@simplysm/sd-cli 14.2.14 → 14.2.18

package/tests/commands/deployment-phase.acc.spec.ts

@@ -8,6 +8,9 @@ const mocks = {
   fsx: {
     readJson: vi.spyOn(fsx, "readJson"),
     copy: vi.spyOn(fsx, "copy"),
+    mkdir: vi.spyOn(fsx, "mkdir"),
+    readdir: vi.spyOn(fsx, "readdir"),
+    rm: vi.spyOn(fsx, "rm"),
   },
   storageConnect: vi.spyOn(StorageFactory, "connect"),
 };
@@ -32,9 +35,30 @@ function createMockLogger() {
   } as unknown as ReturnType<typeof import("@simplysm/core-common").createLogger>;
 }
 
+/** npm 호출 중 실제 배포(publish)만 골라낸다. dist-tag 조회(`npm view`)와 구분하기 위함 */
+function isNpmPublish(cmd: string, args?: string[]): boolean {
+  return cmd === "npm" && args?.[0] === "publish";
+}
+
+/** 독립 패키지들이 한 레벨에 오도록 의존성 없는 package.json 을 돌려준다 */
+function mockIndependentPackages(): void {
+  mocks.fsx.readJson.mockImplementation(((p: string) => {
+    const name = path.basename(path.dirname(p));
+    return { name: `@simplysm/${name}`, version: "14.0.1", dependencies: {} };
+  }) as never);
+}
+
 describe("runDeployment", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    process.exitCode = undefined;
+    // npm 배포는 pnpm pack 이 만든 tarball 을 npm publish 로 올린다
+    mocks.fsx.mkdir.mockResolvedValue(undefined);
+    mocks.fsx.rm.mockResolvedValue(undefined);
+    mocks.fsx.readdir.mockResolvedValue(["pkg-14.0.1.tgz"]);
+    // clearAllMocks 는 호출 기록만 지우므로, 구현이 테스트 간에 새지 않도록 매번 초기화한다
+    mocks.execa.mockImplementation((() => ({ stdout: "", stderr: "", exitCode: 0 })) as never);
+    mocks.storageConnect.mockResolvedValue(undefined);
   });
 
   it("deploys packages in dependency level order", async () => {
@@ -47,7 +71,11 @@ describe("runDeployment", () => {
     );
     mocks.fsx.readJson.mockImplementation(((p: string) => {
       if (p.includes("pkg-b")) {
-        return { name: "@simplysm/pkg-b", version: "14.0.1", dependencies: { "@simplysm/pkg-a": "~14.0.0" } };
+        return {
+          name: "@simplysm/pkg-b",
+          version: "14.0.1",
+          dependencies: { "@simplysm/pkg-a": "~14.0.0" },
+        };
       }
       return { name: "@simplysm/pkg-a", version: "14.0.1", dependencies: {} };
     }) as never);
@@ -62,6 +90,7 @@ describe("runDeployment", () => {
       CWD,
       logger,
       false,
+      undefined,
     );
 
     const aIdx = publishOrder.indexOf("pkg-a");
@@ -69,12 +98,77 @@ describe("runDeployment", () => {
     expect(aIdx).toBeLessThan(bIdx);
   });
 
