@vellumai/assistant 0.6.3 → 0.6.5

package/src/__tests__/clawhub-files.test.ts

@@ -0,0 +1,347 @@
+/**
+ * Unit tests for `skills/clawhub-files.ts` — SkillFileProvider implementation
+ * for clawhub-origin skills.
+ *
+ * Covers:
+ *   - canHandle correctly distinguishes clawhub from skills.sh slugs
+ *   - listFiles maps inspect result files to SkillFileEntry[]
+ *   - listFiles returns null when inspect fails
+ *   - readFileContent returns cached SKILL.md content without extra CLI call
+ *   - readFileContent calls clawhubInspectFile for non-SKILL.md files
+ *   - toSlimSkill maps inspect metadata to ClawhubSlimSkill
+ *   - Cache hit avoids redundant inspect calls
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import type { ClawhubInspectResult } from "../skills/clawhub.js";
+
+// ---------------------------------------------------------------------------
+// Mocks — must be declared before importing the module under test
+// ---------------------------------------------------------------------------
+
+// Suppress logger output
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+let mockInspectResult: { data?: ClawhubInspectResult; error?: string } = {};
+let inspectCallCount = 0;
+let mockInspectFileResult: string | null = null;
+let inspectFileCallCount = 0;
+let inspectFileCalls: Array<{ slug: string; filePath: string }> = [];
+
+mock.module("../skills/clawhub.js", () => ({
+  validateSlug: (slug: string): boolean => {
+    return /^[a-zA-Z0-9]([a-zA-Z0-9._-]*(\/[a-zA-Z0-9][a-zA-Z0-9._-]*)?)?$/.test(
+      slug,
+    );
+  },
+  clawhubInspect: async (
+    _slug: string,
+  ): Promise<{ data?: ClawhubInspectResult; error?: string }> => {
+    inspectCallCount++;
+    return mockInspectResult;
+  },
+  clawhubInspectFile: async (
+    slug: string,
+    filePath: string,
+  ): Promise<string | null> => {
+    inspectFileCallCount++;
+    inspectFileCalls.push({ slug, filePath });
+    return mockInspectFileResult;
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Imports (after mocks)
+// ---------------------------------------------------------------------------
+
+import { createClawhubProvider } from "../skills/clawhub-files.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+// The inspect cache is module-scoped in clawhub-files.ts and persists across
+// tests. To avoid cross-test contamination, each test that calls async
+// provider methods uses a UNIQUE slug so cache entries never collide.
+let slugCounter = 0;
+function uniqueSlug(base = "test-skill"): string {
+  return `${base}-${++slugCounter}`;
+}
+
+function makeInspectData(
+  slug: string,
+  overrides?: Partial<ClawhubInspectResult>,
+): ClawhubInspectResult {
+  return {
+    skill: { slug, displayName: "Test Skill", summary: "A test skill" },
+    owner: { handle: "testauthor", displayName: "Test Author" },
+    stats: { stars: 42, installs: 100, downloads: 200, versions: 3 },
+    createdAt: 1700000000000,
+    updatedAt: 1700100000000,
+    latestVersion: { version: "1.0.0" },
+    files: [
+      { path: "SKILL.md", size: 512, contentType: "text/markdown" },
+      { path: "tools/helper.ts", size: 1024, contentType: "text/typescript" },
+      { path: "assets/icon.png", size: 2048, contentType: "image/png" },
+    ],
+    skillMdContent: "# Test Skill\n\nThis is the SKILL.md content.",
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Reset mock state between tests (cache is handled via unique slugs)
+// ---------------------------------------------------------------------------
+
+beforeEach(() => {
+  mockInspectResult = {};
+  inspectCallCount = 0;
+  mockInspectFileResult = null;
+  inspectFileCallCount = 0;
+  inspectFileCalls = [];
+});
+
+// ---------------------------------------------------------------------------
+// canHandle
+// ---------------------------------------------------------------------------
+
+describe("canHandle", () => {
+  const provider = createClawhubProvider();
+
+  test("returns true for simple slug", () => {
