@indigoai-us/hq-cli 5.32.0 → 5.33.1

package/src/commands/pack-install.test.ts

@@ -21,7 +21,17 @@ import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { installToPackages, runScanPackages, stampInstallSource } from './pack-install.js';
+import {
+  installToPackages,
+  runScanPackages,
+  stampInstallSource,
+  validateManifest,
+  toMarketplaceListing,
+  fetchMarketplace,
+  computeArtifactHash,
+  ArtifactVerificationError,
+} from './pack-install.js';
+import type { MarketplaceDeps } from './pack-install.js';
 import type { PackManifest } from '../types.js';
 
 // ---------------------------------------------------------------------------
@@ -222,6 +232,81 @@ describe('pack-install: install path layout', () => {
     expect(() => stampInstallSource(dest, '@scope/x@1.0.0')).toThrow(/package\.yaml.*not found/);
   });
 
+  // ---- 6. author + capabilities attribution (US-001) ----------------------
+  // Records pack authorship so installs can be attributed. Both fields are
+  // OPTIONAL and backwards-compatible: legacy packs without an author still
+  // validate; a pack that declares an author surfaces uid/handle/displayName.
+  describe('author + capabilities (US-001)', () => {
+    // A minimal, otherwise-valid pack payload that validateManifest accepts.
+    // `contributes` declares one knowledge entry whose payload file exists, so
+    // the only variable across these tests is the author/capabilities block.
+    function writeValidPack(extraYaml: string): string {
+      const dir = mkFakePackPayload({
+        'knowledge/demo/README.md': '# demo knowledge',
+      });
+      fs.writeFileSync(
+        path.join(dir, 'package.yaml'),
+        [
+          'name: hq-pack-test',
+          'version: 1.0.0',
+          "publisher: '@indigoai-us'",
+          'access: public',
+          'requires:',
+          "  hqCore: '>=12.0.0'",
+          'contributes:',
+          '  knowledge:',
+          '    - demo',
+          extraYaml,
+          '',
+        ].join('\n'),
+      );
+      return dir;
+    }
+
+    it('a manifest WITHOUT author validates (backwards-compatible)', () => {
+      const dir = writeValidPack('');
+      const m = validateManifest(dir, '12.0.0');
+      expect(m.name).toBe('hq-pack-test');
+      expect(m.author).toBeUndefined();
+      expect(m.capabilities).toBeUndefined();
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    it('a manifest WITH an author block surfaces uid/handle/displayName', () => {
+      const dir = writeValidPack(
+        [
+          'author:',
+          '  uid: prs_abc123',
+          '  handle: corey',
+          "  displayName: 'Corey Epstein'",
+          'capabilities:',
+          '  - hooks',
+          '  - network',
+        ].join('\n'),
+      );
+      const m = validateManifest(dir, '12.0.0');
+      expect(m.author).toEqual({
+        uid: 'prs_abc123',
+        handle: 'corey',
+        displayName: 'Corey Epstein',
+      });
+      expect(m.capabilities).toEqual(['hooks', 'network']);
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    it('a malformed author (missing displayName) is rejected — not silently accepted', () => {
+      const dir = writeValidPack(['author:', '  uid: prs_abc123', '  handle: corey'].join('\n'));
+      expect(() => validateManifest(dir, '12.0.0')).toThrow(/author\.displayName/);
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    it('capabilities must be a list of strings', () => {
+      const dir = writeValidPack(['capabilities:', '  hooks: true'].join('\n'));
+      expect(() => validateManifest(dir, '12.0.0')).toThrow(/capabilities must be a list/);
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+  });
+
   it('stampInstallSource preserves a leading `---` document marker — no multi-doc YAML stream', () => {
     // Regression: prepending `source:` before a `---` would split the file
     // into two YAML documents, and single-doc `yaml.load` callers downstream
@@ -260,3 +345,126 @@ describe('pack-install: install path layout', () => {
     expect(rewritten.split('\n')[0]).toBe('---');
   });
 });
+
+// ---------------------------------------------------------------------------
+// GET /v1/listings/{id} detail-envelope mapping (Bug 1: contract/envelope)
+// ---------------------------------------------------------------------------
+
+describe('pack-install: listing-detail envelope mapping (toMarketplaceListing)', () => {
