claudeup 6.2.1 → 6.3.2

package/src/__tests__/skill-install-files.test.ts

@@ -1,8 +1,8 @@
 import { describe, expect, test } from "bun:test";
 import path from "node:path";
 import {
-  resolveSkillFilePath,
-  selectSkillFiles,
+	resolveSkillFilePath,
+	selectSkillFiles,
 } from "../services/skills-manager.js";
 
 /**
@@ -21,108 +21,116 @@ const blob = (p: string) => ({ path: p, type: "blob" });
 const tree = (p: string) => ({ path: p, type: "tree" });
 
 describe("selectSkillFiles", () => {
-  test("returns paths relative to the skill directory", () => {
-    expect(
-      selectSkillFiles(
-        [
-          blob("skills/audit-website/SKILL.md"),
-          blob("skills/audit-website/references/OUTPUT-FORMAT.md"),
-          blob("skills/audit-website/assets/icon-small.svg"),
-        ],
-        "skills/audit-website",
-      ),
-    ).toEqual(["SKILL.md", "references/OUTPUT-FORMAT.md", "assets/icon-small.svg"]);
-  });
-
-  test("REGRESSION: a sibling with a shared name prefix is excluded", () => {
-    // Without the trailing slash on the prefix, "skills/audit" also matches
-    // "skills/audit-website/..." and dumps a second skill's files into the
-    // first one's directory.
-    expect(
-      selectSkillFiles(
-        [
-          blob("skills/audit/SKILL.md"),
-          blob("skills/audit-website/SKILL.md"),
-          blob("skills/audit-website/references/OUTPUT-FORMAT.md"),
-        ],
-        "skills/audit",
-      ),
-    ).toEqual(["SKILL.md"]);
-  });
-
-  test("tree entries are skipped — only blobs are downloadable", () => {
-    expect(
-      selectSkillFiles(
-        [
-          tree("skills/x/references"),
-          blob("skills/x/SKILL.md"),
-          blob("skills/x/references/a.md"),
-        ],
-        "skills/x",
-      ),
-    ).toEqual(["SKILL.md", "references/a.md"]);
-  });
-
-  test("files outside the skill directory are excluded", () => {
-    expect(
-      selectSkillFiles(
-        [blob("README.md"), blob("other/SKILL.md"), blob("skills/x/SKILL.md")],
-        "skills/x",
-      ),
-    ).toEqual(["SKILL.md"]);
-  });
-
-  test("a trailing slash on the skill path does not break matching", () => {
-    expect(
-      selectSkillFiles([blob("skills/x/SKILL.md")], "skills/x/"),
-    ).toEqual(["SKILL.md"]);
-  });
-
-  test("a skill directory with no files yields nothing", () => {
-    expect(selectSkillFiles([blob("skills/other/SKILL.md")], "skills/x")).toEqual([]);
-  });
+	test("returns paths relative to the skill directory", () => {
+		expect(
+			selectSkillFiles(
+				[
+					blob("skills/audit-website/SKILL.md"),
+					blob("skills/audit-website/references/OUTPUT-FORMAT.md"),
+					blob("skills/audit-website/assets/icon-small.svg"),
+				],
+				"skills/audit-website",
+			),
+		).toEqual([
+			"SKILL.md",
+			"references/OUTPUT-FORMAT.md",
+			"assets/icon-small.svg",
+		]);
+	});
+
+	test("REGRESSION: a sibling with a shared name prefix is excluded", () => {
+		// Without the trailing slash on the prefix, "skills/audit" also matches
+		// "skills/audit-website/..." and dumps a second skill's files into the
+		// first one's directory.
+		expect(
+			selectSkillFiles(
+				[
+					blob("skills/audit/SKILL.md"),
+					blob("skills/audit-website/SKILL.md"),
+					blob("skills/audit-website/references/OUTPUT-FORMAT.md"),
+				],
+				"skills/audit",
+			),
+		).toEqual(["SKILL.md"]);
+	});
+
+	test("tree entries are skipped — only blobs are downloadable", () => {
+		expect(
+			selectSkillFiles(
+				[
+					tree("skills/x/references"),
+					blob("skills/x/SKILL.md"),
+					blob("skills/x/references/a.md"),
+				],
+				"skills/x",
+			),
+		).toEqual(["SKILL.md", "references/a.md"]);
+	});
+
+	test("files outside the skill directory are excluded", () => {
+		expect(
+			selectSkillFiles(
+				[blob("README.md"), blob("other/SKILL.md"), blob("skills/x/SKILL.md")],
+				"skills/x",
+			),
+		).toEqual(["SKILL.md"]);
+	});
+
+	test("a trailing slash on the skill path does not break matching", () => {
+		expect(selectSkillFiles([blob("skills/x/SKILL.md")], "skills/x/")).toEqual([
+			"SKILL.md",
+		]);
+	});
+
+	test("a skill directory with no files yields nothing", () => {
+		expect(
+			selectSkillFiles([blob("skills/other/SKILL.md")], "skills/x"),
+		).toEqual([]);
+	});
 });
 