+    expect(provider.canHandle("my-skill")).toBe(true);
+  });
+
+  test("returns true for namespaced slug (author/skill)", () => {
+    expect(provider.canHandle("author/my-skill")).toBe(true);
+  });
+
+  test("returns false for skills.sh slug (owner/repo/skill)", () => {
+    expect(provider.canHandle("a/b/c")).toBe(false);
+  });
+
+  test("returns false for deeply nested slug", () => {
+    expect(provider.canHandle("a/b/c/d")).toBe(false);
+  });
+
+  test("returns false for invalid slug", () => {
+    expect(provider.canHandle("")).toBe(false);
+  });
+
+  test("returns false for slug starting with dot", () => {
+    expect(provider.canHandle(".hidden")).toBe(false);
+  });
+
+  test("returns false for slug starting with hyphen", () => {
+    expect(provider.canHandle("-dashed")).toBe(false);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// listFiles
+// ---------------------------------------------------------------------------
+
+describe("listFiles", () => {
+  test("maps inspect result files to SkillFileEntry[]", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("list-map");
+    mockInspectResult = { data: makeInspectData(slug) };
+
+    const entries = await provider.listFiles(slug);
+    expect(entries).not.toBeNull();
+    expect(entries!.length).toBe(3);
+
+    // Entries should be sorted by path (localeCompare: lowercase before uppercase)
+    const paths = entries!.map((e) => e.path);
+    expect(paths).toEqual([...paths].sort((a, b) => a.localeCompare(b)));
+
+    // Verify all entries are present with expected metadata
+    const byPath = Object.fromEntries(entries!.map((e) => [e.path, e]));
+    expect(byPath["SKILL.md"].name).toBe("SKILL.md");
+    expect(byPath["SKILL.md"].size).toBe(512);
+    expect(byPath["SKILL.md"].isBinary).toBe(false);
+    expect(byPath["SKILL.md"].content).toBeNull(); // content is null in listings
+
+    expect(byPath["assets/icon.png"].isBinary).toBe(true);
+
+    expect(byPath["tools/helper.ts"].isBinary).toBe(false);
+  });
+
+  test("returns null when inspect fails", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("list-fail");
+    mockInspectResult = { error: "Skill not found" };
+
+    const entries = await provider.listFiles(slug);
+    expect(entries).toBeNull();
+  });
+
+  test("returns null when inspect returns no files", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("list-nofiles");
+    mockInspectResult = { data: makeInspectData(slug, { files: null }) };
+
+    const entries = await provider.listFiles(slug);
+    expect(entries).toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// readFileContent
+// ---------------------------------------------------------------------------
+
+describe("readFileContent", () => {
+  test("returns cached SKILL.md content without extra CLI call", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("read-skillmd");
+    mockInspectResult = { data: makeInspectData(slug) };
+
+    // First call listFiles to populate the cache
+    await provider.listFiles(slug);
+    const initialCallCount = inspectCallCount;
+
+    // Now read SKILL.md — should use cached skillMdContent
+    const entry = await provider.readFileContent(slug, "SKILL.md");
+    expect(entry).not.toBeNull();
+    expect(entry!.path).toBe("SKILL.md");
+    expect(entry!.name).toBe("SKILL.md");
+    expect(entry!.content).toBe(
+      "# Test Skill\n\nThis is the SKILL.md content.",
+    );
+    expect(entry!.isBinary).toBe(false);
+    expect(entry!.mimeType).toBe("text/markdown");
+
+    // No additional inspect call and no inspectFile call
+    expect(inspectCallCount).toBe(initialCallCount);
+    expect(inspectFileCallCount).toBe(0);
+  });
+
+  test("calls clawhubInspectFile for non-SKILL.md files", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("read-other");
+    mockInspectResult = { data: makeInspectData(slug) };
+    mockInspectFileResult = "export function helper() { return 42; }";
+
+    // Populate cache first
+    await provider.listFiles(slug);
+