-  it("retries failed publish up to 3 times then sets exitCode", async () => {
+  it("runs npm publishes one at a time so their auth prompts cannot collide", async () => {
+    mockIndependentPackages();
+
+    let active = 0;
+    let maxActive = 0;
+    mocks.execa.mockImplementation(((cmd: string, args?: string[]) => {
+      if (!isNpmPublish(cmd, args)) return { stdout: "", stderr: "", exitCode: 0 };
+      active++;
+      maxActive = Math.max(maxActive, active);
+      return new Promise((resolve) => {
+        setTimeout(() => {
+          active--;
+          resolve({ stdout: "", stderr: "", exitCode: 0 });
+        }, 10);
+      });
+    }) as never);
+
+    const logger = createMockLogger();
+    await runDeployment(
+      [
+        { name: "pkg-a", path: pkgPath("pkg-a"), config: { type: "npm" } },
+        { name: "pkg-b", path: pkgPath("pkg-b"), config: { type: "npm" } },
+        { name: "pkg-c", path: pkgPath("pkg-c"), config: { type: "npm" } },
+      ],
+      "14.0.1",
+      CWD,
+      logger,
+      false,
+      undefined,
+    );
+
+    expect(maxActive).toBe(1);
+    expect(process.exitCode).toBeUndefined();
+  });
+
+  it("still runs non-npm publishes in parallel", async () => {
+    mockIndependentPackages();
+
+    let active = 0;
+    let maxActive = 0;
+    mocks.storageConnect.mockImplementation(async () => {
+      active++;
+      maxActive = Math.max(maxActive, active);
+      await new Promise((resolve) => setTimeout(resolve, 10));
+      active--;
+    });
+
+    const logger = createMockLogger();
+    await runDeployment(
+      [
+        { name: "pkg-a", path: pkgPath("pkg-a"), config: { type: "ftp", host: "h" } },
+        { name: "pkg-b", path: pkgPath("pkg-b"), config: { type: "ftp", host: "h" } },
+      ],
+      "14.0.1",
+      CWD,
+      logger,
+      false,
+      undefined,
+    );
+
+    expect(maxActive).toBe(2);
+    expect(process.exitCode).toBeUndefined();
+  });
+
+  it("does not retry a failed npm publish", async () => {
     let publishAttempts = 0;
-    mocks.execa.mockImplementation(() => {
+    mocks.execa.mockImplementation(((cmd: string, args?: string[]) => {
+      if (!isNpmPublish(cmd, args)) return { stdout: "", stderr: "", exitCode: 0 };
       publishAttempts++;
       throw new Error("publish failed");
-    });
+    }) as never);
     mocks.fsx.readJson.mockResolvedValue({
       name: "@simplysm/pkg-a",
       version: "14.0.1",
@@ -88,22 +182,43 @@ describe("runDeployment", () => {
       CWD,
       logger,
       false,
+      undefined,
+    );
+
+    // 재시도하면 npm 인증 UI 가 다시 뜨고, 인증·권한·버전 충돌은 재시도해도 같은 결과다
+    expect(publishAttempts).toBe(1);
+    expect(process.exitCode).toBe(1);
+  });
+
+  it("still retries a failed storage publish up to 3 times", async () => {
+    mockIndependentPackages();
+    let attempts = 0;
+    mocks.storageConnect.mockImplementation(() => {
+      attempts++;
+      throw new Error("connection reset");
+    });
+
+    const logger = createMockLogger();
+    await runDeployment(
+      [{ name: "pkg-a", path: pkgPath("pkg-a"), config: { type: "ftp", host: "h" } }],
+      "14.0.1",
+      CWD,
+      logger,
+      false,
+      undefined,
     );
 
-    expect(publishAttempts).toBe(3);
+    expect(attempts).toBe(3);
     expect(process.exitCode).toBe(1);
   });
 
   it("reports partially deployed packages on failure", async () => {
-    mocks.fsx.readJson.mockImplementation(((p: string) => {
-      const name = path.basename(path.dirname(p));
-      return { name: `@simplysm/${name}`, version: "14.0.1", dependencies: {} };
-    }) as never);
+    mockIndependentPackages();
 
     // pkg-a succeeds, pkg-b fails
     mocks.execa.mockImplementation(
-      ((_cmd: string, _args?: string[], opts?: { cwd?: string }) => {
-        if (opts?.cwd?.includes("pkg-b")) {
+      ((cmd: string, args?: string[], opts?: { cwd?: string }) => {
+        if (isNpmPublish(cmd, args) && opts?.cwd?.includes("pkg-b")) {
           throw new Error("publish failed");
         }
         return { stdout: "", stderr: "", exitCode: 0 };
@@ -120,6 +235,7 @@ describe("runDeployment", () => {
       CWD,
       logger,
       false,
+      undefined,
     );
 
     expect(process.exitCode).toBe(1);
@@ -130,4 +246,25 @@ describe("runDeployment", () => {
     );
     expect(hasPartialMsg).toBe(true);
   });
+
+  it("passes the OTP through to npm publish", async () => {
+    mockIndependentPackages();
+    const npmArgs: string[][] = [];
+    mocks.execa.mockImplementation(((cmd: string, args?: string[]) => {
+      if (isNpmPublish(cmd, args)) npmArgs.push(args ?? []);
+      return { stdout: "", stderr: "", exitCode: 0 };
+    }) as never);
+
+    const logger = createMockLogger();
+    await runDeployment(
+      [{ name: "pkg-a", path: pkgPath("pkg-a"), config: { type: "npm" } }],
+      "14.0.1",
+      CWD,
+      logger,
+      false,
+      "123456",
+    );
+
+    expect(npmArgs[0][npmArgs[0].indexOf("--otp") + 1]).toBe("123456");
+  });
 });

