create-pmos 0.15.0 → 0.16.0

package/workspace/profiles.test.js

@@ -1,362 +0,0 @@
-#!/usr/bin/env node
-/* Claude profile reader — unit suite for workspace/lib/profiles.js (initiative `workspace-profiles`).
- *
- * No framework and no mocks: every case builds a real temp home directory with real files, because
- * the whole point of this module is what the filesystem actually says. A mocked `fs` would let a
- * test pass against a filesystem that does not behave like one — and the two facts this module
- * exists to keep apart (a MISSING directory vs an UNREADABLE one) are distinguished by an errno
- * that only a real filesystem produces.
- *
- *  A. absence vs emptiness   — the two calm states, held apart
- *  B. unreadable             — the failure state, held apart from both of the above
- *  C. happy path             — fields read faithfully, nothing invented
- *  D. one bad file (R4)      — the good ones survive; the bad one is named
- *  E. wrong-typed keys       — rejected loudly, never coerced into a false "none declared"
- *  F. profileLine (R6/R7)    — the five sentences, and the phrase that must never appear
- */
-'use strict';
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { readProfiles, profileLine, profilesDir } = require('./lib/profiles');
-
-/* Assertions are THUNKS, and both the condition and its note are evaluated inside a try.
- *
- * This is not ceremony — it is the lesson `test.js`'s own header records. An assertion that
- * dereferences a value the code was supposed to provide (`r.error.includes(…)`) throws when the
- * code regresses, the throw unwinds past every later section, and the suite exits without a
- * summary. The first time this file was sabotaged on purpose, exactly that happened: the check
- * that mattered went red, the next one threw, and 45 checks never ran. A suite whose failure mode
- * is "stops counting" cannot be trusted to report a pass either, so a throw is recorded as ONE
- * failed check and the run continues.
- */
-const results = [];
-const ok = (name, cond, extra = '') => {
-  let pass = false;
-  let note = '';
-  try {
-    pass = !!(typeof cond === 'function' ? cond() : cond);
-    note = String((typeof extra === 'function' ? extra() : extra) ?? '');
-  } catch (e) {
-    pass = false;
-    note = 'threw: ' + String((e && e.message) || e).slice(0, 160);
-  }
-  results.push({ name, cond: pass });
-  console.log(`${pass ? '✓' : '✗'} ${name}${note ? ' — ' + note : ''}`);
-};
-// A truncated run must not be able to print a healthy-looking fraction of a number it silently
-// shrank. Bumped deliberately when checks are added.
-const EXPECTED_CHECKS = 51;
-
-// ── fixtures ────────────────────────────────────────────────────────────────────────────────────
-const tmp = [];
-/* home(null)  → a home directory with NO .claude at all (the absent case)
- * home({})    → .claude/profiles exists and is empty (the successful-read-of-nothing case)
- * home({...}) → those files written into .claude/profiles; a string body is written verbatim so a
- *               test can plant malformed JSON, an object body is stringified.
- */
-function home(files) {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pmos-profiles-'));
-  tmp.push(root);
-  if (files) {
-    const dir = path.join(root, '.claude', 'profiles');
-    fs.mkdirSync(dir, { recursive: true });
-    for (const [name, body] of Object.entries(files)) {
-      fs.writeFileSync(path.join(dir, name), typeof body === 'string' ? body : JSON.stringify(body, null, 2));
-    }
-  }
-  return root;
-}
-function cleanup() {
-  for (const r of tmp) { try { fs.rmSync(r, { recursive: true, force: true }); } catch {} }
-}
-
-const WORK = { id: 'claude-work', label: 'claude-work', account: 'pm@company.example', mcp: ['jira', 'confluence', 'slack', 'gworkspace'], env: { A: '1', B: '2', C: '3', D: '4' } };
-const PERSONAL = { id: 'claude-personal', label: 'claude-personal', account: 'me@personal.example', mcp: [], env: { A: '1', B: '2' } };
-
-try {
-  // ── A. absence and emptiness are DIFFERENT ANSWERS ────────────────────────────────────────────
-  {
-    const noHome = home(null);
-    const a = readProfiles(noHome);
-    ok('A1: a missing ~/.claude/profiles reads as a calm stated absence, not a failure',
-      a.ok === true && a.absent === true && a.error === null && a.profiles.length === 0,
-      JSON.stringify({ ok: a.ok, absent: a.absent, error: a.error }));
-    ok('A2: the absence NAMES the path it looked for (R2 — an absence with no path is uncheckable)',
-      a.dir === profilesDir(noHome) && a.dir.includes('.claude'), a.dir);
-    // The "pure reader" claim, asserted rather than asserted-in-a-comment.