+    const entry = await provider.readFileContent(slug, "tools/helper.ts");
+    expect(entry).not.toBeNull();
+    expect(entry!.path).toBe("tools/helper.ts");
+    expect(entry!.name).toBe("helper.ts");
+    expect(entry!.content).toBe("export function helper() { return 42; }");
+    expect(entry!.isBinary).toBe(false);
+
+    expect(inspectFileCallCount).toBe(1);
+    expect(inspectFileCalls[0].slug).toBe(slug);
+    expect(inspectFileCalls[0].filePath).toBe("tools/helper.ts");
+  });
+
+  test("returns null when clawhubInspectFile fails for a text file", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("read-fail");
+    mockInspectResult = { data: makeInspectData(slug) };
+    mockInspectFileResult = null;
+
+    await provider.listFiles(slug);
+
+    const entry = await provider.readFileContent(slug, "tools/missing.ts");
+    expect(entry).toBeNull();
+  });
+
+  test("returns SkillFileEntry with content: null for binary files", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("read-binary");
+    mockInspectResult = { data: makeInspectData(slug) };
+    mockInspectFileResult = null; // clawhubInspectFile returns null for binaries
+
+    await provider.listFiles(slug);
+
+    const entry = await provider.readFileContent(slug, "assets/icon.png");
+    expect(entry).not.toBeNull();
+    expect(entry!.path).toBe("assets/icon.png");
+    expect(entry!.name).toBe("icon.png");
+    expect(entry!.isBinary).toBe(true);
+    expect(entry!.content).toBeNull();
+    expect(entry!.size).toBe(2048); // from the inspect data files array
+  });
+});
+
+// ---------------------------------------------------------------------------
+// toSlimSkill
+// ---------------------------------------------------------------------------
+
+describe("toSlimSkill", () => {
+  test("maps inspect metadata to ClawhubSlimSkill", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("slim-map");
+    mockInspectResult = { data: makeInspectData(slug) };
+
+    const slim = await provider.toSlimSkill(slug);
+    expect(slim).not.toBeNull();
+    expect(slim!.id).toBe(slug);
+    expect(slim!.name).toBe("Test Skill");
+    expect(slim!.description).toBe("A test skill");
+    expect(slim!.kind).toBe("catalog");
+    expect(slim!.status).toBe("available");
+    expect(slim!.origin).toBe("clawhub");
+
+    // Clawhub-specific fields
+    const clawhub = slim as unknown as Record<string, unknown>;
+    expect(clawhub.slug).toBe(slug);
+    expect(clawhub.author).toBe("testauthor");
+    expect(clawhub.stars).toBe(42);
+    expect(clawhub.installs).toBe(100);
+    expect(clawhub.reports).toBe(0);
+  });
+
+  test("returns null when inspect fails", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("slim-fail");
+    mockInspectResult = { error: "Not found" };
+
+    const slim = await provider.toSlimSkill(slug);
+    expect(slim).toBeNull();
+  });
+
+  test("handles missing owner gracefully", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("slim-noowner");
+    mockInspectResult = { data: makeInspectData(slug, { owner: null }) };
+
+    const slim = await provider.toSlimSkill(slug);
+    expect(slim).not.toBeNull();
+    const clawhub = slim as unknown as Record<string, unknown>;
+    expect(clawhub.author).toBe("");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Cache behavior
+// ---------------------------------------------------------------------------
+
+describe("caching", () => {
+  test("cache hit avoids redundant inspect calls", async () => {
+    const provider = createClawhubProvider();
+    const slug = uniqueSlug("cache-test");
+    mockInspectResult = { data: makeInspectData(slug) };
+
+    // First call — should trigger inspect
+    await provider.listFiles(slug);
+    expect(inspectCallCount).toBe(1);
+
+    // Second call to toSlimSkill — should use cache
+    await provider.toSlimSkill(slug);
+    expect(inspectCallCount).toBe(1); // no additional call
+
+    // Third call to listFiles — still cached
+    await provider.listFiles(slug);
+    expect(inspectCallCount).toBe(1);
+  });
+});

