@raishin/vanguard-frontier-agentic 2.5.0 → 2.7.0

package/tests/test-vfa-export-coverage.test.mjs

@@ -35,6 +35,8 @@
  *     16. --dry-run --no-skills omits skill lines.
  *     17. cursor --dry-run emits agent lines but no skill lines (unsupported platform).
  *     18. --dry-run stderr summary reports skill count on skill-capable platform.
+ *     19. codex --all --dry-run emits both agent and skill lines.
+ *     20. codex --dry-run --no-skills omits skill lines.
  *
  *   F. Full CLI flag surface
  *     19. --list exits 0 and prints all agents.
@@ -46,6 +48,8 @@
  *     25. --platform claude (alias) resolves to claude-code.
  *     26. --no-skills writes agent file but no skills directory.
  *     27. --force overwrites existing agent files without error.
+ *     28. codex export writes agent + companion skill and rewrites skill path.
+ *     29. two-stage Codex installer dry-run plans all agents and skills.
  *
  *   G. Error / rejection cases
  *     28. No args → usage text printed, non-zero exit.
@@ -65,6 +69,7 @@ import { fileURLToPath } from "node:url";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const exporter = path.join(repoRoot, "scripts", "export-marketplace-agents.mjs");
+const installer = path.join(repoRoot, "scripts", "install-codex-home.mjs");
 
 const agents = JSON.parse(fs.readFileSync(path.join(repoRoot, "catalog/agents.json"), "utf8"));
 const skills = JSON.parse(fs.readFileSync(path.join(repoRoot, "catalog/skills.json"), "utf8"));
@@ -133,6 +138,12 @@ function run(args) {
   return { stdout: r.stdout ?? "", stderr: r.stderr ?? "", exitCode: r.status ?? 0 };
 }
 
+function runInstaller(args) {
+  const r = spawnSync(process.execPath, [installer, ...args], { encoding: "utf8", timeout: 30000 });
+  if (r.signal === "SIGTERM") fail(`installer timed out (30s) for: ${args.join(" ")}`);
+  return { stdout: r.stdout ?? "", stderr: r.stderr ?? "", exitCode: r.status ?? 0 };
+}
+
 // 5. --provider <p> --all should list the same count as the catalog says.
 {
   const r = run(["--platform", "claude-code", "--provider", "nvidia", "--all", "--dry-run"]);
@@ -518,6 +529,31 @@ function findLeakedSkills(skillNames, expectedProvider) {
   }
 }
 
+// E19: codex --all --dry-run emits both agents and companion skills.
+{
+  const r = run(["--platform", "codex", "--all", "--dry-run"]);
+  const agentCount = (r.stdout.match(/^export agent:/gm) || []).length;
+  const skillCount = (r.stdout.match(/^export skill:/gm) || []).length;
+  const codexAgents = agents.filter((a) => Array.isArray(a.harnesses) && a.harnesses.includes("codex"));
+  if (r.exitCode === 0 && agentCount === codexAgents.length && skillCount === skills.length && /\d+ skill\(s\)/.test(r.stderr)) {
+    ok(`E19 codex --all --dry-run emits agents (${agentCount}) and skills (${skillCount})`);
+  } else {
+    fail(`E19 codex dry-run expected ${codexAgents.length} agents and ${skills.length} skills, got agents=${agentCount} skills=${skillCount}; exit=${r.exitCode}; stderr=${r.stderr.slice(0, 300)}`);
+  }
+}
+
+// E20: codex --dry-run --no-skills emits agent lines but no skill lines.
+{
+  const r = run(["--platform", "codex", "--agents", "aws-iam-least-privilege-review-agent", "--dry-run", "--no-skills"]);
+  const agentCount = (r.stdout.match(/^export agent:/gm) || []).length;
+  const skillCount = (r.stdout.match(/^export skill:/gm) || []).length;
+  if (r.exitCode === 0 && agentCount === 1 && skillCount === 0) {
+    ok("E20 codex --dry-run --no-skills: 1 agent line, 0 skill lines");
+  } else {
+    fail(`E20 expected 1 agent and 0 skills, got agents=${agentCount} skills=${skillCount}; exit=${r.exitCode}`);
+  }
+}
+
 // ── F. Full CLI flag surface ──────────────────────────────────────────────────
 
 // F19: --list exits 0 and emits one line per agent.
@@ -638,6 +674,78 @@ function findLeakedSkills(skillNames, expectedProvider) {
   }
 }
 
