@mycadet/assistant 0.12.9 → 0.12.10

package/src/cli/lib/__tests__/plugin-marketplace.test.ts

@@ -1,384 +0,0 @@
-/**
- * Tests for {@link fetchMarketplaceEntries} and {@link resolveMarketplaceSource}.
- *
- * Network is replaced with an in-memory fixture passed via the `fetch`
- * dependency — no globals are monkey-patched.
- */
-
-import { describe, expect, test } from "bun:test";
-
-import type { FetchLike } from "../fetch-like.js";
-import {
-  fetchMarketplaceEntries,
-  type MarketplaceEntry,
-  MarketplaceFetchError,
-  resolveMarketplaceSource,
-} from "../plugin-marketplace.js";
-
-const MANIFEST_URL_PREFIX =
-  "https://api.github.com/repos/vargasjr-dev/mycadet/contents/plugins/marketplace.json";
-
-// External marketplace refs must be full commit SHAs (immutable). Fixtures use
-// realistic 40-char hex object names rather than tags/branches.
-const CAVEMAN_SHA = "63a91ecadbf4c4719a4602a5abb00883f9966034";
-const NESTED_SHA = "0123456789abcdef0123456789abcdef01234567";
-
-/** Serve `body` (any value) as the raw manifest file at the manifest URL. */
-function manifestFetch(body: unknown, status = 200, raw?: string): FetchLike {
-  return (async (input: RequestInfo | URL) => {
-    const url = typeof input === "string" ? input : input.toString();
-    if (!url.startsWith(MANIFEST_URL_PREFIX)) {
-      return new Response("unexpected url: " + url, { status: 500 });
-    }
-    if (status !== 200) {
-      return new Response("error", { status });
-    }
-    return new Response(raw ?? JSON.stringify(body), { status: 200 });
-  }) as FetchLike;
-}
-
-const VALID_MANIFEST = {
-  name: "mycadet",
-  owner: { name: "Cadet" },
-  plugins: [
-    {
-      name: "caveman",
-      source: {
-        source: "github",
-        repo: "JuliusBrussee/caveman",
-        ref: CAVEMAN_SHA,
-      },
-      description: "Ultra-compressed communication mode.",
-      category: "productivity",
-    },
-    {
-      name: "nested",
-      source: {
-        source: "github",
-        repo: "acme/monorepo",
-        path: "packages/nested",
-        ref: NESTED_SHA,
-      },
-    },
-  ],
-};
-
-describe("fetchMarketplaceEntries", () => {
-  test("parses a valid manifest and returns its plugin entries", async () => {
-    // GIVEN a canonical repo serving a valid marketplace manifest
-    const fetch = manifestFetch(VALID_MANIFEST);
-
-    // WHEN we fetch the marketplace entries at a ref
-    const entries = await fetchMarketplaceEntries({ fetch }, { ref: "main" });
-
-    // THEN both whitelisted plugins are returned with their pinned sources
-    expect(entries.map((e) => e.name)).toEqual(["caveman", "nested"]);
-    expect(entries[0]!.source).toEqual({
-      source: "github",
-      repo: "JuliusBrussee/caveman",
-      ref: CAVEMAN_SHA,
-    });
-    expect(entries[1]!.source.path).toBe("packages/nested");
-  });
-
-  test("skips an entry with an unknown future source kind", async () => {
-    const fetch = manifestFetch({
-      ...VALID_MANIFEST,
-      plugins: [
-        VALID_MANIFEST.plugins[0],
-        {
-          name: "future-plugin",
-          source: { source: "registry", package: "future-plugin" },
-        },
-        VALID_MANIFEST.plugins[1],
-      ],
-    });
-
-    const entries = await fetchMarketplaceEntries({ fetch }, { ref: "main" });
-
-    expect(entries.map((entry) => entry.name)).toEqual(["caveman", "nested"]);
-  });
-
-  test("forwards the ref to the GitHub Contents API", async () => {
-    // GIVEN a fixture that records the ref query parameter
-    let seenRef: string | undefined;
-    const fetch: FetchLike = (async (input: RequestInfo | URL) => {
-      const url = typeof input === "string" ? input : input.toString();
-      seenRef = /[?&]ref=([^&]+)/.exec(url)?.[1];
-      return new Response(JSON.stringify(VALID_MANIFEST), { status: 200 });
-    }) as FetchLike;
-
-    // WHEN we fetch at an explicit ref
-    await fetchMarketplaceEntries({ fetch }, { ref: "feat-branch" });
