akm-cli 0.6.1 → 0.7.0

package/dist/tests/save-trust-qa-fixes.test.js

@@ -0,0 +1,270 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+// ── Helpers ──────────────────────────────────────────────────────────────────
+const tempDirs = [];
+function makeTempDir(prefix = "akm-sqafix-") {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    tempDirs.push(dir);
+    return dir;
+}
+afterAll(() => {
+    for (const dir of tempDirs) {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+const xdgCache = makeTempDir("akm-sqafix-cache-");
+const xdgConfig = makeTempDir("akm-sqafix-config-");
+const isolatedHome = makeTempDir("akm-sqafix-home-");
+const repoRoot = path.resolve(import.meta.dir, "..");
+const cliPath = path.join(repoRoot, "src", "cli.ts");
+function runCli(args, extraEnv = {}) {
+    const result = spawnSync("bun", [cliPath, ...args], {
+        encoding: "utf8",
+        timeout: 30_000,
+        cwd: repoRoot,
+        env: {
+            ...process.env,
+            HOME: isolatedHome,
+            XDG_CACHE_HOME: xdgCache,
+            XDG_CONFIG_HOME: xdgConfig,
+            AKM_STASH_DIR: undefined,
+            ...extraEnv,
+        },
+    });
+    return {
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        status: result.status ?? 1,
+    };
+}
+// ── Test 1 & 2: akm save --format json (space-separated and = form) ──────────
+describe("save command: --format flag not consumed as positional name", () => {
+    test("1. akm save --format json returns JSON, not stash-name error", () => {
+        const stashDir = makeTempDir("akm-sqafix-stash-");
+        // Initialize a git repo in stashDir so save has something to work with
+        spawnSync("git", ["init", stashDir], { encoding: "utf8" });
+        const { stdout, stderr, status } = runCli(["save", "--format", "json"], {
+            AKM_STASH_DIR: stashDir,
+        });
+        // Should NOT produce the "No git stash found with name 'json'" error
+        expect(stderr).not.toContain('No git stash found with name "json"');
+        expect(stderr).not.toContain("No git stash found");
+        // Exit 0 (nothing to commit or committed) or the output is valid JSON
+        if (status === 0) {
+            const parsed = JSON.parse(stdout.trim());
+            expect(parsed).toHaveProperty("committed");
+        }
+        else {
+            // May fail if stash dir env not found, but should NOT be a stash-name error
+            expect(stderr).not.toContain('"json"');
+        }
+    });
+    test("2. akm save --format=json still works (eq form)", () => {
+        const stashDir = makeTempDir("akm-sqafix-stash2-");
+        spawnSync("git", ["init", stashDir], { encoding: "utf8" });
+        const { stdout, stderr, status } = runCli(["save", "--format=json"], {
+            AKM_STASH_DIR: stashDir,
+        });
+        expect(stderr).not.toContain('No git stash found with name "json"');
+        if (status === 0) {
+            const parsed = JSON.parse(stdout.trim());
+            expect(parsed).toHaveProperty("committed");
+        }
+    });
+    test("3. akm save my-stash --format json routes correctly (name = my-stash)", () => {
+        // We don't have a real stash named my-stash, so we expect an error about
+        // "my-stash" not found — NOT about "json" not found.
+        const stashDir = makeTempDir("akm-sqafix-stash3-");
+        const { stderr } = runCli(["save", "my-stash", "--format", "json"], {
+            AKM_STASH_DIR: stashDir,
+        });
+        // Error should mention "my-stash", not "json"
+        if (stderr.includes("No git stash found")) {
+            expect(stderr).toContain("my-stash");
+            expect(stderr).not.toContain('"json"');
+        }
+    });
+    test("3b. akm save json --format json keeps 'json' as the positional stash name", () => {
+        // Edge case: the legitimate stash name happens to equal the --format value.
+        // argv-order check should detect this isn't a mis-parse (positional appears
+        // BEFORE --format) and route "json" as the stash name, not the primary.
+        const stashDir = makeTempDir("akm-sqafix-stash3b-");
+        const { stderr } = runCli(["save", "json", "--format", "json"], {
+            AKM_STASH_DIR: stashDir,
+        });
+        // The real stash named "json" doesn't exist, so we expect "No git stash found"
+        // referencing "json" by name — not a primary-stash success.
