@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/cli/lib/__tests__/search-plugins.test.ts

@@ -1,59 +1,44 @@
 /**
- * Tests for {@link searchPlugins}.
+ * Tests for the catalog query helpers: {@link filterPluginCatalog},
+ * {@link assertValidSearchPattern}, and {@link marketplaceMatch}.
  *
- * The catalog is the whitelisted external plugins in the curated
- * `plugins/marketplace.json` manifest. Network is replaced with an in-memory
- * fixture passed via the `fetch` dependency — no globals are monkey-patched and
- * no `--test-hook` exports leak into production code.
+ * These operate purely in memory on a resolved catalog — the catalog itself
+ * is resolved elsewhere (`getPluginCatalog`), so there is no network here.
  */
 
 import { describe, expect, test } from "bun:test";
 
-import type { FetchLike } from "../fetch-like.js";
-import { MarketplaceFetchError } from "../plugin-marketplace.js";
+import { buildBundledPluginCatalog } from "../plugin-catalog-local.js";
+import type { MarketplaceEntry } from "../plugin-marketplace.js";
 import {
+  assertValidSearchPattern,
+  filterPluginCatalog,
   InvalidSearchPatternError,
-  PluginCatalogUnavailableError,
-  searchPlugins,
+  marketplaceMatch,
+  type PluginCatalog,
+  projectMarketplaceEntries,
 } from "../search-plugins.js";
 
-const MANIFEST_URL_PREFIX =
-  "https://api.github.com/repos/vellum-ai/vellum-assistant/contents/plugins/marketplace.json";
-
 // External marketplace refs must be full commit SHAs (immutable). Fixtures use
 // realistic 40-char hex object names rather than tags/branches.
 const SHA_A = "63a91ecadbf4c4719a4602a5abb00883f9966034";
 const SHA_B = "0123456789abcdef0123456789abcdef01234567";
 const SHA_C = "89abcdef0123456789abcdef0123456789abcdef";
 
-interface ManifestPlugin {
-  name: string;
-  source: { source: "github"; repo: string; path?: string; ref: string };
-  description?: string;
-  category?: string;
-}
-
-/** Serve `plugins` as the raw marketplace manifest at the manifest URL. */
-function manifestFetch(plugins: ManifestPlugin[]): FetchLike {
-  return (async (input: RequestInfo | URL) => {
-    const url = typeof input === "string" ? input : input.toString();
-    if (!url.startsWith(MANIFEST_URL_PREFIX)) {
-      return new Response("unexpected url: " + url, { status: 500 });
-    }
-    return new Response(JSON.stringify({ name: "vellum-assistant", plugins }), {
-      status: 200,
-      headers: { "content-type": "application/json" },
-    });
-  }) as FetchLike;
-}
-
-/** A github-sourced manifest entry, with optional path/description. */
+/** A github-sourced marketplace entry, with optional path/description. */
 function entry(
   name: string,
   repo: string,
   ref: string,
-  extra?: { path?: string; description?: string; category?: string },
-): ManifestPlugin {
+  extra?: {
+    path?: string;
+    description?: string;
+    icon?: string;
+    category?: string;
+    homepage?: string;
+    license?: string;
+  },
+): MarketplaceEntry {
   return {
     name,
     source: {
@@ -63,333 +48,232 @@ function entry(
       ref,
     },
     ...(extra?.description ? { description: extra.description } : {}),
+    ...(extra?.icon ? { icon: extra.icon } : {}),
     ...(extra?.category ? { category: extra.category } : {}),
+    ...(extra?.homepage ? { homepage: extra.homepage } : {}),
+    ...(extra?.license ? { license: extra.license } : {}),
   };
 }
 
-describe("searchPlugins", () => {
-  test("matches the query as a case-insensitive regex against plugin names", async () => {
-    const result = await searchPlugins(
-      { query: "memory" },
-      {
-        fetch: manifestFetch([
-          entry("simple-memory", "vellum-ai/simple-memory", SHA_A),
-          entry("memory-graph", "acme/memory-graph", SHA_B),
-          entry("git-tools", "acme/git-tools", SHA_C),
-        ]),
-      },
-    );
+/** Build a resolved {@link PluginCatalog} from raw entries the way the catalog
+ * sources do (dedupe by name, project, sort), reusing the real projection. */
+function catalog(entries: MarketplaceEntry[], ref = "main"): PluginCatalog {
+  return {
+    ...buildBundledPluginCatalog({ name: "vellum-assistant", plugins: entries }),
+    ref,
+  };
+}
 