-
-    // THEN the ref reaches GitHub
-    expect(seenRef).toBe("feat-branch");
-  });
-
-  test("treats a missing manifest (404) as an empty whitelist", async () => {
-    // GIVEN no manifest exists at this ref
-    const fetch = manifestFetch(null, 404);
-
-    // WHEN we fetch the entries
-    const entries = await fetchMarketplaceEntries({ fetch }, { ref: "main" });
-
-    // THEN the absence is a normal empty result, not an error
-    expect(entries).toEqual([]);
-  });
-
-  test("throws MarketplaceFetchError on non-404 HTTP failure", async () => {
-    // GIVEN GitHub returns a server error
-    const fetch = manifestFetch(null, 503);
-
-    // WHEN / THEN the failure surfaces as a typed error
-    await expect(
-      fetchMarketplaceEntries({ fetch }, { ref: "main" }),
-    ).rejects.toBeInstanceOf(MarketplaceFetchError);
-  });
-
-  test("throws MarketplaceFetchError on non-JSON body", async () => {
-    // GIVEN the manifest body is not valid JSON
-    const fetch = manifestFetch(undefined, 200, "{ not json");
-
-    // WHEN / THEN parsing fails loudly
-    await expect(
-      fetchMarketplaceEntries({ fetch }, { ref: "main" }),
-    ).rejects.toBeInstanceOf(MarketplaceFetchError);
-  });
-
-  test("rejects a mutable tag or branch ref (must be a full commit SHA)", async () => {
-    // GIVEN an entry whose source pins a mutable tag rather than a commit SHA
-    const fetch = manifestFetch({
-      name: "x",
-      plugins: [
-        {
-          name: "caveman",
-          source: {
-            source: "github",
-            repo: "JuliusBrussee/caveman",
-            ref: "v1.8.2",
-          },
-        },
-      ],
-    });
-
-    // WHEN / THEN the mutable ref is rejected: a retag could repoint it at
-    // attacker code the daemon later dynamically imports.
-    await expect(
-      fetchMarketplaceEntries({ fetch }, { ref: "main" }),
-    ).rejects.toBeInstanceOf(MarketplaceFetchError);
-  });
-
-  test("rejects an abbreviated commit SHA", async () => {
-    // GIVEN an entry whose source uses a short (ambiguous, non-pinning) SHA
-    const fetch = manifestFetch({
-      name: "x",
-      plugins: [
-        {
-          name: "caveman",
-          source: {
-            source: "github",
-            repo: "JuliusBrussee/caveman",
-            ref: "63a91ec",
-          },
-        },
-      ],
-    });
-
-    // WHEN / THEN only a full object name pins the install immutably
-    await expect(
-      fetchMarketplaceEntries({ fetch }, { ref: "main" }),
-    ).rejects.toBeInstanceOf(MarketplaceFetchError);
-  });
-
-  test("rejects a manifest entry missing a pinned ref", async () => {
-    // GIVEN an entry whose source omits the required ref
-    const fetch = manifestFetch({
-      name: "x",
-      plugins: [
-        { name: "floating", source: { source: "github", repo: "a/b" } },
-      ],
-    });
-
-    // WHEN / THEN schema validation rejects the unpinned source
-    await expect(
-      fetchMarketplaceEntries({ fetch }, { ref: "main" }),
-    ).rejects.toBeInstanceOf(MarketplaceFetchError);
-  });
-
-  test("parses and round-trips an entry with a valid icon emoji", async () => {
-    // GIVEN an entry carrying a curated single-emoji icon
-    const fetch = manifestFetch({
-      name: "x",
-      plugins: [
-        {
-          name: "caveman",
-          source: {
-            source: "github",
-            repo: "JuliusBrussee/caveman",
-            ref: CAVEMAN_SHA,
-          },
-          icon: "🦣",
-        },
-      ],
-    });
-
-    // WHEN we fetch the entries
-    const entries = await fetchMarketplaceEntries({ fetch }, { ref: "main" });
-
-    // THEN the emoji is preserved on the parsed entry
-    expect(entries[0]!.icon).toBe("🦣");
-  });
-
-  test("accepts a multi-code-unit ZWJ emoji (bounded by code points)", async () => {
-    // GIVEN the family ZWJ emoji: one grapheme, 7 code points, 11 UTF-16 units.
