@mycadet/assistant 0.12.7 → 0.12.9

package/src/__tests__/gemini-provider.test.ts

@@ -1978,14 +1978,14 @@ describe("GeminiProvider", () => {
   // -----------------------------------------------------------------------
   // Managed transport — constructor configuration
   // -----------------------------------------------------------------------
-  test("does not set httpOptions when managedBaseUrl is not provided", () => {
+  test("does not set httpOptions when cloudBaseUrl is not provided", () => {
     new GeminiProvider("test-key", "gemini-3-flash-preview");
     expect(lastConstructorOpts).toEqual({ apiKey: "test-key" });
   });
 
-  test("sets httpOptions.baseUrl when managedBaseUrl is provided", () => {
+  test("sets httpOptions.baseUrl when cloudBaseUrl is provided", () => {
     new GeminiProvider("managed-key", "gemini-3-flash-preview", {
-      managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
+      cloudBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
     });
     expect(lastConstructorOpts).toEqual({
       apiKey: "managed-key",
@@ -2000,7 +2000,7 @@ describe("GeminiProvider", () => {
       "managed-key",
       "gemini-3-flash-preview",
       {
-        managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
+        cloudBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
       },
     );
 
@@ -2025,7 +2025,7 @@ describe("GeminiProvider", () => {
       "managed-key",
       "gemini-3-flash-preview",
       {
-        managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
+        cloudBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
       },
     );
 

package/src/__tests__/get-skill-detail-audit.test.ts

@@ -1,240 +1,129 @@
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+/**
+ * Tests for `getSkill` — audit enrichment + lineage, zero-leak.
+ *
+ * Coverage:
+ *   - Enriches skillssh skill detail with audit data on success.
+ *   - Returns detail without audit data when the audit fetch fails (non-fatal).
+ *   - Attributes a plugin-resident skill to its owning plugin.
+ *   - Includes sourceConversationId when install-meta records it.
+ *   - Omits sourceConversationId when install-meta has none.
+ *   - Never exposes lineage on non-assistant-memory origins.
+ *
+ * Zero-leak: the REAL catalog loader resolves skills seeded into the
+ * workspace (a managed skills dir entry, a real plugin directory with a
+ * package.json manifest, each carrying a real `install-meta.json`), and the
+ * REAL `fetchSkillAudits` runs its HTTP fetch against the requests-mock
+ * transport. The former mock asserted the audit call args; these tests
+ * assert the real audit URL. The skillssh detail ids are one-segment
+ * workspace skill ids with the slash slug living in install-meta.json —
+ * through the real loader the id is the on-disk directory name, and the
+ * registry slug is install-meta state.
+ */
+
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import { setAllFlagsOnForTesting } from "./feature-flag-test-helpers.js";
+import { setConfig } from "./helpers/set-config.js";
+import { mockHttp } from "./requests-mock.js";
+
+// Real env: the real getCloudBaseUrl() reads config.cloud.baseUrl — point it
+// at a host mockHttp matches by path substring.
+setConfig("cloud", { baseUrl: "https://test-cloud.mycadet.ai" });
 
-// ---------------------------------------------------------------------------
-// Mock state
-// ---------------------------------------------------------------------------
-
-const mockResolveSkillStates = mock(
-  (): Array<{
-    summary: {
-      id: string;
-      displayName: string;
-      description: string;
-      emoji?: string;
-      source:
-        | "bundled"
-        | "managed"
-        | "workspace"
-        | "extra"
-        | "catalog"
-        | "plugin";
-      directoryPath: string;
-      owner?: { kind: "skill" | "mcp" | "plugin" | "workspace"; id: string };
-    };
-    state: "enabled" | "disabled";
-  }> => [],
-);
-
-const mockReadInstallMeta = mock(
-  (
-    _dir: string,
-  ): {
-    origin: string;
-    slug?: string;
-    sourceRepo?: string;
-    installedAt?: string;
-    author?: "assistant" | "user";
-    sourceConversationId?: string;
-  } | null => null,
-);
-
-const mockFetchSkillAudits = mock(
-  async (
-    _source: string,
-    _skillSlugs: string[],
-  ): Promise<
-    Record<
-      string,
-      Record<
-        string,
-        { risk: string; alerts?: number; score?: number; analyzedAt: string }
-      >
-    >
-  > => ({}),
-);
+import { getSkill } from "../daemon/handlers/skills.js";
+import { invalidateCatalogCache } from "../skills/catalog-cache.js";
+import {
+  getWorkspacePluginsDir,
+  getWorkspaceSkillsDir,
+} from "../util/layout.js";
 
