@mycadet/assistant 0.12.8 → 0.12.9

package/src/__tests__/get-skill-detail-audit.test.ts

@@ -1,241 +1,129 @@
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+/**
+ * Tests for `getSkill` — audit enrichment + lineage, zero-leak.
+ *
+ * Coverage:
+ *   - Enriches skillssh skill detail with audit data on success.
+ *   - Returns detail without audit data when the audit fetch fails (non-fatal).
+ *   - Attributes a plugin-resident skill to its owning plugin.
+ *   - Includes sourceConversationId when install-meta records it.
+ *   - Omits sourceConversationId when install-meta has none.
+ *   - Never exposes lineage on non-assistant-memory origins.
+ *
+ * Zero-leak: the REAL catalog loader resolves skills seeded into the
+ * workspace (a managed skills dir entry, a real plugin directory with a
+ * package.json manifest, each carrying a real `install-meta.json`), and the
+ * REAL `fetchSkillAudits` runs its HTTP fetch against the requests-mock
+ * transport. The former mock asserted the audit call args; these tests
+ * assert the real audit URL. The skillssh detail ids are one-segment
+ * workspace skill ids with the slash slug living in install-meta.json —
+ * through the real loader the id is the on-disk directory name, and the
+ * registry slug is install-meta state.
+ */
+
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import { setAllFlagsOnForTesting } from "./feature-flag-test-helpers.js";
+import { setConfig } from "./helpers/set-config.js";
+import { mockHttp } from "./requests-mock.js";
+
+// Real env: the real getCloudBaseUrl() reads config.cloud.baseUrl — point it
+// at a host mockHttp matches by path substring.
+setConfig("cloud", { baseUrl: "https://test-cloud.mycadet.ai" });
 
-import { setAllFlagsOnForTesting } from "../__tests__/feature-flag-test-helpers.js";
-
-// ---------------------------------------------------------------------------
-// Mock state
-// ---------------------------------------------------------------------------
-
-const mockResolveSkillStates = mock(
-  (): Array<{
-    summary: {
-      id: string;
-      displayName: string;
-      description: string;
-      emoji?: string;
-      source:
-        | "bundled"
-        | "managed"
-        | "workspace"
-        | "extra"
-        | "catalog"
-        | "plugin";
-      directoryPath: string;
-      owner?: { kind: "skill" | "mcp" | "plugin" | "workspace"; id: string };
-    };
-    state: "enabled" | "disabled";
-  }> => [],
-);
-
-const mockReadInstallMeta = mock(
-  (
-    _dir: string,
-  ): {
-    origin: string;
-    slug?: string;
-    sourceRepo?: string;
-    installedAt?: string;
-    author?: "assistant" | "user";
-    sourceConversationId?: string;
-  } | null => null,
-);
-
-const mockFetchSkillAudits = mock(
-  async (
-    _source: string,
-    _skillSlugs: string[],
-  ): Promise<
-    Record<
-      string,
-      Record<
-        string,
-        { risk: string; alerts?: number; score?: number; analyzedAt: string }
-      >
-    >
-  > => ({}),
-);
+import { getSkill } from "../daemon/handlers/skills.js";
+import { invalidateCatalogCache } from "../skills/catalog-cache.js";
+import {
+  getWorkspacePluginsDir,
+  getWorkspaceSkillsDir,
+} from "../util/layout.js";
 
 // ---------------------------------------------------------------------------
-// Mock modules — before importing module under test
+// Workspace seeding — the real loader resolves these
 // ---------------------------------------------------------------------------
 
