@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/commands/marketplace-install.test.ts

@@ -1,543 +0,0 @@
-/**
- * US-006 — `hq install marketplace:<slug>` transport.
- *
- * All network is mocked via injected `MarketplaceDeps` (resolveListing /
- * refreshListing / download); the only real I/O is the local filesystem
- * (tarball creation, safe-extract, install + symlink wiring) under per-test
- * tmp dirs. These tests never hit the real listings API or S3.
- *
- * E2E behaviors covered:
- *   - Approved listing → `hq install marketplace:<slug>` installs; contributes
- *     (skills/workers/knowledge) appear under core/packages/<name>/.
- *   - Pack declaring hooks → the hook-consent gate fires before wiring.
- *   - Installed marketplace pack → `hq packs update` (resolveLatestMarketplace)
- *     checks for a newer listing version.
- *   - Tarball whose bytes don't match the approved hash → refuses, wires
- *     nothing (ArtifactVerificationError, no core/packages/<name>/).
- *   - Expired presigned URL → re-resolve once and retry; raw S3 403 never leaks.
- *   - REGRESSION: legacy/local transport still classifies + installs unchanged
- *     after adding the marketplace transport.
- */
-
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-
-// Mock readline so the hook-consent prompt is non-interactive. `consentAnswer`
-// is read at prompt time, so each test can set it before installing. ESM
-// disallows spying on the live `createInterface` export, so we replace the
-// module instead.
-let consentAnswer = 'n';
-vi.mock('node:readline', () => ({
-  createInterface: () => ({
-    question: (_q: string, cb: (a: string) => void) => cb(consentAnswer),
-    close: () => undefined,
-  }),
-}));
-
-// Mock the public listings API so `defaultMarketplaceDeps().resolveListing` is
-// exercised against a controllable feed (BUG-1 exact-slug-match regression).
-// `publicResponder` is read at call time so each test can shape the response —
-// it receives the call options + a zero-based call index so a test can return a
-// different body for the browse call vs. the follow-up detail fetch.
-type PublicResponse = { ok: boolean; status: number; body: unknown };
-let publicResponder: (
-  opts: { path: string; query?: Record<string, string> },
-  call: number,
-) => PublicResponse = () => ({ ok: true, status: 200, body: { listings: [] } });
-const fetchPublicCalls: Array<{ path: string; query?: Record<string, string> }> = [];
-vi.mock('../utils/vault-api.js', () => ({
-  vaultApiFetchPublic: async (opts: { path: string; query?: Record<string, string> }) => {
-    const call = fetchPublicCalls.length;
-    fetchPublicCalls.push(opts);
-    const r = publicResponder(opts, call);
-    return {
-      ok: r.ok,
-      status: r.status,
-      json: async () => r.body,
-    } as unknown as Response;
-  },
-}));
-
-import {
-  classify,
-  parseMarketplaceSource,
-  toMarketplaceListing,
-  fetchMarketplace,
-  resolveLatestMarketplace,
-  installPack,
-  defaultMarketplaceDeps,
-  ArtifactVerificationError,
-  type MarketplaceDeps,
-  type MarketplaceListing,
-} from './pack-install.js';
-
-// ---------------------------------------------------------------------------
-// Fixtures
-// ---------------------------------------------------------------------------
-
-/** A minimal, valid pack payload that validateManifest accepts. */
-function writePackPayload(
-  root: string,
-  opts: { name?: string; version?: string; withHooks?: boolean } = {},
-): string {
-  const name = opts.name ?? 'hq-pack-demo';
-  const version = opts.version ?? '1.0.0';
-  const dir = path.join(root, 'payload');
-  fs.mkdirSync(path.join(dir, 'skills', 'demo'), { recursive: true });
-  fs.writeFileSync(path.join(dir, 'skills', 'demo', 'SKILL.md'), '# demo skill\n');
-  const contributes: string[] = ['contributes:', '  skills:', '    - demo'];
-  if (opts.withHooks) {
-    fs.mkdirSync(path.join(dir, 'hooks'), { recursive: true });
-    fs.writeFileSync(path.join(dir, 'hooks', 'pre.sh'), '#!/bin/sh\necho hi\n');
-    contributes.push('  hooks:', '    - pre');
-  }
-  fs.writeFileSync(
-    path.join(dir, 'package.yaml'),
-    [
-      `name: ${name}`,
-      `version: ${version}`,
-      "publisher: '@indigoai-us'",
-      'access: public',
-      'requires:',
-      "  hqCore: '>=1.0.0'",
-      ...contributes,
-      '',
-    ].join('\n'),
-  );
-  return dir;
-}
-
-/** tar -czf payloadDir contents at archive root (matches publish.ts packing). */
-function tarballOf(payloadDir: string): Uint8Array {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'mkt-tar-'));
-  const tarPath = path.join(tmp, 'pack.tar.gz');
-  try {
-    execFileSync(
-      'tar',