+        if (stderr.includes("No git stash found")) {
+            expect(stderr).toContain("json");
+        }
+    });
+});
+// ── Test 4: Primary stash with writable:true pushes on save ──────────────────
+describe("save command: primary stash respects root-level writable config", () => {
+    test("4. primary stash with writable:true in config pushes when remote is configured", () => {
+        // Create a bare remote repo
+        const bareDir = makeTempDir("akm-sqafix-bare-");
+        spawnSync("git", ["init", "--bare", bareDir], { encoding: "utf8" });
+        // Create the primary stash as a git repo with the bare remote
+        const stashDir = makeTempDir("akm-sqafix-primary-");
+        spawnSync("git", ["init", stashDir], { encoding: "utf8" });
+        spawnSync("git", ["-C", stashDir, "remote", "add", "origin", bareDir], { encoding: "utf8" });
+        // Create an initial file so the repo is non-empty
+        fs.writeFileSync(path.join(stashDir, "skill.md"), "# skill\n");
+        spawnSync("git", ["-C", stashDir, "-c", "user.name=test", "-c", "user.email=test@local", "add", "-A"], {
+            encoding: "utf8",
+        });
+        spawnSync("git", ["-C", stashDir, "-c", "user.name=test", "-c", "user.email=test@local", "commit", "-m", "init"], { encoding: "utf8" });
+        spawnSync("git", ["-C", stashDir, "push", "--set-upstream", "origin", "master"], { encoding: "utf8" });
+        spawnSync("git", ["-C", stashDir, "push", "--set-upstream", "origin", "main"], { encoding: "utf8" });
+        // Write a config with writable:true and stashDir pointing to our git repo
+        const configDir = makeTempDir("akm-sqafix-cfg-");
+        const configPath = path.join(configDir, "config.json");
+        fs.writeFileSync(configPath, JSON.stringify({ semanticSearchMode: "off", writable: true }));
+        // Write a new file to commit and push
+        fs.writeFileSync(path.join(stashDir, "new-skill.md"), "# new skill\n");
+        const { stdout, status } = runCli(["save", "-m", "test push"], {
+            AKM_STASH_DIR: stashDir,
+            AKM_CONFIG_DIR: configDir,
+            HOME: makeTempDir("akm-sqafix-home2-"),
+            XDG_CONFIG_HOME: configDir,
+        });
+        // Should have committed and pushed
+        if (status === 0) {
+            const parsed = JSON.parse(stdout.trim());
+            expect(parsed.committed).toBe(true);
+            expect(parsed.pushed).toBe(true);
+        }
+        // Verify the remote received the push by checking it has commits
+        const logResult = spawnSync("git", ["--git-dir", bareDir, "log", "--oneline"], { encoding: "utf8" });
+        // If push succeeded, log should have at least the push commit
+        expect(logResult.stdout.trim().length).toBeGreaterThan(0);
+    }, { timeout: 30_000 });
+});
+// ── Test 5 & 6 & 7: akm add --trust warnings and audit ───────────────────────
+describe("stash-add: --trust warning for local paths", () => {
+    test("6. akm add <local-dir> --trust emits warning about no effect", () => {
+        const localDir = makeTempDir("akm-sqafix-local-");
+        // Create a minimal skill so the dir is a valid stash root
+        const skillsDir = path.join(localDir, "skills");
+        fs.mkdirSync(skillsDir, { recursive: true });
+        fs.writeFileSync(path.join(skillsDir, "test.md"), "# test skill\n");
+        const stashDir = makeTempDir("akm-sqafix-add-stash-");
+        const { stderr, status } = runCli(["add", localDir, "--trust"], {
+            AKM_STASH_DIR: stashDir,
+        });
+        // Should emit the clarifying warning on stderr
+        expect(stderr).toContain("--trust has no effect on local directory sources");
+        // Should still succeed
+        expect(status).toBe(0);
+    });
+    test("7. akm add <blocked-source> without --trust includes --trust in error message", () => {
+        // Use a local dir with a "malicious" content to trigger the audit block.
+        // We simulate by checking the install-audit error message text directly
+        // via formatInstallAuditFailure (unit-level check).
