@indigoai-us/hq-cli 5.33.0 → 5.34.0

package/src/commands/marketplace-install.test.ts

@@ -0,0 +1,414 @@
+/**
+ * US-006 — `hq install marketplace:<slug>` transport.
+ *
+ * All network is mocked via injected `MarketplaceDeps` (resolveListing /
+ * refreshListing / download); the only real I/O is the local filesystem
+ * (tarball creation, safe-extract, install + symlink wiring) under per-test
+ * tmp dirs. These tests never hit the real listings API or S3.
+ *
+ * E2E behaviors covered:
+ *   - Approved listing → `hq install marketplace:<slug>` installs; contributes
+ *     (skills/workers/knowledge) appear under core/packages/<name>/.
+ *   - Pack declaring hooks → the hook-consent gate fires before wiring.
+ *   - Installed marketplace pack → `hq packs update` (resolveLatestMarketplace)
+ *     checks for a newer listing version.
+ *   - Tarball whose bytes don't match the approved hash → refuses, wires
+ *     nothing (ArtifactVerificationError, no core/packages/<name>/).
+ *   - Expired presigned URL → re-resolve once and retry; raw S3 403 never leaks.
+ *   - REGRESSION: legacy/local transport still classifies + installs unchanged
+ *     after adding the marketplace transport.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+
+// Mock readline so the hook-consent prompt is non-interactive. `consentAnswer`
+// is read at prompt time, so each test can set it before installing. ESM
+// disallows spying on the live `createInterface` export, so we replace the
+// module instead.
+let consentAnswer = 'n';
+vi.mock('node:readline', () => ({
+  createInterface: () => ({
+    question: (_q: string, cb: (a: string) => void) => cb(consentAnswer),
+    close: () => undefined,
+  }),
+}));
+
+import {
+  classify,
+  parseMarketplaceSource,
+  toMarketplaceListing,
+  fetchMarketplace,
+  resolveLatestMarketplace,
+  installPack,
+  ArtifactVerificationError,
+  type MarketplaceDeps,
+  type MarketplaceListing,
+} from './pack-install.js';
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+/** A minimal, valid pack payload that validateManifest accepts. */
+function writePackPayload(
+  root: string,
+  opts: { name?: string; version?: string; withHooks?: boolean } = {},
+): string {
+  const name = opts.name ?? 'hq-pack-demo';
+  const version = opts.version ?? '1.0.0';
+  const dir = path.join(root, 'payload');
+  fs.mkdirSync(path.join(dir, 'skills', 'demo'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'skills', 'demo', 'SKILL.md'), '# demo skill\n');
+  const contributes: string[] = ['contributes:', '  skills:', '    - demo'];
+  if (opts.withHooks) {
+    fs.mkdirSync(path.join(dir, 'hooks'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'hooks', 'pre.sh'), '#!/bin/sh\necho hi\n');
+    contributes.push('  hooks:', '    - pre');
+  }
+  fs.writeFileSync(
+    path.join(dir, 'package.yaml'),
+    [
+      `name: ${name}`,
+      `version: ${version}`,
+      "publisher: '@indigoai-us'",
+      'access: public',
+      'requires:',
+      "  hqCore: '>=1.0.0'",
+      ...contributes,
+      '',
+    ].join('\n'),
+  );
+  return dir;
+}
+
+/** tar -czf payloadDir contents at archive root (matches publish.ts packing). */
+function tarballOf(payloadDir: string): Uint8Array {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'mkt-tar-'));
+  const tarPath = path.join(tmp, 'pack.tar.gz');
+  try {
+    execFileSync(
+      'tar',
+      ['-czf', tarPath, '-C', payloadDir, '--exclude=.DS_Store', '.'],
+      { stdio: ['ignore', 'ignore', 'inherit'] },
+    );
+    return fs.readFileSync(tarPath);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+function sha256Hex(bytes: Uint8Array): string {
+  return createHash('sha256').update(bytes).digest('hex');
+}
+
+/** Build injected deps that serve `bytes` for `slug` with the matching hash. */
+function makeDeps(
+  slug: string,
+  bytes: Uint8Array,
+  opts: {
+    version?: string;
+    contentHash?: string; // override to simulate tamper
+    latestVersion?: string; // for update probe
+    expireFirstDownload?: boolean;
+  } = {},
+): { deps: MarketplaceDeps; calls: { resolve: number; refresh: number; download: number } } {
+  const calls = { resolve: 0, refresh: 0, download: 0 };
+  const detail: MarketplaceListing = {
+    listingId: `lst_${slug}`,
+    slug,
+    version: opts.version ?? '1.0.0',
+    downloadUrl: 'https://s3.example/presigned?sig=abc',
+    contentHash: opts.contentHash ?? sha256Hex(bytes),
+  };
+  let firstDownload = true;
+  return {
+    calls,
+    deps: {
+      resolveListing: async (s, v) => {
+        calls.resolve++;
+        expect(s).toBe(slug);
+        // For the update probe we resolve with NO version → report latest.
