@cohortapp/agent-sdk 2.12.0 → 2.13.0

package/scripts/vendor/sync-skill-packs.test.mjs

@@ -0,0 +1,103 @@
+/**
+ * Tests for the vendoring maintainer tool — the half that can run with no
+ * network. `syncPack` itself downloads a pinned tarball and is not exercised
+ * here; what IS exercised is the planner and the content pin, because those are
+ * the two places a re-sync can quietly change what the fleet reads.
+ *
+ * @module scripts/vendor/sync-skill-packs.test
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { planPack, buildManifest, sha256File } from "./sync-skill-packs.mjs";
+import { PACKS, findPack, manifestDigest } from "./skill-packs.mjs";
+
+const REPO_ROOT = path.resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..");
+const VENDOR = path.join(REPO_ROOT, "plugins", "maestro-skills", "vendor");
+
+describe("sync-skill-packs: the content pin", () => {
+  it("manifestDigest is order-independent and moves for any file added, removed or changed", () => {
+    const a = [{ path: "SKILL.md", sha256: "aa" }, { path: "reference/x.md", sha256: "bb" }];
+    assert.equal(manifestDigest(a), manifestDigest([...a].reverse()), "sorted, so a re-sort is not a change");
+    assert.notEqual(manifestDigest(a), manifestDigest([...a, { path: "reference/y.md", sha256: "cc" }]));
+    assert.notEqual(manifestDigest(a), manifestDigest([a[0]]));
+    assert.notEqual(manifestDigest(a), manifestDigest([a[0], { path: "reference/x.md", sha256: "b0" }]));
+  });
+
+  it("what the syncer would write for each committed pack still matches its pinned digest", () => {
+    // buildManifest is what a re-sync produces; if it and the committed
+    // UPSTREAM.json disagree, someone hand-edited a vendored tree.
+    for (const pack of PACKS) {
+      const doc = JSON.parse(readFileSync(path.join(VENDOR, pack.id, "UPSTREAM.json"), "utf8"));
+      const rebuilt = buildManifest(pack, doc.files);
+      assert.deepEqual(rebuilt.files, doc.files, pack.id);
+      assert.deepEqual(rebuilt.omitted, doc.omitted, `${pack.id} omitted[] matches the registry`);
+      assert.equal(rebuilt.notes, doc.notes, `${pack.id} notes match the registry`);
+      assert.equal(manifestDigest(rebuilt.files), pack.contentSha256, pack.id);
+    }
+  });
+
+  it("every recorded sha256 is the sha256 of the file on disk", () => {
+    for (const pack of PACKS) {
+      const doc = JSON.parse(readFileSync(path.join(VENDOR, pack.id, "UPSTREAM.json"), "utf8"));
+      for (const f of doc.files) {
+        assert.equal(sha256File(path.join(VENDOR, pack.id, f.path)), f.sha256, `${pack.id}/${f.path}`);
+      }
+    }
+  });
+});
+
+describe("sync-skill-packs: the planner", () => {
+  /** A fake upstream tree, so the planner runs with no network. */
+  function upstream(files) {
+    const root = mkdtempSync(path.join(tmpdir(), "maestro-upstream-"));
+    for (const [rel, body] of Object.entries(files)) {
+      const abs = path.join(root, rel);
+      mkdirSync(path.dirname(abs), { recursive: true });
+      writeFileSync(abs, body);
+    }
+    return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+  }
+
+  it("unlazy's rules take the gate checker and refuse the hook machinery", () => {
+    // The pack is vendored for its gate checker. `install-hooks.mjs` writes a
+    // Stop hook into a settings file — `--global` into the one every session on
+    // the machine reads — so it is excluded at the rule, not discouraged in
+    // prose: a file that reaches the seat can be run whatever its mode says.
+    const t = upstream({
+      "SKILL.md": "---\nname: unlazy\n---\n",
+      "SECURITY.md": "#\n",
+      "LICENSE": "MIT\n",
+      "references/gates.md": "#\n",
+      "templates/PLAN.md": "#\n",
+      "scripts/gate-check.mjs": "//\n",
+      "scripts/lib/gates.mjs": "//\n",
+      "scripts/install-hooks.mjs": "// writes a Stop hook\n",
+      "scripts/stop-hook.mjs": "// the hook body\n",
+    });
+    try {
+      const { pairs, missing } = planPack(findPack("unlazy"), t.root);
+      const took = pairs.map((p) => p.to);
+      assert.deepEqual(missing, []);
+      assert.ok(took.includes("scripts/gate-check.mjs"));
+      assert.ok(took.includes("scripts/lib/gates.mjs"));
+      assert.equal(took.includes("scripts/install-hooks.mjs"), false);
+      assert.equal(took.includes("scripts/stop-hook.mjs"), false);
+    } finally { t.cleanup(); }
+  });
+
+  it("a rule that produced a path its own allow-list rejects is a defect, not a quiet write", () => {
+    const pack = {
+      ...findPack("unlazy"),
+      rules: [{ type: "dir", from: "scripts", to: "../escape", match: /\.mjs$/, recursive: true }],
+    };
+    const t = upstream({ "scripts/x.mjs": "//\n" });
+    try {
+      assert.throws(() => planPack(pack, t.root), /allow-list rejects/);
+    } finally { t.cleanup(); }
+  });
+});