@bongos/core 1.19.396 → 1.19.398

package/tests/ui_design_skills.mjs

@@ -0,0 +1,168 @@
+// tests/ui_design_skills.mjs — the ui-design module's vendored-skill policy (task 1003321,
+// ADR 0198) is a pinned contract, not a README: every skill under skills/vendor/ carries a
+// PROVENANCE.md sidecar with an allowlisted licence and a landable scan verdict; its SKILL.md
+// opens with the PLATFORM PREAMBLE byte-identical to PREAMBLE.md; every name the manifest
+// contributes resolves to a real skill dir; a module-owned skill reaches a builder's
+// materialised .claude/skills with its sidecar (and not when the module is off); /design
+// lists every vendored skill by name; the policy ADR is indexed. DB-free.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const MODULE = path.join(ROOT, 'modules', 'ui-design');
+const SKILLS = path.join(MODULE, 'skills');
+const VENDOR = path.join(SKILLS, 'vendor');
+const read = (p) => fs.readFileSync(p, 'utf8').replace(/\r\n/g, '\n');
+const readJson = (p) => JSON.parse(fs.readFileSync(p, 'utf8'));
+const policy = readJson(path.join(SKILLS, 'policy.json'));
+const manifest = readJson(path.join(MODULE, 'module.json'));
+const materialize = require(path.join(ROOT, 'scripts', 'gds', 'claude-materialize.js'));
+
+// Minimal YAML-frontmatter reader: `key: value` lines between the first two `---` fences.
+function frontmatter(text) {
+  const m = text.match(/^---\n([\s\S]*?)\n---\n/);
+  const out = {};
+  if (!m) return out;
+  for (const line of m[1].split('\n')) {
+    const kv = line.match(/^([A-Za-z][A-Za-z0-9_-]*):\s*(.*)$/);
+    if (kv) out[kv[1]] = kv[2].replace(/^["']|["']$/g, '').trim();
+  }
+  return out;
+}
+
+const vendoredDirs = fs.existsSync(VENDOR)
+  ? fs.readdirSync(VENDOR).filter((n) => fs.statSync(path.join(VENDOR, n)).isDirectory()).sort()
+  : [];
+const ownDirs = fs.readdirSync(SKILLS)
+  .filter((n) => n !== 'vendor' && fs.statSync(path.join(SKILLS, n)).isDirectory() && fs.existsSync(path.join(SKILLS, n, 'SKILL.md')))
+  .sort();
+
+// ── the policy itself ────────────────────────────────────────────────────────
+test('the policy file pins the allowlist, the landable verdicts, the sidecar and the preamble markers', () => {
+  assert.deepEqual(policy.licenceAllowlist, ['Apache-2.0', 'MIT', 'BSD-2-Clause', 'BSD-3-Clause', 'CC-BY-4.0']);
+  assert.deepEqual(policy.verdictsThatMayLand, ['clean', 'caution'], 'a dangerous verdict never lands a copy');
+  assert.equal(policy.sidecar, 'PROVENANCE.md');
+  assert.equal(policy.preamble.source, 'PREAMBLE.md');
+  assert.ok(policy.sidecarRequiredFields.includes('licence') && policy.sidecarRequiredFields.includes('scanVerdict') && policy.sidecarRequiredFields.includes('commit'));
+});
+
+test('PREAMBLE.md is one fenced block that reads the world before any taste rule', () => {
+  const pre = read(path.join(SKILLS, 'PREAMBLE.md'));
+  assert.ok(pre.startsWith(policy.preamble.begin), 'opens with the BEGIN marker');
+  assert.ok(pre.trimEnd().endsWith(policy.preamble.end), 'closes with the END marker');
+  assert.equal(pre.split(policy.preamble.begin).length, 2, 'exactly one BEGIN marker');
+  assert.equal(pre.split(policy.preamble.end).length, 2, 'exactly one END marker');
+  for (const must of ['config/branding.json', 'config/branding.neutral.json', 'config/design-tokens.json', 'DESIGN.md', 'fifteen', 'prefers-reduced-motion', '24px', '4.5:1', 'hero plates', 'ui-look-before-you-ship']) {
+    assert.ok(pre.includes(must), `preamble names ${must}`);
+  }
+});
+
+// ── every vendored skill: sidecar, licence, verdict, preamble ───────────────
+test('every vendored skill carries a PROVENANCE.md with an allowlisted licence, a landable verdict and every required field', () => {