 describe("resolveSkillFilePath", () => {
-  const dir = path.join(path.sep, "tmp", "skills", "demo");
-
-  test("resolves a plain relative path inside the install directory", () => {
-    expect(resolveSkillFilePath(dir, "SKILL.md")).toBe(
-      path.join(dir, "SKILL.md"),
-    );
-  });
-
-  test("resolves a nested path", () => {
-    expect(resolveSkillFilePath(dir, "references/OUTPUT-FORMAT.md")).toBe(
-      path.join(dir, "references", "OUTPUT-FORMAT.md"),
-    );
-  });
-
-  test("SECURITY: rejects paths escaping via ..", () => {
-    // These paths come from a remote repository and are untrusted input to a
-    // filesystem write.
-    expect(resolveSkillFilePath(dir, "../evil.md")).toBeNull();
-    expect(resolveSkillFilePath(dir, "../../.bashrc")).toBeNull();
-    expect(resolveSkillFilePath(dir, "refs/../../../evil.md")).toBeNull();
-  });
-
-  test("SECURITY: rejects absolute paths", () => {
-    expect(resolveSkillFilePath(dir, path.join(path.sep, "etc", "passwd"))).toBeNull();
-  });
-
-  test("rejects an empty path", () => {
-    expect(resolveSkillFilePath(dir, "")).toBeNull();
-  });
-
-  test("a .. that stays inside the directory is allowed", () => {
-    expect(resolveSkillFilePath(dir, "refs/../SKILL.md")).toBe(
-      path.join(dir, "SKILL.md"),
-    );
-  });
-
-  test("REGRESSION: a sibling directory sharing the name prefix is rejected", () => {
-    // path.startsWith without a separator would accept /tmp/skills/demo-evil
-    // as being inside /tmp/skills/demo.
-    expect(resolveSkillFilePath(dir, "../demo-evil/x.md")).toBeNull();
-  });
+	const dir = path.join(path.sep, "tmp", "skills", "demo");
+
+	test("resolves a plain relative path inside the install directory", () => {
+		expect(resolveSkillFilePath(dir, "SKILL.md")).toBe(
+			path.join(dir, "SKILL.md"),
+		);
+	});
+
+	test("resolves a nested path", () => {
+		expect(resolveSkillFilePath(dir, "references/OUTPUT-FORMAT.md")).toBe(
+			path.join(dir, "references", "OUTPUT-FORMAT.md"),
+		);
+	});
+
+	test("SECURITY: rejects paths escaping via ..", () => {
+		// These paths come from a remote repository and are untrusted input to a
+		// filesystem write.
+		expect(resolveSkillFilePath(dir, "../evil.md")).toBeNull();
+		expect(resolveSkillFilePath(dir, "../../.bashrc")).toBeNull();
+		expect(resolveSkillFilePath(dir, "refs/../../../evil.md")).toBeNull();
+	});
+
+	test("SECURITY: rejects absolute paths", () => {
+		expect(
+			resolveSkillFilePath(dir, path.join(path.sep, "etc", "passwd")),
+		).toBeNull();
+	});
+
+	test("rejects an empty path", () => {
+		expect(resolveSkillFilePath(dir, "")).toBeNull();
+	});
+
+	test("a .. that stays inside the directory is allowed", () => {
+		expect(resolveSkillFilePath(dir, "refs/../SKILL.md")).toBe(
+			path.join(dir, "SKILL.md"),
+		);
+	});
+
+	test("REGRESSION: a sibling directory sharing the name prefix is rejected", () => {
+		// path.startsWith without a separator would accept /tmp/skills/demo-evil
+		// as being inside /tmp/skills/demo.
+		expect(resolveSkillFilePath(dir, "../demo-evil/x.md")).toBeNull();
+	});
 });