package/src/__tests__/cli-command-risk-guard.test.ts

@@ -32,6 +32,7 @@ mock.module("../config/loader.js", () => ({
 }));
 
 import { buildCliProgram } from "../cli/program.js";
+import type { RiskClassification } from "../permissions/checker.js";
 import { classifyRisk } from "../permissions/checker.js";
 import { RiskLevel } from "../permissions/types.js";
 
@@ -39,17 +40,17 @@ import { RiskLevel } from "../permissions/types.js";
  * Assert that a command classifies as Low risk, with a descriptive failure
  * message that guides developers toward the correct fix.
  */
-function expectLowRisk(command: string, actual: RiskLevel): void {
-  if (actual !== RiskLevel.Low) {
+function expectLowRisk(command: string, actual: RiskClassification): void {
+  if (actual.level !== RiskLevel.Low) {
     throw new Error(
-      `"${command}" classified as ${actual} instead of Low. ` +
+      `"${command}" classified as ${actual.level} instead of Low. ` +
         `assistant CLI commands must be Low risk by default — the assistant ` +
         `uses its own CLI during normal operation. If you need risk ` +
         `escalation for specific subcommands, add them to the elevated ` +
         `risk tests in this guard test with justification.`,
     );
   }
-  expect(actual).toBe(RiskLevel.Low);
+  expect(actual.level).toBe(RiskLevel.Low);
 }
 
 // Dynamically extract subcommand names from the CLI program definition.
@@ -84,11 +85,7 @@ describe("CLI command risk guard: assistant commands", () => {
   });
 
   test("assistant with flags classifies as Low risk", async () => {
-    const flagCommands = [
-      "assistant --version",
-      "assistant --help",
-      "assistant doctor --verbose",
-    ];
+    const flagCommands = ["assistant --version", "assistant --help"];
 
     for (const command of flagCommands) {
       const risk = await classifyRisk("bash", { command });
@@ -105,56 +102,56 @@ describe("CLI command risk guard: elevated assistant subcommands", () => {
     const risk = await classifyRisk("bash", {
       command: "assistant oauth token",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("assistant oauth mode --set is High risk (changes auth mode)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant oauth mode --set managed",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("assistant oauth mode --set=value is High risk (equals syntax)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant oauth mode google --set=managed",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("assistant oauth mode without --set is Low risk (read-only)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant oauth mode",
     });
-    expect(risk).toBe(RiskLevel.Low);
+    expect(risk.level).toBe(RiskLevel.Low);
   });
 
   test("assistant credentials reveal is High risk (exposes secrets)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant credentials reveal",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("assistant oauth request is Medium risk (initiates OAuth flow)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant oauth request",
     });
-    expect(risk).toBe(RiskLevel.Medium);
+    expect(risk.level).toBe(RiskLevel.Medium);
   });
 
   test("assistant oauth connect is Medium risk (modifies OAuth connections)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant oauth connect",
     });
-    expect(risk).toBe(RiskLevel.Medium);
+    expect(risk.level).toBe(RiskLevel.Medium);
   });
 
   test("assistant oauth disconnect is Medium risk (removes OAuth connections)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant oauth disconnect",
     });
-    expect(risk).toBe(RiskLevel.Medium);
+    expect(risk.level).toBe(RiskLevel.Medium);
   });
 
   test("--help on non-elevated subcommands remains Low risk", async () => {
@@ -199,12 +196,12 @@ describe("CLI command risk guard: elevated assistant subcommands", () => {
     // THEN --help does not bypass the elevated risk level
     for (const command of highRiskWithHelp) {
       const risk = await classifyRisk("bash", { command });
-      expect(risk).toBe(RiskLevel.High);
+      expect(risk.level).toBe(RiskLevel.High);
     }
 
     for (const command of mediumRiskWithHelp) {
       const risk = await classifyRisk("bash", { command });
-      expect(risk).toBe(RiskLevel.Medium);
+      expect(risk.level).toBe(RiskLevel.Medium);
     }
   });
 