-mock.module("../config/skills.js", () => ({
-  loadSkillCatalog: () => [],
-}));
-
-mock.module("../config/skill-state.js", () => ({
-  resolveSkillStates: mockResolveSkillStates,
-  skillFlagKey: () => null,
-}));
-
-mock.module("../skills/install-meta.js", () => ({
-  readInstallMeta: mockReadInstallMeta,
-}));
-
-mock.module("../skills/skillssh-registry.js", () => ({
-  searchSkillsRegistry: mock(async () => []),
-  fetchSkillAudits: mockFetchSkillAudits,
-  // resolveSkillSource uses the real implementation — its pure parsing
-  // logic is reliable and doesn't need mocking. The handler calls it to
-  // derive owner/repo/skillSlug from the slug string before calling
-  // fetchSkillAudits, so as long as fetchSkillAudits receives the right
-  // args (asserted below), we know resolveSkillSource did its job.
-  resolveSkillSource: (source: string) => {
-    const parts = source.split("/");
-    return { owner: parts[0], repo: parts[1], skillSlug: parts[2] };
-  },
-  installExternalSkill: mock(async () => {}),
-}));
-
-mock.module("../skills/clawhub.js", () => ({
-  clawhubSearch: mock(async () => ({ skills: [] })),
-  clawhubCheckUpdates: mock(async () => []),
-  clawhubInspect: mock(async () => ({})),
-  clawhubInstall: mock(async () => ({ success: true })),
-  clawhubUpdate: mock(async () => ({ success: true })),
-}));
-
-mock.module("../skills/catalog-search.js", () => ({
-  filterByQuery: () => [],
-}));
-
-mock.module("../providers/provider-send-message.js", () => ({
-  createTimeout: () => ({
-    signal: AbortSignal.timeout(1000),
-    cleanup: () => {},
-  }),
-  extractText: () => "",
-  getConfiguredProvider: async () => null,
-  userMessage: () => ({}),
-}));
-
-mock.module("../runtime/routes/workspace-utils.js", () => ({
-  isTextMimeType: () => true,
-}));
-
-mock.module("../skills/catalog-cache.js", () => ({
-  getCatalog: async () => [],
-}));
-
-mock.module("../skills/catalog-files.js", () => ({
-  catalogSkillToSlim: () => ({}),
-  createCadetCatalogProvider: () => ({
-    canHandle: () => false,
-    listFiles: async () => null,
-    toSlimSkill: async () => null,
-    readFileContent: async () => null,
-  }),
-  hasHiddenOrSkippedSegment: () => false,
-  sanitizeRelativePath: (p: string) => p,
-  SKIP_DIRS: new Set(),
-}));
-
-mock.module("../skills/skillssh-files.js", () => ({
-  createSkillsShProvider: () => ({
-    canHandle: () => false,
-    listFiles: async () => null,
-    toSlimSkill: async () => null,
-    readFileContent: async () => null,
-  }),
-}));
-
-mock.module("../skills/clawhub-files.js", () => ({
-  createClawhubProvider: () => ({
-    canHandle: () => false,
-    listFiles: async () => null,
-    toSlimSkill: async () => null,
-    readFileContent: async () => null,
-  }),
-}));
-
-mock.module("../skills/catalog-install.js", () => ({
-  installSkillLocally: async () => {},
-}));
-
-mock.module("../skills/cloud-store.js", () => ({
-  createCloudSkill: () => ({ created: true }),
-  deleteCloudSkill: () => ({ deleted: true }),
-  validateCloudSkillId: () => null,
-}));
-
-mock.module("../plugins/defaults/memory/graph/capability-seed.js", () => ({
-  deleteSkillCapabilityNode: () => {},
-  seedSkillGraphNodes: () => {},
-  seedUninstalledCatalogSkillMemories: async () => {},
-}));
-
-mock.module("../daemon/handlers/shared.js", () => ({
-  CONFIG_RELOAD_DEBOUNCE_MS: 100,
-  ensureSkillEntry: () => ({}),
-  log: {
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-    debug: () => {},
-  },
-}));
-
-// Import after mocking
-import { getSkill } from "../daemon/handlers/skills.js";
+const seededDirs: string[] = [];
+
+/** Seed a managed skill (workspace skills dir entry) with an install-meta.json. */
+function seedManagedSkill(
+  id: string,
+  installMeta: Record<string, unknown> | null,
+): string {
+  const dir = join(getWorkspaceSkillsDir(), id);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(dir, "SKILL.md"),
+    `---\nname: ${id}\ndescription: seeded test skill\n---\n# ${id}\n`,
+  );
+  if (installMeta !== null) {
+    writeFileSync(
+      join(dir, "install-meta.json"),
+      JSON.stringify(installMeta, null, 2),
+    );
+  }
+  seededDirs.push(dir);
+  return dir;
+}
+
+/** Seed a real plugin directory (package.json manifest + one resident skill). */
+function seedPluginWithSkill(pluginId: string, skillId: string): string {
+  const pluginDir = join(getWorkspacePluginsDir(), pluginId);
+  const skillDir = join(pluginDir, "skills", skillId);
+  mkdirSync(skillDir, { recursive: true });
+  writeFileSync(
+    join(pluginDir, "package.json"),
+    JSON.stringify({ name: pluginId, version: "1.0.0" }),
+  );
+  writeFileSync(
+    join(skillDir, "SKILL.md"),
+    `---\nname: ${skillId}\ndescription: seeded plugin skill\n---\n# ${skillId}\n`,
+  );
+  seededDirs.push(pluginDir);
+  return pluginDir;
+}
+
+beforeEach(() => {
+  setAllFlagsOnForTesting();
+  invalidateCatalogCache();
+});
 