package/src/__tests__/symlink-manager.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtemp, rm, lstat, readlink } from "node:fs/promises";
+import { lstat, mkdtemp, readlink, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import fs from "fs-extra";
@@ -17,7 +17,8 @@ async function materialize(
 ) {
 	const dir = profileDir(name, project);
 	await fs.ensureDir(dir);
-	if (files.settings) await fs.writeJson(join(dir, "settings.json"), files.settings);
+	if (files.settings)
+		await fs.writeJson(join(dir, "settings.json"), files.settings);
 	if (files.mcp) await fs.writeJson(join(dir, "mcp.json"), files.mcp);
 	if (files.skills) await fs.ensureDir(join(dir, "skills"));
 }
@@ -40,12 +41,20 @@ describe("symlink-manager", () => {
 		await activateProfile("frontend", project);
 
 		// settings.json is a symlink into the profile dir
-		expect((await lstat(join(project, ".claude", "settings.json"))).isSymbolicLink()).toBe(true);
-		expect((await lstat(join(project, ".mcp.json"))).isSymbolicLink()).toBe(true);
-		expect((await lstat(join(project, ".claude", "skills"))).isSymbolicLink()).toBe(true);
+		expect(
+			(await lstat(join(project, ".claude", "settings.json"))).isSymbolicLink(),
+		).toBe(true);
+		expect((await lstat(join(project, ".mcp.json"))).isSymbolicLink()).toBe(
+			true,
+		);
+		expect(
+			(await lstat(join(project, ".claude", "skills"))).isSymbolicLink(),
+		).toBe(true);
 
 		// reading through the link returns the profile's content
-		const settings = await fs.readJson(join(project, ".claude", "settings.json"));
+		const settings = await fs.readJson(
+			join(project, ".claude", "settings.json"),
+		);
 		expect(settings.enabledPlugins["dev@magus"]).toBe(true);
 	});
 
@@ -54,8 +63,12 @@ describe("symlink-manager", () => {
 		await activateProfile("frontend", project);
 		await fs.writeJson(join(project, ".claude", "settings.json"), { a: 2 });
 		// The real file inside the profile dir was updated (symlink preserved).
-		expect((await lstat(join(project, ".claude", "settings.json"))).isSymbolicLink()).toBe(true);
-		expect((await fs.readJson(profileDir("frontend", project) + "/settings.json")).a).toBe(2);
+		expect(
+			(await lstat(join(project, ".claude", "settings.json"))).isSymbolicLink(),
+		).toBe(true);
+		expect(
+			(await fs.readJson(`${profileDir("frontend", project)}/settings.json`)).a,
+		).toBe(2);
 	});
 
 	test("switching repoints links and activeProfile tracks it", async () => {
@@ -64,11 +77,15 @@ describe("symlink-manager", () => {
 
 		await activateProfile("frontend", project);
 		expect(await activeProfile(project)).toBe("frontend");
-		expect((await fs.readJson(join(project, ".claude", "settings.json"))).which).toBe("frontend");
+		expect(
+			(await fs.readJson(join(project, ".claude", "settings.json"))).which,
+		).toBe("frontend");
 
