canary-test-cli 5.10.1 → 5.12.0

package/dist/engine-checks.js

@@ -1,4 +1,4 @@
-"use strict";
+'use strict';
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -33,12 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRegistryVersion = parseRegistryVersion;
 exports.isOlder = isOlder;
 exports.checkVersion = checkVersion;
 exports.checkGit = checkGit;
 exports.checkOverlays = checkOverlays;
 exports.checkProjectConfig = checkProjectConfig;
 exports.checkMcpConfig = checkMcpConfig;
+exports.checkOverlayConflicts = checkOverlayConflicts;
+exports.checkSkillRequirements = checkSkillRequirements;
 exports.runEngineChecks = runEngineChecks;
 /**
  * Built-in `canary doctor` engine checks (Phase 2, tier 1). Each returns a
@@ -50,32 +53,44 @@ const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const overlay_commands_js_1 = require("./overlay-commands.js");
 const registry = __importStar(require("./overlays-registry.js"));
+const overlay_conflicts_js_1 = require("./overlay-conflicts.js");
+const skill_requirements_js_1 = require("./skill-requirements.js");
 /** The published npm package name (mirrors the install remedy in the shim). */
-const PKG = "canary-test-cli";
+const PKG = 'canary-test-cli';
 const DEFAULT_TIMEOUT_MS = 5000;
 const realGit = (args, opts = {}) => {
-    const { spawnSync } = require("node:child_process");
-    const r = spawnSync("git", args, { cwd: opts.cwd, encoding: "utf8" });
+    const { spawnSync } = require('node:child_process');
+    const r = spawnSync('git', args, { cwd: opts.cwd, encoding: 'utf8' });
     if (r.error) {
         const code = r.error.code;
-        return { status: code === "ENOENT" ? 127 : 1, stdout: "", stderr: String(r.error.message) };
+        return {
+            status: code === 'ENOENT' ? 127 : 1,
+            stdout: '',
+            stderr: String(r.error.message),
+        };
     }
-    return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+    return {
+        status: r.status ?? 1,
+        stdout: r.stdout ?? '',
+        stderr: r.stderr ?? '',
+    };
 };
 /** Read this package's own version from its package.json (best effort). */
 function ownVersion() {
     try {
-        const pkgPath = path.join(__dirname, "..", "package.json");
-        return JSON.parse(fs.readFileSync(pkgPath, "utf8")).version ?? null;
+        const pkgPath = path.join(__dirname, '..', 'package.json');
+        return (JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+            .version ?? null);
     }
     catch {
         return null;
     }
 }
-/** Extract `version` from a registry dist-tag body; null on any parse error. */
-function parseRegistryVersion(body) {
+/** String `version` from a registry body; null on parse error or non-string shape (SEC-DES-001: registry JSON is untrusted). */
+function parseRegistryVersion(rawBody) {
     try {
-        return JSON.parse(body).version ?? null;
+        const v = JSON.parse(rawBody)?.version;
+        return typeof v === 'string' ? v : null;
     }
     catch {
         return null;
@@ -90,18 +105,18 @@ function fetchLatestVersion(timeoutMs) {
                 resolve(null);
                 return;
             }
-            let body = "";
-            res.on("data", (c) => (body += c));
-            res.on("end", () => resolve(parseRegistryVersion(body)));
+            let body = '';
+            res.on('data', (c) => (body += c));
+            res.on('end', () => resolve(parseRegistryVersion(body)));
         });
-        req.on("error", () => resolve(null));
+        req.on('error', () => resolve(null));
         req.setTimeout(timeoutMs, () => req.destroy());
     });
 }
 /** True when semver `a` is strictly older than `b` (numeric compare, no prerelease). */
 function isOlder(a, b) {
-    const pa = a.split(".").map((n) => Number.parseInt(n, 10));
-    const pb = b.split(".").map((n) => Number.parseInt(n, 10));
+    const pa = a.split('.').map((n) => Number.parseInt(n, 10));
+    const pb = b.split('.').map((n) => Number.parseInt(n, 10));
     for (let i = 0; i < 3; i += 1) {
         const x = pa[i] ?? 0;
         const y = pb[i] ?? 0;
@@ -115,35 +130,52 @@ function isOlder(a, b) {
 async function checkVersion(deps = {}) {
     const current = deps.currentVersion ?? ownVersion();
     if (!current) {
-        return { id: "engine:version", status: "info", label: "CLI version: unknown" };
+        return {
+            id: 'engine:version',
+            status: 'info',
+            label: 'CLI version: unknown',
+        };
     }
-    const getLatest = deps.getLatestVersion ?? (() => fetchLatestVersion(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS));
+    const getLatest = deps.getLatestVersion ??
