@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/scripts/setup/init-skill-marketplace.test.mjs

@@ -1,193 +0,0 @@
-/**
- * init-skill-marketplace.test.mjs — rung 1 of the execution ladder.
- * Run: node --test scripts/setup/init-skill-marketplace.test.mjs
- *
- * The regression under guard: skill markdown files shipped under
- * `plugins/<id>/skills/*.md` are DEAD at runtime unless their plugin is declared
- * by a `.claude-plugin/marketplace.json` and enabled in `~/.claude/settings.json`.
- * They were neither, and nothing said so. These tests use an injected
- * `probeSkillPlugin` and an injected fs so no real plugin dir or operator
- * settings file is ever touched.
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { findSkillPlugins, registerMarketplaces } from "./init-skill-marketplace.mjs";
-
-/** An injected fs describing a plugin tree, without creating one. */
-function fakeFs(tree) {
-  return {
-    existsSync: (p) => Object.prototype.hasOwnProperty.call(tree, String(p)),
-    readdirSync: (p, opts) => {
-      const v = tree[String(p)];
-      if (!Array.isArray(v)) throw new Error(`ENOTDIR ${p}`);
-      if (opts && opts.withFileTypes) return v.map((n) => ({ name: n, isDirectory: () => !String(n).endsWith(".md") }));
-      return v;
-    },
-  };
-}
-
-test("findSkillPlugins discovers plugins across BOTH the agent repo and the framework", () => {
-  const deps = fakeFs({
-    "/agent/plugins": ["agent-skills"],
-    "/agent/plugins/agent-skills": ["skills"],
-    "/agent/plugins/agent-skills/skills": ["morning-brief.md", "outreach.md"],
-    "/fw/plugins": ["maestro-skills"],
-    "/fw/plugins/maestro-skills": ["skills"],
-    "/fw/plugins/maestro-skills/skills": ["triage.md"],
-  });
-  const found = findSkillPlugins({ roots: ["/agent", "/fw"] }, deps);
-  assert.deepEqual(found.map((p) => p.pluginId), ["agent-skills", "maestro-skills"]);
-  assert.deepEqual(found[0].skills, ["morning-brief.md", "outreach.md"]);
-  assert.equal(found[1].skills.length, 1);
-});
-
-test("findSkillPlugins ignores plugin dirs that carry no skill files", () => {
-  const deps = fakeFs({
-    "/agent/plugins": ["hooks-only", "agent-skills"],
-    "/agent/plugins/hooks-only": ["hooks"],
-    "/agent/plugins/agent-skills": ["skills"],
-    "/agent/plugins/agent-skills/skills": ["a.md"],
-  });
-  const found = findSkillPlugins({ roots: ["/agent"] }, deps);
-  assert.deepEqual(found.map((p) => p.pluginId), ["agent-skills"]);
-});
-
-test("findSkillPlugins: the agent repo wins a plugin-id collision, and no root is required", () => {
-  const deps = fakeFs({
-    "/agent/plugins": ["agent-skills"],
-    "/agent/plugins/agent-skills": ["skills"],
-    "/agent/plugins/agent-skills/skills": ["local.md"],
-    "/fw/plugins": ["agent-skills"],
-    "/fw/plugins/agent-skills": ["skills"],
-    "/fw/plugins/agent-skills/skills": ["framework.md", "another.md"],
-  });
-  const found = findSkillPlugins({ roots: ["/agent", "/fw"] }, deps);
-  assert.equal(found.length, 1, "the id is de-duplicated");
-  assert.deepEqual(found[0].skills, ["local.md"], "the agent's own copy wins");
-  // A missing plugins dir is a no-op, not a throw.
