claudeup 4.36.0 → 4.38.0

package/src/__tests__/community-registry.test.ts

@@ -0,0 +1,269 @@
+import { describe, expect, test } from "bun:test";
+import {
+	COMMUNITY_ID_SEPARATOR,
+	COMMUNITY_SOURCES,
+	COMMUNITY_STYLES,
+	DENIED_REPOS,
+	LICENCE_DEFERRED_REPOS,
+	coordinateProblem,
+	findCommunitySource,
+	findCommunityStyle,
+	rawUrlFor,
+	resolveCommunityStyle,
+	slugOf,
+	stylesForSource,
+} from "../data/community-styles.js";
+import { isValidGitHubRepo } from "../utils/string-utils.js";
+
+// Pure data invariants. No I/O, no network — the registry is a constant, and
+// every defect it can carry is visible without leaving the process. Fetching to
+// prove a path exists is the job of `scripts/verify-community-registry.ts`,
+// which a human runs while curating and which must never run in CI.
+
+describe("sources", () => {
+	test("every repo is a syntactically valid GitHub coordinate", () => {
+		// Not decoration: the repo goes straight into a URL, so a malformed one is
+		// an SSRF vector before it is a 404.
+		for (const source of COMMUNITY_SOURCES) {
+			expect(isValidGitHubRepo(source.repo), source.repo).toBe(true);
+		}
+	});
+
+	test("source ids are unique and filename-safe", () => {
+		// The id is the first half of every cache filename this source produces.
+		const ids = COMMUNITY_SOURCES.map((source) => source.id);
+		expect(new Set(ids).size).toBe(ids.length);
+		for (const id of ids) expect(id, id).toMatch(/^[a-z0-9-]+$/);
+	});
+
+	test("every shipped source declares a licence", () => {
+		// `licence: null` is representable on purpose — the type carries it and the
+		// UI renders it in warning colour — but nothing with one ships in v1. See
+		// LICENCE_DEFERRED_REPOS.
+		for (const source of COMMUNITY_SOURCES) {
+			expect(
+				source.licence,
+				`${source.repo} declares a licence`,
+			).not.toBeNull();
+			expect(
+				source.licenceUrl,
+				`${source.repo} links its licence`,
+			).toBeTruthy();
+		}
+	});
+
+	test("the styles directory is per-source, never assumed", () => {
+		// research.md finding 1: four of five use `output-styles/` and one uses
+		// `.claude/output-styles/`. A test that only saw the majority would let a
+		// future globbing "simplification" through.
+		const dirs = new Set(COMMUNITY_SOURCES.map((source) => source.dir));
+		expect(dirs.size).toBeGreaterThan(1);
+		expect(dirs).toContain(".claude/output-styles");
+	});
+
+	test("every source is attributed and reachable by a human", () => {
+		for (const source of COMMUNITY_SOURCES) {
+			expect(source.author, source.repo).toBeTruthy();
+			expect(source.homepage, source.repo).toContain(source.repo);
+		}
+	});
+});
+
+describe("styles", () => {
+	test("ids are unique", () => {
+		const ids = COMMUNITY_STYLES.map((style) => style.id);
+		expect(new Set(ids).size).toBe(ids.length);
+	});
+
+	test("every entry resolves to a source, and names it in its id", () => {
+		for (const style of COMMUNITY_STYLES) {
+			const source = findCommunitySource(style.sourceId);
+			expect(source, `${style.id} resolves its source`).not.toBeNull();
+			expect(
+				style.id.startsWith(`${style.sourceId}${COMMUNITY_ID_SEPARATOR}`),
+			).toBe(true);
+		}
+	});
+
+	test("every coordinate passes the validator the fetcher runs", () => {
+		// The fetcher THROWS on a bad coordinate, because it is our data and a
+		// failure is a bug in a commit rather than a user error. This is the test
+		// that catches it in the commit instead of at a keypress.
+		for (const style of COMMUNITY_STYLES) {
+			const source = findCommunitySource(style.sourceId);
+			expect(source).not.toBeNull();
+			if (!source) continue;
+			expect(coordinateProblem(style, source), style.id).toBeNull();
+		}
+	});
+
+	test("no path escapes its repo or its styles directory", () => {
+		for (const style of COMMUNITY_STYLES) {
+			const source = findCommunitySource(style.sourceId);
+			if (!source) continue;
+			expect(style.path.endsWith(".md"), style.id).toBe(true);
+			expect(style.path.includes(".."), style.id).toBe(false);
+			expect(style.path.startsWith("/"), style.id).toBe(false);
+			expect(style.path.startsWith(`${source.dir}/`), style.id).toBe(true);
+		}
+	});
+
+	test("every entry carries a display name and a summary we wrote", () => {
+		for (const style of COMMUNITY_STYLES) {
+			expect(style.displayName, style.id).toBeTruthy();
+			expect(style.summary, style.id).toBeTruthy();
+			// The summary is the row text. Longer than this and it truncates in the
+			// list, which reads as a bug rather than as a long description.
+			expect(
+				style.summary.length,
+				`${style.id} summary length`,
+			).toBeLessThanOrEqual(100);
+		}
+	});
+
+	test("no display name or summary carries a comma-driven round-trip hazard", () => {
+		// `style-imports` is comma-separated, so only the ID must be comma-free.
+		// Asserting it here as well as in the id regex, because this is the field a
+		// future editor is most likely to paste an upstream string into.