package/tests/commands/npm-publisher.acc.spec.ts

@@ -0,0 +1,360 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import path from "path";
+import semver from "semver";
+import { cpx, fsx } from "@simplysm/core-node";
+
+const mocks = {
+  spawn: vi.spyOn(cpx, "spawn"),
+  mkdir: vi.spyOn(fsx, "mkdir"),
+  readdir: vi.spyOn(fsx, "readdir"),
+  rm: vi.spyOn(fsx, "rm"),
+  readJson: vi.spyOn(fsx, "readJson"),
+};
+
+import { publishNpm, validateOtp } from "../../src/commands/publish/npm-publisher";
+
+const OTP = "123456";
+const TARBALL = "simplysm-pkg-a-14.0.1.tgz";
+
+function createMockLogger() {
+  return {
+    info: vi.fn(),
+    debug: vi.fn(),
+    error: vi.fn(),
+    warn: vi.fn(),
+    start: vi.fn(),
+    success: vi.fn(),
+    fail: vi.fn(),
+  } as unknown as ReturnType<typeof import("@simplysm/core-common").createLogger>;
+}
+
+function loggedMessages(logger: ReturnType<typeof createMockLogger>): string {
+  const calls = [
+    ...(logger.debug as unknown as ReturnType<typeof vi.fn>).mock.calls,
+    ...(logger.info as unknown as ReturnType<typeof vi.fn>).mock.calls,
+  ];
+  return calls.map((c: unknown[]) => String(c[0])).join("\n");
+}
+
+interface SpawnCall {
+  cmd: string;
+  args: string[];
+  opts: { cwd?: string; stdio?: unknown };
+}
+
+/**
+ * cpx.spawn 호출을 수집한다.
+ *
+ * `npm view <pkg> dist-tags.latest` 응답만 `registryLatest` 로 흉내내고, 나머지는 성공 처리한다.
+ * 반환 배열에는 publish 파이프라인 호출(pack, publish)만 담긴다.
+ */
+function captureSpawns(registryLatest?: string): SpawnCall[] {
+  const calls: SpawnCall[] = [];
+  mocks.spawn.mockImplementation(((
+    cmd: string,
+    args?: string[],
+    opts?: { cwd?: string; stdio?: unknown },
+  ) => {
+    const argList = args ?? [];
+    if (cmd === "npm" && argList[0] === "view") {
+      if (registryLatest == null) throw new Error("E404 not found");
+      return { stdout: `${registryLatest}\n`, stderr: "", exitCode: 0 };
+    }
+    calls.push({ cmd, args: argList, opts: opts ?? {} });
+    return { stdout: "", stderr: "", exitCode: 0 };
+  }) as never);
+  return calls;
+}
+
+describe("validateOtp", () => {
+  it("accepts 6 digits and trims", () => {
+    expect(validateOtp(" 012345 ")).toBe("012345");
+  });
+
+  it("rejects anything else", () => {
+    for (const bad of ["12345", "1234567", "abcdef", "123456; rm -rf /", ""]) {
+      expect(() => validateOtp(bad)).toThrow("OTP 는 6자리 숫자여야 합니다.");
+    }
+  });
+});
+
+describe("publishNpm", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.mkdir.mockResolvedValue(undefined);
+    mocks.rm.mockResolvedValue(undefined);
+    mocks.readdir.mockResolvedValue([TARBALL]);
+    mocks.readJson.mockResolvedValue({ name: "@simplysm/pkg-a" });
+  });
+
+  it("packs with pnpm and publishes the tarball with npm", async () => {
+    const calls = captureSpawns();
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, undefined);
+
+    expect(calls).toHaveLength(2);
+    // workspace: 치환과 publishConfig 머지는 pnpm pack 이 해준다
+    expect(calls[0].cmd).toBe("pnpm");
+    expect(calls[0].args[0]).toBe("pack");
+    // 2FA 인증은 npm 이 처리하므로 tarball 을 npm 으로 올린다
+    expect(calls[1].cmd).toBe("npm");
+    expect(calls[1].args[0]).toBe("publish");
+    expect(calls[1].args.join(" ")).toContain(TARBALL);
+    expect(calls[1].args[calls[1].args.indexOf("--access") + 1]).toBe("public");
+  });
+
+  it("looks up the registry latest by the npm package name, not the directory name", async () => {
+    const viewed: string[] = [];
+    mocks.spawn.mockImplementation(((cmd: string, args?: string[]) => {
+      const argList = args ?? [];
+      if (cmd === "npm" && argList[0] === "view") {
+        viewed.push(argList[1]);
+        return { stdout: "14.2.14\n", stderr: "", exitCode: 0 };
+      }
+      return { stdout: "", stderr: "", exitCode: 0 };
+    }) as never);
+    mocks.readJson.mockResolvedValue({ name: "@simplysm/core-common" });
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/core-common", "core-common", "14.2.15", logger, false, undefined);
+
+    expect(viewed).toEqual(['"@simplysm/core-common"']);
+  });
+
+  it("hands the terminal over to npm so it can run its own auth flow", async () => {