-  assert.deepEqual(findSkillPlugins({ roots: ["/nothing/here"] }, deps), []);
-  assert.deepEqual(findSkillPlugins({}, deps), []);
-});
-
-test("registerMarketplaces repairs every plugin and reports what it wrote", async () => {
-  const calls = [];
-  const deps = {
-    ...fakeFs({
-      "/agent/plugins": ["agent-skills"],
-      "/agent/plugins/agent-skills": ["skills"],
-      "/agent/plugins/agent-skills/skills": ["a.md", "b.md"],
-    }),
-    probeSkillPlugin: (o) => {
-      calls.push(o);
-      return { ok: true, detail: "marketplace+enabledPlugins", repaired: ["wrote .claude-plugin/marketplace.json", "enabled in settings.json"] };
-    },
-  };
-  const res = await registerMarketplaces({ agentRoot: "/agent", maestroRoot: "/fw" }, deps);
-
-  assert.equal(calls.length, 1);
-  assert.equal(calls[0].repair, true, "a non-dry run repairs");
-  assert.equal(calls[0].pluginId, "agent-skills");
-  assert.equal(res.skillCount, 2);
-  assert.equal(res.failed.length, 0);
-  assert.deepEqual(res.repaired, [
-    "agent-skills: wrote .claude-plugin/marketplace.json",
-    "agent-skills: enabled in settings.json",
-  ]);
-});
-
-test("--dry-run probes but never repairs", async () => {
-  const calls = [];
-  const deps = {
-    ...fakeFs({
-      "/agent/plugins": ["agent-skills"],
-      "/agent/plugins/agent-skills": ["skills"],
-      "/agent/plugins/agent-skills/skills": ["a.md"],
-    }),
-    probeSkillPlugin: (o) => { calls.push(o); return { ok: false, degraded: "marketplace-missing", detail: "no manifest", repaired: [] }; },
-  };
-  const res = await registerMarketplaces({ agentRoot: "/agent", maestroRoot: "/fw", dryRun: true }, deps);
-  assert.equal(calls[0].repair, false, "dry run must not write");
-  assert.equal(res.repaired.length, 0);
-});
-
-test("a plugin that cannot be repaired is reported LOUDLY, never swallowed", async () => {
-  const deps = {
-    ...fakeFs({
-      "/agent/plugins": ["good", "broken"],
-      "/agent/plugins/good": ["skills"],
-      "/agent/plugins/good/skills": ["a.md"],
-      "/agent/plugins/broken": ["skills"],
-      "/agent/plugins/broken/skills": ["b.md", "c.md"],
-    }),
-    probeSkillPlugin: (o) => (o.pluginId === "broken"
-      ? { ok: false, degraded: "marketplace-unwritable", detail: "EACCES", repaired: [] }
-      : { ok: true, detail: "ok", repaired: [] }),
-  };
-  const res = await registerMarketplaces({ agentRoot: "/agent", maestroRoot: "/fw" }, deps);
-
-  assert.equal(res.failed.length, 1);
-  assert.equal(res.failed[0].pluginId, "broken");
-  assert.equal(res.failed[0].degraded, "marketplace-unwritable");
-  assert.equal(res.failed[0].detail, "EACCES");
-  // Its skills stay unreachable, which is what the plan compiler then refuses to cite.
-  assert.equal(res.plugins.find((p) => p.pluginId === "broken").ok, false);
-  assert.equal(res.plugins.find((p) => p.pluginId === "good").ok, true);
-});
-
-test("idempotent: a second run over an already-registered plugin writes nothing new", async () => {
-  let registered = false;
-  const deps = {
-    ...fakeFs({
-      "/agent/plugins": ["agent-skills"],
-      "/agent/plugins/agent-skills": ["skills"],
-      "/agent/plugins/agent-skills/skills": ["a.md"],
-    }),
-    probeSkillPlugin: () => {
-      const repaired = registered ? [] : ["wrote marketplace.json"];
-      registered = true;
-      return { ok: true, detail: "ok", repaired };
-    },
-  };
-  const first = await registerMarketplaces({ agentRoot: "/agent" }, deps);
-  const second = await registerMarketplaces({ agentRoot: "/agent" }, deps);
-  assert.equal(first.repaired.length, 1);
-  assert.equal(second.repaired.length, 0, "no churn on a no-op re-run");
-  assert.deepEqual(first.plugins.map((p) => p.pluginId), second.plugins.map((p) => p.pluginId));
-});
-
-test("the REAL probe writes a valid marketplace manifest into a scratch plugin dir", async () => {
-  // One end-to-end pass against the actual probe, in a tmp tree, to prove the
-  // injected contract above matches the real implementation's shape.
-  const root = mkdtempSync(join(tmpdir(), "maestro-skillmkt-"));
-  const home = mkdtempSync(join(tmpdir(), "maestro-skillhome-"));
-  mkdirSync(join(root, "plugins", "agent-skills", "skills"), { recursive: true });
-  writeFileSync(join(root, "plugins", "agent-skills", "skills", "morning-brief.md"), "# morning-brief\n");
-
-  const { probeSkillPlugin } = await import("../../lib/capability/probe.mjs");
-  const res = await registerMarketplaces(
-    { agentRoot: root, maestroRoot: root },
-    { probeSkillPlugin: (o, d) => probeSkillPlugin(o, { ...d, homeDir: home }) },
-  );
-
-  assert.equal(res.plugins.length, 1);
-  assert.equal(res.skillCount, 1);
-  const manifestPath = join(root, "plugins", "agent-skills", ".claude-plugin", "marketplace.json");
-  assert.ok(existsSync(manifestPath), "the marketplace manifest was written");
-  const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
-  assert.equal(manifest.name, "agent-skills");
-  assert.ok(Array.isArray(manifest.plugins) && manifest.plugins.length === 1);
-});
-
-test("the feature is registered in framework-features.json so `maestro upgrade` picks it up", async () => {
-  const features = JSON.parse(readFileSync(new URL("../../framework-features.json", import.meta.url), "utf-8"));
-  const f = (features.features || features)["skill-marketplace"];
-  assert.ok(f, "skill-marketplace feature entry exists");
-  assert.equal(f.init.auto, true, "it is an auto migration (idempotent, ~instant)");
-  assert.match(f.init.command, /init-skill-marketplace\.mjs/);
-});

package/scripts/vendor/sync-skill-packs.test.mjs

@@ -1,103 +0,0 @@
-/**
- * Tests for the vendoring maintainer tool — the half that can run with no
- * network. `syncPack` itself downloads a pinned tarball and is not exercised
- * here; what IS exercised is the planner and the content pin, because those are
- * the two places a re-sync can quietly change what the fleet reads.