-    expect(result.matches.map((m) => m.name)).toEqual([
+describe("filterPluginCatalog", () => {
+  test("matches the query as a case-insensitive regex against plugin names", () => {
+    const matches = filterPluginCatalog(
+      catalog([
+        entry("simple-memory", "vellum-ai/simple-memory", SHA_A),
+        entry("memory-graph", "acme/memory-graph", SHA_B),
+        entry("git-tools", "acme/git-tools", SHA_C),
+      ]),
+      "memory",
+    );
+    expect(matches.map((m) => m.name)).toEqual([
       "memory-graph",
       "simple-memory",
     ]);
-    expect(result.matches[0]!.path).toBe(`github:acme/memory-graph@${SHA_B}`);
-    expect(result.query).toBe("memory");
-    expect(result.ref).toBe("main");
+    expect(matches[0]!.path).toBe(`github:acme/memory-graph@${SHA_B}`);
   });
 
-  test("matches regardless of query casing (case-insensitive)", async () => {
-    const result = await searchPlugins(
-      { query: "MEMORY" },
-      {
-        fetch: manifestFetch([
-          entry("simple-memory", "vellum-ai/simple-memory", SHA_A),
-        ]),
-      },
+  test("matches regardless of query casing (case-insensitive)", () => {
+    const matches = filterPluginCatalog(
+      catalog([entry("simple-memory", "vellum-ai/simple-memory", SHA_A)]),
+      "MEMORY",
     );
-    expect(result.matches.map((m) => m.name)).toEqual(["simple-memory"]);
+    expect(matches.map((m) => m.name)).toEqual(["simple-memory"]);
   });
 
-  test("anchored patterns work without escaping", async () => {
-    const result = await searchPlugins(
-      { query: "^memory-" },
-      {
-        fetch: manifestFetch([
-          entry("memory-graph", "acme/memory-graph", SHA_B),
-          entry("simple-memory", "vellum-ai/simple-memory", SHA_A),
-        ]),
-      },
+  test("anchored patterns work without escaping", () => {
+    const matches = filterPluginCatalog(
+      catalog([
+        entry("memory-graph", "acme/memory-graph", SHA_B),
+        entry("simple-memory", "vellum-ai/simple-memory", SHA_A),
+      ]),
+      "^memory-",
     );
-    expect(result.matches.map((m) => m.name)).toEqual(["memory-graph"]);
+    expect(matches.map((m) => m.name)).toEqual(["memory-graph"]);
   });
 
-  test("empty query matches every whitelisted entry", async () => {
-    const result = await searchPlugins(
-      { query: "" },
-      {
-        fetch: manifestFetch([
-          entry("simple-memory", "vellum-ai/simple-memory", SHA_A),
-          entry("memory-graph", "acme/memory-graph", SHA_B),
-          entry("git-tools", "acme/git-tools", SHA_C),
-        ]),
-      },
+  test("empty query matches every catalog entry", () => {
+    const matches = filterPluginCatalog(
+      catalog([
+        entry("simple-memory", "vellum-ai/simple-memory", SHA_A),
+        entry("memory-graph", "acme/memory-graph", SHA_B),
+        entry("git-tools", "acme/git-tools", SHA_C),
+      ]),
+      "",
     );
-    expect(result.matches.map((m) => m.name)).toEqual([
+    expect(matches.map((m) => m.name)).toEqual([
       "git-tools",
       "memory-graph",
       "simple-memory",
     ]);
   });
 
-  test("projects each entry onto a github source with a display locator", async () => {
-    // GIVEN a whitelisted external plugin nested in a subdirectory
-    // WHEN we search
-    const result = await searchPlugins(
-      { query: "nested" },
-      {
-        fetch: manifestFetch([
-          entry("nested", "acme/monorepo", SHA_B, {
-            path: "packages/nested",
-            description: "A nested plugin.",
-          }),
-        ]),
-      },
+  test("empty result set on no matches", () => {
+    const matches = filterPluginCatalog(
+      catalog([entry("simple-memory", "vellum-ai/simple-memory", SHA_A)]),
+      "nothing-matches",
     );
-
-    // THEN the match carries the github coordinates and a human locator
-    expect(result.matches).toEqual([
-      {
-        name: "nested",
-        path: `github:acme/monorepo/packages/nested@${SHA_B}`,
-        description: "A nested plugin.",
-        category: null,
-        source: {
-          kind: "github",
-          repo: "acme/monorepo",
-          path: "packages/nested",
-          ref: SHA_B,
-        },
-      },
-    ]);
+    expect(matches).toEqual([]);
   });
 
