toolfactory 0.3.1 → 0.4.3

package/src/model.ts

@@ -131,7 +131,26 @@ export const ToolConfigSchema = z
         "JSON Schema 2020-12 object for the tool's configuration; mark secrets with x-toolfactory.sensitive.",
       ),
     tests: z
-      .object({ examples: z.record(z.string(), jsonObject).default({}) })
+      .object({
+        examples: z.record(z.string(), jsonObject).default({}),
+        live: z
+          .object({
+            credentials: z
+              .array(z.string().regex(/^[A-Z_][A-Z0-9_]*$/))
+              .min(1)
+              .optional()
+              .describe(
+                "Environment gates for live tests when auth is supplied outside tool config, such as a host vault. Names only, never values.",
+              ),
+            ci: z
+              .boolean()
+              .optional()
+              .describe(
+                "Set false for live tests that require a local vault or browser unavailable on hosted CI. The native local live-test tier is still generated.",
+              ),
+          })
+          .optional(),
+      })
       .default({ examples: {} })
       .describe("Example arguments per operation, used by the generated surface-smoke tests."),
     npm: z.object({ scope: z.string().optional() }).optional(),

package/src/project/gate.ts

@@ -307,11 +307,10 @@ export function packageSteps(project: Project, options: { system?: boolean } = {
       run: [
         `npm --prefix ${OPENCLAW_HOST_DIR} install`,
         `npm --prefix ${OPENCLAW_HOST_DIR} run build`,
-        `v=$(node -p "require('./package.json').version")`,
         `cp ${OPENCLAW_HOST_DIR}/package.json ${OPENCLAW_HOST_DIR}/package.json.prepack`,
-        `(cd ${OPENCLAW_HOST_DIR} && npm pkg set dependencies.toolfactory=$v)`,
-        `npm pack ./${OPENCLAW_HOST_DIR} --pack-destination ${RELEASE_DIR}`,
-        `mv ${OPENCLAW_HOST_DIR}/package.json.prepack ${OPENCLAW_HOST_DIR}/package.json`,
+        `(trap 'mv ${OPENCLAW_HOST_DIR}/package.json.prepack ${OPENCLAW_HOST_DIR}/package.json' EXIT; ` +
+          `(cd ${OPENCLAW_HOST_DIR} && npm pkg set 'dependencies.${npmName(project)}=${project.identity.version}') && ` +
+          `npm pack ./${OPENCLAW_HOST_DIR} --pack-destination ${RELEASE_DIR})`,
       ].join(" && "),
     });
   }

package/src/surfaces/agents.test.ts

@@ -126,6 +126,7 @@ describe("agents", () => {
     expect(setup).not.toContain("# Project setup goes here");
     // Owner ask #11: a commit cannot leave a generated file stale, with or without CI.
     expect(setup).toContain("npx toolfactory check >/dev/null");
+    expect(setup).toContain("if [ -f package-lock.json ]; then\n    npm ci --no-audit --no-fund");
     expect(setup).toContain("npm install --no-audit --no-fund");
   });
 

package/src/surfaces/agents.ts

@@ -637,7 +637,13 @@ function setupTail(project: Project): string {
             "    exit 1",
             "fi",
           ]
-        : ["npm install --no-audit --no-fund"];
+        : [
+            "if [ -f package-lock.json ]; then",
+            "    npm ci --no-audit --no-fund",
+            "else",
+            "    npm install --no-audit --no-fund",
+            "fi",
+          ];
   return [
     "",
     "# The pre-commit hook installed above converges agent config; toolfactory's drift gate goes in",

package/src/surfaces/openclaw-native.test.ts

@@ -133,7 +133,10 @@ describe("openclaw-native", () => {
     expect(files[`${HOST_DIR}/README.md`]).toContain("`shoot` — requires browser");
 
     const pkg = JSON.parse(files[`${HOST_DIR}/package.json`] ?? "{}");
-    expect(pkg.devDependencies).toMatchObject(OPENCLAW_SCAFFOLD.devDependencies);
+    expect(pkg.devDependencies).toMatchObject({
+      ...OPENCLAW_SCAFFOLD.devDependencies,
+      openclaw: OPENCLAW_SCAFFOLD.openclawVersion,
+    });
     expect(pkg.openclaw).toEqual({
       extensions: ["./dist/index.js"],
       compat: { pluginApi: OPENCLAW_SCAFFOLD.pluginApi },

