@stigmer/cli 3.35.0 → 3.37.0

package/src/commands/validate.test.ts

@@ -1,168 +0,0 @@
-// Command-level contract for `validate`. Drives the real commander program
-// against temp files and asserts the classified exit code and, for the plugin
-// route, the rendered output. The contract: 0 = valid (a plugin with warnings
-// is still 0), 2 = invalid input (bad path, bad YAML, unknown kind, schema
-// failure, a plugin the reader refuses), 1 = unexpected. This is a
-// deliberate, documented refinement over the Go CLI, which returned a
-// generic exit 1 for all validate failures. The YAML cases are unchanged by
-// the plugin route and pin that it stays out of their way.
-
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
-import { classify, ExitCode } from "../errors/index.js";
-import { buildProgram } from "../program.js";
-
-let dir: string;
-let plugin: string;
-let brokenPlugin: string;
-
-function write(root: string, rel: string, content: string): void {
-  const full = join(root, rel);
-  mkdirSync(join(full, ".."), { recursive: true });
-  writeFileSync(full, content);
-}
-
-beforeAll(() => {
-  dir = mkdtempSync(join(tmpdir(), "stigmer-validate-"));
-  writeFileSync(
-    join(dir, "valid.yaml"),
-    [
-      "apiVersion: agentic.stigmer.ai/v1",
-      "kind: Agent",
-      "metadata:",
-      "  name: Reviewer",
-      "  slug: reviewer",
-      "  org: acme",
-      "spec:",
-      "  description: reviews code",
-      "",
-    ].join("\n"),
-  );
-  writeFileSync(join(dir, "bad-schema.yaml"), ["kind: Agent", "metadata: not-an-object", ""].join("\n"));
-  writeFileSync(join(dir, "unknown.yaml"), ["kind: Banana", "metadata:", "  name: x", ""].join("\n"));
-
-  // A Cursor plugin with a header token the manifest does not declare: valid,
-  // with one warning, and an ai.stigmer/ document that must not be validated
-  // as a loose resource.
-  plugin = mkdtempSync(join(tmpdir(), "stigmer-validate-plugin-"));
-  write(plugin, ".cursor-plugin/plugin.json", JSON.stringify({ name: "github", version: "1.0.0", mcpServers: "./mcp.json", logo: "assets/logo.svg" }));
-  write(plugin, "mcp.json", JSON.stringify({ mcpServers: { github: { type: "http", url: "https://api.example.com/mcp/", headers: { Authorization: "Bearer ${GITHUB_TOKEN}" } } } }));
-  write(plugin, "ai.stigmer/agent.yaml", "not: a valid resource document\n");
-  write(plugin, "assets/logo.svg", "<svg/>");
-
-  // The same plugin with the URL made a variable: the one refusal.
-  brokenPlugin = mkdtempSync(join(tmpdir(), "stigmer-validate-broken-"));
-  write(brokenPlugin, ".cursor-plugin/plugin.json", JSON.stringify({ name: "Broken Name", mcpServers: "./mcp.json" }));
-  write(brokenPlugin, "mcp.json", JSON.stringify({ mcpServers: { crm: { type: "http", url: "${CRM_URL}", auth: { scopes: ["a"] } } } }));
-});
-
-afterAll(() => {
-  for (const path of [dir, plugin, brokenPlugin]) rmSync(path, { recursive: true, force: true });
-});
-
-interface Run {
-  readonly exitCode: number;
-  readonly stdout: string;
-  readonly stderr: string;
-  readonly error: unknown;
-}
-
-// Runs `validate <args>` with output captured, returning the classified exit
-// code (0 on success) and what reached each stream.