+    const calls = captureSpawns();
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, undefined);
+
+    // pack 은 로그를 캡처하고, publish 는 TTY 를 그대로 물려준다
+    expect(calls[0].opts.stdio).toBeUndefined();
+    expect(calls[1].opts.stdio).toBe("inherit");
+  });
+
+  it("cleans up the temporary tarball directory when pack fails", async () => {
+    mocks.spawn.mockImplementation(() => {
+      throw new Error("pack failed");
+    });
+
+    const logger = createMockLogger();
+    await expect(
+      publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, undefined),
+    ).rejects.toThrow("pack failed");
+
+    expect(mocks.rm).toHaveBeenCalledTimes(1);
+    expect(String(mocks.rm.mock.calls[0][0])).toContain("sd-cli-pack-pkg-a");
+  });
+
+  it("cleans up the temporary tarball directory when publish fails", async () => {
+    mocks.spawn.mockImplementation(((cmd: string, args?: string[]) => {
+      if (cmd === "npm" && args?.[0] === "publish") throw new Error("publish failed");
+      return { stdout: "", stderr: "", exitCode: 0 };
+    }) as never);
+
+    const logger = createMockLogger();
+    await expect(
+      publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, undefined),
+    ).rejects.toThrow("publish failed");
+
+    expect(mocks.rm).toHaveBeenCalledTimes(1);
+  });
+
+  it("points to the npm output because stdio was handed over", async () => {
+    mocks.spawn.mockImplementation(((cmd: string, args?: string[]) => {
+      if (cmd === "npm" && args?.[0] === "publish") throw new Error("Command failed (exit 1)");
+      return { stdout: "", stderr: "", exitCode: 0 };
+    }) as never);
+
+    const logger = createMockLogger();
+    await expect(
+      publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, undefined),
+    ).rejects.toThrow("위 npm 출력을 확인하세요");
+  });
+
+  it("does not let a cleanup failure hide the publish failure", async () => {
+    mocks.spawn.mockImplementation(((cmd: string, args?: string[]) => {
+      if (cmd === "npm" && args?.[0] === "publish") throw new Error("publish failed");
+      return { stdout: "", stderr: "", exitCode: 0 };
+    }) as never);
+    mocks.rm.mockRejectedValue(new Error("EBUSY"));
+
+    const logger = createMockLogger();
+    await expect(
+      publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, undefined),
+    ).rejects.toThrow("publish failed");
+  });
+
+  it("fails when pack produced no tarball", async () => {
+    captureSpawns();
+    mocks.readdir.mockResolvedValue([]);
+
+    const logger = createMockLogger();
+    await expect(
+      publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, undefined),
+    ).rejects.toThrow("tarball 을 찾을 수 없습니다");
+  });
+
+  it("adds a prerelease tag from the version", async () => {
+    const calls = captureSpawns();
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1-beta.3", logger, false, undefined);
+
+    const args = calls[1].args;
+    expect(args[args.indexOf("--tag") + 1]).toBe("beta");
+  });
+
+  it("never lets a prerelease become latest, even with a numeric identifier", async () => {
+    const calls = captureSpawns("14.0.0");
+
+    const logger = createMockLogger();
+    // semver.inc(v, "prerelease") 는 `14.3.0-1` 같은 숫자 식별자를 만든다
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.3.0-1", logger, false, undefined);
+
+    const args = calls[1].args;
+    const tag = args[args.indexOf("--tag") + 1];
+    expect(args).toContain("--tag");
+    expect(semver.validRange(tag)).toBeNull();
+  });
+
+  it("adds a major tag when the registry latest is higher", async () => {
+    const calls = captureSpawns("15.1.15");
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.2.15", logger, false, undefined);
+
+    // latest 를 15.1.15 에서 끌어내리지 않으려면 별도 태그가 필요하다
+    const args = calls[1].args;
+    expect(args[args.indexOf("--tag") + 1]).toBe("latest-14");
+  });
+
+  it("never uses a tag name npm would read as a semver range", async () => {
+    const calls = captureSpawns("15.1.15");
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.2.15", logger, false, undefined);
+
+    // npm 은 `v14`, `14.x` 처럼 범위로 해석되는 이름을 dist-tag 로 거부한다