 // ---------------------------------------------------------------------------
-// Mock modules — before importing module under test
+// Workspace seeding — the real loader resolves these
 // ---------------------------------------------------------------------------
 
-mock.module("../config/skills.js", () => ({
-  loadSkillCatalog: () => [],
-}));
-
-mock.module("../config/skill-state.js", () => ({
-  resolveSkillStates: mockResolveSkillStates,
-  skillFlagKey: () => null,
-}));
-
-mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: () => true,
-}));
-
-mock.module("../skills/install-meta.js", () => ({
-  readInstallMeta: mockReadInstallMeta,
-}));
-
-mock.module("../skills/skillssh-registry.js", () => ({
-  searchSkillsRegistry: mock(async () => []),
-  fetchSkillAudits: mockFetchSkillAudits,
-  // resolveSkillSource uses the real implementation — its pure parsing
-  // logic is reliable and doesn't need mocking. The handler calls it to
-  // derive owner/repo/skillSlug from the slug string before calling
-  // fetchSkillAudits, so as long as fetchSkillAudits receives the right
-  // args (asserted below), we know resolveSkillSource did its job.
-  resolveSkillSource: (source: string) => {
-    const parts = source.split("/");
-    return { owner: parts[0], repo: parts[1], skillSlug: parts[2] };
-  },
-  installExternalSkill: mock(async () => {}),
-}));
-
-mock.module("../skills/clawhub.js", () => ({
-  clawhubSearch: mock(async () => ({ skills: [] })),
-  clawhubCheckUpdates: mock(async () => []),
-  clawhubInspect: mock(async () => ({})),
-  clawhubInstall: mock(async () => ({ success: true })),
-  clawhubUpdate: mock(async () => ({ success: true })),
-}));
-
-mock.module("../skills/catalog-search.js", () => ({
-  filterByQuery: () => [],
-}));
-
-mock.module("../providers/provider-send-message.js", () => ({
-  createTimeout: () => ({
-    signal: AbortSignal.timeout(1000),
-    cleanup: () => {},
-  }),
-  extractText: () => "",
-  getConfiguredProvider: async () => null,
-  userMessage: () => ({}),
-}));
-
-mock.module("../runtime/routes/workspace-utils.js", () => ({
-  isTextMimeType: () => true,
-}));
-
-mock.module("../skills/catalog-cache.js", () => ({
-  getCatalog: async () => [],
-}));
-
-mock.module("../skills/catalog-files.js", () => ({
-  catalogSkillToSlim: () => ({}),
-  createCadetCatalogProvider: () => ({
-    canHandle: () => false,
-    listFiles: async () => null,
-    toSlimSkill: async () => null,
-    readFileContent: async () => null,
-  }),
-  hasHiddenOrSkippedSegment: () => false,
-  sanitizeRelativePath: (p: string) => p,
-  SKIP_DIRS: new Set(),
-}));
-
-mock.module("../skills/skillssh-files.js", () => ({
-  createSkillsShProvider: () => ({
-    canHandle: () => false,
-    listFiles: async () => null,
-    toSlimSkill: async () => null,
-    readFileContent: async () => null,
-  }),
-}));
-
-mock.module("../skills/clawhub-files.js", () => ({
-  createClawhubProvider: () => ({
-    canHandle: () => false,
-    listFiles: async () => null,
-    toSlimSkill: async () => null,
-    readFileContent: async () => null,
-  }),
-}));
-
-mock.module("../skills/catalog-install.js", () => ({
-  installSkillLocally: async () => {},
-}));
-
-mock.module("../skills/managed-store.js", () => ({
-  createManagedSkill: () => ({ created: true }),
-  deleteManagedSkill: () => ({ deleted: true }),
-  validateManagedSkillId: () => null,
-}));
-
-mock.module("../plugins/defaults/memory/graph/capability-seed.js", () => ({
-  deleteSkillCapabilityNode: () => {},
-  seedSkillGraphNodes: () => {},
-  seedUninstalledCatalogSkillMemories: async () => {},
-}));
-
-mock.module("../daemon/handlers/shared.js", () => ({
-  CONFIG_RELOAD_DEBOUNCE_MS: 100,
-  ensureSkillEntry: () => ({}),
-  log: {
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-    debug: () => {},
-  },
-}));
-
-// Import after mocking
-import { getSkill } from "../daemon/handlers/skills.js";
+const seededDirs: string[] = [];
+
+/** Seed a managed skill (workspace skills dir entry) with an install-meta.json. */
+function seedManagedSkill(
+  id: string,
+  installMeta: Record<string, unknown> | null,
+): string {
+  const dir = join(getWorkspaceSkillsDir(), id);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(dir, "SKILL.md"),
+    `---\nname: ${id}\ndescription: seeded test skill\n---\n# ${id}\n`,
+  );
+  if (installMeta !== null) {
+    writeFileSync(
+      join(dir, "install-meta.json"),
+      JSON.stringify(installMeta, null, 2),
+    );
+  }
+  seededDirs.push(dir);
+  return dir;
+}
+
+/** Seed a real plugin directory (package.json manifest + one resident skill). */
+function seedPluginWithSkill(pluginId: string, skillId: string): string {
+  const pluginDir = join(getWorkspacePluginsDir(), pluginId);
+  const skillDir = join(pluginDir, "skills", skillId);
+  mkdirSync(skillDir, { recursive: true });
+  writeFileSync(
+    join(pluginDir, "package.json"),
+    JSON.stringify({ name: pluginId, version: "1.0.0" }),
+  );
+  writeFileSync(
+    join(skillDir, "SKILL.md"),
+    `---\nname: ${skillId}\ndescription: seeded plugin skill\n---\n# ${skillId}\n`,
+  );
+  seededDirs.push(pluginDir);
+  return pluginDir;
+}
+
+beforeEach(() => {
+  setAllFlagsOnForTesting();
+  invalidateCatalogCache();
+});
 