-async function runValidate(...args: string[]): Promise<Run> {
-  const program = buildProgram();
-  program.exitOverride();
-  let stdout = "";
-  let stderr = "";
-  const outSpy = vi.spyOn(process.stdout, "write").mockImplementation((chunk) => {
-    stdout += String(chunk);
-    return true;
-  });
-  const errSpy = vi.spyOn(process.stderr, "write").mockImplementation((chunk) => {
-    stderr += String(chunk);
-    return true;
-  });
-  try {
-    await program.parseAsync(["node", "stigmer", "validate", ...args]);
-    return { exitCode: ExitCode.Success, stdout, stderr, error: undefined };
-  } catch (err) {
-    return { exitCode: classify(err)?.exitCode ?? -1, stdout, stderr, error: err };
-  } finally {
-    outSpy.mockRestore();
-    errSpy.mockRestore();
-  }
-}
-
-describe("validate exit codes (YAML)", () => {
-  it("exits 0 for a valid resource", async () => {
-    expect((await runValidate("-f", join(dir, "valid.yaml"))).exitCode).toBe(ExitCode.Success);
-  });
-
-  it("fails the batch when a directory holds an invalid file", async () => {
-    expect((await runValidate("-f", dir)).exitCode).not.toBe(ExitCode.Success);
-  });
-
-  it("exits 2 for a schema-invalid resource", async () => {
-    expect((await runValidate("-f", join(dir, "bad-schema.yaml"))).exitCode).toBe(ExitCode.Usage);
-  });
-
-  it("exits 2 for an unknown resource kind", async () => {
-    expect((await runValidate("-f", join(dir, "unknown.yaml"))).exitCode).toBe(ExitCode.Usage);
-  });
-
-  it("exits 2 for a path that does not exist", async () => {
-    expect((await runValidate("-f", join(dir, "missing.yaml"))).exitCode).toBe(ExitCode.Usage);
-  });
-});
-
-describe("validate on a plugin directory", () => {
-  it("accepts the plugin with a warning status, exit 0, everything on stderr", async () => {
-    const run = await runValidate("-f", plugin);
-    expect(run.exitCode).toBe(ExitCode.Success);
-    expect(run.stdout).toBe("");
-    expect(run.stderr).toContain("Plugin 'github' is valid with 1 warning");
-    expect(run.stderr).toContain("Cursor plugin");
-    // Section keys are padded to the widest key, so match key and value loosely.
-    expect(run.stderr).toMatch(/MCP servers\s+1: github \(http\)/);
-    expect(run.stderr).toMatch(/Variables\s+1: GITHUB_TOKEN \(inferred\)/);
-    expect(run.stderr).toMatch(/Files\s+4 read, 0 excluded by ignore rules/);
-    expect(run.stderr).toMatch(/Stigmer overlay\s+agent/);
-    expect(run.stderr).toContain("variable 'GITHUB_TOKEN' is referenced by MCP server 'github' but not declared");
-    expect(run.stderr).toContain("- logo (.cursor-plugin/plugin.json#logo)");
-  });
-
-  it("emits the normalised package as JSON data on stdout with --json", async () => {
-    const run = await runValidate("-f", plugin, "--json");
-    expect(run.exitCode).toBe(ExitCode.Success);
-    expect(run.stderr).toBe("");
-    const parsed = JSON.parse(run.stdout);
-    expect(parsed.status).toBe("warning");
-    expect(parsed.data.plugin).toMatchObject({
-      name: "github",
-      dialect: "cursor",
-      mcpServers: [{ name: "github", transport: "http", env: ["GITHUB_TOKEN"] }],
-      variables: [{ name: "GITHUB_TOKEN", isSecret: true, optional: false, declaredBy: "inferred" }],
-      overlay: { agent: "ai.stigmer/agent.yaml", workflows: [], mcpServers: [] },
-    });
-    expect(parsed.data.warnings.map((w: { kind: string }) => w.kind)).toEqual(["variable-inferred"]);
-  });
-
-  it("prints only the status line with --quiet", async () => {
-    const run = await runValidate("-f", plugin, "--quiet");
-    expect(run.stderr.trim()).toBe("⚠ Plugin 'github' is valid with 1 warning");
-  });
-
-  it("refuses with exit 2 and every problem's sentence", async () => {
-    const run = await runValidate("-f", brokenPlugin);
-    expect(run.exitCode).toBe(ExitCode.Usage);
-    const message = (run.error as Error).message;
-    expect(message).toContain("plugin cannot be installed, 2 problems found:");
-    expect(message).toContain("plugin name 'Broken Name' in '.cursor-plugin/plugin.json' is invalid");
-    expect(message).toContain("MCP server 'crm' in 'mcp.json' has a variable in its 'url'");
-    // Warnings ride along under the refusal so one run says everything.