+  it('maps from the `{ listing: {...} }` envelope (id + downloadUrl + contentHash)', () => {
+    // Prod shape: GET /v1/listings/{id} wraps the listing in an envelope and
+    // uses `id` (not `listingId`). Previously this threw "Listing detail
+    // missing an id." because the mapper read from the top level.
+    const listing = toMarketplaceListing({
+      listing: {
+        id: 'lst_abc123',
+        slug: 'hq-pack-test',
+        version: '1.2.3',
+        downloadUrl: 'https://s3.example/presigned',
+        contentHash: 'a'.repeat(64),
+        contentHashAlg: 'sha256',
+        signature: 'sig-base64',
+        signingKeyId: 'key-1',
+        publicKey: 'pub-pem',
+      },
+    });
+    expect(listing.listingId).toBe('lst_abc123');
+    expect(listing.downloadUrl).toBe('https://s3.example/presigned');
+    expect(listing.contentHash).toBe('a'.repeat(64));
+    expect(listing.contentHashAlg).toBe('sha256');
+    expect(listing.slug).toBe('hq-pack-test');
+    expect(listing.version).toBe('1.2.3');
+    expect(listing.signature).toBe('sig-base64');
+    expect(listing.signingKeyId).toBe('key-1');
+    expect(listing.publicKey).toBe('pub-pem');
+  });
+
+  it('still maps the legacy FLAT shape at the top level (backwards-compat)', () => {
+    const listing = toMarketplaceListing({
+      listingId: 'lst_legacy',
+      slug: 'hq-pack-old',
+      version: '0.9.0',
+      downloadUrl: 'https://s3.example/legacy',
+      contentHash: 'b'.repeat(64),
+    });
+    expect(listing.listingId).toBe('lst_legacy');
+    expect(listing.downloadUrl).toBe('https://s3.example/legacy');
+    expect(listing.contentHash).toBe('b'.repeat(64));
+  });
+
+  it('throws the missing-id error only when neither envelope nor flat carry an id', () => {
+    expect(() =>
+      toMarketplaceListing({ listing: { downloadUrl: 'x', contentHash: 'c'.repeat(64) } }),
+    ).toThrow(/missing an id/);
+  });
+
+  it('refuses (no content hash) when the unwrapped detail lacks contentHash', () => {
+    expect(() =>
+      toMarketplaceListing({
+        listing: { id: 'lst_nohash', downloadUrl: 'https://s3.example/x' },
+      }),
+    ).toThrow(/no content hash/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// fetchMarketplace integrity: envelope-mapped hash verifies / refuses
+// ---------------------------------------------------------------------------
+
+describe('pack-install: fetchMarketplace honors the envelope-mapped contentHash', () => {
+  function depsFor(
+    envelopeContentHash: string,
+    tarballBytes: Uint8Array,
+  ): MarketplaceDeps {
+    // resolveListing returns the envelope-mapped detail; download returns the
+    // bytes. fetchMarketplace verifies the bytes against the pinned hash.
+    const listing = toMarketplaceListing({
+      listing: {
+        id: 'lst_int',
+        slug: 'hq-pack-int',
+        version: '1.0.0',
+        downloadUrl: 'https://s3.example/int',
+        contentHash: envelopeContentHash,
+        contentHashAlg: 'sha256',
+      },
+    });
+    return {
+      resolveListing: async () => listing,
+      refreshListing: async () => listing,
+      download: async () => tarballBytes,
+    };
+  }
+
+  it('a tampered/mismatched hash still refuses (ArtifactVerificationError)', async () => {
+    const bytes = new Uint8Array([1, 2, 3, 4]);
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hq-cli-int-'));
+    try {
+      await expect(
+        fetchMarketplace(
+          'marketplace:hq-pack-int@1.0.0',
+          tmpDir,
+          depsFor('f'.repeat(64), bytes), // wrong hash
+        ),
+      ).rejects.toBeInstanceOf(ArtifactVerificationError);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it('the correct envelope-mapped hash passes verification (reaches extraction)', async () => {
+    const bytes = new Uint8Array([1, 2, 3, 4]);
+    const realHash = computeArtifactHash(bytes);
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hq-cli-int-'));
+    try {
+      // The 4 junk bytes are not a real gzip tarball, so extraction fails AFTER
+      // verification — proving the hash check passed (it did NOT throw the
+      // verification error first). A verification failure would reject with
+      // ArtifactVerificationError instead.
+      await expect(
+        fetchMarketplace('marketplace:hq-pack-int@1.0.0', tmpDir, depsFor(realHash, bytes)),
+      ).rejects.not.toBeInstanceOf(ArtifactVerificationError);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});