+        (() => fetchLatestVersion(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS));
     const latest = await getLatest();
     if (!latest) {
-        return { id: "engine:version", status: "info", label: `CLI ${current} (could not check latest — offline?)` };
+        return {
+            id: 'engine:version',
+            status: 'info',
+            label: `CLI ${current} (could not check latest — offline?)`,
+        };
     }
     if (isOlder(current, latest)) {
         return {
-            id: "engine:version",
-            status: "fail",
+            id: 'engine:version',
+            status: 'fail',
             label: `CLI ${current} is behind latest ${latest}`,
             remedy: `Upgrade: npm install -g ${PKG}@latest`,
         };
     }
-    return { id: "engine:version", status: "pass", label: `CLI ${current} (latest)` };
+    return {
+        id: 'engine:version',
+        status: 'pass',
+        label: `CLI ${current} (latest)`,
+    };
 }
 /** git present on PATH. */
 function checkGit(deps = {}) {
     const git = deps.git ?? realGit;
-    const res = git(["--version"]);
+    const res = git(['--version']);
     if (res.status === 0) {
-        return { id: "engine:git", status: "pass", label: `git present (${res.stdout.trim() || "ok"})` };
+        return {
+            id: 'engine:git',
+            status: 'pass',
+            label: `git present (${res.stdout.trim() || 'ok'})`,
+        };
     }
     return {
-        id: "engine:git",
-        status: "fail",
-        label: "git not found on PATH",
-        remedy: "Install git and ensure it is on your PATH — overlay add/update need it.",
+        id: 'engine:git',
+        status: 'fail',
+        label: 'git not found on PATH',
+        remedy: 'Install git and ensure it is on your PATH — overlay add/update need it.',
     };
 }
 /** Registered overlays present, fresh, and free of local modifications. */
@@ -157,48 +189,62 @@ function checkOverlays(deps = {}) {
     catch (e) {
         return [
             {
-                id: "engine:overlays",
-                status: "fail",
-                label: "overlays registry unreadable",
+                id: 'engine:overlays',
+                status: 'fail',
+                label: 'overlays registry unreadable',
                 remedy: e.message,
             },
         ];
     }
     if (reg.overlays.length === 0) {
-        return [{ id: "engine:overlays", status: "info", label: "no overlays registered" }];
+        return [
+            {
+                id: 'engine:overlays',
+                status: 'info',
+                label: 'no overlays registered',
+            },
+        ];
     }
     const results = [];
     for (const o of reg.overlays) {
         const fresh = (0, overlay_commands_js_1.freshness)(o.path, o, git);
-        if (fresh.startsWith("missing")) {
+        if (fresh.startsWith('missing')) {
             results.push({
                 id: `overlay:${o.name}:present`,
-                status: "fail",
+                status: 'fail',
                 label: `overlay "${o.name}": clone missing`,
                 remedy: `Re-add it: canary overlay remove ${o.name} (if needed) then canary overlay add ${o.source}`,
             });
             continue;
         }
-        if (fresh.includes("behind")) {
+        if (fresh.includes('behind')) {
             results.push({
                 id: `overlay:${o.name}:fresh`,
-                status: "fail",
+                status: 'fail',
                 label: `overlay "${o.name}": ${fresh}`,
                 remedy: `Update it: canary overlay update ${o.name}`,
             });
         }
         else {
-            results.push({ id: `overlay:${o.name}:fresh`, status: "pass", label: `overlay "${o.name}": ${fresh}` });
+            results.push({
+                id: `overlay:${o.name}:fresh`,
+                status: 'pass',
+                label: `overlay "${o.name}": ${fresh}`,
+            });
         }
