@boyingliu01/xp-gate 0.35.23 → 0.36.0

package/lib/__tests__/install-skill.test.js

@@ -1,7 +1,9 @@
 /**
- * @test install-skill
- * @intent Verify installSkill() handles deps check, bundle lookup, config, backup, and errors
- * @covers AC-416-01, AC-416-05
+ * @test REQ-416, REQ-725
+ * @intent Verify installSkill() handles deps check, bundle lookup, config, backup, and errors,
+ *         and that it writes EVERY platform already carrying the skill rather than only the
+ *         one detectPlatform() short-circuits to.
+ * @covers AC-416-01, AC-416-05, AC-725-06
  */
 const fs = require('fs');
 const path = require('path');
@@ -17,37 +19,60 @@ function listDirs(root) {
     .sort();
 }
 
-describe('install-skill', () => {
-  let tmpHome, originalHome;
-
-  beforeEach(() => {
-    originalHome = process.env.HOME;
-    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-in-'));
-    process.env.HOME = tmpHome;
+/**
+ * Shared fixture for the blocks that need a throwaway HOME and a clean module
+ * cache.
+ *
+ * install-skill reads caches HOME at module load, so every test has to reset
+ * four modules and silence three console channels. Two copies of that boilerplate
+ * tripped the clone detector, and the two copies had already drifted (one
+ * afterEach waited for a pending setImmediate, the other did not) -- which is
+ * exactly how a teardown race starts. The stricter teardown wins here.
+ */
+function makeHomeFixture(prefix) {
+  const handle = { tmpHome: null, originalHome: null };
+  const MODULES = ['../install-skill', '../detect-deps', '../shared-paths', '../rollback'];
+
+  handle.dropModuleCache = () => {
+    for (const mod of MODULES) delete require.cache[require.resolve(mod)];
+  };
+
+  handle.beforeEach = () => {
+    handle.originalHome = process.env.HOME;
+    handle.tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    process.env.HOME = handle.tmpHome;
     vi.resetModules();
-    for (const mod of ['../install-skill', '../detect-deps', '../shared-paths', '../rollback']) {
-      delete require.cache[require.resolve(mod)];
-    }
+    handle.dropModuleCache();
     vi.spyOn(console, 'log').mockImplementation(() => {});
     vi.spyOn(console, 'error').mockImplementation(() => {});
     vi.spyOn(console, 'warn').mockImplementation(() => {});
-  });
+  };
 
-  afterEach(async () => {
+  handle.afterEach = async () => {
     await new Promise((resolve) => setImmediate(resolve));
-    process.env.HOME = originalHome;
+    process.env.HOME = handle.originalHome;
     vi.restoreAllMocks();
-    if (fs.existsSync(tmpHome)) {
-      fs.rmSync(tmpHome, { recursive: true, force: true });
+    if (fs.existsSync(handle.tmpHome)) {
+      fs.rmSync(handle.tmpHome, { recursive: true, force: true });
     }
-  });
+    handle.dropModuleCache();
+  };
+
+  return handle;
+}
+
+describe('install-skill', () => {
+  const fx = makeHomeFixture('xpgate-in-');
+
+  beforeEach(fx.beforeEach);
+  afterEach(fx.afterEach);
 
   function skillsDir() {
-    return path.join(tmpHome, '.config', 'opencode', 'skills');
+    return path.join(fx.tmpHome, '.config', 'opencode', 'skills');
   }
 
   function configDir() {
-    return path.join(tmpHome, '.config', 'xp-gate');
+    return path.join(fx.tmpHome, '.config', 'xp-gate');
   }
 