+    const args = calls[1].args;
+    expect(semver.validRange(args[args.indexOf("--tag") + 1])).toBeNull();
+  });
+
+  it("does not tag when the version becomes the new latest", async () => {
+    const calls = captureSpawns("14.2.14");
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.2.15", logger, false, undefined);
+
+    expect(calls[1].args).not.toContain("--tag");
+  });
+
+  it("does not tag a package that was never published", async () => {
+    const calls = captureSpawns();
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.2.15", logger, false, undefined);
+
+    expect(calls[1].args).not.toContain("--tag");
+  });
+
+  it("passes the OTP to npm but masks it in logs", async () => {
+    const calls = captureSpawns();
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, OTP);
+
+    const args = calls[1].args;
+    expect(args[args.indexOf("--otp") + 1]).toBe(OTP);
+
+    const logged = loggedMessages(logger);
+    expect(logged).not.toContain(OTP);
+    expect(logged).toContain("******");
+  });
+
+  it("does not add --otp when no code is given", async () => {
+    const calls = captureSpawns();
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, undefined);
+
+    expect(calls[1].args).not.toContain("--otp");
+  });
+
+  it("masks the OTP in the failure message and keeps the original stack", async () => {
+    mocks.spawn.mockImplementation(((cmd: string) => {
+      if (cmd === "pnpm") return { stdout: "", stderr: "", exitCode: 0 };
+      // 실제 실패 메시지에는 실행된 명령줄이 그대로 담긴다
+      const err = new Error(`Command failed (exit 1): npm publish --otp ${OTP}\nEOTP required`);
+      err.stack = `Error: publish failed with --otp ${OTP}\n    at spawnedByNpmPublish (cp.ts:1:1)`;
+      throw err;
+    }) as never);
+
+    const logger = createMockLogger();
+    const err = await publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, OTP).then(
+      () => null,
+      (e: unknown) => e,
+    );
+
+    const asError = err as Error;
+    expect(asError.message).toContain("EOTP");
+    expect(asError.message).not.toContain(OTP);
+    expect(asError.message).toContain("******");
+    expect(asError.stack ?? "").toContain("spawnedByNpmPublish");
+    expect(asError.stack ?? "").not.toContain(OTP);
+  });
+
+  it("masks a padded OTP consistently", async () => {
+    let publishArgs: string[] = [];
+    mocks.spawn.mockImplementation(((cmd: string, args?: string[]) => {
+      const argList = args ?? [];
+      if (!(cmd === "npm" && argList[0] === "publish")) {
+        return { stdout: "", stderr: "", exitCode: 0 };
+      }
+      publishArgs = argList;
+      throw new Error(`Command failed: npm ${argList.join(" ")}`);
+    }) as never);
+
+    const logger = createMockLogger();
+    const err = await publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, ` ${OTP} `).then(
+      () => null,
+      (e: unknown) => e,
+    );
+
+    // 명령줄에 trim 된 값이 들어가고, 마스킹 대상도 같은 값이어야 한다
+    expect(publishArgs[publishArgs.indexOf("--otp") + 1]).toBe(OTP);
+    expect((err as Error).message).not.toContain(OTP);
+    expect((err as Error).message).toContain("******");
+  });
+
+  it("rejects a malformed OTP", async () => {
+    captureSpawns();
+
+    const logger = createMockLogger();
+    await expect(
+      publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, "12345; rm -rf /"),
+    ).rejects.toThrow("OTP 는 6자리 숫자여야 합니다.");
+  });
+
+  it("adds --dry-run instead of publishing for real", async () => {
+    const calls = captureSpawns();
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, true, undefined);
+
+    expect(calls[1].args).toContain("--dry-run");
+  });
+
+  it("quotes paths so spaces cannot split the shell command", async () => {
+    const calls = captureSpawns();
+
+    const logger = createMockLogger();
+    await publishNpm("/tmp/pkg-a", "pkg-a", "14.0.1", logger, false, undefined);
+
+    const packDest = calls[0].args[calls[0].args.indexOf("--pack-destination") + 1];
+    expect(packDest.startsWith('"')).toBe(true);
+    expect(packDest.endsWith('"')).toBe(true);
+    expect(calls[1].args[1]).toBe(`"${path.join(packDest.slice(1, -1), TARBALL)}"`);
+  });
+});