+		for (const style of COMMUNITY_STYLES) {
+			expect(style.id.includes(","), style.id).toBe(false);
+		}
+	});
+
+	test("the raw URL is built from the coordinate, with nothing inferred", () => {
+		const resolved = resolveCommunityStyle("attention-span--spartan");
+		expect(resolved).not.toBeNull();
+		if (!resolved) return;
+		expect(rawUrlFor(resolved.style, resolved.source)).toBe(
+			"https://raw.githubusercontent.com/alexgreensh/attention-span/HEAD/output-styles/spartan.md",
+		);
+	});
+
+	test("the one source with a non-standard directory is actually shipped", () => {
+		// hesreallyhim keeps its styles in `.claude/output-styles/`. Shipping it is
+		// what keeps the per-entry path exercised in production rather than merely
+		// designed for.
+		const paths = stylesForSource("hesreallyhim").map((style) => style.path);
+		expect(paths.length).toBeGreaterThan(0);
+		for (const path of paths) {
+			expect(path.startsWith(".claude/output-styles/")).toBe(true);
+		}
+	});
+});
+
+describe("lookup", () => {
+	test("finds an entry by its coordinate id", () => {
+		expect(findCommunityStyle("attention-span--spartan")?.displayName).toBe(
+			"Spartan",
+		);
+	});
+
+	test("returns null rather than guessing at an unknown id", () => {
+		expect(findCommunityStyle("attention-span--nope")).toBeNull();
+		expect(findCommunitySource("nope")).toBeNull();
+		expect(resolveCommunityStyle("nope--nope")).toBeNull();
+	});
+
+	test("splits a coordinate on the FIRST separator, so hyphenated slugs survive", () => {
+		expect(slugOf("lej-output-fixer--walk-me-through-it")).toBe(
+			"walk-me-through-it",
+		);
+		expect(slugOf("attention-span--spartan")).toBe("spartan");
+	});
+});
+
+describe("exclusions", () => {
+	test("no entry names a repo that ships zero style files", () => {
+		// THE POINT OF THIS TEST, so a future editor learns it instead of deleting
+		// it: `JuliusBrussee/caveman` (98,781 stars) and `blader/humanizer`
+		// (36,229) are the two highest-starred names in this space and they ship
+		// NO output styles at all — they are methodologies packaged as skills. An
+		// entry for either would 404 on first fetch. Anyone re-adding one from a
+		// popularity list will land here first.
+		const shipped = new Set(COMMUNITY_SOURCES.map((source) => source.repo));
+		for (const denied of DENIED_REPOS) {
+			expect(shipped.has(denied), `${denied} must not be a source`).toBe(false);
+		}
+	});
+
+	test("the deny-list still names the two that motivate it", () => {
+		// A deny-list that quietly lost its most important entries would pass the
+		// test above while protecting nothing.
+		expect(DENIED_REPOS).toContain("JuliusBrussee/caveman");
+		expect(DENIED_REPOS).toContain("blader/humanizer");
+	});
+
+	test("repos with no redistribution licence are deferred, not shipped", () => {
+		// smixs is NOASSERTION and SimpleClaude has no licence file. Excluded from
+		// v1 deliberately: the cost of being wrong this way is a style the user can
+		// still install by hand; the other way it is a legal problem on other
+		// people's machines.
+		const shipped = new Set(COMMUNITY_SOURCES.map((source) => source.repo));
+		for (const deferred of LICENCE_DEFERRED_REPOS) {
+			expect(shipped.has(deferred), `${deferred} is deferred`).toBe(false);
+		}
+	});
+});
+
+describe("coordinateProblem", () => {
+	const source = COMMUNITY_SOURCES[0];
+
+	const entry = (over: Partial<(typeof COMMUNITY_STYLES)[number]> = {}) => ({
+		id: "attention-span--spartan",
+		sourceId: "attention-span",
+		path: "output-styles/spartan.md",
+		displayName: "Spartan",
+		summary: "s",
+		...over,
+	});
+
+	test("accepts a well-formed entry", () => {
+		expect(coordinateProblem(entry(), source)).toBeNull();
+	});
+
+	test("rejects a traversing path", () => {
+		expect(
+			coordinateProblem(
+				entry({ path: "output-styles/../../etc/passwd.md" }),
+				source,
+			),
+		).toBeTruthy();
+	});
+
+	test("rejects a path outside the source's directory", () => {
+		expect(coordinateProblem(entry({ path: "README.md" }), source)).toContain(
+			"is not under",
+		);
+	});
+
+	test("rejects a path that is not markdown", () => {
+		expect(
+			coordinateProblem(entry({ path: "output-styles/spartan.sh" }), source),
+		).toBeTruthy();
+	});
+
+	test("rejects an id that is not a slug pair", () => {
+		expect(coordinateProblem(entry({ id: "Zen Master" }), source)).toBeTruthy();
+		expect(
+			coordinateProblem(entry({ id: "attention-span--Blunt, fast" }), source),
+		).toBeTruthy();
+	});
+
+	test("rejects an id whose source half does not match", () => {
+		expect(
+			coordinateProblem(entry({ id: "other-repo--spartan" }), source),
+		).toBeTruthy();
+	});
+
+	test("rejects a malformed repo", () => {
+		expect(
+			coordinateProblem(entry(), { ...source, repo: "http://evil/x" }),
+		).toBeTruthy();
+	});
+
+	test("rejects a ref that could smuggle a query string", () => {
+		expect(
+			coordinateProblem(entry(), { ...source, ref: "HEAD?x=1" }),
+		).toBeTruthy();
+	});
+});