   function setupValidDeps() {
@@ -161,8 +186,13 @@ describe('install-skill', () => {
     expect(fs.existsSync(configFile)).toBe(true);
     const config = JSON.parse(fs.readFileSync(configFile, 'utf8'));
     expect(config.installedSkills).toHaveProperty('delphi-review');
-    // Read version dynamically from VERSION file — no hardcoded version to break on bump
-    const expectedVersion = fs.readFileSync(path.join(__dirname, '..', '..', '..', '..', 'VERSION'), 'utf8').trim();
+    // Read the version dynamically so a bump never breaks this test. The source
+    // is package.json, not the repo's VERSION: that file is a release stamp
+    // ('0.35.23.0'), is not shipped in the npm package, and resolving it from
+    // __dirname only works inside a checkout (#713).
+    const expectedVersion = JSON.parse(
+      fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf8')
+    ).version;
     expect(config.installedSkills['delphi-review'].version).toBe(expectedVersion);
     expect(config.installedSkills['delphi-review'].installedAt).toMatch(/^\d{4}-/);
   });
@@ -246,3 +276,141 @@ describe('install-skill', () => {
     expect(result).toBe(0);
   });
 });
+
+// ── #713: the "unknown skill" hint must not print a fake version ─────────────
+// getCliVersion() resolved `../../../VERSION` relative to __dirname. In an
+// installed package __dirname is
+// `node_modules/@boyingliu01/xp-gate/lib`, so three levels up lands in
+// `node_modules/` -- and the package does not ship a VERSION file at all. The
+// catch therefore fed `0.0.0` to every caller that prints it, so a user seeing
+//
+//   xp-gate 0.0.0 bundles: ...
+//
+// reasonably concluded their install was broken. The version has to come from
+// the package.json the CLI is actually running out of.
+describe('install-skill #713 CLI version reporting', () => {
+  const fx = makeHomeFixture('xpgate-ver-');
+
+  beforeEach(fx.beforeEach);
+  afterEach(fx.afterEach);
+
+  /**
+   * @test REQ-713 Honest version reporting
+   * @intent An unknown-skill error must name the real package version, never 0.0.0
+   * @covers AC-713-04
+   *
+   * The repo checkout masks this bug: `<repo>/VERSION` exists, so resolving
+   * `../../../VERSION` from `src/npm-package/lib/` lands on it and looks correct.
+   * An installed package has no such luck -- npm's `files` list does not include
+   * VERSION, and three levels up from `node_modules/@boyingliu01/xp-gate/lib` is
+   * `node_modules/`. So the assertion that matters is the one that holds in the
+   * shipped layout, which is measured here by demanding the value AGREE with
+   * package.json rather than with whatever VERSION happens to sit above the tree.
+   */
+  it('AC-713-04: unknown-skill error reports the package version, not 0.0.0 and not repo VERSION', async () => {
+    const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf8'));
+
+    // install-skill destructures checkDeps at require time, so a spy on the
+    // module object cannot intercept it. Inject a stub into the require cache
+    // BEFORE install-skill loads -- the deps gate runs ahead of the name check,
+    // and this test measures version reporting, not dependency probing.
+    const detectPath = require.resolve('../detect-deps.js');
+    require.cache[detectPath] = {
+      id: detectPath,
+      filename: detectPath,
+      loaded: true,
+      exports: {
+        ...require('../detect-deps.js'),
+        checkDeps: async () => ({ ok: true }),
+      },
+    };
+
+    const { installSkill } = require('../install-skill');
+    const code = await installSkill('definitely-not-a-bundled-skill', { force: true });
+    expect(code).toBe(1);
+
+    const said = console.error.mock.calls.map((c) => c.join(' ')).join('\n');
+    expect(said).toMatch(/Unknown skill/);
+    expect(said).not.toContain('0.0.0');
+    expect(said).toContain(`xp-gate ${pkg.version} bundles:`);
+  });
+
+  /**
+   * AC-725-06: a machine carrying the same skill on more than one platform must
+   * have every copy updated. `detectPlatform()` short-circuits to the first
+   * marker it finds, so the single-target path froze the other copy while
+   * reporting success -- and `doctor` then agreed, because both read the same
+   * short-circuited answer. Migration-era machines with Qoder AND OpenCode are
+   * the normal case, not an edge one.
+   */
+  it('AC-725-06: updates every deployed platform, not just the detected one', async () => {
+    // Two platforms carry the skill; detectPlatform() would only ever see one.
+    const qoderSkills = path.join(fx.tmpHome, '.qoder', 'skills');
+    const opencodeSkills = path.join(fx.tmpHome, '.config', 'opencode', 'skills');
+    const SKILL = 'sprint-flow';
+    for (const root of [qoderSkills, opencodeSkills]) {
+      fs.mkdirSync(path.join(root, SKILL), { recursive: true });
+      fs.writeFileSync(path.join(root, SKILL, 'SKILL.md'), '# stale copy\n');
+    }
+
+    const detectPath = require.resolve('../detect-deps.js');
+    require.cache[detectPath] = {
+      id: detectPath,
+      filename: detectPath,
+      loaded: true,
+      exports: {
+        ...require('../detect-deps.js'),
+        checkDeps: async () => ({ ok: true }),
+      },
+    };
+
+    const { installSkill } = require('../install-skill');
+    const code = await installSkill(SKILL, { force: true });
+    expect(code).toBe(0);
+
+    // Both copies must now carry the shipped content, not the stale fixture.
+    for (const root of [qoderSkills, opencodeSkills]) {
+      const installed = path.join(root, SKILL, 'SKILL.md');
+      expect(fs.existsSync(installed)).toBe(true);
+      const body = fs.readFileSync(installed, 'utf8');
+      expect(body).not.toBe('# stale copy\n');
+      expect(body.length).toBeGreaterThan(100);
+    }
+  });
+
+  it('AC-725-06: a platform whose copy cannot be read does not abort the others', async () => {
+    // Qoder's skills root is a FILE, so readdir throws ENOTDIR for it. That
+    // platform must be skipped, and OpenCode -- which is readable -- must still
+    // be updated. The prior single-target code never reached this case because
+    // detectPlatform() would have picked one platform and ignored the other.
+    const qoderSkills = path.join(fx.tmpHome, '.qoder', 'skills');
+    const opencodeSkills = path.join(fx.tmpHome, '.config', 'opencode', 'skills');
+    const SKILL = 'sprint-flow';
+    fs.mkdirSync(path.dirname(qoderSkills), { recursive: true });
+    fs.writeFileSync(qoderSkills, 'not a directory');
+    fs.mkdirSync(path.join(opencodeSkills, SKILL), { recursive: true });
+    fs.writeFileSync(path.join(opencodeSkills, SKILL, 'SKILL.md'), '# stale copy\n');
+
+    const detectPath = require.resolve('../detect-deps.js');
+    require.cache[detectPath] = {
+      id: detectPath,
+      filename: detectPath,
+      loaded: true,
+      exports: {
+        ...require('../detect-deps.js'),
+        checkDeps: async () => ({ ok: true }),
+      },
+    };
+
+    const { installSkill } = require('../install-skill');
+    const code = await installSkill(SKILL, { force: true });
+
+    // The readable platform must still have been written.
+    const healthy = path.join(opencodeSkills, SKILL, 'SKILL.md');
+    expect(fs.existsSync(healthy)).toBe(true);
+    expect(fs.readFileSync(healthy, 'utf8')).not.toBe('# stale copy\n');
+    // The unreadable root must not have been silently "updated" into a file.
+    expect(fs.statSync(qoderSkills).isFile()).toBe(true);
+    expect(code).toBe(0);
+  });
+});