@@ -212,14 +209,14 @@ describe("CLI command risk guard: elevated assistant subcommands", () => {
     const risk = await classifyRisk("bash", {
       command: "assistant credentials reveal 123 --service --help",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("-h used as option value does not downgrade oauth mode --set risk", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant oauth mode --set -h",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("non-sensitive oauth subcommands remain Low risk", async () => {
@@ -252,28 +249,28 @@ describe("CLI command risk guard: elevated assistant subcommands", () => {
     const risk = await classifyRisk("bash", {
       command: "assistant credentials set",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("assistant credentials delete is High risk (removes stored credentials)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant credentials delete",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("assistant keys set is High risk (modifies API keys)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant keys set anthropic sk-ant-xxx",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("assistant keys delete is High risk (removes API keys)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant keys delete openai",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("non-sensitive keys subcommands remain Low risk", async () => {
@@ -289,14 +286,14 @@ describe("CLI command risk guard: elevated assistant subcommands", () => {
     const risk = await classifyRisk("bash", {
       command: "assistant trust remove abc123",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("assistant trust clear is High risk (clears all trust rules)", async () => {
     const risk = await classifyRisk("bash", {
       command: "assistant trust clear",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("non-sensitive trust subcommands remain Low risk", async () => {
@@ -314,35 +311,35 @@ describe("CLI command risk guard: wrapper program propagation", () => {
     const risk = await classifyRisk("bash", {
       command: "env assistant oauth token",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("nice assistant credentials reveal is High risk", async () => {
     const risk = await classifyRisk("bash", {
       command: "nice assistant credentials reveal",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("timeout 30 assistant oauth request is Medium risk", async () => {
     const risk = await classifyRisk("bash", {
       command: "timeout 30 assistant oauth request",
     });
-    expect(risk).toBe(RiskLevel.Medium);
+    expect(risk.level).toBe(RiskLevel.Medium);
   });
 
   test("timeout 30 assistant oauth token is High risk", async () => {
     const risk = await classifyRisk("bash", {
       command: "timeout 30 assistant oauth token",
     });
-    expect(risk).toBe(RiskLevel.High);
+    expect(risk.level).toBe(RiskLevel.High);
   });
 
   test("timeout 30 git push is Medium risk", async () => {
     const risk = await classifyRisk("bash", {
       command: "timeout 30 git push",
     });
-    expect(risk).toBe(RiskLevel.Medium);
+    expect(risk.level).toBe(RiskLevel.Medium);
   });
 
   test("timeout 30 git status is Low risk", async () => {
@@ -361,7 +358,7 @@ describe("CLI command risk guard: wrapper program propagation", () => {
 
   test("env git push is Medium risk (not Low)", async () => {
     const risk = await classifyRisk("bash", { command: "env git push" });
-    expect(risk).toBe(RiskLevel.Medium);
+    expect(risk.level).toBe(RiskLevel.Medium);
   });
 
   test("env git status is Low risk", async () => {

package/src/__tests__/commit-message-enrichment-service.test.ts

@@ -64,31 +64,48 @@ describe("CommitEnrichmentService", () => {
     };
   }
 
-  async function createCommit(): Promise<string> {
-    const filename = `file-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`;
-    writeFileSync(join(testDir, filename), "content");
-    // Use execFileSync directly for test setup commits to avoid async
-    // timing issues that can leave stale index.lock files on loaded CI runners.
+  function clearIndexLock(): void {
     const lockPath = join(testDir, ".git", "index.lock");
     try {
       unlinkSync(lockPath);
     } catch {
       /* no lock to clean */
     }
-    execFileSync("git", ["add", "-A"], { cwd: testDir });
-    execFileSync(
-      "git",
-      [
-        "-c",
-        "core.hooksPath=/dev/null",
-        "commit",
-        "--no-verify",
-        "-m",
-        "test commit",
-        "--allow-empty",
-      ],
-      { cwd: testDir },
-    );
+  }
+
+  function gitWithRetry(args: string[], retries = 3): void {
+    for (let attempt = 0; attempt < retries; attempt++) {
+      try {
+        clearIndexLock();
+        execFileSync("git", args, { cwd: testDir });
+        return;
+      } catch (err) {
+        if (attempt < retries - 1 && String(err).includes("index.lock")) {
+          // Brief pause to let the previous git process fully release the lock
+          execFileSync("sleep", ["0.05"]);
+          continue;
+        }
+        throw err;
+      }
+    }
+  }
+
+  async function createCommit(): Promise<string> {
+    const filename = `file-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`;
+    writeFileSync(join(testDir, filename), "content");
+    // Use execFileSync directly for test setup commits to avoid async
+    // timing issues that can leave stale index.lock files on loaded CI runners.
+    // Retry with index.lock cleanup between git add and git commit.
+    gitWithRetry(["add", "-A"]);
+    gitWithRetry([
+      "-c",
+      "core.hooksPath=/dev/null",
+      "commit",
+      "--no-verify",
+      "-m",
+      "test commit",
+      "--allow-empty",
+    ]);
     return execFileSync("git", ["rev-parse", "HEAD"], {
       cwd: testDir,
       encoding: "utf-8",