-  test("carries the marketplace entry category, defaulting to null", async () => {
-    // GIVEN one entry that declares a category and one that does not
-    // WHEN we search
-    const result = await searchPlugins(
-      { query: "" },
-      {
-        fetch: manifestFetch([
-          entry("calendar-sync", "acme/calendar-sync", SHA_A, {
-            category: "calendar",
-          }),
-          entry("plain-plugin", "acme/plain-plugin", SHA_B),
-        ]),
-      },
-    );
-
-    // THEN the declared category flows through and a missing one is null
-    expect(
-      result.matches.map((m) => ({ name: m.name, category: m.category })),
-    ).toEqual([
-      { name: "calendar-sync", category: "calendar" },
-      { name: "plain-plugin", category: null },
-    ]);
+  test("throws InvalidSearchPatternError on a malformed pattern", () => {
+    expect(() =>
+      filterPluginCatalog(catalog([]), "(unterminated"),
+    ).toThrow(InvalidSearchPatternError);
   });
+});
 
-  test("rejects invalid regex patterns up front (no network call)", async () => {
-    let fetchCalled = false;
-    const fetch: FetchLike = (async () => {
-      fetchCalled = true;
-      return new Response("", { status: 200 });
-    }) as FetchLike;
+describe("assertValidSearchPattern", () => {
+  test("accepts a valid regex", () => {
+    expect(() => assertValidSearchPattern("^memory-")).not.toThrow();
+  });
 
-    await expect(
-      searchPlugins({ query: "(unterminated" }, { fetch }),
-    ).rejects.toBeInstanceOf(InvalidSearchPatternError);
-    expect(fetchCalled).toBe(false);
+  test("accepts an empty pattern (matches everything)", () => {
+    expect(() => assertValidSearchPattern("")).not.toThrow();
   });
 
-  test("empty result set on no matches", async () => {
-    const result = await searchPlugins(
-      { query: "nothing-matches" },
-      {
-        fetch: manifestFetch([
-          entry("simple-memory", "vellum-ai/simple-memory", SHA_A),
-        ]),
-      },
+  test("throws InvalidSearchPatternError on a malformed pattern", () => {
+    expect(() => assertValidSearchPattern("(unterminated")).toThrow(
+      InvalidSearchPatternError,
     );
-    expect(result.matches).toEqual([]);
   });
+});
 
-  test("respects `ref` option by forwarding to GitHub", async () => {
-    // The CLI does not surface a `--ref` flag (the source-path convention
-    // may change), but the underlying function keeps `ref` for test
-    // injection and future internal callers.
-    let seenRef: string | undefined;
-    const result = await searchPlugins(
-      { query: "memory", ref: "feat-branch" },
-      {
-        fetch: (async (input: RequestInfo | URL) => {
-          const url = typeof input === "string" ? input : input.toString();
-          const m = /[?&]ref=([^&]+)/.exec(url);
-          seenRef = m ? decodeURIComponent(m[1]!) : undefined;
-          return new Response(
-            JSON.stringify({
-              name: "vellum-assistant",
-              plugins: [
-                entry("simple-memory", "vellum-ai/simple-memory", SHA_A),
-              ],
-            }),
-            { status: 200, headers: { "content-type": "application/json" } },
-          );
-        }) as FetchLike,
+describe("marketplaceMatch", () => {
+  test("projects a root entry onto a github source with a display locator", () => {
+    expect(
+      marketplaceMatch(entry("simple-memory", "vellum-ai/simple-memory", SHA_A)),
+    ).toEqual({
+      name: "simple-memory",
+      path: `github:vellum-ai/simple-memory@${SHA_A}`,
+      description: undefined,
+      category: null,
+      homepage: undefined,
+      license: undefined,
+      source: {
+        kind: "github",
+        repo: "vellum-ai/simple-memory",
+        path: undefined,
+        ref: SHA_A,
       },
-    );
-
-    expect(seenRef).toBe("feat-branch");
-    expect(result.ref).toBe("feat-branch");
-    expect(result.matches.map((m) => m.name)).toEqual(["simple-memory"]);
+    });
   });
 