 		await activateProfile("backend", project);
 		expect(await activeProfile(project)).toBe("backend");
-		expect((await fs.readJson(join(project, ".claude", "settings.json"))).which).toBe("backend");
+		expect(
+			(await fs.readJson(join(project, ".claude", "settings.json"))).which,
+		).toBe("backend");
 	});
 
 	test("uses relative (not absolute) symlinks", async () => {

package/src/__tests__/theme-env.test.ts

@@ -0,0 +1,281 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { loadProjectDotenv } from "../services/dotenv.js";
+import { resolveTheme, snapshotThemeEnv } from "../ui/theme-resolve.js";
+
+/**
+ * `TERM_THEME` is read from the process environment and never from a `.env`.
+ *
+ * Nothing at runtime enforces that — `loadProjectDotenv` merges into the same
+ * `process.env` the resolver would otherwise read — so the isolation is the
+ * ORDER of two calls in main.tsx: snapshot first, dotenv second. T-env-1 and
+ * T-env-2 prove the mechanism; T-env-3 pins the order at source level, which is
+ * the only place it can be pinned without spawning the TUI.
+ *
+ * Order alone is not enough on the source path: Bun autoloads the cwd's `.env`
+ * into `process.env` BEFORE any user code runs, so a snapshot taken as the
+ * first statement already holds the file's values. Every source launcher
+ * therefore passes `--no-env-file` (the compiled binary is built with
+ * `--no-compile-autoload-dotenv`). T-env-4 proves that flag live, with a
+ * negative control showing the leak without it.
+ */
+
+const dirs: string[] = [];
+
+const MAIN_TSX = path.join(import.meta.dir, "..", "main.tsx");
+const THEME_RESOLVE = path.join(
+	import.meta.dir,
+	"..",
+	"ui",
+	"theme-resolve.ts",
+);
+
+/**
+ * Spawn bun from `cwd` with the three theme variables removed from the parent
+ * environment, so the only way `TERM_THEME` can reach the child is Bun's own
+ * `.env` autoload. Returns stdout/stderr/status.
+ */
+function spawnBun(
+	cwd: string,
+	args: string[],
+): { status: number | null; stdout: string; stderr: string } {
+	const env: Record<string, string | undefined> = { ...process.env };
+	env.TERM_THEME = undefined;
+	env.CLAUDEUP_THEME = undefined;
+	env.COLORFGBG = undefined;
+	const r = spawnSync("bun", args, {
+		cwd,
+		env: env as NodeJS.ProcessEnv,
+		encoding: "utf-8",
+		input: "",
+	});
+	return { status: r.status, stdout: r.stdout, stderr: r.stderr };
+}
+
+/** A one-file harness that prints `snapshotThemeEnv()` of its own process. */
+function writeSnapshotHarness(cwd: string): string {
+	const file = path.join(cwd, "print-snapshot.ts");
+	writeFileSync(
+		file,
+		[
+			`import { snapshotThemeEnv } from ${JSON.stringify(THEME_RESOLVE)};`,
+			"console.log(JSON.stringify(snapshotThemeEnv()));",
+			"",
+		].join("\n"),
+	);
+	return file;
+}
+
+afterEach(() => {
+	for (const dir of dirs.splice(0))
+		rmSync(dir, { recursive: true, force: true });
+});
+
+function tempDir(): string {
+	const dir = mkdtempSync(path.join(os.tmpdir(), "claudeup-theme-env-"));
+	dirs.push(dir);
+	return dir;
+}
+
+describe("snapshotThemeEnv", () => {
+	test("T-env-1: the snapshot is a copy — later writes to env do not reach it", () => {
+		const env: Record<string, string | undefined> = {
+			TERM_THEME: "light",
+			CLAUDEUP_THEME: "dark",
+			COLORFGBG: "0;15",
+			UNRELATED: "x",
+		};
+
+		const snapshot = snapshotThemeEnv(env);