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
+afterEach(() => {
+  for (const dir of seededDirs) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  seededDirs.length = 0;
+});
 
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
 
 describe("getSkill — skillssh audit enrichment", () => {
-  beforeEach(() => {
-    // Real flag resolution replaces the former blanket module mock.
-    setAllFlagsOnForTesting();
-
-    mockResolveSkillStates.mockReset();
-    mockReadInstallMeta.mockReset();
-    mockFetchSkillAudits.mockReset();
-
-    // Default: no skills resolved
-    mockResolveSkillStates.mockReturnValue([]);
-    mockReadInstallMeta.mockReturnValue(null);
-    mockFetchSkillAudits.mockResolvedValue({});
-  });
-
   test("enriches skillssh skill detail with audit data on success", async () => {
-    // Set up a skillssh installed skill
-    mockResolveSkillStates.mockReturnValue([
-      {
-        summary: {
-          id: "acme/tools/lint",
-          displayName: "Lint",
-          description: "A lint skill",
-          source: "extra" as const,
-          directoryPath: "/tmp/test-skills/lint",
-        },
-        state: "enabled" as const,
-      },
-    ]);
-
-    // Return skillssh origin from install-meta
-    mockReadInstallMeta.mockReturnValue({
+    const http = mockHttp();
+    seedManagedSkill("lint-skill", {
       origin: "skillssh",
       slug: "acme/tools/lint",
       sourceRepo: "acme/tools",
     });
-
-    // fetchSkillAudits returns audit data keyed by skill slug
-    mockFetchSkillAudits.mockResolvedValue({
-      lint: {
-        ath: { risk: "safe", score: 100, analyzedAt: "2025-06-01T00:00:00Z" },
-        socket: {
-          risk: "low",
-          alerts: 1,
-          analyzedAt: "2025-06-01T00:00:00Z",
+    // The real fetchSkillAudits runs its HTTP fetch; the audit service
+    // response is keyed by skill slug.
+    http.on("GET", "add-skill.vercel.sh/audit", {
+      status: 200,
+      body: {
+        lint: {
+          ath: { risk: "safe", score: 100, analyzedAt: "2025-06-01T00:00:00Z" },
+          socket: {
+            risk: "low",
+            alerts: 1,
+            analyzedAt: "2025-06-01T00:00:00Z",
+          },
         },
       },
     });
 
-    const result = await getSkill("acme/tools/lint");
+    const result = await getSkill("lint-skill");
 
     // Should succeed
     expect("skill" in result).toBe(true);
@@ -245,8 +133,7 @@ describe("getSkill — skillssh audit enrichment", () => {
 
     const detail = result.skill;
     expect(detail.origin).toBe("skillssh");
-    expect(detail.id).toBe("acme/tools/lint");
-    expect(detail.name).toBe("Lint");
+    expect(detail.id).toBe("lint-skill");
 