-    expect(message).toContain("and 1 warning:");
-    expect(message).toContain("MCP server 'crm' in 'mcp.json' has an 'auth' block Stigmer does not read");
-  });
-});

package/src/config/config.test.ts

@@ -1,132 +0,0 @@
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, describe, expect, it } from "vitest";
-import { setStandalone } from "../runtime.js";
-import { getDefault, isCloudMode, load, save } from "./config.js";
-
-function tempConfigPath(): string {
-  const dir = mkdtempSync(join(tmpdir(), "stigmer-cli-config-"));
-  return join(dir, "config.yaml");
-}
-
-afterEach(() => {
-  setStandalone(false);
-});
-
-describe("load", () => {
-  it("returns the local default when the file is missing", () => {
-    const config = load(join(tempConfigPath(), "does-not-exist.yaml"));
-    expect(config).toEqual(getDefault());
-    expect(isCloudMode(config)).toBe(false);
-  });
-
-  it("returns the default in standalone mode without reading the file", () => {
-    const path = tempConfigPath();
-    writeFileSync(path, "backend:\n  type: cloud\n");
-    setStandalone(true);
-    expect(load(path)).toEqual(getDefault());
-  });
-
-  it("migrates a legacy cloud config into the named model on load", () => {
-    const path = tempConfigPath();
-    writeFileSync(
-      path,
-      "backend:\n  type: cloud\n  cloud:\n    endpoint: api.stigmer.ai:443\n    org_id: acme\ncontext:\n  organization: acme\n",
-    );
-    const config = load(path);
-    // The legacy slot becomes the reserved "cloud" entry; the legacy type
-    // selects it as current. The slot itself is not carried forward.
-    expect(config.current_backend).toBe("cloud");
-    expect(config.backends?.["cloud"]).toEqual({
-      type: "cloud",
-      endpoint: "api.stigmer.ai:443",
-      org_id: "acme",
-    });
-    expect(config.backend.cloud).toBeUndefined();
-    expect(config.context?.organization).toBe("acme");
-    expect(isCloudMode(config)).toBe(true);
-  });
-
-  it("parses a named-model config with selfhost entries", () => {
-    const path = tempConfigPath();
-    writeFileSync(
-      path,
-      "backend:\n  type: cloud\nbackends:\n  staging:\n    type: selfhost\n    endpoint: stigmer.example.com:7234\n    api_key: stk_x\ncurrent_backend: staging\n",
-    );
-    const config = load(path);
-    expect(config.current_backend).toBe("staging");
-    expect(config.backends?.["staging"]?.type).toBe("selfhost");
-    expect(config.backends?.["staging"]?.api_key).toBe("stk_x");
-    expect(isCloudMode(config)).toBe(false);
-  });
-});
-
-describe("save", () => {
-  it("round-trips a config and writes a 0600 file with the doc header", () => {
-    const path = tempConfigPath();
-    const config = getDefault();
-    (config.backends ??= {})["cloud"] = {
-      type: "cloud",
-      endpoint: "api.stigmer.ai:443",
-      token: "t",
-      org_id: "acme",
-    };
-    config.current_backend = "cloud";
-    save(config, path);
-
-    const text = readFileSync(path, "utf8");
-    expect(text).toContain("# Stigmer CLI Configuration");
-    const reloaded = load(path);
-    expect(reloaded.backends).toEqual(config.backends);
-    expect(reloaded.current_backend).toBe("cloud");
-    // The legacy mirror is written for older readers.
-    expect(reloaded.backend.type).toBe("cloud");
-
-    rmSync(path);
-  });
-
-  it("writes a legacy-loaded cloud config in the named shape (the one-time migration)", () => {
-    const path = tempConfigPath();
-    writeFileSync(
-      path,
-      "backend:\n  type: cloud\n  cloud:\n    endpoint: api.stigmer.ai:443\n    token: t\n",
-    );
-    save(load(path), path);
-
-    const text = readFileSync(path, "utf8");
-    expect(text).toContain("backends:");
-    expect(text).toContain("current_backend: cloud");
-    // The legacy slot is gone; its content lives in backends.cloud.