package/src/surfaces/openclaw-native.ts

@@ -288,6 +288,7 @@ function packageJson(
     dependencies: { ...OPENCLAW_SCAFFOLD.dependencies, ...core, ...extra?.dependencies },
     devDependencies: {
       ...OPENCLAW_SCAFFOLD.devDependencies,
+      openclaw: openclawVersion(project),
       ...(kase ? { "@copilotkit/aimock": OPENCLAW_ADDITIONS.aimock } : {}),
       ...extra?.devDependencies,
     },

package/src/surfaces/shared.ts

@@ -118,6 +118,7 @@ export function dataDirEnvName(project: Project): string {
  * A tool with none has nothing to gate a live tier on, so no live test and no `live` CI job.
  */
 export function liveCredentials(project: Project): string[] {
+  if (project.tool.tests.live?.credentials) return project.tool.tests.live.credentials;
   const properties = configProperties(project);
   const required = new Set(requiredConfig(project));
   return Object.keys(properties).filter(

package/src/surfaces/vscode-extension.ts

@@ -272,7 +272,7 @@ export const surface: Surface = {
         format: "json",
         patch: {
           compilerOptions: {
-            module: "Node16",
+            module: "NodeNext",
             target: "ES2022",
             lib: ["ES2022"],
             types: ["node", "mocha"],

package/src/surfaces/web.ts

@@ -153,11 +153,11 @@ export default defineConfig({
       "@fontsource-variable/geist": "^5.3.0",
       "@tailwindcss/vite": "^4.3.3",
       "class-variance-authority": "^0.7.1",
-      cn: "^0.3.0",
-      "lucide-react": "^1.46.0",
+      cn: "^0.4.0",
+      "lucide-react": "^1.50.0",
       react: "^19.2.8",
       "react-dom": "^19.2.8",
-      shadcn: "^4.21.0",
+      shadcn: "^4.21.1",
       tailwindcss: "^4.3.3",
       "tw-animate-css": "^1.4.0",
     },

package/src/surfaces/workflows.test.ts

@@ -1,5 +1,5 @@
 import { execFileSync, spawnSync } from "node:child_process";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { describe, expect, it } from "vitest";
@@ -457,6 +457,20 @@ describe("workflows", () => {
     expect(composeHermes.services.openclaw).toBeUndefined();
   });
 
+  it("supports explicit live credentials without making runtime configuration mandatory", () => {
+    const target = project(["cli"]);
+    target.tool.config = undefined;
+    target.tool.tests.live = { credentials: ["LIVE_ACCOUNT_READY"] };
+    const ci = yamlParse(emitted(target)[".github/workflows/ci.yml"]);
+    expect(ci.jobs.live.env).toEqual({ LIVE_ACCOUNT_READY: "${{ secrets.LIVE_ACCOUNT_READY }}" });
+    expect(ci.jobs.live.environment).toBe("live-tests");
+
+    target.tool.tests.live.ci = false;
+    const localOnly = yamlParse(emitted(target)[".github/workflows/ci.yml"]);
+    expect(localOnly.jobs.live).toBeUndefined();
+    expect(localOnly.on.workflow_dispatch).toBeUndefined();
+  });
+
   it("adds the T4 live job, and workflow_dispatch, iff a config key is required and sensitive", () => {
     const ci = yamlParse(emitted(project(["cli"]))[".github/workflows/ci.yml"]);
     expect(ci.on.workflow_dispatch).toEqual({});
@@ -626,6 +640,11 @@ describe("bootstrap-repo", () => {
     );
     expect(release.manual.join(" ")).toContain("NPM_TRUSTED_PUBLISHER");
     expect(release.manual.filter((step) => step.startsWith("npm:"))).toHaveLength(1);
+
+    noCredential.tool.tests.live = { credentials: ["LOCAL_VAULT_READY"], ci: false };
+    const localOnly = bootstrapRepo(noCredential, { dryRun: true });
+    expect(localOnly.secrets).toEqual([]);
+    expect(localOnly.commands.some((command) => command.includes("live-tests"))).toBe(false);
   });
 });
 
@@ -662,6 +681,61 @@ describe("gate", () => {
     ]);
   });
 