     // Verify audit data is attached
     if (detail.origin === "skillssh") {
@@ -263,39 +150,29 @@ describe("getSkill — skillssh audit enrichment", () => {
       });
     }
 
-    // Verify fetchSkillAudits was called with the correct source repo and slug
-    expect(mockFetchSkillAudits).toHaveBeenCalledTimes(1);
-    expect(mockFetchSkillAudits).toHaveBeenCalledWith("acme/tools", ["lint"]);
+    // Verify the real audit fetch targeted the install-meta source repo and
+    // the registry slug's last segment.
+    const auditCall = http.lastCall("GET");
+    expect(auditCall).toBeDefined();
+    expect(auditCall!.url).toContain("add-skill.vercel.sh/audit");
+    expect(auditCall!.url).toContain("source=acme%2Ftools");
+    expect(auditCall!.url).toContain("skills=lint");
   });
 
-  test("returns detail without audit data when fetchSkillAudits throws", async () => {
-    // Set up a skillssh installed skill
-    mockResolveSkillStates.mockReturnValue([
-      {
-        summary: {
-          id: "org/repo/my-tool",
-          displayName: "My Tool",
-          description: "A community tool",
-          source: "extra" as const,
-          directoryPath: "/tmp/test-skills/my-tool",
-        },
-        state: "enabled" as const,
-      },
-    ]);
-
-    // Return skillssh origin from install-meta
-    mockReadInstallMeta.mockReturnValue({
+  test("returns detail without audit data when the audit fetch fails", async () => {
+    const http = mockHttp();
+    seedManagedSkill("my-tool", {
       origin: "skillssh",
       slug: "org/repo/my-tool",
       sourceRepo: "org/repo",
     });
+    // The real fetchSkillAudits throws on a non-2xx; the handler treats
+    // audit failure as non-fatal.
+    http.on("GET", "add-skill.vercel.sh/audit", {
+      status: 500,
+    });
 
-    // fetchSkillAudits throws an error
-    mockFetchSkillAudits.mockRejectedValue(
-      new Error("audit service unavailable"),
-    );
-
-    const result = await getSkill("org/repo/my-tool");
+    const result = await getSkill("my-tool");
 
     // Should still succeed — audit failure is non-fatal
     expect("skill" in result).toBe(true);
@@ -305,41 +182,28 @@ describe("getSkill — skillssh audit enrichment", () => {
 
     const detail = result.skill;
     expect(detail.origin).toBe("skillssh");
-    expect(detail.id).toBe("org/repo/my-tool");
-    expect(detail.name).toBe("My Tool");
+    expect(detail.id).toBe("my-tool");
 
     // Audit data should not be present
     if (detail.origin === "skillssh") {
       expect(detail.audit).toBeUndefined();
     }
 
-    // fetchSkillAudits was still called (just failed)
-    expect(mockFetchSkillAudits).toHaveBeenCalledTimes(1);
+    // The audit fetch was still attempted (and failed)
+    expect(http.callCount("GET")).toBe(1);
   });
 
   test("attributes a plugin-resident skill to its owning plugin on the detail response", async () => {
-    // GIVEN a skill shipped inside an installed plugin, resolved with a
-    // `plugin` source and a plugin owner descriptor
-    mockResolveSkillStates.mockReturnValue([
-      {
-        summary: {
-          id: "caveman",
-          displayName: "Caveman",
-          description: "Ultra-compressed communication mode",
-          source: "plugin" as const,
-          directoryPath: "/tmp/test-skills/plugins/caveman/skills/caveman",
-          owner: { kind: "plugin", id: "caveman" },
-        },
-        state: "enabled" as const,
-      },
-    ]);
+    // GIVEN a skill shipped inside a real plugin directory (package.json
+    // manifest + skills/<id>/SKILL.md), discovered by the real loader
+    seedPluginWithSkill("caveman", "caveman");
 
     // WHEN we fetch its detail
     const result = await getSkill("caveman");
 