         const clean = (0, overlay_commands_js_1.workingTreeStatus)(o.path, git);
-        if (clean === "clean") {
-            results.push({ id: `overlay:${o.name}:clean`, status: "pass", label: `overlay "${o.name}": no local changes` });
+        if (clean === 'clean') {
+            results.push({
+                id: `overlay:${o.name}:clean`,
+                status: 'pass',
+                label: `overlay "${o.name}": no local changes`,
+            });
         }
         else {
             results.push({
                 id: `overlay:${o.name}:clean`,
-                status: "fail",
-                label: `overlay "${o.name}": ${clean === "dirty" ? "local modifications" : "git status unreadable"}`,
+                status: 'fail',
+                label: `overlay "${o.name}": ${clean === 'dirty' ? 'local modifications' : 'git status unreadable'}`,
                 remedy: `Commit/stash changes in ${o.path}, or canary overlay remove ${o.name} and re-add.`,
             });
         }
@@ -209,10 +255,12 @@ function checkOverlays(deps = {}) {
 function parseErrorOrNull(file) {
     let raw;
     try {
-        raw = fs.readFileSync(file, "utf8");
+        raw = fs.readFileSync(file, 'utf8');
     }
     catch (e) {
-        return e.code === "ENOENT" ? null : e.message;
+        return e.code === 'ENOENT'
+            ? null
+            : e.message;
     }
     try {
         JSON.parse(raw);
@@ -225,38 +273,52 @@ function parseErrorOrNull(file) {
 /** Project `.canary/` config files parse as JSON. */
 function checkProjectConfig(deps = {}) {
     const cwd = deps.cwd ?? process.cwd();
-    const dir = path.join(cwd, ".canary");
+    const dir = path.join(cwd, '.canary');
     let names;
     try {
-        names = fs.readdirSync(dir).filter((n) => /^company(\.[\w-]+)?\.json$/.test(n));
+        names = fs
+            .readdirSync(dir)
+            .filter((n) => /^company(\.[\w-]+)?\.json$/.test(n));
     }
     catch {
-        return { id: "engine:project-config", status: "skip", label: "no project .canary/ config" };
+        return {
+            id: 'engine:project-config',
+            status: 'skip',
+            label: 'no project .canary/ config',
+        };
     }
     if (names.length === 0) {
-        return { id: "engine:project-config", status: "skip", label: "no project .canary/ config" };
+        return {
+            id: 'engine:project-config',
+            status: 'skip',
+            label: 'no project .canary/ config',
+        };
     }
     for (const name of names) {
         const err = parseErrorOrNull(path.join(dir, name));
         if (err) {
             return {
-                id: "engine:project-config",
-                status: "fail",
+                id: 'engine:project-config',
+                status: 'fail',
                 label: `project .canary/${name} does not parse`,
                 remedy: `Fix the JSON in .canary/${name}: ${err}`,
             };
         }
     }
-    return { id: "engine:project-config", status: "pass", label: `project .canary/ config parses (${names.length} file(s))` };
+    return {
+        id: 'engine:project-config',
+        status: 'pass',
+        label: `project .canary/ config parses (${names.length} file(s))`,
+    };
 }
 /** Assert a single `.mcp.json` parses and each server entry is well-formed. */
 function inspectMcpFile(file) {
     let raw;
     try {
-        raw = fs.readFileSync(file, "utf8");
+        raw = fs.readFileSync(file, 'utf8');
     }
     catch (e) {
-        if (e.code === "ENOENT") {
+        if (e.code === 'ENOENT') {
             return { present: false };
         }
         return { present: true, error: e.message };
@@ -272,13 +334,16 @@ function inspectMcpFile(file) {
     if (servers === undefined) {
         return { present: true };
     }
-    if (typeof servers !== "object" || servers === null) {
-        return { present: true, error: "mcpServers is not an object" };
+    if (typeof servers !== 'object' || servers === null) {
+        return { present: true, error: 'mcpServers is not an object' };