-      ['-czf', tarPath, '-C', payloadDir, '--exclude=.DS_Store', '.'],
-      { stdio: ['ignore', 'ignore', 'inherit'] },
-    );
-    return fs.readFileSync(tarPath);
-  } finally {
-    fs.rmSync(tmp, { recursive: true, force: true });
-  }
-}
-
-function sha256Hex(bytes: Uint8Array): string {
-  return createHash('sha256').update(bytes).digest('hex');
-}
-
-/** Build injected deps that serve `bytes` for `slug` with the matching hash. */
-function makeDeps(
-  slug: string,
-  bytes: Uint8Array,
-  opts: {
-    version?: string;
-    contentHash?: string; // override to simulate tamper
-    latestVersion?: string; // for update probe
-    expireFirstDownload?: boolean;
-  } = {},
-): { deps: MarketplaceDeps; calls: { resolve: number; refresh: number; download: number } } {
-  const calls = { resolve: 0, refresh: 0, download: 0 };
-  const detail: MarketplaceListing = {
-    listingId: `lst_${slug}`,
-    slug,
-    version: opts.version ?? '1.0.0',
-    downloadUrl: 'https://s3.example/presigned?sig=abc',
-    contentHash: opts.contentHash ?? sha256Hex(bytes),
-  };
-  let firstDownload = true;
-  return {
-    calls,
-    deps: {
-      resolveListing: async (s, v) => {
-        calls.resolve++;
-        expect(s).toBe(slug);
-        // For the update probe we resolve with NO version → report latest.
-        if (v === undefined && opts.latestVersion) {
-          return { ...detail, version: opts.latestVersion };
-        }
-        return { ...detail };
-      },
-      refreshListing: async (id) => {
-        calls.refresh++;
-        expect(id).toBe(detail.listingId);
-        return { ...detail, downloadUrl: 'https://s3.example/presigned?sig=fresh' };
-      },
-      download: async (_url) => {
-        calls.download++;
-        if (opts.expireFirstDownload && firstDownload) {
-          firstDownload = false;
-          return { expired: true };
-        }
-        return bytes;
-      },
-    },
-  };
-}
-
-/** A fake HQ root with `.claude/` so findHqRoot() resolves to it. */
-function mkFakeHq(): string {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'mkt-hq-'));
-  fs.mkdirSync(path.join(root, '.claude'), { recursive: true });
-  fs.writeFileSync(path.join(root, 'core.yaml'), 'hqVersion: 99.0.0\n');
-  return root;
-}
-
-// ---------------------------------------------------------------------------
-// parse + classify
-// ---------------------------------------------------------------------------
-
-describe('US-006 marketplace: source parsing + classification', () => {
-  it('classify recognizes marketplace: BEFORE every other transport', () => {
-    expect(classify('marketplace:my-pack')).toBe('marketplace');
-    expect(classify('marketplace:my-pack@1.2.3')).toBe('marketplace');
-    // A marketplace source must never be misread as npm/git/local.
-    expect(classify('@scope/name')).toBe('npm');
-    expect(classify('./local')).toBe('local');
-  });
-
-  it('parseMarketplaceSource splits slug and optional version', () => {
-    expect(parseMarketplaceSource('marketplace:foo')).toEqual({ slug: 'foo' });
-    expect(parseMarketplaceSource('marketplace:foo@2.0.0')).toEqual({
-      slug: 'foo',
-      version: '2.0.0',
-    });
-  });
-
-  it('parseMarketplaceSource rejects an empty slug', () => {
-    expect(() => parseMarketplaceSource('marketplace:')).toThrow(/requires a slug/);
-  });
-
-  it('toMarketplaceListing refuses a listing with no content hash', () => {
-    expect(() =>
-      toMarketplaceListing({ id: 'lst_x', downloadUrl: 'https://s3/x' }),
-    ).toThrow(/no content hash/);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// fetchMarketplace — verify-before-extract
-// ---------------------------------------------------------------------------
-
-describe('US-006 marketplace: fetchMarketplace', () => {
-  let hq: string;
-  let tmpDir: string;
-
-  beforeEach(() => {
-    hq = mkFakeHq();
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mkt-fetch-'));
-  });
-  afterEach(() => {
-    fs.rmSync(hq, { recursive: true, force: true });
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it('downloads, verifies hash, and safe-extracts to a payloadDir with package.yaml', async () => {
-    const payload = writePackPayload(hq);
-    const bytes = tarballOf(payload);
-    const { deps } = makeDeps('demo', bytes, { version: '1.0.0' });
-
-    const result = await fetchMarketplace('marketplace:demo', tmpDir, deps);
-
-    expect(fs.existsSync(path.join(result.payloadDir, 'package.yaml'))).toBe(true);
-    expect(fs.existsSync(path.join(result.payloadDir, 'skills', 'demo', 'SKILL.md'))).toBe(
-      true,
-    );
-    // Resolved source records the marketplace version for re-install/update.