package/tests/commands/version-upgrade.acc.spec.ts

@@ -141,52 +141,6 @@ describe("upgradeVersion", () => {
     expect(templateChanges).toHaveLength(0);
   });
 
-  it("plugins 하위의 *-plugin manifest 버전을 함께 업데이트한다", async () => {
-    writeJson(path.join(tmpDir, "package.json"), {
-      name: "@simplysm/root",
-      version: "14.0.0",
-    });
-    fs.mkdirSync(path.join(tmpDir, "packages", "sd-cli", "templates"), {
-      recursive: true,
-    });
-
-    const codexPluginPath = path.join(tmpDir, "plugins", "sd", ".codex-plugin", "plugin.json");
-    const claudePluginPath = path.join(tmpDir, "plugins", "sd", ".claude-plugin", "plugin.json");
-    const anotherPluginPath = path.join(tmpDir, "plugins", "extra", "custom-plugin", "plugin.json");
-    const nonMatchingPluginPath = path.join(tmpDir, "plugins", "extra", "plugin.json");
-    writeJson(codexPluginPath, {
-      name: "sd",
-      version: "14.0.0",
-      description: "Codex plugin",
-    });
-    writeJson(claudePluginPath, {
-      name: "sd",
-      version: "14.0.0",
-      description: "Claude plugin",
-    });
-    writeJson(anotherPluginPath, {
-      name: "custom",
-      version: "14.0.0",
-      description: "Custom plugin",
-    });
-    writeJson(nonMatchingPluginPath, {
-      name: "ignored",
-      version: "14.0.0",
-      description: "Ignored plugin",
-    });
-
-    const result = await upgradeVersion(tmpDir, [], false);
-
-    expect(readJson<{ version: string }>(codexPluginPath).version).toBe("14.0.1");
-    expect(readJson<{ version: string }>(claudePluginPath).version).toBe("14.0.1");
-    expect(readJson<{ version: string }>(anotherPluginPath).version).toBe("14.0.1");
-    expect(readJson<{ version: string }>(nonMatchingPluginPath).version).toBe("14.0.0");
-    expect(result.changedFiles).toContain(path.resolve(codexPluginPath));
-    expect(result.changedFiles).toContain(path.resolve(claudePluginPath));
-    expect(result.changedFiles).toContain(path.resolve(anotherPluginPath));
-    expect(result.changedFiles).not.toContain(path.resolve(nonMatchingPluginPath));
-  });
-
   it("changedFiles[0]이 프로젝트 루트 package.json 경로이다", async () => {
     // Given: allPkgPaths에 3개 패키지가 있다
     writeJson(path.join(tmpDir, "package.json"), {

package/tests/sd-cli-entry.spec.ts

@@ -61,6 +61,26 @@ describe("sd-cli-entry createCliParser", () => {
     ).resolves.toBeDefined();
   });
 
+  it("passes publish --otp through to runPublish", async () => {
+    const { createCliParser } = await import("../src/sd-cli-entry");
+
+    await createCliParser(["publish", "--otp", "012345"]).exitProcess(false).parse();
+
+    expect(publishCmd.runPublish).toHaveBeenCalledWith(
+      expect.objectContaining({ otp: "012345" }),
+    );
+  });
+
+  it("leaves publish otp undefined when not given", async () => {
+    const { createCliParser } = await import("../src/sd-cli-entry");
+
+    await createCliParser(["publish"]).exitProcess(false).parse();
+
+    expect(publishCmd.runPublish).toHaveBeenCalledWith(
+      expect.objectContaining({ otp: undefined }),
+    );
+  });
+
   it("throws on --type test (removed type)", async () => {
     const { createCliParser } = await import("../src/sd-cli-entry");