-    expect(text).not.toContain("  cloud:\n    endpoint");
-    const reloaded = load(path);
-    expect(reloaded.backends?.["cloud"]?.token).toBe("t");
-  });
-
-  it("keeps a pristine local config byte-stable (no named-model keys appear)", () => {
-    const path = tempConfigPath();
-    save(getDefault(), path);
-    const text = readFileSync(path, "utf8");
-    expect(text).not.toContain("backends:");
-    expect(text).not.toContain("current_backend:");
-    expect(text).toContain("type: local");
-  });
-
-  it("preserves the opaque local backend section across a load/save round-trip", () => {
-    const path = tempConfigPath();
-    writeFileSync(
-      path,
-      "backend:\n  type: local\n  local:\n    temporal:\n      managed: true\n    execution:\n      mode: local\n",
-    );
-
-    const config = load(path);
-    // Mutate an unrelated field, then save.
-    (config.context ??= {}).organization = "acme";
-    save(config, path);
-
-    const reloaded = readFileSync(path, "utf8");
-    expect(reloaded).toContain("managed: true");
-    expect(reloaded).toContain("mode: local");
-    expect(reloaded).toContain("organization: acme");
-  });
-});

package/src/config/keys.test.ts

@@ -1,61 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { UsageError } from "../errors/usage-error.js";
-import { getDefault } from "./config.js";
-import { configKeyNames, getConfigValue, setConfigValue } from "./keys.js";
-
-describe("config keys", () => {
-  it("lists the known keys sorted", () => {
-    expect(configKeyNames()).toEqual([
-      "backend.cloud.endpoint",
-      "backend.cloud.org_id",
-      "backend.type",
-      "context.organization",
-      "current_backend",
-    ]);
-  });
-
-  it("gets the backend type", () => {
-    expect(getConfigValue(getDefault(), "backend.type")).toBe("local");
-  });
-
-  it("returns empty string for unset nested keys", () => {
-    expect(getConfigValue(getDefault(), "backend.cloud.org_id")).toBe("");
-  });
-
-  it("sets a nested key, creating the reserved cloud entry", () => {
-    const config = getDefault();
-    setConfigValue(config, "backend.cloud.org_id", "acme");
-    expect(config.backends?.["cloud"]?.org_id).toBe("acme");
-    expect(getConfigValue(config, "backend.cloud.org_id")).toBe("acme");
-  });
-
-  it("backend.type set to cloud selects the reserved cloud entry", () => {
-    const config = getDefault();
-    setConfigValue(config, "backend.type", "cloud");
-    expect(config.current_backend).toBe("cloud");
-    expect(config.backends?.["cloud"]?.type).toBe("cloud");
-    expect(getConfigValue(config, "backend.type")).toBe("cloud");
-  });
-
-  it("current_backend switches only to known names", () => {
-    const config = getDefault();
-    expect(() => setConfigValue(config, "current_backend", "nope")).toThrow(
-      UsageError,
-    );
-    setConfigValue(config, "current_backend", "local");
-    expect(getConfigValue(config, "current_backend")).toBe("local");
-  });
-
-  it("validates backend.type values", () => {
-    expect(() => setConfigValue(getDefault(), "backend.type", "bogus")).toThrow(
-      UsageError,
-    );
-  });
-
-  it("rejects unknown keys", () => {
-    expect(() => getConfigValue(getDefault(), "nope.nope")).toThrow(UsageError);
-    expect(() => setConfigValue(getDefault(), "nope.nope", "x")).toThrow(
-      UsageError,
-    );
-  });
-});

package/src/config/resolve.test.ts

@@ -1,242 +0,0 @@
-// Pins the effective-value resolvers over the named-backend model (O3):
-// env > active entry > defaults for endpoint/token/org/console-URL, the
-// selfhost credential lane (api_key), and the auth gate's three postures
-// (local never, selfhost never client-side, cloud requires a credential).