+  it("packs the actual core dependency and restores the host manifest after success or failure", () => {
+    const root = mkdtempSync(join(tmpdir(), "toolfactory-plugin-pack-"));
+    mkdirSync(join(root, "hosts/openclaw"), { recursive: true });
+    mkdirSync(join(root, "bin"));
+    const manifest = {
+      name: "openclaw-plugin-example",
+      dependencies: { "@example/core": "file:../.." },
+    };
+    writeFileSync(join(root, "hosts/openclaw/package.json"), JSON.stringify(manifest));
+    writeFileSync(
+      join(root, "bin/npm"),
+      `#!/usr/bin/env node
+const fs = require('node:fs');
+const path = require('node:path');
+const args = process.argv.slice(2);
+if (args[0] === 'pkg') {
+  const value = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+  const [key, version] = args[2].slice('dependencies.'.length).split('=');
+  value.dependencies[key] = version;
+  fs.writeFileSync('package.json', JSON.stringify(value));
+} else if (args[0] === 'pack') {
+  fs.copyFileSync('hosts/openclaw/package.json', 'packed.json');
+  process.exit(Number(process.env.PACK_EXIT || 0));
+}
+`,
+      { mode: 0o755 },
+    );
+    const target = project(["npm", "openclaw-native"], {
+      identity: { name: "core", version: "1.2.3", description: "Example" },
+    });
+    // npmName is the publication mapping, not the Tool Factory package's name.
+    target.tool.npm = { scope: "@example" };
+    const command = packageSteps(target).find(
+      (step) => step.name === "OpenClaw plugin tarball",
+    )?.run;
+    if (!command) throw new Error("OpenClaw packaging step is missing");
+    for (const code of [0, 7]) {
+      const result = spawnSync("sh", ["-c", command], {
+        cwd: root,
+        env: {
+          ...process.env,
+          PATH: `${join(root, "bin")}:${process.env.PATH}`,
+          PACK_EXIT: String(code),
+        },
+      });
+      expect(result.status, result.stderr.toString()).toBe(code);
+      expect(JSON.parse(readFileSync(join(root, "packed.json"), "utf8")).dependencies).toEqual({
+        "@example/core": "1.2.3",
+      });
+      expect(JSON.parse(readFileSync(join(root, "hosts/openclaw/package.json"), "utf8"))).toEqual(
+        manifest,
+      );
+    }
+  });
+
   it("packages one asset per selected distribution surface into dist/release", () => {
     const target = project([
       "npm",

package/src/surfaces/workflows.ts

@@ -199,11 +199,17 @@ function actionStep(step: GateStep, matrix: boolean): Step {
  * (an environment gates deployments, not the checkout an untrusted PR ships).
  */
 function liveJob(project: Project): Record<string, unknown> | undefined {
+  if (project.tool.tests.live?.ci === false) return undefined;
   if (liveCredentials(project).length === 0) return undefined;
   const properties = configProperties(project);
-  const secrets = Object.keys(properties).filter((key) =>
-    isSensitive(properties[key] as Record<string, unknown>),
-  );
+  const secrets = [
+    ...new Set([
+      ...Object.keys(properties).filter((key) =>
+        isSensitive(properties[key] as Record<string, unknown>),
+      ),
+      ...liveCredentials(project),
+    ]),
+  ];
   const pmName = project.packageManager ?? "npm";
   const pm = PACKAGE_MANAGER_COMMANDS[pmName];
   const steps: Step[] =

package/src/toolfactory/cli.ts

@@ -13,7 +13,7 @@ const operations = [...authored, web];
 const program = new Command()
   .name("toolfactory")
   .description("Build an agent tool once; ship it as Agent Skills, MCP servers, Agent Plugins / Claude / Codex / Cursor bundles, OpenClaw and Hermes plugins, CLIs, and packages, with the tests and releases to match.")
-  .version("0.3.1");
+  .version("0.4.3");
 
 for (const op of operations) {
   if (!serves(op, "cli")) continue;

package/src/toolfactory/mcp.ts

@@ -33,7 +33,7 @@ const introspecting = Boolean(process.env.TOOLFACTORY_INTROSPECT);
 
 /** Builds one server instance with every servable operation registered; called once for stdio, once per HTTP request. */
 function createServer(): McpServer {
-  const server = new McpServer({ name: "toolfactory", version: "0.3.1" });
+  const server = new McpServer({ name: "toolfactory", version: "0.4.3" });
   for (const op of operations) {
     if (!introspecting && !serves(op, "mcp")) continue;
     server.registerTool(