package/lib/__tests__/mirror-sync.test.js

@@ -49,8 +49,15 @@ afterEach(() => {
  */
 function write(root, rel, content) {
   const full = path.join(root, rel);
-  fs.mkdirSync(path.dirname(full), { recursive: true });
-  fs.writeFileSync(full, content);
+  try {
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, content);
+  } catch (err) {
+    // Swallowing this would turn a broken fixture into a confusing assertion
+    // failure further down ("expected undefined"), so rethrow with the path that
+    // actually failed. The rule wants the IO handled, not hidden.
+    throw new Error(`failed to write fixture ${rel}: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 
 /**
@@ -264,13 +271,24 @@ describe('syncMirrors — AC-713-04 safety', () => {
   it('preserves the executable bit so hooks stay runnable', () => {
     write(TMP_REPO, 'canonical/hook.sh', '#!/bin/sh\necho a\n');
     fs.chmodSync(path.join(TMP_REPO, 'canonical/hook.sh'), 0o755);
-    write(TMP_REPO, 'mirror/hook.sh', '#!/bin/sh\necho a\n');
+    // The mirror must start as *drift*. The sync loop only touches files that
+    // are `missing` or `differing`, so identical content is skipped and the mode
+    // never gets rewritten. An earlier version gave both sides the same bytes,
+    // so the file never entered `toWrite`; on Linux the assertion then failed
+    // ("expected +0 to be truthy") while Windows skipped the whole block, which
+    // is how it stayed invisible locally. The test was measuring nothing.
+    write(TMP_REPO, 'mirror/hook.sh', '#!/bin/sh\necho stale\n');
     trackAll(TMP_REPO);
 
-    syncMirrors(TMP_REPO, [{ canonical: 'canonical', mirror: 'mirror' }]);
-    const mode = fs.statSync(path.join(TMP_REPO, 'mirror/hook.sh')).mode;
+    const result = syncMirrors(TMP_REPO, [{ canonical: 'canonical', mirror: 'mirror' }]);
+    // Prove the copy actually happened, so a green result cannot come from
+    // "nothing was touched".
+    expect(result.copied).toContain('hook.sh');
+    expect(fs.readFileSync(path.join(TMP_REPO, 'mirror/hook.sh'), 'utf8')).toBe('#!/bin/sh\necho a\n');
+
     // On Windows the exec bit is not meaningful; only assert where it applies.
     if (process.platform !== 'win32') {
+      const mode = fs.statSync(path.join(TMP_REPO, 'mirror/hook.sh')).mode;
       expect(mode & 0o111).toBeTruthy();
     }
   });