+        if (v === undefined && opts.latestVersion) {
+          return { ...detail, version: opts.latestVersion };
+        }
+        return { ...detail };
+      },
+      refreshListing: async (id) => {
+        calls.refresh++;
+        expect(id).toBe(detail.listingId);
+        return { ...detail, downloadUrl: 'https://s3.example/presigned?sig=fresh' };
+      },
+      download: async (_url) => {
+        calls.download++;
+        if (opts.expireFirstDownload && firstDownload) {
+          firstDownload = false;
+          return { expired: true };
+        }
+        return bytes;
+      },
+    },
+  };
+}
+
+/** A fake HQ root with `.claude/` so findHqRoot() resolves to it. */
+function mkFakeHq(): string {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'mkt-hq-'));
+  fs.mkdirSync(path.join(root, '.claude'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'core.yaml'), 'hqVersion: 99.0.0\n');
+  return root;
+}
+
+// ---------------------------------------------------------------------------
+// parse + classify
+// ---------------------------------------------------------------------------
+
+describe('US-006 marketplace: source parsing + classification', () => {
+  it('classify recognizes marketplace: BEFORE every other transport', () => {
+    expect(classify('marketplace:my-pack')).toBe('marketplace');
+    expect(classify('marketplace:my-pack@1.2.3')).toBe('marketplace');
+    // A marketplace source must never be misread as npm/git/local.
+    expect(classify('@scope/name')).toBe('npm');
+    expect(classify('./local')).toBe('local');
+  });
+
+  it('parseMarketplaceSource splits slug and optional version', () => {
+    expect(parseMarketplaceSource('marketplace:foo')).toEqual({ slug: 'foo' });
+    expect(parseMarketplaceSource('marketplace:foo@2.0.0')).toEqual({
+      slug: 'foo',
+      version: '2.0.0',
+    });
+  });
+
+  it('parseMarketplaceSource rejects an empty slug', () => {
+    expect(() => parseMarketplaceSource('marketplace:')).toThrow(/requires a slug/);
+  });
+
+  it('toMarketplaceListing refuses a listing with no content hash', () => {
+    expect(() =>
+      toMarketplaceListing({ id: 'lst_x', downloadUrl: 'https://s3/x' }),
+    ).toThrow(/no content hash/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// fetchMarketplace — verify-before-extract
+// ---------------------------------------------------------------------------
+
+describe('US-006 marketplace: fetchMarketplace', () => {
+  let hq: string;
+  let tmpDir: string;
+
+  beforeEach(() => {
+    hq = mkFakeHq();
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mkt-fetch-'));
+  });
+  afterEach(() => {
+    fs.rmSync(hq, { recursive: true, force: true });
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it('downloads, verifies hash, and safe-extracts to a payloadDir with package.yaml', async () => {
+    const payload = writePackPayload(hq);
+    const bytes = tarballOf(payload);
+    const { deps } = makeDeps('demo', bytes, { version: '1.0.0' });
+
+    const result = await fetchMarketplace('marketplace:demo', tmpDir, deps);
+
+    expect(fs.existsSync(path.join(result.payloadDir, 'package.yaml'))).toBe(true);
+    expect(fs.existsSync(path.join(result.payloadDir, 'skills', 'demo', 'SKILL.md'))).toBe(
+      true,
+    );
+    // Resolved source records the marketplace version for re-install/update.
+    expect(result.resolvedSource).toBe('marketplace:demo@1.0.0');
+  });
+
+  it('REFUSES + extracts nothing when the bytes do not match the approved hash', async () => {
+    const payload = writePackPayload(hq);
+    const bytes = tarballOf(payload);
+    // Listing pins a DIFFERENT hash than the bytes we serve (tamper).