     }
     for (const [key, entry] of Object.entries(servers)) {
         const e = entry;
-        if (typeof e.command !== "string" && typeof e.url !== "string") {
-            return { present: true, error: `server "${key}" has neither a command nor a url` };
+        if (typeof e.command !== 'string' && typeof e.url !== 'string') {
+            return {
+                present: true,
+                error: `server "${key}" has neither a command nor a url`,
+            };
         }
     }
     return { present: true };
@@ -287,24 +352,176 @@ function inspectMcpFile(file) {
 function checkMcpConfig(deps = {}) {
     const cwd = deps.cwd ?? process.cwd();
     const homeDir = deps.homeDir ?? os.homedir();
-    const files = [path.join(cwd, ".mcp.json"), path.join(homeDir, ".mcp.json")];
+    const files = [path.join(cwd, '.mcp.json'), path.join(homeDir, '.mcp.json')];
     let anyPresent = false;
     for (const file of files) {
         const r = inspectMcpFile(file);
         anyPresent = anyPresent || r.present;
         if (r.error) {
             return {
-                id: "engine:mcp",
-                status: "fail",
+                id: 'engine:mcp',
+                status: 'fail',
                 label: `MCP config ${file} is invalid`,
                 remedy: `Fix ${file}: ${r.error}`,
             };
         }
     }
     if (!anyPresent) {
-        return { id: "engine:mcp", status: "skip", label: "no .mcp.json found" };
+        return { id: 'engine:mcp', status: 'skip', label: 'no .mcp.json found' };
+    }
+    return { id: 'engine:mcp', status: 'pass', label: 'MCP config resolves' };
+}
+/**
+ * Skill-name collisions across registered overlays are resolved by a declared
+ * precedence (#333). A collision with no precedence winner is a `fail` — which
+ * definition wins is otherwise accidental (directory-name order). No overlays
+ * or no collisions → an informational/passing line, never a false alarm.
+ */
+function checkOverlayConflicts(deps = {}) {
+    const homeDir = deps.homeDir ?? os.homedir();
+    let reg;
+    try {
+        reg = registry.read(homeDir);
+    }
+    catch {
+        // The dedicated engine:overlays check already reports an unreadable
+        // registry; don't double-fail here.
+        return {
+            id: 'engine:overlay-conflicts',
+            status: 'skip',
+            label: 'overlay skill conflicts: registry unreadable',
+        };
+    }
+    const conflicts = (0, overlay_conflicts_js_1.detectSkillConflicts)(reg);
+    const unresolved = conflicts.filter((c) => !c.resolved);
+    if (unresolved.length > 0) {
+        const names = unresolved.map((c) => c.skill).join(', ');
+        return {
+            id: 'engine:overlay-conflicts',
+            status: 'fail',
+            label: `overlay skill conflicts unresolved: ${names}`,
+            remedy: 'Two overlays ship these skill name(s) with equal precedence — the ' +
+                'winner is accidental. Set a higher `precedence` on the overlay you ' +
+                'want to win in ~/.canary/overlays.json, or run ' +
+                '`canary overlay list --conflicts` for details.',
+        };
+    }
+    if (conflicts.length > 0) {
+        return {
+            id: 'engine:overlay-conflicts',
+            status: 'pass',
+            label: `overlay skill conflicts: ${conflicts.length} resolved by precedence`,
+        };
+    }
+    return {
+        id: 'engine:overlay-conflicts',
+        status: 'pass',
+        label: 'no overlay skill conflicts',
+    };
+}
+/** Real command probe (#336): `<cmd> --version`, extract the first x.y[.z]. */
+const realProbe = (command) => {
+    const { spawnSync } = require('node:child_process');
+    const r = spawnSync(command, ['--version'], {
+        encoding: 'utf8',
+        timeout: DEFAULT_TIMEOUT_MS,
+    });
+    // ENOENT (not on PATH) sets r.error; a non-zero exit does not — the command
+    // exists, it just may not print a parseable version.