+		env.TERM_THEME = "dark";
+		env.CLAUDEUP_THEME = undefined;
+		env.COLORFGBG = "15;0";
+
+		expect(snapshot).toEqual({
+			TERM_THEME: "light",
+			CLAUDEUP_THEME: "dark",
+			COLORFGBG: "0;15",
+		});
+	});
+
+	test("T-env-1b: an unset variable is absent from the snapshot, not undefined", () => {
+		expect(snapshotThemeEnv({})).toEqual({});
+		expect(Object.keys(snapshotThemeEnv({ TERM_THEME: "light" }))).toEqual([
+			"TERM_THEME",
+		]);
+	});
+
+	test("T-env-2: a .env TERM_THEME lands in env but never in a snapshot taken first", () => {
+		const cwd = tempDir();
+		writeFileSync(path.join(cwd, ".env"), "TERM_THEME=light\n");
+		const env: Record<string, string | undefined> = {};
+
+		const snapshot = snapshotThemeEnv(env);
+		const outcome = loadProjectDotenv(cwd, env);
+
+		expect(outcome.warnings).toEqual([]);
+		expect(env.TERM_THEME).toBe("light");
+		expect(snapshot.TERM_THEME).toBeUndefined();
+		expect(snapshot).toEqual({});
+	});
+
+	test("T-env-2b: a .env TERM_THEME=light never reaches the resolver — the probe still runs and wins", async () => {
+		// End to end through the resolver: snapshot, then .env, then resolve
+		// with the snapshot. Were the .env value reaching the resolver, step 3
+		// would answer light and the probe would never be called.
+		const cwd = tempDir();
+		writeFileSync(
+			path.join(cwd, ".env"),
+			"TERM_THEME=light\nCLAUDEUP_THEME=light\n",
+		);
+		const env: Record<string, string | undefined> = {};
+		let probeCalls = 0;
+
+		const snapshot = snapshotThemeEnv(env);
+		loadProjectDotenv(cwd, env);
+		const interactive = await resolveTheme({
+			env: snapshot,
+			isInteractive: true,
+			probe: async () => {
+				probeCalls += 1;
+				return "dark";
+			},
+		});
+		const headless = await resolveTheme({
+			env: snapshot,
+			isInteractive: false,
+			probe: async () => "light",
+		});
+
+		expect(env.TERM_THEME).toBe("light");
+		expect(interactive).toEqual({ mode: "dark", source: "osc11" });
+		expect(probeCalls).toBe(1);
+		expect(headless).toEqual({ mode: "dark", source: "default" });
+	});
+
+	test("T-env-2c: .env.local is isolated the same way as .env", async () => {
+		const cwd = tempDir();
+		writeFileSync(path.join(cwd, ".env.local"), "TERM_THEME=light\n");
+		const env: Record<string, string | undefined> = { COLORFGBG: "15;0" };
+
+		const snapshot = snapshotThemeEnv(env);
+		loadProjectDotenv(cwd, env);
+		const r = await resolveTheme({
+			env: snapshot,
+			isInteractive: false,
+			probe: async () => null,
+		});
+
+		expect(env.TERM_THEME).toBe("light");
+		expect(r).toEqual({ mode: "dark", source: "COLORFGBG" });
+	});
+});
+
+describe("Bun .env autoload (live)", () => {
+	test("T-env-4: `bun --no-env-file src/main.tsx --theme bogus` from a cwd with .env exits in the router, not from the file", () => {
+		// --theme bogus exits 1 before the renderer, so no tty is needed. The
+		// point of the run is the exit path: a leaked .env value cannot change
+		// it, and the flag must not break the source launch either.
+		const cwd = tempDir();
+		writeFileSync(
+			path.join(cwd, ".env"),
+			"TERM_THEME=light\nCLAUDEUP_THEME=light\n",
+		);
+
+		const r = spawnBun(cwd, ["--no-env-file", MAIN_TSX, "--theme", "bogus"]);
+
+		expect(r.status).toBe(1);
+		expect(r.stderr).toContain("bogus");
+		expect(r.stderr).toContain("--theme");
+	});