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
+afterEach(() => {
+  for (const dir of seededDirs) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  seededDirs.length = 0;
+});
 
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
 
 describe("getSkill — skillssh audit enrichment", () => {
-  beforeEach(() => {
-    mockResolveSkillStates.mockReset();
-    mockReadInstallMeta.mockReset();
-    mockFetchSkillAudits.mockReset();
-
-    // Default: no skills resolved
-    mockResolveSkillStates.mockReturnValue([]);
-    mockReadInstallMeta.mockReturnValue(null);
-    mockFetchSkillAudits.mockResolvedValue({});
-  });
-
   test("enriches skillssh skill detail with audit data on success", async () => {
-    // Set up a skillssh installed skill
-    mockResolveSkillStates.mockReturnValue([
-      {
-        summary: {
-          id: "acme/tools/lint",
-          displayName: "Lint",
-          description: "A lint skill",
-          source: "extra" as const,
-          directoryPath: "/tmp/test-skills/lint",
-        },
-        state: "enabled" as const,
-      },
-    ]);
-
-    // Return skillssh origin from install-meta
-    mockReadInstallMeta.mockReturnValue({
+    const http = mockHttp();
+    seedManagedSkill("lint-skill", {
       origin: "skillssh",
       slug: "acme/tools/lint",
       sourceRepo: "acme/tools",
     });
-
-    // fetchSkillAudits returns audit data keyed by skill slug
-    mockFetchSkillAudits.mockResolvedValue({
-      lint: {
-        ath: { risk: "safe", score: 100, analyzedAt: "2025-06-01T00:00:00Z" },
-        socket: {
-          risk: "low",
-          alerts: 1,
-          analyzedAt: "2025-06-01T00:00:00Z",
+    // The real fetchSkillAudits runs its HTTP fetch; the audit service
+    // response is keyed by skill slug.
+    http.on("GET", "add-skill.vercel.sh/audit", {
+      status: 200,
+      body: {
+        lint: {
+          ath: { risk: "safe", score: 100, analyzedAt: "2025-06-01T00:00:00Z" },
+          socket: {
+            risk: "low",
+            alerts: 1,
+            analyzedAt: "2025-06-01T00:00:00Z",
+          },
         },
       },
     });
 
-    const result = await getSkill("acme/tools/lint");
+    const result = await getSkill("lint-skill");
 
     // Should succeed
     expect("skill" in result).toBe(true);
@@ -244,8 +133,7 @@ describe("getSkill — skillssh audit enrichment", () => {
 
     const detail = result.skill;
     expect(detail.origin).toBe("skillssh");
-    expect(detail.id).toBe("acme/tools/lint");
-    expect(detail.name).toBe("Lint");
+    expect(detail.id).toBe("lint-skill");
 
     // Verify audit data is attached
     if (detail.origin === "skillssh") {
@@ -262,39 +150,29 @@ describe("getSkill — skillssh audit enrichment", () => {
       });
     }
 