+    if (r.error)
+        return { present: false, version: null };
+    const out = `${r.stdout ?? ''}${r.stderr ?? ''}`;
+    const m = out.match(/(\d+\.\d+(?:\.\d+)?)/);
+    return { present: true, version: m ? m[1] : null };
+};
+/** SKILL.md paths + source labels for skills installed in a consuming repo. */
+function skillMdRoots(homeDir, cwd) {
+    const roots = [];
+    const overlays = path.join(homeDir, '.canary', 'overlays');
+    for (const ov of safeDirs(overlays)) {
+        roots.push([path.join(overlays, ov, '.canary', 'skills'), `overlay:${ov}`]);
+    }
+    roots.push([path.join(homeDir, '.canary', 'skills'), 'global']);
+    roots.push([path.join(cwd, '.canary', 'skills'), 'local']);
+    return roots;
+}
+/** Directory entries (names) under `dir`, or [] when it is absent/unreadable. */
+function safeDirs(dir) {
+    try {
+        return fs
+            .readdirSync(dir, { withFileTypes: true })
+            .filter((d) => d.isDirectory())
+            .map((d) => d.name);
+    }
+    catch {
+        return [];
+    }
+}
+/** Collect `requires` declarations from every skill installed in this repo. */
+function scanSkillRequirements(homeDir, cwd) {
+    const found = [];
+    for (const [skillsDir, source] of skillMdRoots(homeDir, cwd)) {
+        for (const name of safeDirs(skillsDir)) {
+            const md = path.join(skillsDir, name, 'SKILL.md');
+            let text;
+            try {
+                text = fs.readFileSync(md, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            const requires = (0, skill_requirements_js_1.parseRequiresField)(text);
+            if (requires.length > 0)
+                found.push({ name, source, requires });
+        }
+    }
+    return found;
+}
+/**
+ * Verify the runtime requirements declared by installed skills (#336). Reads
+ * `requires:` from each overlay/global/local skill's SKILL.md and checks every
+ * declared command (and optional version) against the environment. A missing
+ * or too-old requirement is a `fail` naming the skill and command; a bare
+ * presence check that passes, or a token whose version cannot be read, never
+ * fails. No declarations at all → an informational line (not a false "all
+ * good"). Bundled skills ship inside the engine and are out of scope here.
+ */
+function checkSkillRequirements(deps = {}) {
+    const homeDir = deps.homeDir ?? os.homedir();
+    const cwd = deps.cwd ?? process.cwd();
+    const probe = deps.skillProbe ?? realProbe;
+    const skills = scanSkillRequirements(homeDir, cwd);
+    if (skills.length === 0) {
+        return {
+            id: 'engine:skill-requirements',
+            status: 'info',
+            label: 'no installed skill declares runtime requirements',
+        };
+    }
+    const failures = [];
+    let checked = 0;
+    for (const skill of skills) {
+        for (const token of skill.requires) {
+            checked += 1;
+            const r = (0, skill_requirements_js_1.checkRequirement)((0, skill_requirements_js_1.parseRequirement)(token), probe);
+            if (r.status === 'missing' || r.status === 'too-old') {
+                failures.push(`${skill.source}/${skill.name} needs ${token}: ${r.detail}`);
+            }
+        }
     }
-    return { id: "engine:mcp", status: "pass", label: "MCP config resolves" };
+    if (failures.length > 0) {
+        return {
+            id: 'engine:skill-requirements',
+            status: 'fail',
+            label: `skill runtime requirements unmet: ${failures.length} of ${checked}`,
+            remedy: `Install/upgrade the missing tools — ${failures.join('; ')}`,
+        };
+    }
+    return {
+        id: 'engine:skill-requirements',
+        status: 'pass',
+        label: `skill runtime requirements: ${checked} satisfied across ${skills.length} skill(s)`,
+    };
 }
 /** Run every engine check, in display order. */
 async function runEngineChecks(deps = {}) {
@@ -312,6 +529,8 @@ async function runEngineChecks(deps = {}) {
         await checkVersion(deps),
         checkGit(deps),
         ...checkOverlays(deps),
+        checkOverlayConflicts(deps),
+        checkSkillRequirements(deps),
         checkProjectConfig(deps),
         checkMcpConfig(deps),
     ];