-    expect(result.resolvedSource).toBe('marketplace:demo@1.0.0');
-  });
-
-  it('REFUSES + extracts nothing when the bytes do not match the approved hash', async () => {
-    const payload = writePackPayload(hq);
-    const bytes = tarballOf(payload);
-    // Listing pins a DIFFERENT hash than the bytes we serve (tamper).
-    const wrongHash = 'a'.repeat(64);
-    const { deps } = makeDeps('demo', bytes, { contentHash: wrongHash });
-
-    await expect(fetchMarketplace('marketplace:demo', tmpDir, deps)).rejects.toThrow(
-      ArtifactVerificationError,
-    );
-    // No extract dir was produced — nothing unpacked.
-    expect(fs.existsSync(path.join(tmpDir, 'extracted'))).toBe(false);
-  });
-
-  it('re-resolves a FRESH presigned URL on an expired (403) download, then succeeds', async () => {
-    const payload = writePackPayload(hq);
-    const bytes = tarballOf(payload);
-    const { deps, calls } = makeDeps('demo', bytes, { expireFirstDownload: true });
-
-    const result = await fetchMarketplace('marketplace:demo', tmpDir, deps);
-
-    expect(fs.existsSync(path.join(result.payloadDir, 'package.yaml'))).toBe(true);
-    expect(calls.refresh).toBe(1); // re-resolved once
-    expect(calls.download).toBe(2); // first 403, second OK
-  });
-});
-
-// ---------------------------------------------------------------------------
-// installPack — full E2E through the existing local-install path
-// ---------------------------------------------------------------------------
-
-describe('US-006 marketplace: installPack E2E', () => {
-  let hq: string;
-  let prevCwd: string;
-
-  beforeEach(() => {
-    hq = mkFakeHq();
-    prevCwd = process.cwd();
-    process.chdir(hq); // findHqRoot() resolves to hq via .claude/
-  });
-  afterEach(() => {
-    process.chdir(prevCwd);
-    fs.rmSync(hq, { recursive: true, force: true });
-    vi.restoreAllMocks();
-  });
-
-  it('approved listing → installs; contributes land under core/packages/<name>/ and source is stamped', async () => {
-    const payload = writePackPayload(hq, { name: 'hq-pack-demo', version: '1.0.0' });
-    const bytes = tarballOf(payload);
-    const { deps } = makeDeps('demo', bytes, { version: '1.0.0' });
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-
-    await installPack('marketplace:demo', { marketplaceDeps: deps });
-
-    const dest = path.join(hq, 'core', 'packages', 'hq-pack-demo');
-    expect(fs.existsSync(path.join(dest, 'skills', 'demo', 'SKILL.md'))).toBe(true);
-    // modules.yaml provenance equivalent: the resolved marketplace source is
-    // stamped into the installed package.yaml so re-install + packs update work.
-    const stamped = fs.readFileSync(path.join(dest, 'package.yaml'), 'utf-8');
-    expect(stamped.split('\n')[0]).toBe('source: "marketplace:demo@1.0.0"');
-  });
-
-  it('pack declaring hooks → hook-consent gate fires BEFORE wiring (declines → nothing installed)', async () => {
-    const payload = writePackPayload(hq, { name: 'hq-pack-hooked', withHooks: true });
-    const bytes = tarballOf(payload);
-    const { deps } = makeDeps('hooked', bytes);
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-
-    // Consent prompt DECLINES (simulates the gate firing).
-    consentAnswer = 'n';
-    await installPack('marketplace:hooked', { marketplaceDeps: deps });
-
-    // Declined at the consent gate → pack must NOT be wired.