-  test("HTTP 5xx is a transient PluginCatalogUnavailableError", async () => {
-    // GIVEN GitHub returns a 5xx (upstream outage)
-    // WHEN we search
-    // THEN the failure is classified transient so the caller can serve a
-    // stale cache and the route can map it to 503 (not a misleading 500).
-    const err = await searchPlugins(
-      { query: "memory" },
-      {
-        fetch: (async () =>
-          new Response("upstream broken", { status: 503 })) as FetchLike,
+  test("projects a nested entry with its sub-path in the locator", () => {
+    expect(
+      marketplaceMatch(
+        entry("nested", "acme/monorepo", SHA_B, {
+          path: "packages/nested",
+          description: "A nested plugin.",
+        }),
+      ),
+    ).toEqual({
+      name: "nested",
+      path: `github:acme/monorepo/packages/nested@${SHA_B}`,
+      description: "A nested plugin.",
+      category: null,
+      homepage: undefined,
+      license: undefined,
+      source: {
+        kind: "github",
+        repo: "acme/monorepo",
+        path: "packages/nested",
+        ref: SHA_B,
       },
-    ).catch((e: unknown) => e);
-    expect(err).toBeInstanceOf(PluginCatalogUnavailableError);
-    expect((err as PluginCatalogUnavailableError).status).toBe(503);
+    });
   });
 
-  test("rate-limited 403 (x-ratelimit-remaining: 0) is transient", async () => {
-    // GIVEN GitHub returns 403 with the rate-limit budget exhausted
-    // WHEN we search
-    // THEN it's transient — this is exactly the unauthenticated 60 req/hr
-    // exhaustion that empties the catalog, and it must surface as 503.
-    const err = await searchPlugins(
-      { query: "memory" },
-      {
-        fetch: (async () =>
-          new Response("rate limit exceeded", {
-            status: 403,
-            headers: { "x-ratelimit-remaining": "0" },
-          })) as FetchLike,
-      },
-    ).catch((e: unknown) => e);
-    expect(err).toBeInstanceOf(PluginCatalogUnavailableError);
-    expect((err as PluginCatalogUnavailableError).status).toBe(403);
+  test("carries the marketplace category, defaulting to null when absent", () => {
+    expect(
+      marketplaceMatch(
+        entry("calendar-sync", "acme/calendar-sync", SHA_A, {
+          category: "calendar",
+        }),
+      ).category,
+    ).toBe("calendar");
+    expect(
+      marketplaceMatch(entry("plain-plugin", "acme/plain-plugin", SHA_B))
+        .category,
+    ).toBeNull();
   });
 
-  test("a 403 without the rate-limit signal is a hard error", async () => {
-    // GIVEN a bare 403 (genuine permissions problem, not rate limiting)
-    // WHEN we search
-    // THEN it is NOT transient — serving a stale catalog would mask a real
-    // misconfiguration, so it propagates as a plain error.
-    const err = await searchPlugins(
-      { query: "memory" },
-      {
-        fetch: (async () =>
-          new Response("forbidden", { status: 403 })) as FetchLike,
-      },
-    ).catch((e: unknown) => e);
-    expect(err).toBeInstanceOf(Error);
-    expect(err).not.toBeInstanceOf(PluginCatalogUnavailableError);
-    expect((err as Error).message).toMatch(/HTTP 403/);
+  test("carries homepage/license when the entry declares them", () => {
+    const match = marketplaceMatch(
+      entry("calendar-sync", "acme/calendar-sync", SHA_A, {
+        homepage: "https://example.com/calendar-sync",
+        license: "MIT",
+      }),
+    );
+    expect(match.homepage).toBe("https://example.com/calendar-sync");
+    expect(match.license).toBe("MIT");
   });
 
-  test("a missing manifest (404) is a clean empty catalog", async () => {
-    // Unlike a 5xx or a bare 403, a 404 on `marketplace.json` means no
-    // whitelist has been published at this ref yet — a normal empty catalog,
-    // not a misconfiguration. The search returns no matches without error.
-    const result = await searchPlugins(
-      { query: "memory" },
-      {
-        fetch: (async () =>
-          new Response("not found", { status: 404 })) as FetchLike,
-      },
+  test("leaves homepage/license undefined when the entry omits them", () => {
+    const match = marketplaceMatch(
+      entry("plain-plugin", "acme/plain-plugin", SHA_B),
     );
-    expect(result.matches).toEqual([]);
+    expect(match.homepage).toBeUndefined();
+    expect(match.license).toBeUndefined();
   });
 
-  test("a malformed manifest is a hard error (not silently empty)", async () => {
-    // GIVEN the manifest body is not valid JSON
-    // WHEN we search
-    // THEN it surfaces as a hard MarketplaceFetchError — the catalog is the
-    // source of truth, so a broken whitelist must not masquerade as empty,
-    // and it is NOT transient (retrying won't fix malformed bytes).
-    const err = await searchPlugins(
-      { query: "" },
-      {
-        fetch: (async () =>
-          new Response("{ not json", { status: 200 })) as FetchLike,
-      },
-    ).catch((e: unknown) => e);
-    expect(err).toBeInstanceOf(MarketplaceFetchError);
-    expect(err).not.toBeInstanceOf(PluginCatalogUnavailableError);
+  test("carries the curated icon, leaving it undefined when absent", () => {
+    expect(
+      marketplaceMatch(
+        entry("calendar-sync", "acme/calendar-sync", SHA_A, { icon: "📅" }),
+      ).icon,
+    ).toBe("📅");
+    expect(
+      marketplaceMatch(entry("plain-plugin", "acme/plain-plugin", SHA_B)).icon,
+    ).toBeUndefined();
   });
+});
 