-    const fetch = manifestFetch({
-      name: "x",
-      plugins: [
-        {
-          name: "caveman",
-          source: {
-            source: "github",
-            repo: "JuliusBrussee/caveman",
-            ref: CAVEMAN_SHA,
-          },
-          icon: "👩‍👩‍👧‍👦",
-        },
-      ],
-    });
-
-    // WHEN we fetch the entries
-    const entries = await fetchMarketplaceEntries({ fetch }, { ref: "main" });
-
-    // THEN the ZWJ emoji survives validation (would fail under `.length`)
-    expect(entries[0]!.icon).toBe("👩‍👩‍👧‍👦");
-  });
-
-  test("rejects an over-long icon string", async () => {
-    // GIVEN an icon far longer than a single emoji
-    const fetch = manifestFetch({
-      name: "x",
-      plugins: [
-        {
-          name: "caveman",
-          source: {
-            source: "github",
-            repo: "JuliusBrussee/caveman",
-            ref: CAVEMAN_SHA,
-          },
-          icon: "not-an-emoji-just-text",
-        },
-      ],
-    });
-
-    // WHEN / THEN the refine rejects it
-    await expect(
-      fetchMarketplaceEntries({ fetch }, { ref: "main" }),
-    ).rejects.toBeInstanceOf(MarketplaceFetchError);
-  });
-
-  test("rejects an icon that looks like a URL or path", async () => {
-    // GIVEN an icon that is a URL rather than an emoji
-    const fetch = manifestFetch({
-      name: "x",
-      plugins: [
-        {
-          name: "caveman",
-          source: {
-            source: "github",
-            repo: "JuliusBrussee/caveman",
-            ref: CAVEMAN_SHA,
-          },
-          icon: "http://x",
-        },
-      ],
-    });
-
-    // WHEN / THEN a URL/path-shaped icon is rejected by the refine
-    await expect(
-      fetchMarketplaceEntries({ fetch }, { ref: "main" }),
-    ).rejects.toBeInstanceOf(MarketplaceFetchError);
-  });
-
-  test("rejects a path that escapes the repo root", async () => {
-    // GIVEN an entry whose path contains a parent-segment escape
-    const fetch = manifestFetch({
-      name: "x",
-      plugins: [
-        {
-          name: "escape",
-          source: {
-            source: "github",
-            repo: "a/b",
-            path: "../../etc",
-            ref: "main",
-          },
-        },
-      ],
-    });
-
-    // WHEN / THEN the unsafe path is rejected
-    await expect(
-      fetchMarketplaceEntries({ fetch }, { ref: "main" }),
-    ).rejects.toBeInstanceOf(MarketplaceFetchError);
-  });
-});
-
-describe("resolveMarketplaceSource", () => {
-  const entries: readonly MarketplaceEntry[] = [
-    {
-      name: "caveman",
-      source: {
-        source: "github",
-        repo: "JuliusBrussee/caveman",
-        ref: CAVEMAN_SHA,
-      },
-    },
-    {
-      name: "nested",
-      source: {
-        source: "github",
-        repo: "acme/monorepo",
-        path: "packages/nested",
-        ref: NESTED_SHA,
-      },
-    },
-  ];
-
-  test("resolves a repo-root plugin to owner/repo with empty path", () => {
-    // GIVEN whitelisted entries
-    // WHEN resolving a name whose source has no sub-path
-    const resolved = resolveMarketplaceSource("caveman", entries);
-
-    // THEN the owner/repo split out and path defaults to repo root
-    expect(resolved).toEqual({
-      kind: "github",
-      owner: "JuliusBrussee",
-      repo: "caveman",
-      path: "",
-      ref: CAVEMAN_SHA,
-    });
-  });
-
-  test("resolves a sub-path plugin to its directory", () => {
-    // GIVEN whitelisted entries
-    // WHEN resolving a name whose source pins a sub-path
-    const resolved = resolveMarketplaceSource("nested", entries);
-
-    // THEN the sub-path is preserved
-    expect(resolved).toEqual({
-      kind: "github",
-      owner: "acme",
-      repo: "monorepo",
-      path: "packages/nested",
-      ref: NESTED_SHA,
-    });
-  });
-
-  test("returns null for a name not in the whitelist", () => {
-    // GIVEN whitelisted entries
-    // WHEN resolving an unknown name
-    // THEN no source is returned (the name is not installable)
-    expect(resolveMarketplaceSource("unknown", entries)).toBeNull();
-  });
-});

package/src/cli/lib/__tests__/plugin-pin-history.test.ts

@@ -1,164 +0,0 @@
-/**
- * Tests for {@link listPinHistory} and {@link resolvePinToMarketplaceCommit}.
- *
- * The marketplace manifest stores only the current pin, so pin history is
- * reconstructed by walking the manifest's commit history and reading the
- * plugin's pin at each commit. The fixtures model that timeline with an
- * in-memory `fetch`: a commits-list endpoint plus a manifest-at-ref endpoint
- * keyed by commit SHA.
- */
-
-import { describe, expect, test } from "bun:test";
-
-import type { FetchLike } from "../fetch-like.js";
-import {
-  listPinHistory,
-  resolvePinToMarketplaceCommit,
-} from "../plugin-pin-history.js";
-
-const PIN_A = "a".repeat(40);
-const PIN_B = "b".repeat(40);
-const PIN_C = "c".repeat(40);
-
-// Marketplace-manifest commits, newest → oldest. `C2B` touches the manifest
-// without changing this plugin's pin (a bump for some other plugin), so it must
-// collapse into the same distinct pin as `C3`.