+  for (const name of vendoredDirs) {
+    const dir = path.join(VENDOR, name);
+    assert.ok(fs.existsSync(path.join(dir, 'SKILL.md')), `${name}: SKILL.md`);
+    const side = path.join(dir, policy.sidecar);
+    assert.ok(fs.existsSync(side), `${name}: ${policy.sidecar} sidecar`);
+    const fm = frontmatter(read(side));
+    for (const f of policy.sidecarRequiredFields) assert.ok(fm[f], `${name}: sidecar field ${f}`);
+    assert.equal(fm.name, name, `${name}: sidecar names its own dir`);
+    assert.ok(policy.licenceAllowlist.includes(fm.licence), `${name}: licence ${fm.licence} is on the allowlist`);
+    assert.ok(policy.verdictsThatMayLand.includes(fm.scanVerdict), `${name}: verdict ${fm.scanVerdict} may land`);
+    assert.match(fm.commit, /^[0-9a-f]{40}$/, `${name}: the pinned commit is a full sha`);
+    assert.match(fm.origin, /^https:\/\//, `${name}: origin is an https url`);
+    assert.ok(fs.existsSync(path.join(dir, 'LICENSE')), `${name}: the upstream licence text travels with the copy`);
+  }
+});
+
+test('every vendored SKILL.md opens with the PLATFORM PREAMBLE, byte-identical to PREAMBLE.md, right after its frontmatter', () => {
+  const pre = read(path.join(SKILLS, 'PREAMBLE.md')).trimEnd();
+  for (const name of vendoredDirs) {
+    const text = read(path.join(VENDOR, name, 'SKILL.md'));
+    const fm = text.match(/^---\n[\s\S]*?\n---\n/);
+    assert.ok(fm, `${name}: SKILL.md keeps its frontmatter first (the harness parses it)`);
+    const body = text.slice(fm[0].length).replace(/^\n+/, '');
+    assert.ok(body.startsWith(pre), `${name}: the preamble block is the first thing after the frontmatter and matches PREAMBLE.md byte for byte`);
+    assert.equal(text.split(policy.preamble.begin).length, 2, `${name}: the preamble appears exactly once`);
+  }
+});
+
+// ── the manifest declares what is on disk, and nothing else ─────────────────
+test('every skill the manifest contributes resolves to a skill dir (core .claude/skills or the module), and every module skill dir is declared', () => {
+  const declared = manifest.contributes.skills;
+  assert.ok(Array.isArray(declared) && declared.length >= 3);
+  for (const name of declared) {
+    const homes = [path.join(ROOT, '.claude', 'skills', name), path.join(SKILLS, name), path.join(VENDOR, name)];
+    assert.ok(homes.some((h) => fs.existsSync(path.join(h, 'SKILL.md'))), `${name}: declared but no SKILL.md in any home`);
+  }
+  for (const name of [...ownDirs, ...vendoredDirs]) assert.ok(declared.includes(name), `${name}: on disk under the module but not declared in contributes.skills`);
+  const sources = materialize.moduleSkillSources({ coreRoot: ROOT, instanceDir: ROOT });
+  assert.deepEqual(sources.map((s) => s.name).sort(), [...ownDirs, ...vendoredDirs].sort(), 'the materialiser resolves exactly the module skill dirs on disk');
+});
+
+// ── materialisation: the builder's .claude/skills carries the set, sidecar included ─
+test('a module-owned skill lands in a materialised .claude/skills with its sidecar when the module is on, and not when it is off', () => {
+  const core = fs.mkdtempSync(path.join(os.tmpdir(), 'ui-skills-core-'));
+  const mod = path.join(core, 'modules', 'ui-design');
+  fs.mkdirSync(path.join(mod, 'skills', 'vendor', 'sample'), { recursive: true });
+  fs.mkdirSync(path.join(core, '.claude', 'skills'), { recursive: true });
+  fs.writeFileSync(path.join(mod, 'module.json'), JSON.stringify({ key: 'ui-design', default: true, contributes: { skills: ['sample'] } }));
+  const pre = read(path.join(SKILLS, 'PREAMBLE.md'));
+  fs.writeFileSync(path.join(mod, 'skills', 'vendor', 'sample', 'SKILL.md'), `---\nname: sample\n---\n\n${pre}\nupstream body\n`);