-    // Verify fetchSkillAudits was called with the correct source repo and slug
-    expect(mockFetchSkillAudits).toHaveBeenCalledTimes(1);
-    expect(mockFetchSkillAudits).toHaveBeenCalledWith("acme/tools", ["lint"]);
+    // Verify the real audit fetch targeted the install-meta source repo and
+    // the registry slug's last segment.
+    const auditCall = http.lastCall("GET");
+    expect(auditCall).toBeDefined();
+    expect(auditCall!.url).toContain("add-skill.vercel.sh/audit");
+    expect(auditCall!.url).toContain("source=acme%2Ftools");
+    expect(auditCall!.url).toContain("skills=lint");
   });
 
-  test("returns detail without audit data when fetchSkillAudits throws", async () => {
-    // Set up a skillssh installed skill
-    mockResolveSkillStates.mockReturnValue([
-      {
-        summary: {
-          id: "org/repo/my-tool",
-          displayName: "My Tool",
-          description: "A community tool",
-          source: "extra" as const,
-          directoryPath: "/tmp/test-skills/my-tool",
-        },
-        state: "enabled" as const,
-      },
-    ]);
-
-    // Return skillssh origin from install-meta
-    mockReadInstallMeta.mockReturnValue({
+  test("returns detail without audit data when the audit fetch fails", async () => {
+    const http = mockHttp();
+    seedManagedSkill("my-tool", {
       origin: "skillssh",
       slug: "org/repo/my-tool",
       sourceRepo: "org/repo",
     });
+    // The real fetchSkillAudits throws on a non-2xx; the handler treats
+    // audit failure as non-fatal.
+    http.on("GET", "add-skill.vercel.sh/audit", {
+      status: 500,
+    });
 
-    // fetchSkillAudits throws an error
-    mockFetchSkillAudits.mockRejectedValue(
-      new Error("audit service unavailable"),
-    );
-
-    const result = await getSkill("org/repo/my-tool");
+    const result = await getSkill("my-tool");
 
     // Should still succeed — audit failure is non-fatal
     expect("skill" in result).toBe(true);
@@ -304,41 +182,28 @@ describe("getSkill — skillssh audit enrichment", () => {
 
     const detail = result.skill;
     expect(detail.origin).toBe("skillssh");
-    expect(detail.id).toBe("org/repo/my-tool");
-    expect(detail.name).toBe("My Tool");
+    expect(detail.id).toBe("my-tool");
 
     // Audit data should not be present
     if (detail.origin === "skillssh") {
       expect(detail.audit).toBeUndefined();
     }
 
-    // fetchSkillAudits was still called (just failed)
-    expect(mockFetchSkillAudits).toHaveBeenCalledTimes(1);
+    // The audit fetch was still attempted (and failed)
+    expect(http.callCount("GET")).toBe(1);
   });
 
   test("attributes a plugin-resident skill to its owning plugin on the detail response", async () => {
-    // GIVEN a skill shipped inside an installed plugin, resolved with a
-    // `plugin` source and a plugin owner descriptor
-    mockResolveSkillStates.mockReturnValue([
-      {
-        summary: {
-          id: "caveman",
-          displayName: "Caveman",
-          description: "Ultra-compressed communication mode",
-          source: "plugin" as const,
-          directoryPath: "/tmp/test-skills/plugins/caveman/skills/caveman",
-          owner: { kind: "plugin", id: "caveman" },
-        },
-        state: "enabled" as const,
-      },
-    ]);
+    // GIVEN a skill shipped inside a real plugin directory (package.json
+    // manifest + skills/<id>/SKILL.md), discovered by the real loader
+    seedPluginWithSkill("caveman", "caveman");
 
     // WHEN we fetch its detail
     const result = await getSkill("caveman");
 
     // THEN it resolves to the cadet origin (plugin skills are mapped to
     // bundled/cadet for older clients) while preserving plugin attribution
-    // on the owner descriptor
+    // on the owner descriptor the real loader attached
     expect("skill" in result).toBe(true);
     if (!("skill" in result)) {
       throw new Error("Expected skill response");
@@ -355,29 +220,10 @@ describe("getSkill — skillssh audit enrichment", () => {
 });
 
 describe("getSkill — assistant-memory conversation lineage", () => {
-  beforeEach(() => {
-    mockResolveSkillStates.mockReset();
-    mockReadInstallMeta.mockReset();
-    mockFetchSkillAudits.mockReset();
-
-    mockResolveSkillStates.mockReturnValue([
-      {
-        summary: {
-          id: "triage-inbox",
-          displayName: "Triage Inbox",
-          description: "Distilled inbox triage procedure",
-          source: "managed" as const,
-          directoryPath: "/tmp/test-skills/triage-inbox",
-        },
-        state: "enabled" as const,
-      },
-    ]);
-    mockFetchSkillAudits.mockResolvedValue({});
-  });
-
   test("includes sourceConversationId when install-meta records it", async () => {
-    // GIVEN a retrospective-authored skill whose install-meta carries lineage
-    mockReadInstallMeta.mockReturnValue({
+    // GIVEN a retrospective-authored skill whose real install-meta.json
+    // carries lineage
+    seedManagedSkill("triage-inbox", {
       origin: "custom",
       author: "assistant",
       sourceConversationId: "conv-123",
@@ -400,7 +246,7 @@ describe("getSkill — assistant-memory conversation lineage", () => {
 