+    const wrongHash = 'a'.repeat(64);
+    const { deps } = makeDeps('demo', bytes, { contentHash: wrongHash });
+
+    await expect(fetchMarketplace('marketplace:demo', tmpDir, deps)).rejects.toThrow(
+      ArtifactVerificationError,
+    );
+    // No extract dir was produced — nothing unpacked.
+    expect(fs.existsSync(path.join(tmpDir, 'extracted'))).toBe(false);
+  });
+
+  it('re-resolves a FRESH presigned URL on an expired (403) download, then succeeds', async () => {
+    const payload = writePackPayload(hq);
+    const bytes = tarballOf(payload);
+    const { deps, calls } = makeDeps('demo', bytes, { expireFirstDownload: true });
+
+    const result = await fetchMarketplace('marketplace:demo', tmpDir, deps);
+
+    expect(fs.existsSync(path.join(result.payloadDir, 'package.yaml'))).toBe(true);
+    expect(calls.refresh).toBe(1); // re-resolved once
+    expect(calls.download).toBe(2); // first 403, second OK
+  });
+});
+
+// ---------------------------------------------------------------------------
+// installPack — full E2E through the existing local-install path
+// ---------------------------------------------------------------------------
+
+describe('US-006 marketplace: installPack E2E', () => {
+  let hq: string;
+  let prevCwd: string;
+
+  beforeEach(() => {
+    hq = mkFakeHq();
+    prevCwd = process.cwd();
+    process.chdir(hq); // findHqRoot() resolves to hq via .claude/
+  });
+  afterEach(() => {
+    process.chdir(prevCwd);
+    fs.rmSync(hq, { recursive: true, force: true });
+    vi.restoreAllMocks();
+  });
+
+  it('approved listing → installs; contributes land under core/packages/<name>/ and source is stamped', async () => {
+    const payload = writePackPayload(hq, { name: 'hq-pack-demo', version: '1.0.0' });
+    const bytes = tarballOf(payload);
+    const { deps } = makeDeps('demo', bytes, { version: '1.0.0' });
+    vi.spyOn(console, 'log').mockImplementation(() => undefined);
+
+    await installPack('marketplace:demo', { marketplaceDeps: deps });
+
+    const dest = path.join(hq, 'core', 'packages', 'hq-pack-demo');
+    expect(fs.existsSync(path.join(dest, 'skills', 'demo', 'SKILL.md'))).toBe(true);
+    // modules.yaml provenance equivalent: the resolved marketplace source is
+    // stamped into the installed package.yaml so re-install + packs update work.
+    const stamped = fs.readFileSync(path.join(dest, 'package.yaml'), 'utf-8');
+    expect(stamped.split('\n')[0]).toBe('source: "marketplace:demo@1.0.0"');
+  });
+
+  it('pack declaring hooks → hook-consent gate fires BEFORE wiring (declines → nothing installed)', async () => {
+    const payload = writePackPayload(hq, { name: 'hq-pack-hooked', withHooks: true });
+    const bytes = tarballOf(payload);
+    const { deps } = makeDeps('hooked', bytes);
+    vi.spyOn(console, 'log').mockImplementation(() => undefined);
+
+    // Consent prompt DECLINES (simulates the gate firing).
+    consentAnswer = 'n';
+    await installPack('marketplace:hooked', { marketplaceDeps: deps });
+
+    // Declined at the consent gate → pack must NOT be wired.
+    expect(fs.existsSync(path.join(hq, 'core', 'packages', 'hq-pack-hooked'))).toBe(false);
+  });
+
+  it('pack declaring hooks → consent accepted installs the pack (gate not bypassed)', async () => {
+    const payload = writePackPayload(hq, { name: 'hq-pack-hooked', withHooks: true });
+    const bytes = tarballOf(payload);
+    const { deps } = makeDeps('hooked', bytes);
+    vi.spyOn(console, 'log').mockImplementation(() => undefined);
+
+    // Consent prompt ACCEPTS — gate fired and was approved (not bypassed).