- *
- * @module scripts/vendor/sync-skill-packs.test
- */
-
-import { describe, it } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { planPack, buildManifest, sha256File } from "./sync-skill-packs.mjs";
-import { PACKS, findPack, manifestDigest } from "./skill-packs.mjs";
-
-const REPO_ROOT = path.resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..");
-const VENDOR = path.join(REPO_ROOT, "plugins", "maestro-skills", "vendor");
-
-describe("sync-skill-packs: the content pin", () => {
-  it("manifestDigest is order-independent and moves for any file added, removed or changed", () => {
-    const a = [{ path: "SKILL.md", sha256: "aa" }, { path: "reference/x.md", sha256: "bb" }];
-    assert.equal(manifestDigest(a), manifestDigest([...a].reverse()), "sorted, so a re-sort is not a change");
-    assert.notEqual(manifestDigest(a), manifestDigest([...a, { path: "reference/y.md", sha256: "cc" }]));
-    assert.notEqual(manifestDigest(a), manifestDigest([a[0]]));
-    assert.notEqual(manifestDigest(a), manifestDigest([a[0], { path: "reference/x.md", sha256: "b0" }]));
-  });
-
-  it("what the syncer would write for each committed pack still matches its pinned digest", () => {
-    // buildManifest is what a re-sync produces; if it and the committed
-    // UPSTREAM.json disagree, someone hand-edited a vendored tree.
-    for (const pack of PACKS) {
-      const doc = JSON.parse(readFileSync(path.join(VENDOR, pack.id, "UPSTREAM.json"), "utf8"));
-      const rebuilt = buildManifest(pack, doc.files);
-      assert.deepEqual(rebuilt.files, doc.files, pack.id);
-      assert.deepEqual(rebuilt.omitted, doc.omitted, `${pack.id} omitted[] matches the registry`);
-      assert.equal(rebuilt.notes, doc.notes, `${pack.id} notes match the registry`);
-      assert.equal(manifestDigest(rebuilt.files), pack.contentSha256, pack.id);
-    }
-  });
-
-  it("every recorded sha256 is the sha256 of the file on disk", () => {
-    for (const pack of PACKS) {
-      const doc = JSON.parse(readFileSync(path.join(VENDOR, pack.id, "UPSTREAM.json"), "utf8"));
-      for (const f of doc.files) {
-        assert.equal(sha256File(path.join(VENDOR, pack.id, f.path)), f.sha256, `${pack.id}/${f.path}`);
-      }
-    }
-  });
-});
-
-describe("sync-skill-packs: the planner", () => {
-  /** A fake upstream tree, so the planner runs with no network. */
-  function upstream(files) {
-    const root = mkdtempSync(path.join(tmpdir(), "maestro-upstream-"));
-    for (const [rel, body] of Object.entries(files)) {
-      const abs = path.join(root, rel);
-      mkdirSync(path.dirname(abs), { recursive: true });
-      writeFileSync(abs, body);
-    }
-    return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) };
-  }
-
-  it("unlazy's rules take the gate checker and refuse the hook machinery", () => {
-    // The pack is vendored for its gate checker. `install-hooks.mjs` writes a
-    // Stop hook into a settings file — `--global` into the one every session on
-    // the machine reads — so it is excluded at the rule, not discouraged in
-    // prose: a file that reaches the seat can be run whatever its mode says.
