'not authenticated' when gh auth status fails", async () => {
+        setupSequence([
+            { stdout: "gh version 2.x.x" }, // gh --version
+            { fail: true, stderr: "You are not logged into any GitHub hosts" }, // gh auth status
+        ]);
+        const output = await ghCreatePr(makeInput());
+        expect(output.ok).toBe(false);
+        expect(output.reason).toMatch(/not authenticated/i);
+    });
+});
+describe("ghCreatePr — git push fails", () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        vi.clearAllMocks();
+    });
+    it("returns ok=false with push failure reason when git push -u origin fails", async () => {
+        setupSequence([
+            { stdout: "gh version 2.x.x" }, // gh --version
+            { stdout: "Logged in to github.com" }, // gh auth status
+            { fail: true }, // git rev-parse --verify (branch doesn't exist)
+            { stdout: "" }, // git checkout -b
+            { fail: true, stderr: "remote: Permission denied" }, // git push -u origin
+        ]);
+        const output = await ghCreatePr(makeInput());
+        expect(output.ok).toBe(false);
+        expect(output.reason).toMatch(/push failed/i);
+        expect(output.reason).toContain("Permission denied");
+    });
+});
+describe("ghCreatePr — invalid branch name rejected immediately", () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        vi.clearAllMocks();
+    });
+    it("returns ok=false without calling any child_process when branch has invalid chars", async () => {
+        const output = await ghCreatePr(makeInput({ branch: "claude/bug; rm -rf /" }));
+        expect(output.ok).toBe(false);
+        expect(output.reason).toMatch(/invalid characters/i);
+        // execFile should NOT have been called at all.
+        expect(mockExecFile).not.toHaveBeenCalled();
+    });
+    it("rejects branch names with shell metacharacters", async () => {
+        const output = await ghCreatePr(makeInput({ branch: "feature/$(evil)" }));
+        expect(output.ok).toBe(false);
+        expect(output.reason).toMatch(/invalid characters/i);
+        expect(mockExecFile).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=gh-create-pr.test.js.map

package/dist/src/maintain/__tests__/pr-builder.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * pr-builder.test.ts — P16 unit tests.
+ *
+ * Covers:
+ *   1. Happy path: diff + body generated, all changed files inside radius.
+ *   2. Files-outside-radius flagged in output but not blocking.
+ *   3. LLM mock returns body verbatim (no transformation by buildPr).
+ *   4. Squash gracefully degrades when marker SHA file is missing.
+ */
+export {};