-const C3 = "3".repeat(40);
-const C2B = "d".repeat(40);
-const C2 = "2".repeat(40);
-const C1 = "1".repeat(40);
-
-const COMMIT_DATES: Record<string, string> = {
-  [C3]: "2026-06-10T00:00:00.000Z",
-  [C2B]: "2026-06-08T00:00:00.000Z",
-  [C2]: "2026-06-05T00:00:00.000Z",
-  [C1]: "2026-06-01T00:00:00.000Z",
-};
-
-/** Plugin pin resolved from the manifest at each ref (`main` = current tip). */
-const PIN_BY_REF: Record<string, string> = {
-  main: PIN_C,
-  [C3]: PIN_C,
-  [C2B]: PIN_C,
-  [C2]: PIN_B,
-  [C1]: PIN_A,
-};
-
-function manifest(pin: string): string {
-  return JSON.stringify({
-    name: "cadet",
-    plugins: [
-      {
-        name: "level-up",
-        source: { source: "github", repo: "example-org/level-up", ref: pin },
-      },
-    ],
-  });
-}
-
-/**
- * Build a `fetch` serving the commits list and the manifest at each ref.
- * `commits` is the newest-first commit list the API returns.
- */
-function makeFetch(commits: string[] = [C3, C2B, C2, C1]): FetchLike {
-  return (async (input: RequestInfo | URL) => {
-    const url = typeof input === "string" ? input : input.toString();
-    if (url.includes("/commits?")) {
-      const body = commits.map((sha) => ({
-        sha,
-        commit: { committer: { date: COMMIT_DATES[sha] } },
-      }));
-      return new Response(JSON.stringify(body), { status: 200 });
-    }
-    const m = url.match(/contents\/plugins\/marketplace\.json\?ref=([^&]+)/);
-    if (m) {
-      const ref = decodeURIComponent(m[1]!);
-      const pin = PIN_BY_REF[ref];
-      if (!pin) {
-        return new Response("not found", { status: 404 });
-      }
-      return new Response(manifest(pin), { status: 200 });
-    }
-    return new Response("unexpected url: " + url, { status: 500 });
-  }) as FetchLike;
-}
-
-describe("listPinHistory", () => {
-  test("lists distinct pins newest-first, collapsing unchanged revisions", async () => {
-    // GIVEN a manifest history with three distinct pins (one commit left the
-    // plugin's pin unchanged)
-    const history = await listPinHistory("level-up", { fetch: makeFetch() });
-
-    // THEN one entry per distinct pin, newest first, each tagged with the
-    // newest marketplace commit that carries it
-    expect(history).toEqual([
-      {
-        pin: PIN_C,
-        marketplaceCommit: C3,
-        promotedAt: COMMIT_DATES[C3]!,
-        current: true,
-      },
-      {
-        pin: PIN_B,
-        marketplaceCommit: C2,
-        promotedAt: COMMIT_DATES[C2]!,
-        current: false,
-      },
-      {
-        pin: PIN_A,
-        marketplaceCommit: C1,
-        promotedAt: COMMIT_DATES[C1]!,
-        current: false,
-      },
-    ]);
-  });
-
-  test("honors the limit (newest pins win)", async () => {
-    const history = await listPinHistory(
-      "level-up",
-      { fetch: makeFetch() },
-      { limit: 2 },
-    );
-    expect(history.map((e) => e.pin)).toEqual([PIN_C, PIN_B]);
-  });
-
-  test("returns an empty list for a plugin absent from every revision", async () => {
-    const history = await listPinHistory("ghost", { fetch: makeFetch() });
-    expect(history).toEqual([]);
-  });
-
-  test("returns an empty list when the manifest has no commit history", async () => {
-    const history = await listPinHistory("level-up", {
-      fetch: makeFetch([]),
-    });
-    expect(history).toEqual([]);
-  });
-});
-
-describe("resolvePinToMarketplaceCommit", () => {
-  test("maps a reviewed pin to the marketplace commit that introduced it", async () => {
-    const entry = await resolvePinToMarketplaceCommit("level-up", PIN_B, {
-      fetch: makeFetch(),
-    });
-    expect(entry?.marketplaceCommit).toBe(C2);
-    expect(entry?.pin).toBe(PIN_B);
-  });
-
-  test("is case-insensitive on the pin SHA", async () => {
-    const entry = await resolvePinToMarketplaceCommit(
-      "level-up",
-      PIN_B.toUpperCase(),
-      { fetch: makeFetch() },
-    );
-    expect(entry?.marketplaceCommit).toBe(C2);
-  });
-
-  test("returns null for a pin not in the reviewed history", async () => {
-    const entry = await resolvePinToMarketplaceCommit(
-      "level-up",
-      "f".repeat(40),
-      { fetch: makeFetch() },
-    );
-    expect(entry).toBeNull();
-  });
-});