-    expect(fs.existsSync(path.join(hq, 'core', 'packages', 'hq-pack-hooked'))).toBe(false);
-  });
-
-  it('pack declaring hooks → consent accepted installs the pack (gate not bypassed)', async () => {
-    const payload = writePackPayload(hq, { name: 'hq-pack-hooked', withHooks: true });
-    const bytes = tarballOf(payload);
-    const { deps } = makeDeps('hooked', bytes);
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-
-    // Consent prompt ACCEPTS — gate fired and was approved (not bypassed).
-    consentAnswer = 'y';
-    await installPack('marketplace:hooked', { marketplaceDeps: deps });
-
-    expect(fs.existsSync(path.join(hq, 'core', 'packages', 'hq-pack-hooked'))).toBe(true);
-  });
-
-  it('tampered bytes (hash mismatch) → installPack refuses; nothing wired', async () => {
-    const payload = writePackPayload(hq, { name: 'hq-pack-demo' });
-    const bytes = tarballOf(payload);
-    const { deps } = makeDeps('demo', bytes, { contentHash: 'b'.repeat(64) });
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-
-    await expect(
-      installPack('marketplace:demo', { marketplaceDeps: deps }),
-    ).rejects.toThrow(ArtifactVerificationError);
-
-    expect(fs.existsSync(path.join(hq, 'core', 'packages', 'hq-pack-demo'))).toBe(false);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// hq packs update — async marketplace probe
-// ---------------------------------------------------------------------------
-
-describe('US-006 marketplace: update probe', () => {
-  it('reports a newer listing version as updateAvailable', async () => {
-    const dummy = new Uint8Array([1, 2, 3]);
-    const { deps } = makeDeps('demo', dummy, { latestVersion: '2.0.0' });
-
-    const r = await resolveLatestMarketplace('marketplace:demo@1.0.0', '1.0.0', deps);
-
-    expect(r.transport).toBe('marketplace');
-    expect(r.current).toBe('1.0.0');
-    expect(r.latest).toBe('2.0.0');
-    expect(r.updateAvailable).toBe(true);
-  });
-
-  it('reports no update when the listing version matches', async () => {
-    const dummy = new Uint8Array([1, 2, 3]);
-    const { deps } = makeDeps('demo', dummy, { latestVersion: '1.0.0' });
-
-    const r = await resolveLatestMarketplace('marketplace:demo@1.0.0', '1.0.0', deps);
-
-    expect(r.updateAvailable).toBe(false);
-  });
-
-  it('never throws on a network failure — returns updateAvailable:null + error', async () => {
-    const deps: MarketplaceDeps = {
-      resolveListing: async () => {
-        throw new Error('network down');
-      },
-      refreshListing: async () => {
-        throw new Error('network down');
-      },
-      download: async () => new Uint8Array(),
-    };
-
-    const r = await resolveLatestMarketplace('marketplace:demo@1.0.0', '1.0.0', deps);
-
-    expect(r.updateAvailable).toBeNull();
-    expect(r.error).toMatch(/network down/);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// REGRESSION — legacy transports unchanged by adding marketplace
-// ---------------------------------------------------------------------------
-
-describe('US-006 REGRESSION: legacy transports still dispatch + install unchanged', () => {
-  it('classify still routes npm / git / local exactly as before', () => {
-    expect(classify('@scope/name@1.0.0')).toBe('npm');
-    expect(classify('https://github.com/o/r.git')).toBe('git');
-    expect(classify('github:owner/repo')).toBe('git');
-    expect(classify('git@github.com:o/r.git')).toBe('git');
-    expect(classify('./path')).toBe('local');
-    expect(classify('/abs/path')).toBe('local');
-    expect(classify('file:./x')).toBe('local');
-    // Bare slug still rejected by classify → routed to the legacy registry flow.
-    expect(() => classify('bare-slug')).toThrow(/Bare slugs go through the registry/);
-  });
-
-  it('local transport still installs end-to-end (no marketplace deps involved)', async () => {
-    const hq = mkFakeHq();
-    const payload = writePackPayload(hq, { name: 'hq-pack-local' });
-    const prevCwd = process.cwd();
-    process.chdir(hq);
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-    try {
-      // Point installPack at the local payload dir — the legacy local path.
-      await installPack(payload);
-      const dest = path.join(hq, 'core', 'packages', 'hq-pack-local');
-      expect(fs.existsSync(path.join(dest, 'skills', 'demo', 'SKILL.md'))).toBe(true);
-      // Local source stamped verbatim (NOT rewritten as a marketplace source).