+    consentAnswer = 'y';
+    await installPack('marketplace:hooked', { marketplaceDeps: deps });
+
+    expect(fs.existsSync(path.join(hq, 'core', 'packages', 'hq-pack-hooked'))).toBe(true);
+  });
+
+  it('tampered bytes (hash mismatch) → installPack refuses; nothing wired', async () => {
+    const payload = writePackPayload(hq, { name: 'hq-pack-demo' });
+    const bytes = tarballOf(payload);
+    const { deps } = makeDeps('demo', bytes, { contentHash: 'b'.repeat(64) });
+    vi.spyOn(console, 'log').mockImplementation(() => undefined);
+
+    await expect(
+      installPack('marketplace:demo', { marketplaceDeps: deps }),
+    ).rejects.toThrow(ArtifactVerificationError);
+
+    expect(fs.existsSync(path.join(hq, 'core', 'packages', 'hq-pack-demo'))).toBe(false);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// hq packs update — async marketplace probe
+// ---------------------------------------------------------------------------
+
+describe('US-006 marketplace: update probe', () => {
+  it('reports a newer listing version as updateAvailable', async () => {
+    const dummy = new Uint8Array([1, 2, 3]);
+    const { deps } = makeDeps('demo', dummy, { latestVersion: '2.0.0' });
+
+    const r = await resolveLatestMarketplace('marketplace:demo@1.0.0', '1.0.0', deps);
+
+    expect(r.transport).toBe('marketplace');
+    expect(r.current).toBe('1.0.0');
+    expect(r.latest).toBe('2.0.0');
+    expect(r.updateAvailable).toBe(true);
+  });
+
+  it('reports no update when the listing version matches', async () => {
+    const dummy = new Uint8Array([1, 2, 3]);
+    const { deps } = makeDeps('demo', dummy, { latestVersion: '1.0.0' });
+
+    const r = await resolveLatestMarketplace('marketplace:demo@1.0.0', '1.0.0', deps);
+
+    expect(r.updateAvailable).toBe(false);
+  });
+
+  it('never throws on a network failure — returns updateAvailable:null + error', async () => {
+    const deps: MarketplaceDeps = {
+      resolveListing: async () => {
+        throw new Error('network down');
+      },
+      refreshListing: async () => {
+        throw new Error('network down');
+      },
+      download: async () => new Uint8Array(),
+    };
+
+    const r = await resolveLatestMarketplace('marketplace:demo@1.0.0', '1.0.0', deps);
+
+    expect(r.updateAvailable).toBeNull();
+    expect(r.error).toMatch(/network down/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// REGRESSION — legacy transports unchanged by adding marketplace
+// ---------------------------------------------------------------------------
+
+describe('US-006 REGRESSION: legacy transports still dispatch + install unchanged', () => {
+  it('classify still routes npm / git / local exactly as before', () => {
+    expect(classify('@scope/name@1.0.0')).toBe('npm');
+    expect(classify('https://github.com/o/r.git')).toBe('git');
+    expect(classify('github:owner/repo')).toBe('git');
+    expect(classify('git@github.com:o/r.git')).toBe('git');
+    expect(classify('./path')).toBe('local');
+    expect(classify('/abs/path')).toBe('local');
+    expect(classify('file:./x')).toBe('local');
+    // Bare slug still rejected by classify → routed to the legacy registry flow.
+    expect(() => classify('bare-slug')).toThrow(/Bare slugs go through the registry/);
+  });
+
+  it('local transport still installs end-to-end (no marketplace deps involved)', async () => {
+    const hq = mkFakeHq();
+    const payload = writePackPayload(hq, { name: 'hq-pack-local' });
+    const prevCwd = process.cwd();
+    process.chdir(hq);
+    vi.spyOn(console, 'log').mockImplementation(() => undefined);
+    try {
+      // Point installPack at the local payload dir — the legacy local path.
+      await installPack(payload);
+      const dest = path.join(hq, 'core', 'packages', 'hq-pack-local');
+      expect(fs.existsSync(path.join(dest, 'skills', 'demo', 'SKILL.md'))).toBe(true);
+      // Local source stamped verbatim (NOT rewritten as a marketplace source).
+      const stamped = fs.readFileSync(path.join(dest, 'package.yaml'), 'utf-8');
+      expect(stamped.split('\n')[0]).toBe(`source: "${payload}"`);
+    } finally {
+      process.chdir(prevCwd);
+      fs.rmSync(hq, { recursive: true, force: true });
+      vi.restoreAllMocks();
+    }
+  });
+});