-
-import { afterEach, describe, expect, it } from "vitest";
-import { CliExitError } from "../errors/index.js";
-import type { Config, NamedBackendConfig } from "./config.js";
-import {
-  DEFAULT_CLOUD_CONSOLE_URL,
-  ensureAuthenticated,
-  resolveConsoleURL,
-  resolveContextOrganization,
-  resolveEndpoint,
-  resolveOrganization,
-  resolveToken,
-} from "./resolve.js";
-
-const ENV_KEYS = [
-  "STIGMER_SERVER_ADDRESS",
-  "STIGMER_API_KEY",
-  "STIGMER_ORG_ID",
-] as const;
-
-afterEach(() => {
-  for (const key of ENV_KEYS) delete process.env[key];
-});
-
-function localConfig(context?: Config["context"]): Config {
-  return {
-    backend: { type: "local" },
-    backends: {},
-    current_backend: "local",
-    context,
-  };
-}
-
-function cloudConfig(
-  overrides: Partial<NamedBackendConfig> = {},
-  context?: Config["context"],
-): Config {
-  return {
-    backend: { type: "cloud" },
-    backends: {
-      cloud: { type: "cloud", endpoint: "cloud.example:443", ...overrides },
-    },
-    current_backend: "cloud",
-    context,
-  };
-}
-
-function selfhostConfig(overrides: Partial<NamedBackendConfig> = {}): Config {
-  return {
-    backend: { type: "cloud" },
-    backends: {
-      staging: {
-        type: "selfhost",
-        endpoint: "stigmer.example.com:7234",
-        ...overrides,
-      },
-    },
-    current_backend: "staging",
-  };
-}
-
-describe("resolveEndpoint", () => {
-  it("defaults to the local daemon address in local mode", () => {
-    expect(resolveEndpoint(localConfig())).toBe("localhost:7234");
-  });
-
-  it("uses the cloud default when no endpoint is configured", () => {
-    expect(resolveEndpoint(cloudConfig({ endpoint: undefined }))).toBe(
-      "api.stigmer.ai:443",
-    );
-  });
-
-  it("prefers the configured cloud endpoint", () => {
-    expect(resolveEndpoint(cloudConfig())).toBe("cloud.example:443");
-  });
-
-  it("uses the selfhost entry's endpoint", () => {
-    expect(resolveEndpoint(selfhostConfig())).toBe("stigmer.example.com:7234");
-  });
-
-  it("refuses a selfhost entry without an endpoint (hand-edited config)", () => {
-    expect(() =>
-      resolveEndpoint(selfhostConfig({ endpoint: undefined })),
-    ).toThrow(CliExitError);
-  });
-
-  it("lets STIGMER_SERVER_ADDRESS override everything", () => {
-    process.env.STIGMER_SERVER_ADDRESS = "override:7234";
-    expect(resolveEndpoint(cloudConfig())).toBe("override:7234");
-  });
-});
-
-describe("resolveToken", () => {
-  it("prefers STIGMER_API_KEY over the config token", () => {
-    process.env.STIGMER_API_KEY = "env-key";
-    expect(resolveToken(cloudConfig({ token: "config-token" }))).toBe(
-      "env-key",
-    );
-  });
-
-  it("falls back to the cloud entry's login token", () => {
-    expect(resolveToken(cloudConfig({ token: "config-token" }))).toBe(
-      "config-token",
-    );
-  });
-
-  it("uses the selfhost entry's api_key", () => {
-    expect(resolveToken(selfhostConfig({ api_key: "stk_stored" }))).toBe(
-      "stk_stored",
-    );
-  });
-
-  it("returns empty string when unauthenticated", () => {
-    expect(resolveToken(cloudConfig({ endpoint: undefined }))).toBe("");
-    expect(resolveToken(selfhostConfig())).toBe("");
-    expect(resolveToken(localConfig())).toBe("");
-  });
-});
-
-describe("resolveOrganization", () => {
-  it("prefers the --org flag override", () => {
-    process.env.STIGMER_ORG_ID = "env-org";
-    const config = cloudConfig({ org_id: "config-org" });
-    expect(resolveOrganization(config, "flag-org")).toBe("flag-org");
-  });
-
-  it("falls back to STIGMER_ORG_ID, then context, then the entry's org_id", () => {
-    process.env.STIGMER_ORG_ID = "env-org";
-    expect(resolveOrganization(cloudConfig({ org_id: "config-org" }))).toBe(