-    const t = upstream({
-      "SKILL.md": "---\nname: unlazy\n---\n",
-      "SECURITY.md": "#\n",
-      "LICENSE": "MIT\n",
-      "references/gates.md": "#\n",
-      "templates/PLAN.md": "#\n",
-      "scripts/gate-check.mjs": "//\n",
-      "scripts/lib/gates.mjs": "//\n",
-      "scripts/install-hooks.mjs": "// writes a Stop hook\n",
-      "scripts/stop-hook.mjs": "// the hook body\n",
-    });
-    try {
-      const { pairs, missing } = planPack(findPack("unlazy"), t.root);
-      const took = pairs.map((p) => p.to);
-      assert.deepEqual(missing, []);
-      assert.ok(took.includes("scripts/gate-check.mjs"));
-      assert.ok(took.includes("scripts/lib/gates.mjs"));
-      assert.equal(took.includes("scripts/install-hooks.mjs"), false);
-      assert.equal(took.includes("scripts/stop-hook.mjs"), false);
-    } finally { t.cleanup(); }
-  });
-
-  it("a rule that produced a path its own allow-list rejects is a defect, not a quiet write", () => {
-    const pack = {
-      ...findPack("unlazy"),
-      rules: [{ type: "dir", from: "scripts", to: "../escape", match: /\.mjs$/, recursive: true }],
-    };
-    const t = upstream({ "scripts/x.mjs": "//\n" });
-    try {
-      assert.throws(() => planPack(pack, t.root), /allow-list rejects/);
-    } finally { t.cleanup(); }
-  });
-});

package/scripts/watchdog/memory-watchdog.test.mjs

@@ -1,64 +0,0 @@
-/**
- * memory-watchdog.test.mjs — audit F16: the HARD tier could SIGTERM the
- * seat's long-lived interactive main session (it only spared the OLDEST
- * claude process, and a freshly relaunched main session is not the oldest).
- *
- * The rule under test is a pure shell function, `is_protected_cmdline`,
- * extracted from the script and run under bash: a command line carrying
- * `--name <anything>-main` or `scripts/session/feed.mjs` is never a kill
- * candidate. The kill loop is also checked textually for the call site, so
- * the function cannot be defined and then not used.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { spawnSync } from "node:child_process";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const SCRIPT = join(dirname(fileURLToPath(import.meta.url)), "memory-watchdog.sh");
-
-/** Extract `is_protected_cmdline` from the script and evaluate it on one command line. Exit 0 = protected. */
-function isProtected(cmdline) {
-  const src = readFileSync(SCRIPT, "utf8");
-  const m = src.match(/\nis_protected_cmdline\(\) \{[\s\S]*?\n\}\n/);
-  assert.ok(m, "memory-watchdog.sh defines is_protected_cmdline()");
-  const r = spawnSync("/bin/bash", ["-c", `${m[0]}\nis_protected_cmdline "$1"`, "_", cmdline], { encoding: "utf8" });
-  return r.status === 0;
-}
-
-test("the main session (`--name <first>-main`) is protected, whatever the first name", () => {
-  assert.equal(isProtected("claude --name alex-main --resume 1234 --dangerously-skip-permissions"), true);
-  assert.equal(isProtected("/opt/homebrew/bin/claude --dangerously-skip-permissions --name marc-main"), true);
-  assert.equal(isProtected("node /Users/x/.npm-global/lib/node_modules/@anthropic-ai/claude-code/cli.js --name olivia-main"), true);
-});
-
-test("the session feed (scripts/session/feed.mjs) is protected", () => {
-  assert.equal(isProtected("node /Users/alex/alex-ai/scripts/session/feed.mjs"), true);
-  assert.equal(isProtected("/usr/local/bin/node scripts/session/feed.mjs --agent-root /x"), true);
-});
-
-test("sub-sessions, peers and print spawns are NOT protected", () => {
-  assert.equal(isProtected("claude --print --output-format json --dangerously-skip-permissions prompt"), false);
-  assert.equal(isProtected("claude --name alex-research --dangerously-skip-permissions"), false);
-  assert.equal(isProtected("claude --name alex-mainline"), false, "-main must be a whole token");
-  assert.equal(isProtected("claude --name alex-main-2"), false);
-  assert.equal(isProtected("node scripts/daemon/maestro-daemon.mjs"), false);
-  assert.equal(isProtected(""), false);
-});
-
-test("the HARD-tier kill loop consults is_protected_cmdline before SIGTERM and logs the skip", () => {
-  const src = readFileSync(SCRIPT, "utf8");
-  const loop = src.slice(src.indexOf("kill_youngest_biggest_subagents() {"), src.indexOf('done <<< "$(get_claude_processes)"'));
-  assert.match(loop, /is_protected_cmdline/, "the kill loop calls the guard");
-  assert.match(loop, /skip_protected/, "a protected skip is logged");
-  assert.ok(loop.indexOf("is_protected_cmdline") < loop.indexOf('kill -TERM "$pid"'), "the guard runs before the signal");
-});
-
-test("cmdline_of reads the FULL command line (ps -ww) so a long argv is never cut before --name <first>-main on a narrow tty", () => {
-  const src = readFileSync(SCRIPT, "utf8");
-  const m = src.match(/\ncmdline_of\(\) \{[\s\S]*?\n\}\n/);
-  assert.ok(m, "memory-watchdog.sh defines cmdline_of()");
-  assert.match(m[0], /\/bin\/ps -ww /, "ps must be given -ww (unlimited width) — macOS truncates `-o command=` to the terminal width otherwise");
-});