-    ok('A3: reading an absent directory creates nothing — the reader is pure',
-      !fs.existsSync(path.join(noHome, '.claude')));
-
-    const emptyHome = home({});
-    const b = readProfiles(emptyHome);
-    ok('A4: an EMPTY profiles directory is a successful read of nothing, not an absence',
-      b.ok === true && b.absent === false && b.error === null && b.profiles.length === 0 && b.broken.length === 0,
-      JSON.stringify({ ok: b.ok, absent: b.absent }));
-    // The distinction itself. Both are calm and both yield zero chips; they are different facts
-    // about the machine and the surface renders different words for them.
-    ok('A5: THE DISTINCTION — absent and empty are not the same return value',
-      a.absent !== b.absent && a.ok === b.ok && a.profiles.length === b.profiles.length,
-      `absent=${a.absent} vs ${b.absent}`);
-  }
-
-  // ── B. unreadable is a THIRD answer, and it is a failure ──────────────────────────────────────
-  {
-    // A file sitting where the directory should be → ENOTDIR. This is the portable unreadable
-    // case: it does not depend on the uid the suite runs as, which the chmod case below does.
-    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pmos-profiles-'));
-    tmp.push(root);
-    fs.mkdirSync(path.join(root, '.claude'), { recursive: true });
-    fs.writeFileSync(path.join(root, '.claude', 'profiles'), 'not a directory');
-    const r = readProfiles(root);
-    ok('B1: a FILE where the profiles directory should be reads as a failure, never as an absence',
-      r.ok === false && r.absent === false && typeof r.error === 'string' && r.error.length > 0,
-      JSON.stringify({ ok: r.ok, absent: r.absent }));
-    ok('B2: the failure states its reason and names the path (it must render red with the reason)',
-      () => r.error.includes(profilesDir(root)) && /not a directory/.test(r.error), () => r.error);
-    // THE FAILURE THIS MODULE EXISTS TO PREVENT. "PMOS could not look" must never be reported as
-    // "your machine has no profiles" — that states a capability claim the data does not support.
-    ok('B3: THE HONESTY REQUIREMENT — an unreadable directory never reports absent:true',
-      r.absent === false && r.ok === false);
-
-    // Permission failure, where the suite's uid makes it meaningful. Under root, chmod 000 is still
-    // readable, so the check is SKIPPED and says so rather than reporting a pass it never earned.
-    const canTestPerms = typeof process.getuid === 'function' && process.getuid() !== 0;
-    if (canTestPerms) {
-      const p = home({});
-      fs.chmodSync(profilesDir(p), 0o000);
-      const pr = readProfiles(p);
-      ok('B4: an unreadable-by-permission directory is a failure with its errno, not an absence',
-        pr.ok === false && pr.absent === false && /EACCES|EPERM/.test(pr.error), pr.error);
-      fs.chmodSync(profilesDir(p), 0o700);
-    } else {
-      ok('B4: skipped — running as uid 0, where chmod 000 does not deny a read', true, 'no unprivileged uid');
-    }
-
-    const nh = readProfiles('');
-    ok('B5: no home directory given is a stated failure, not a throw and not a guess',
-      nh.ok === false && nh.absent === false && /will not guess/.test(nh.error), nh.error);
-    ok('B6: an undefined home directory behaves the same way', readProfiles(undefined).ok === false);
-  }
-
-  // ── C. the happy path: read faithfully, invent nothing ────────────────────────────────────────
-  {
-    const h = home({ 'claude-work.json': WORK, 'claude-personal.json': PERSONAL });
-    const r = readProfiles(h);
-    ok('C1: two good descriptors read as two profiles',
-      r.ok === true && r.absent === false && r.profiles.length === 2 && r.broken.length === 0,
-      r.profiles.map((p) => p.id).join(','));
-    ok('C2: chip order is stable (sorted), not filesystem order',
-      r.profiles.map((p) => p.id).join(',') === 'claude-personal,claude-work');
-    const work = r.profiles.find((p) => p.id === 'claude-work');
-    ok('C3: account is carried verbatim and mcp names are carried as declared',
-      () => work.account === 'pm@company.example' && work.mcp.join(' ') === 'jira confluence slack gworkspace',
-      () => work.account);
-    ok('C4: each profile names the descriptor path it came from (R10 footer)',
-      () => work.path === path.join(profilesDir(h), 'claude-work.json'), () => work.path);
-    ok('C5: the env overlay is read as declared',
-      () => Object.keys(work.env).length === 4 && work.env.A === '1');
-
-    // R1: no default is substituted for a missing key. An absent account must stay absent so the
-    // consumer can say "not declared" instead of showing an empty string that looks like a value.