+// F28: codex real write installs agent + companion skill and rewrites skill path.
+{
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "vfa-test-codex-skills-"));
+  try {
+    const r = run(["--platform", "codex", "--agents", "aws-iam-least-privilege-review-agent", "--repo", tmpDir]);
+    const agentFile = path.join(tmpDir, ".codex", "agents", "aws-iam-least-privilege-review-agent.toml");
+    const skillDir = path.join(tmpDir, ".codex", "skills", "aws-iam-least-privilege-review");
+    const skillFile = path.join(skillDir, "SKILL.md");
+    const agentText = fs.existsSync(agentFile) ? fs.readFileSync(agentFile, "utf8") : "";
+    const expectedPathLine = `path = ${JSON.stringify(skillDir)}`;
+    if (
+      r.exitCode === 0 &&
+      fs.existsSync(agentFile) &&
+      fs.existsSync(skillFile) &&
+      agentText.includes(expectedPathLine) &&
+      !agentText.includes('path = "skills/aws/aws-iam-least-privilege-review/SKILL.md"')
+    ) {
+      ok("F28 codex export writes agent + skill and rewrites skill path to installed folder");
+    } else {
+      fail(`F28 codex export invalid: exit=${r.exitCode} agent=${fs.existsSync(agentFile)} skill=${fs.existsSync(skillFile)} hasExpectedPath=${agentText.includes(expectedPathLine)} stderr=${r.stderr.slice(0, 300)}`);
+    }
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+// F28b: skill bundling refuses destination symlinks even with --force.
+{
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "vfa-test-skill-symlink-"));
+  const outsideDir = fs.mkdtempSync(path.join(os.tmpdir(), "vfa-test-outside-"));
+  const outsideFile = path.join(outsideDir, "OUTSIDE_SENTINEL");
+  try {
+    const skillDir = path.join(tmpDir, ".codex", "skills", "aws-iam-least-privilege-review");
+    fs.mkdirSync(skillDir, { recursive: true });
+    fs.writeFileSync(outsideFile, "ORIGINAL_OUTSIDE_SENTINEL\n");
+    fs.symlinkSync(outsideFile, path.join(skillDir, "SKILL.md"));
+    const r = run([
+      "--platform", "codex",
+      "--agents", "aws-iam-least-privilege-review-agent",
+      "--repo", tmpDir,
+      "--force",
+    ]);
+    const outsideText = fs.readFileSync(outsideFile, "utf8");
+    if (r.exitCode !== 0 && /symbolic link destination in skill tree/i.test(r.stderr) && outsideText === "ORIGINAL_OUTSIDE_SENTINEL\n") {
+      ok("F28b codex skill export rejects destination symlink and preserves outside file");
+    } else {
+      fail(`F28b expected symlink rejection without outside overwrite; exit=${r.exitCode} preserved=${outsideText === "ORIGINAL_OUTSIDE_SENTINEL\n"} stderr=${r.stderr.slice(0, 300)}`);
+    }
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    fs.rmSync(outsideDir, { recursive: true, force: true });
+  }
+}
+
+// F29: two-stage installer dry-run composes marketplace-safe export path.
+{
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "vfa-test-two-stage-"));
+  try {
+    const r = runInstaller(["--dry-run", "--skip-marketplace", "--repo", tmpDir]);
+    const combined = `${r.stdout}
+${r.stderr}`;
+    const planMatch = /(\d+) agent\(s\), (\d+) skill\(s\) planned/.exec(combined);
+    if (r.exitCode === 0 && planMatch && parseInt(planMatch[1], 10) > 0 && parseInt(planMatch[2], 10) > 0) {
+      ok(`F29 two-stage Codex installer dry-run plans all agents and skills (${planMatch[1]} agents, ${planMatch[2]} skills)`);
+    } else {
+      fail(`F29 installer dry-run did not plan expected agents/skills; exit=${r.exitCode} output=${combined.slice(-500)}`);
+    }
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
 // ── G. Error / rejection cases ────────────────────────────────────────────────
 
 // G28: No args → usage text printed to stderr, non-zero exit.

package/tests/validate-codex-marketplace.py

@@ -116,12 +116,34 @@ def main() -> int:
                 f"{prefix} ({name}): plugin.json name {manifest.get('name')!r} must equal marketplace entry name {name!r}",
             )
 
-        # Version parity for the primary plugin
+        # Version parity and install-surface checks for the primary plugin.
         if name == "vanguard-frontier-agentic":
             if manifest.get("version") != pkg.get("version"):
                 errors.append(
                     f"{prefix} ({name}): plugin.json version {manifest.get('version')!r} != package.json {pkg.get('version')!r}",
                 )
+            if manifest.get("skills") != "./skills/":
+                errors.append(
+                    f"{prefix} ({name}): plugin.json must declare skills './skills/' for the bundled Codex install skill",
+                )
+            install_skill = plugin_dir / "skills" / "vanguard-frontier-agentic-install" / "SKILL.md"
+            if not install_skill.is_file():
+                errors.append(
+                    f"{prefix} ({name}): bundled install skill is missing at {install_skill.relative_to(REPO)}",
+                )
+
+        skills_path = manifest.get("skills")
+        if skills_path is not None:
+            if not isinstance(skills_path, str) or not skills_path.startswith("./"):
+                errors.append(f"{prefix} ({name}): plugin.json skills path must be a './'-prefixed string")
+            else:
+                skills_dir = (plugin_dir / skills_path).resolve()
+                if not skills_dir.is_relative_to(plugin_dir.resolve()):
+                    errors.append(f"{prefix} ({name}): plugin.json skills path must stay inside plugin root")
+                elif not skills_dir.is_dir():
+                    errors.append(f"{prefix} ({name}): plugin.json skills directory {skills_path!r} is missing")
+                elif not any(skills_dir.glob("*/SKILL.md")):
+                    errors.append(f"{prefix} ({name}): plugin.json skills directory has no */SKILL.md entries")
 
         policy = plugin.get("policy") or {}
         install = policy.get("installation")