-  test("returns matches sorted by name", async () => {
-    const result = await searchPlugins(
-      { query: "" },
-      {
-        fetch: manifestFetch([
-          entry("zeta-plugin", "acme/zeta", SHA_A),
-          entry("alpha-plugin", "acme/alpha", SHA_B),
-          entry("mu-plugin", "acme/mu", SHA_C),
-        ]),
-      },
-    );
-    expect(result.matches.map((m) => m.name)).toEqual([
-      "alpha-plugin",
-      "mu-plugin",
-      "zeta-plugin",
+describe("projectMarketplaceEntries", () => {
+  test("dedupes by name (first wins) and sorts alphabetically", () => {
+    const matches = projectMarketplaceEntries([
+      entry("git-tools", "acme/git-tools", SHA_C),
+      entry("memory-graph", "acme/memory-graph", SHA_B),
+      entry("git-tools", "acme/other-git-tools", SHA_A),
     ]);
+    expect(matches.map((m) => m.name)).toEqual(["git-tools", "memory-graph"]);
+    // First occurrence wins on a name collision.
+    expect(matches[0]!.source.repo).toBe("acme/git-tools");
   });
 
-  test("dedupes entries that repeat a name, keeping the first", async () => {
-    // GIVEN a manifest that lists the same name twice (e.g. a bad edit)
-    // WHEN we search
-    // THEN the name surfaces once, from the first entry, so a duplicate can't
-    // inflate the catalog or shadow the reviewed source
-    const result = await searchPlugins(
-      { query: "caveman" },
-      {
-        fetch: manifestFetch([
-          entry("caveman", "JuliusBrussee/caveman", SHA_A),
-          entry("caveman", "impostor/caveman", SHA_B),
-        ]),
-      },
-    );
-    expect(result.matches).toEqual([
-      {
-        name: "caveman",
-        path: `github:JuliusBrussee/caveman@${SHA_A}`,
-        category: null,
-        source: {
-          kind: "github",
-          repo: "JuliusBrussee/caveman",
-          ref: SHA_A,
-        },
-      },
+  test("projects each entry via marketplaceMatch", () => {
+    const [match] = projectMarketplaceEntries([
+      entry("simple-memory", "vellum-ai/simple-memory", SHA_A),
     ]);
+    expect(match).toEqual(
+      marketplaceMatch(entry("simple-memory", "vellum-ai/simple-memory", SHA_A)),
+    );
   });
 
-  test("sends no Authorization header (canonical source is a public repo)", async () => {
-    let seenAuth: string | undefined;
-    let seenUserAgent: string | undefined;
-    await searchPlugins(
-      { query: "memory" },
-      {
-        fetch: (async (_input: RequestInfo | URL, init?: RequestInit) => {
-          const headers = init?.headers as Record<string, string> | undefined;
-          seenAuth = headers?.Authorization;
-          seenUserAgent = headers?.["User-Agent"];
-          return new Response(
-            JSON.stringify({ name: "vellum-assistant", plugins: [] }),
-            { status: 200, headers: { "content-type": "application/json" } },
-          );
-        }) as FetchLike,
-      },
-    );
-    expect(seenAuth).toBeUndefined();
-    expect(seenUserAgent).toBe("vellum-assistant-cli");
+  test("returns an empty list for no entries", () => {
+    expect(projectMarketplaceEntries([])).toEqual([]);
+  });
+
+  test("carries homepage/license through, undefined when the entry omits them", () => {
+    const [withMeta, without] = projectMarketplaceEntries([
+      entry("calendar-sync", "acme/calendar-sync", SHA_A, {
+        homepage: "https://example.com/calendar-sync",
+        license: "MIT",
+      }),
+      entry("plain-plugin", "acme/plain-plugin", SHA_B),
+    ]);
+    expect(withMeta).toMatchObject({
+      homepage: "https://example.com/calendar-sync",
+      license: "MIT",
+    });
+    expect(without!.homepage).toBeUndefined();
+    expect(without!.license).toBeUndefined();
   });
 });