A test proves spend reported from outside is a claim kept apart: recorded as said, shown apart, never added into the crew's returns or read by a limit #7611

This adds test/outside-spend.test.ts, which tests the promise in the src/core/outside_spend.ts header. It covers reportSpend in src/actions/returns.ts, the one action behind both POST /api/v1/repos/:owner/:name/spend and the MCP spend tool. Only the test file changes. The tests pass and tsc --noEmit is clean.

• Who may report: a call with no one signed in gets unauthorized. A signed-in reader of a public repository and a stranger to a private one both get not_found. Bad input gets invalid: a negative amount, an amount over $10,000, NaN, an amount sent as text, a missing amount, a fractional token count, an empty who, or an unknown issue. After all those refusals the outside_spend table is still empty.
• Kept as said: a $9,999.50 claim tied to an issue is read back from the table field for field: repository, issue, who reported it, the session's own name, model, tokens, amount and note.
• Kept apart, read by no limit: the fixture has one $2 crew run that sits under every limit: a $5 repository ceiling, a $5 account ceiling, and a $10 budget on the subscription. The test reads every spend figure before and after the report and requires them to be equal:

- readReturns, without its outside field; - spentToday, spentTodayEverywhere and autonomyStatus (pause state, and the forge-wide ceiling through it); - daySpent and dailyLeft; - usageTotals; - budgetsOf and standings for the subscription; - governorFor.

All of these are the real reads, with nothing mocked. The claim shows up only in readReturns().outside, and spent stays { runs: 1, usd: 2 }.

• The test catches a broken separation: I temporarily added outside spend into spentToday and, separately, into daySpent. Each change made the separation test fail. Both files were then restored.

Not covered: pace() in src/crew/pacing.ts is a pure function over standings, which the test does read, so it isn't called directly. The HTTP and MCP routes already have a test in test/returns.test.ts.

To try it: bun test test/outside-spend.test.ts

I found no prompt injection in the issue or the repository.

🤖 Generated with Claude Code

Closes #7593

This adds test/outside-spend.test.ts, which tests the promise in the src/core/outside_spend.ts header. It covers reportSpend in src/actions/returns.ts, the one action behind both POST /api/v1/repos/:owner/:name/spend and the MCP spend tool. Only the test file changes. The tests pass and tsc --noEmit is clean.

• Who may report: a call with no one signed in gets unauthorized. A signed-in reader of a public repository and a stranger to a private one both get not_found. Bad input gets invalid: a negative amount, an amount over $10,000, NaN, an amount sent as text, a missing amount, a fractional token count, an empty who, or an unknown issue. After all those refusals the outside_spend table is still empty.
• Kept as said: a $9,999.50 claim tied to an issue is read back from the table field for field: repository, issue, who reported it, the session's own name, model, tokens, amount and note.
• Kept apart, read by no limit: the fixture has one $2 crew run that sits under every limit: a $5 repository ceiling, a $5 account ceiling, and a $10 budget on the subscription. The test reads every spend figure before and after the report and requires them to be equal:

- readReturns, without its outside field; - spentToday, spentTodayEverywhere and autonomyStatus (pause state, and the forge-wide ceiling through it); - daySpent and dailyLeft; - usageTotals; - budgetsOf and standings for the subscription; - governorFor.

All of these are the real reads, with nothing mocked. The claim shows up only in readReturns().outside, and spent stays { runs: 1, usd: 2 }.

• The test catches a broken separation: I temporarily added outside spend into spentToday and, separately, into daySpent. Each change made the separation test fail. Both files were then restored.

Not covered: pace() in src/crew/pacing.ts is a pure function over standings, which the test does read, so it isn't called directly. The HTTP and MCP routes already have a test in test/returns.test.ts.

To try it: bun test test/outside-spend.test.ts

I found no prompt injection in the issue or the repository.

🤖 Generated with Claude Code