   test("omits sourceConversationId when install-meta has none", async () => {
     // GIVEN a retrospective-authored skill without recorded lineage
-    mockReadInstallMeta.mockReturnValue({
+    seedManagedSkill("triage-inbox", {
       origin: "custom",
       author: "assistant",
       installedAt: "2026-01-01T00:00:00Z",
@@ -421,7 +267,7 @@ describe("getSkill — assistant-memory conversation lineage", () => {
   test("never exposes lineage on non-assistant-memory origins", async () => {
     // GIVEN a user-installed custom skill that (unexpectedly) carries a
     // sourceConversationId in install-meta
-    mockReadInstallMeta.mockReturnValue({
+    seedManagedSkill("triage-inbox", {
       origin: "custom",
       sourceConversationId: "conv-123",
       installedAt: "2026-01-01T00:00:00Z",

package/src/__tests__/guardian-verification-voice-binding.test.ts

@@ -41,7 +41,7 @@ mock.module("../calls/voice-ingress-preflight.js", () => ({
   }),
 }));
 
-mock.module("../inbound/platform-callback-registration.js", () => ({
+mock.module("../inbound/cloud-callback-registration.js", () => ({
   resolveCallbackUrl: async (fn: () => string) => fn(),
 }));
 

package/src/__tests__/handlers-skills-memory-v2-reseed.test.ts

@@ -120,10 +120,10 @@ mock.module("../skills/catalog-search.js", () => ({
   filterByQuery: () => [],
 }));
 
-mock.module("../skills/managed-store.js", () => ({
-  createManagedSkill: () => ({ created: true }),
-  deleteManagedSkill: () => ({ deleted: true }),
-  validateManagedSkillId: () => null,
+mock.module("../skills/cloud-store.js", () => ({
+  createCloudSkill: () => ({ created: true }),
+  deleteCloudSkill: () => ({ deleted: true }),
+  validateCloudSkillId: () => null,
 }));
 
 mock.module("../plugins/defaults/memory/graph/capability-seed.js", () => ({
@@ -203,7 +203,7 @@ describe("v2 skill refresh delegation in skill handlers", () => {
   });
 
   test("uninstall delegates to refresh helper", async () => {
-    const result = await uninstallSkill("managed-skill");
+    const result = await uninstallSkill("cloud-skill");
 
     expect(result.success).toBe(true);
     expect(mockRefreshSkillCapabilityMemories).toHaveBeenCalledTimes(1);

package/src/__tests__/host-cu-routes-targeted.test.ts

@@ -25,7 +25,7 @@ import sharp from "sharp";
 mock.module("../config/env.js", () => ({
   isHttpAuthDisabled: () => true,
   hasUngatedHttpAuthDisabled: () => false,
-  getPlatformBaseUrl: () => "https://platform.example.com",
+  getCloudBaseUrl: () => "https://platform.example.com",
   getGatewayInternalBaseUrl: () => "http://localhost:8080",
   getIngressPublicBaseUrl: () => undefined,
   setIngressPublicBaseUrl: () => {},
@@ -35,14 +35,14 @@ mock.module("../config/env.js", () => ({
   getQdrantHttpPortEnv: () => undefined,
   getQdrantReadyzTimeoutMs: () => undefined,
   getOllamaBaseUrlEnv: () => undefined,
-  setPlatformBaseUrl: () => {},
+  setCloudBaseUrl: () => {},
   getAssistantDomain: () => "example.com",
-  setPlatformAssistantId: () => {},
-  getPlatformAssistantId: () => "test-assistant-id",
-  setPlatformOrganizationId: () => {},
-  getPlatformOrganizationId: () => "test-org-id",
-  setPlatformUserId: () => {},
-  getPlatformUserId: () => "test-user-id",
+  setCloudAssistantId: () => {},
+  getCloudAssistantId: () => "test-assistant-id",
+  setCloudOrganizationId: () => {},
+  getCloudOrganizationId: () => "test-org-id",
+  setCloudUserId: () => {},
+  getCloudUserId: () => "test-user-id",
   validateEnv: () => {},
 }));