     // THEN it resolves to the cadet origin (plugin skills are mapped to
     // bundled/cadet for older clients) while preserving plugin attribution
-    // on the owner descriptor
+    // on the owner descriptor the real loader attached
     expect("skill" in result).toBe(true);
     if (!("skill" in result)) {
       throw new Error("Expected skill response");
@@ -356,29 +220,10 @@ describe("getSkill — skillssh audit enrichment", () => {
 });
 
 describe("getSkill — assistant-memory conversation lineage", () => {
-  beforeEach(() => {
-    mockResolveSkillStates.mockReset();
-    mockReadInstallMeta.mockReset();
-    mockFetchSkillAudits.mockReset();
-
-    mockResolveSkillStates.mockReturnValue([
-      {
-        summary: {
-          id: "triage-inbox",
-          displayName: "Triage Inbox",
-          description: "Distilled inbox triage procedure",
-          source: "managed" as const,
-          directoryPath: "/tmp/test-skills/triage-inbox",
-        },
-        state: "enabled" as const,
-      },
-    ]);
-    mockFetchSkillAudits.mockResolvedValue({});
-  });
-
   test("includes sourceConversationId when install-meta records it", async () => {
-    // GIVEN a retrospective-authored skill whose install-meta carries lineage
-    mockReadInstallMeta.mockReturnValue({
+    // GIVEN a retrospective-authored skill whose real install-meta.json
+    // carries lineage
+    seedManagedSkill("triage-inbox", {
       origin: "custom",
       author: "assistant",
       sourceConversationId: "conv-123",
@@ -401,7 +246,7 @@ describe("getSkill — assistant-memory conversation lineage", () => {
 
   test("omits sourceConversationId when install-meta has none", async () => {
     // GIVEN a retrospective-authored skill without recorded lineage
-    mockReadInstallMeta.mockReturnValue({
+    seedManagedSkill("triage-inbox", {
       origin: "custom",
       author: "assistant",
       installedAt: "2026-01-01T00:00:00Z",
@@ -422,7 +267,7 @@ describe("getSkill — assistant-memory conversation lineage", () => {
   test("never exposes lineage on non-assistant-memory origins", async () => {
     // GIVEN a user-installed custom skill that (unexpectedly) carries a
     // sourceConversationId in install-meta
-    mockReadInstallMeta.mockReturnValue({
+    seedManagedSkill("triage-inbox", {
       origin: "custom",
       sourceConversationId: "conv-123",
       installedAt: "2026-01-01T00:00:00Z",

package/src/__tests__/mcp-abort-signal.test.ts

@@ -11,7 +11,6 @@ mock.module("../config/env-registry.js", () => ({
   getDebugStdoutLogs: () => false,
   getIsContainerized: () => false,
   getIsCloud: () => false,
-  isCloudRemote: () => false,
   getCpuLimit: () => undefined,
   getMinikubeStorageSize: () => undefined,
   getProfilerRunId: () => undefined,

package/src/__tests__/mcp-client-auth.test.ts

@@ -11,7 +11,6 @@ mock.module("../config/env-registry.js", () => ({
   getDebugStdoutLogs: () => false,
   getIsContainerized: () => false,
   getIsCloud: () => false,
-  isCloudRemote: () => false,
   getCpuLimit: () => undefined,
   getMinikubeStorageSize: () => undefined,
   getProfilerRunId: () => undefined,

package/src/__tests__/mcp-config-secret-boundary.test.ts

@@ -88,7 +88,6 @@ mock.module("../persistence/embeddings/embedding-backend.js", () => ({
 
 const { ROUTES } =
   await import("../runtime/routes/conversation-query-routes.js");
-const { BadRequestError } = await import("../runtime/routes/errors.js");
 
 function findRoute(operationId: string) {
   const route = ROUTES.find((r) => r.operationId === operationId);
@@ -220,25 +219,30 @@ describe("MCP config secret boundary", () => {
     });
   });
 