+
+	test("T-env-4b: with --no-env-file the process snapshot holds nothing from the cwd's .env", () => {
+		const cwd = tempDir();
+		writeFileSync(
+			path.join(cwd, ".env"),
+			"TERM_THEME=light\nCLAUDEUP_THEME=light\n",
+		);
+		const harness = writeSnapshotHarness(cwd);
+
+		const r = spawnBun(cwd, ["--no-env-file", harness]);
+
+		expect(r.status).toBe(0);
+		expect(JSON.parse(r.stdout.trim())).toEqual({});
+	});
+
+	test("T-env-4c (negative control): without --no-env-file the same harness sees TERM_THEME=light — the flag is what isolates", () => {
+		const cwd = tempDir();
+		writeFileSync(
+			path.join(cwd, ".env"),
+			"TERM_THEME=light\nCLAUDEUP_THEME=light\n",
+		);
+		const harness = writeSnapshotHarness(cwd);
+
+		const r = spawnBun(cwd, [harness]);
+
+		expect(r.status).toBe(0);
+		expect(JSON.parse(r.stdout.trim())).toEqual({
+			TERM_THEME: "light",
+			CLAUDEUP_THEME: "light",
+		});
+	});
+
+	test("T-env-4d: every source launcher passes --no-env-file", () => {
+		// package.json scripts and the bin fallback are the launch surfaces a
+		// developer actually uses; a `bun src/main.tsx` without the flag is the
+		// bug T-env-4c demonstrates.
+		const root = path.join(import.meta.dir, "..", "..");
+		const pkg = JSON.parse(
+			readFileSync(path.join(root, "package.json"), "utf-8"),
+		) as { scripts: Record<string, string> };
+		const bin = readFileSync(path.join(root, "bin", "claudeup.js"), "utf-8");
+
+		for (const name of ["start", "dev"]) {
+			expect(pkg.scripts[name]).toContain("--no-env-file");
+			expect(pkg.scripts[name]).toContain("src/main.tsx");
+		}
+		expect(bin).toMatch(/spawnSync\(\s*"bun",\s*\[\s*"--no-env-file"/);
+	});
+});
+
+/**
+ * Drop `//` line comments and `/* *\/` blocks so a guard below matches code,
+ * never a comment that happens to name the call. Strings in main.tsx contain
+ * neither `//` nor `/*`, so the crude regex is exact enough for that one file.
+ */
+function stripComments(source: string): string {
+	return source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "");
+}
+
+describe("main.tsx order", () => {
+	const code = stripComments(
+		readFileSync(path.join(import.meta.dir, "..", "main.tsx"), "utf-8"),
+	);
+
+	test("T-env-3: the snapshot STATEMENT runs before the loadProjectDotenv() call", () => {
+		// Source-level guard. Honest about what it is: nothing at runtime would
+		// notice a .env winning, and the TUI cannot be spawned in a test. It
+		// anchors on the concrete statement, in comment-stripped source, so the
+		// explanatory comment above the call cannot satisfy it (it once did).
+		const snapshotAt = code.indexOf("const themeEnv = snapshotThemeEnv()");
+		const dotenvAt = code.indexOf("loadProjectDotenv(");
+
+		expect(snapshotAt).toBeGreaterThan(-1);
+		expect(dotenvAt).toBeGreaterThan(-1);
+		expect(snapshotAt).toBeLessThan(dotenvAt);
+	});
+
+	test("T-env-3b: main.tsx reads the three theme variables only through the snapshot", () => {
+		// A later `process.env.TERM_THEME` would see the merged .env and bypass
+		// the snapshot silently; the resolver must be handed `themeEnv` instead.
+		for (const name of ["TERM_THEME", "CLAUDEUP_THEME", "COLORFGBG"]) {
+			expect(code).not.toMatch(
+				new RegExp(`process\\.env(\\.${name}\\b|\\[["'\`]${name}["'\`]\\])`),
+			);
+		}
+		expect(code).toMatch(/env:\s*themeEnv\b/);
+	});
+});