+        const { formatInstallAuditFailure } = require("../src/commands/install-audit");
+        const fakeReport = {
+            enabled: true,
+            passed: false,
+            blocked: true,
+            trusted: false,
+            registryLabels: [],
+            findings: [
+                {
+                    id: "remote-shell-pipe",
+                    severity: "critical",
+                    category: "malicious-code",
+                    message: "Downloads remote content and pipes it directly into a shell.",
+                },
+            ],
+            scannedFiles: 1,
+            scannedBytes: 100,
+            summary: { low: 0, moderate: 0, high: 0, critical: 1, total: 1 },
+        };
+        const msg = formatInstallAuditFailure("test:pkg", fakeReport);
+        expect(msg).toContain("--trust");
+    });
+});
+// ── Test: install-audit formatInstallAuditFailure mentions --trust ────────────
+describe("install-audit: block error mentions --trust", () => {
+    test("block error message includes --trust as remediation", async () => {
+        const { formatInstallAuditFailure } = await import("../src/commands/install-audit");
+        const fakeReport = {
+            enabled: true,
+            passed: false,
+            blocked: true,
+            trusted: false,
+            registryLabels: [],
+            findings: [
+                {
+                    id: "remote-shell-pipe",
+                    severity: "critical",
+                    category: "malicious-code",
+                    message: "Downloads remote content and pipes it directly into a shell.",
+                },
+            ],
+            scannedFiles: 1,
+            scannedBytes: 100,
+            summary: { low: 0, moderate: 0, high: 0, critical: 1, total: 1 },
+        };
+        const msg = formatInstallAuditFailure("test:pkg", fakeReport);
+        expect(msg).toContain("--trust");
+        expect(msg).toContain("bypass this audit");
+    });
+});
+// ── Test: config.ts root-level writable field is parsed ──────────────────────
+describe("config: root-level writable field", () => {
+    test("writable:true in config.json is loaded correctly", async () => {
+        const { loadConfig, resetConfigCache } = await import("../src/core/config");
+        // XDG_CONFIG_HOME -> akm subdir -> config.json
+        const xdgDir = makeTempDir("akm-sqafix-cfgtest-");
+        const akmConfigDir = path.join(xdgDir, "akm");
+        fs.mkdirSync(akmConfigDir, { recursive: true });
+        const configPath = path.join(akmConfigDir, "config.json");
+        fs.writeFileSync(configPath, JSON.stringify({ semanticSearchMode: "off", writable: true }));
+        // Use AKM_CONFIG_DIR env override (most direct override)
+        const origEnv = { AKM_CONFIG_DIR: process.env.AKM_CONFIG_DIR };
+        process.env.AKM_CONFIG_DIR = akmConfigDir;
+        resetConfigCache();
+        try {
+            const cfg = loadConfig();
+            expect(cfg.writable).toBe(true);
+        }
+        finally {
+            if (origEnv.AKM_CONFIG_DIR === undefined) {
+                delete process.env.AKM_CONFIG_DIR;
+            }
+            else {
+                process.env.AKM_CONFIG_DIR = origEnv.AKM_CONFIG_DIR;
+            }
+            resetConfigCache();
+        }
+    });
+    test("writable not set defaults to undefined (falsy)", async () => {
+        const { loadConfig, resetConfigCache } = await import("../src/core/config");
+        const xdgDir2 = makeTempDir("akm-sqafix-cfgtest2-");
+        const akmConfigDir2 = path.join(xdgDir2, "akm");
+        fs.mkdirSync(akmConfigDir2, { recursive: true });
+        const configPath = path.join(akmConfigDir2, "config.json");
+        fs.writeFileSync(configPath, JSON.stringify({ semanticSearchMode: "off" }));
+        const origEnv = { AKM_CONFIG_DIR: process.env.AKM_CONFIG_DIR };
+        process.env.AKM_CONFIG_DIR = akmConfigDir2;
+        resetConfigCache();
+        try {
+            const cfg = loadConfig();
+            expect(cfg.writable).toBeUndefined();
+        }
+        finally {
+            if (origEnv.AKM_CONFIG_DIR === undefined) {
+                delete process.env.AKM_CONFIG_DIR;
+            }
+            else {
+                process.env.AKM_CONFIG_DIR = origEnv.AKM_CONFIG_DIR;
+            }
+            resetConfigCache();
+        }
+    });
+});