-      const stamped = fs.readFileSync(path.join(dest, 'package.yaml'), 'utf-8');
-      expect(stamped.split('\n')[0]).toBe(`source: "${payload}"`);
-    } finally {
-      process.chdir(prevCwd);
-      fs.rmSync(hq, { recursive: true, force: true });
-      vi.restoreAllMocks();
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// BUG-1 — defaultMarketplaceDeps().resolveListing must EXACT-slug-match
-//
-// The browse handler historically ignored `?slug=` and only honored `?q=`
-// (fuzzy), so `?slug=tdd` returned ALL approved listings newest-first. The old
-// code took `listings[0]` → installed the NEWEST pack, not the requested slug
-// (verified live: `marketplace:tdd` installed hq-pack-review). resolveListing
-// must now exact-match `l.slug === slug` and throw when no exact match exists,
-// and must query with BOTH `slug` + `q` for forward/back compatibility.
-// ---------------------------------------------------------------------------
-
-describe('BUG-1 resolveListing exact-slug match (defaultMarketplaceDeps)', () => {
-  beforeEach(() => {
-    fetchPublicCalls.length = 0;
-    publicResponder = () => ({ ok: true, status: 200, body: { listings: [] } });
-  });
-
-  /** A browse-summary entry (id present, no URL — detail fetch mints it). */
-  function summary(slug: string, version: string, extra?: Record<string, unknown>) {
-    return { listingId: `lst_${slug}`, slug, version, status: 'approved', ...extra };
-  }
-
-  /** The `GET /v1/listings/{id}` detail the follow-up fetch returns. */
-  function detailBody(slug: string, version: string) {
-    return {
-      listing: {
-        id: `lst_${slug}`,
-        slug,
-        version,
-        downloadUrl: 'https://s3.example/presigned?sig=abc',
-        contentHash: 'a'.repeat(64),
-      },
-    };
-  }
-
-  it('returns the EXACTLY-slugged listing — NOT listings[0] — from a multi-pack feed', async () => {
-    // Server returns a slug-ignoring fuzzy feed newest-first: review is [0], the
-    // requested tdd is later. Old code returned review; the fix returns tdd.
-    publicResponder = (_opts, call) =>
-      call === 0
-        ? {
-            ok: true,
-            status: 200,
-            body: { listings: [summary('review', '3.0.0'), summary('tdd', '1.2.0')] },
-          }
-        : { ok: true, status: 200, body: detailBody('tdd', '1.2.0') };
-
-    const listing = await defaultMarketplaceDeps().resolveListing('tdd');
-
-    expect(listing.slug).toBe('tdd');
-    expect(listing.listingId).toBe('lst_tdd');
-    // The browse query carried BOTH slug (exact) and q (fuzzy fallback).
-    expect(fetchPublicCalls[0].query).toMatchObject({ slug: 'tdd', q: 'tdd' });
-  });
-
-  it('throws a clear error when NO exact-slug match exists (never installs a near-miss)', async () => {
-    // Feed contains only OTHER slugs — a slug-ignoring/fuzzy server response.
-    publicResponder = () => ({
-      ok: true,
-      status: 200,
-      body: { listings: [summary('review', '3.0.0'), summary('tdd-helper', '1.0.0')] },
-    });
-
-    await expect(defaultMarketplaceDeps().resolveListing('tdd')).rejects.toThrow(
-      /No marketplace listing found for slug "tdd"/,
-    );
-  });
-
-  it('with a pinned version, requires BOTH exact slug AND exact version', async () => {
-    publicResponder = (_opts, call) =>
-      call === 0
-        ? {
-            ok: true,
-            status: 200,
-            body: {
-              listings: [
-                summary('tdd', '2.0.0'),
-                summary('tdd', '1.5.0'),
-                summary('review', '9.9.9'),
-              ],
-            },
-          }
-        : { ok: true, status: 200, body: detailBody('tdd', '1.5.0') };
-
-    const listing = await defaultMarketplaceDeps().resolveListing('tdd', '1.5.0');
-
-    expect(listing.slug).toBe('tdd');
-    expect(listing.version).toBe('1.5.0');
-    expect(fetchPublicCalls[0].query).toMatchObject({ slug: 'tdd', q: 'tdd', version: '1.5.0' });
-  });
-
-  it('throws when the pinned version is absent even if the slug matches', async () => {
-    publicResponder = () => ({
-      ok: true,
-      status: 200,
-      body: { listings: [summary('tdd', '2.0.0'), summary('tdd', '1.5.0')] },
-    });
-
-    await expect(defaultMarketplaceDeps().resolveListing('tdd', '9.9.9')).rejects.toThrow(
-      /No marketplace listing found for slug "tdd"@9\.9\.9/,
-    );
-  });
-});