-  test("config_patch rejects MCP transport headers so generic writes cannot reintroduce plaintext credentials", async () => {
-    await expect(
-      configPatchRoute.handler({
-        body: {
-          mcp: {
-            servers: {
-              remote: {
-                transport: {
-                  type: "streamable-http",
-                  url: "https://mcp.example.com",
-                  headers: { Authorization: "Bearer mcp-secret" },
-                },
+  test("config_patch strips MCP transport headers so generic writes cannot persist plaintext credentials", async () => {
+    const result = await configPatchRoute.handler({
+      body: {
+        mcp: {
+          servers: {
+            remote: {
+              transport: {
+                type: "streamable-http",
+                url: "https://mcp.example.com",
+                headers: { Authorization: "Bearer mcp-secret" },
               },
             },
           },
         },
-      }),
-    ).rejects.toThrow(BadRequestError);
-    expect(committedRaw()).toBeNull();
+      },
+    });
+
+    // `mcp` is not an AssistantConfigSchema key: the write's schema parse
+    // strips it, so the secret never reaches disk — and the response's
+    // projected workspace view carries no such server either.
+    expect(committedRaw()?.mcp).toBeUndefined();
+    expect(
+      (result as { mcp: { servers: Record<string, unknown> } }).mcp.servers,
+    ).toEqual({});
   });
 
   test("config_patch strips mcp so a full-config round trip cannot write it back", async () => {
@@ -263,34 +267,34 @@ describe("MCP config secret boundary", () => {
     ).toEqual({});
   });
 
-  test("config_set rejects MCP server writes", async () => {
-    await expect(
-      configSetRoute.handler({
-        body: {
-          path: "mcp.servers",
-          value: {
-            remote: {
-              transport: {
-                type: "streamable-http",
-                url: "https://mcp.example.com",
-              },
+  test("config_set drops MCP server writes", async () => {
+    const result = await configSetRoute.handler({
+      body: {
+        path: "mcp.servers",
+        value: {
+          remote: {
+            transport: {
+              type: "streamable-http",
+              url: "https://mcp.example.com",
             },
           },
         },
-      }),
-    ).rejects.toThrow(BadRequestError);
-    expect(committedRaw()).toBeNull();
+      },
+    });
+
+    expect(result).toEqual({ ok: true });
+    expect(committedRaw()?.mcp).toBeUndefined();
   });
 
-  test("config_set rejects direct MCP transport header paths", async () => {
-    await expect(
-      configSetRoute.handler({
-        body: {
-          path: "mcp.servers.remote.transport.headers.Authorization",
-          value: "Bearer mcp-secret",
-        },
-      }),
-    ).rejects.toThrow(BadRequestError);
-    expect(committedRaw()).toBeNull();
+  test("config_set drops direct MCP transport header paths", async () => {
+    const result = await configSetRoute.handler({
+      body: {
+        path: "mcp.servers.remote.transport.headers.Authorization",
+        value: "Bearer mcp-secret",
+      },
+    });
+
+    expect(result).toEqual({ ok: true });
+    expect(committedRaw()?.mcp).toBeUndefined();
   });
 });

package/src/__tests__/mcp-tool-annotations-risk.test.ts

@@ -11,7 +11,6 @@ mock.module("../config/env-registry.js", () => ({
   getDebugStdoutLogs: () => false,
   getIsContainerized: () => false,
   getIsCloud: () => false,
-  isCloudRemote: () => false,
   getCpuLimit: () => undefined,
   getMinikubeStorageSize: () => undefined,
   getProfilerRunId: () => undefined,

package/src/__tests__/plugin-api-store-credential.test.ts

@@ -198,7 +198,10 @@ describe("storeCredential", () => {
 
   test("scrubs the stored value from recent transcripts", async () => {
     await asPlugin(() => storeCredential("acme/api_key", "sk-secret"));
-    expect(scrubSpy).toHaveBeenCalledWith("sk-secret");
+    expect(scrubSpy).toHaveBeenCalledWith("sk-secret", {
+      service: "acme",
+      field: "api_key",
+    });
   });
 
   test("skips the transcript scrub when asked", async () => {