+  fs.writeFileSync(path.join(mod, 'skills', 'vendor', 'sample', 'PROVENANCE.md'), '---\nname: sample\nlicence: MIT\nscanVerdict: clean\n---\n');
+  fs.writeFileSync(path.join(mod, 'skills', 'vendor', 'sample', 'LICENSE'), 'MIT\n');
+
+  const on = fs.mkdtempSync(path.join(os.tmpdir(), 'ui-skills-inst-'));
+  const resOn = materialize.materializeClaude({ coreRoot: core, instanceDir: on, dryRun: false });
+  assert.equal(resOn.moduleSkills, 3);
+  for (const f of ['SKILL.md', 'PROVENANCE.md', 'LICENSE']) assert.ok(fs.existsSync(path.join(on, '.claude', 'skills', 'sample', f)), `materialised ${f}`);
+  assert.ok(read(path.join(on, '.claude', 'skills', 'sample', 'SKILL.md')).includes(policy.preamble.begin), 'the preamble survives materialisation');
+
+  const off = fs.mkdtempSync(path.join(os.tmpdir(), 'ui-skills-inst-'));
+  fs.mkdirSync(path.join(off, 'config'), { recursive: true });
+  fs.writeFileSync(path.join(off, 'config', 'modules.json'), JSON.stringify({ modules: { 'ui-design': false } }));
+  const resOff = materialize.materializeClaude({ coreRoot: core, instanceDir: off, dryRun: false });
+  assert.equal(resOff.moduleSkills, 0);
+  assert.ok(!fs.existsSync(path.join(off, '.claude', 'skills', 'sample')), 'disabling the module withdraws the skill');
+  assert.deepEqual(resOff.excludedSkills, ['sample']);
+
+  // the policy holds at COPY time too, read from this module's own policy.json: a
+  // dangerous verdict never lands, whatever the CI test would have said
+  fs.copyFileSync(path.join(SKILLS, 'policy.json'), path.join(mod, 'skills', 'policy.json'));
+  fs.writeFileSync(path.join(mod, 'skills', 'vendor', 'sample', 'PROVENANCE.md'), '---\nname: sample\nlicence: MIT\nscanVerdict: dangerous\n---\n');
+  const refusedInst = fs.mkdtempSync(path.join(os.tmpdir(), 'ui-skills-inst-'));
+  const resRefused = materialize.materializeClaude({ coreRoot: core, instanceDir: refusedInst, dryRun: false });
+  assert.equal(resRefused.moduleSkills, 0);
+  assert.ok(!fs.existsSync(path.join(refusedInst, '.claude', 'skills', 'sample')), 'a dangerous verdict is refused at copy time');
+  assert.ok(resRefused.notes.some((n) => n.includes('refused') && n.includes('may not land')));
+  for (const d of [core, on, off, refusedInst]) fs.rmSync(d, { recursive: true, force: true });
+});
+
+// ── the doors: /design lists them, the README rosters them, the ADR is indexed ──
+test('/design lists every vendored skill by name, one line each, and names the playwright plugin as a prerequisite', () => {
+  const design = read(path.join(ROOT, '.claude', 'skills', 'design', 'SKILL.md'));
+  for (const name of vendoredDirs) {
+    const line = design.split('\n').find((l) => l.includes(`\`/${name}\``) || l.includes(`**${name}**`));
+    assert.ok(line, `/design names ${name} on a line of its own`);
+  }
+  assert.match(design, /playwright/i, '/design names the playwright plugin');
+});
+
+test('the skills README rosters every vendored skill and every rebuild spec by name', () => {
+  const readme = read(path.join(SKILLS, 'README.md'));
+  for (const name of vendoredDirs) assert.ok(readme.includes(`\`${name}\``), `README rosters ${name}`);
+  assert.ok(readme.includes('policy.json') && readme.includes('PREAMBLE.md') && readme.includes('PROVENANCE.md'));
+});
+
+test('the vendoring policy ADR exists and is indexed', () => {
+  const adr = fs.readdirSync(path.join(ROOT, 'docs', 'adr')).find((f) => /^0198-/.test(f));
+  assert.ok(adr, 'docs/adr/0198-*.md exists');
+  const index = read(path.join(ROOT, 'docs', 'adr', 'README.md'));
+  assert.ok(index.includes(`](${adr})`), 'docs/adr/README.md links the ADR');
+});