-      "env-org",
-    );
-  });
-
-  it("uses context organization when no flag/env is set", () => {
-    const config = cloudConfig(
-      { org_id: "legacy" },
-      { organization: "ctx-org" },
-    );
-    expect(resolveOrganization(config)).toBe("ctx-org");
-    expect(resolveContextOrganization(config)).toBe("ctx-org");
-  });
-
-  it("falls back to the entry's org_id", () => {
-    expect(resolveContextOrganization(cloudConfig({ org_id: "legacy" }))).toBe(
-      "legacy",
-    );
-  });
-
-  it("defaults to the stigmer org in local mode when nothing is configured", () => {
-    expect(resolveOrganization(localConfig())).toBe("stigmer");
-  });
-
-  it("defaults to the stigmer org on a selfhost backend (it IS the OSS server)", () => {
-    expect(resolveOrganization(selfhostConfig())).toBe("stigmer");
-  });
-
-  it("prefers an explicit context org over the local default", () => {
-    expect(
-      resolveOrganization(localConfig({ organization: "my-local-org" })),
-    ).toBe("my-local-org");
-  });
-
-  it("does not apply the local default in cloud mode (org stays empty)", () => {
-    expect(resolveOrganization(cloudConfig({ endpoint: undefined }))).toBe("");
-  });
-
-  it("reports an unset local org as empty via resolveContextOrganization (no implicit default)", () => {
-    // The implicit local default lives only in resolveOrganization (effective
-    // org for operations); the context query must stay faithful so config/context
-    // display can show "(not set)".
-    expect(resolveContextOrganization(localConfig())).toBe("");
-  });
-});
-
-describe("resolveConsoleURL", () => {
-  it("prefers the STIGMER_CONSOLE_URL override", () => {
-    expect(
-      resolveConsoleURL(cloudConfig(), {
-        STIGMER_CONSOLE_URL: "https://console.example",
-      } as NodeJS.ProcessEnv),
-    ).toBe("https://console.example");
-  });
-
-  it("uses the local web-console port for the local backend", () => {
-    expect(resolveConsoleURL(localConfig(), {} as NodeJS.ProcessEnv)).toBe(
-      "http://localhost:7234",
-    );
-  });
-
-  it("uses the cloud console URL for the cloud backend", () => {
-    expect(resolveConsoleURL(cloudConfig(), {} as NodeJS.ProcessEnv)).toBe(
-      DEFAULT_CLOUD_CONSOLE_URL,
-    );
-  });
-
-  it("derives the selfhost console from the entry's endpoint (one-origin rule)", () => {
-    expect(resolveConsoleURL(selfhostConfig(), {} as NodeJS.ProcessEnv)).toBe(
-      "http://stigmer.example.com:7234",
-    );
-    expect(
-      resolveConsoleURL(
-        selfhostConfig({ endpoint: "stigmer.example.com:443" }),
-        {} as NodeJS.ProcessEnv,
-      ),
-    ).toBe("https://stigmer.example.com");
-  });
-});
-
-describe("ensureAuthenticated", () => {
-  it("never requires auth in local mode", () => {
-    expect(() => ensureAuthenticated(localConfig())).not.toThrow();
-  });
-
-  it("never gates selfhost client-side (the server owns that decision)", () => {
-    expect(() => ensureAuthenticated(selfhostConfig())).not.toThrow();
-  });
-
-  it("throws in cloud mode with no credentials", () => {
-    expect(() => ensureAuthenticated(cloudConfig())).toThrow(CliExitError);
-  });
-
-  it("passes with a stored access token", () => {
-    expect(() =>
-      ensureAuthenticated(cloudConfig({ token: "t" })),
-    ).not.toThrow();
-  });
-
-  it("passes with only a refresh token (silent refresh will mint one)", () => {
-    expect(() =>
-      ensureAuthenticated(cloudConfig({ refresh_token: "r" })),
-    ).not.toThrow();
-  });
-
-  it("passes with STIGMER_API_KEY in the environment", () => {
-    process.env.STIGMER_API_KEY = "stk_env";
-    expect(() => ensureAuthenticated(cloudConfig())).not.toThrow();
-  });
-});