-    const h2 = home({ 'bare.json': { id: 'bare' } });
-    const b = readProfiles(h2).profiles[0];
-    ok('C6: a descriptor with only an id is valid — absent account stays null, nothing invented',
-      !!b && b.account === null && Array.isArray(b.mcp) && b.mcp.length === 0 && b.env === null,
-      JSON.stringify({ account: b && b.account, mcp: b && b.mcp, env: b && b.env }));
-    ok('C7: label falls back to id when absent, and wins when present (R1)',
-      () => b.label === 'bare' &&
-        readProfiles(home({ 'x.json': { id: 'x', label: 'Work Account' } })).profiles[0].label === 'Work Account');
-
-    // Files that are not descriptors are not failed descriptors.
-    const h3 = home({ 'claude-work.json': WORK, 'README.md': '# notes', 'notes.txt': 'hi' });
-    const r3 = readProfiles(h3);
-    ok('C8: non-.json files are ignored entirely — not read, not reported as broken',
-      r3.profiles.length === 1 && r3.broken.length === 0);
-  }
-
-  // ── D. R4: one bad file does not take the others down ─────────────────────────────────────────
-  {
-    const h = home({ 'claude-work.json': WORK, 'claude-personal.json': '{ this is not json' });
-    const r = readProfiles(h);
-    ok('D1: R4 — a malformed descriptor beside a good one leaves the good one offered',
-      r.ok === true && r.profiles.length === 1 && r.profiles[0].id === 'claude-work',
-      r.profiles.map((p) => p.id).join(','));
-    ok('D2: the bad one is named, with its filename and parse error, so it can render red',
-      r.broken.length === 1 && r.broken[0].file === 'claude-personal.json' &&
-      /not valid JSON/.test(r.broken[0].error) && r.broken[0].path.endsWith('claude-personal.json'),
-      r.broken[0] && r.broken[0].error);
-    ok('D3: a directory-level ok stays true — a bad FILE is not a bad DIRECTORY',
-      r.ok === true && r.error === null && r.absent === false);
-
-    // An id that disagrees with its filename is rejected (R1/R4): the id is the identity every
-    // other surface cites, so a descriptor whose identity is ambiguous cannot be offered.
-    const mm = readProfiles(home({ 'claude-work.json': { id: 'claude-personal', mcp: [] } }));
-    ok('D4: an id/filename mismatch is rejected and says which is which',
-      mm.profiles.length === 0 && mm.broken.length === 1 && /disagrees with its filename/.test(mm.broken[0].error),
-      mm.broken[0] && mm.broken[0].error);
-    const noid = readProfiles(home({ 'claude-work.json': { account: 'x' } }));
-    ok('D5: a descriptor with no id is rejected — the filename is never substituted as identity',
-      noid.profiles.length === 0 && noid.broken.length === 1 && /declares no `id`/.test(noid.broken[0].error));
-
-    // Shapes that parse as JSON but are not descriptors.
-    const shapes = readProfiles(home({ 'a.json': '[]', 'b.json': '"nope"', 'c.json': 'null', 'd.json': '42' }));
-    ok('D6: JSON that is not an object (array/string/null/number) is rejected, each named',
-      shapes.profiles.length === 0 && shapes.broken.length === 4 &&
-      shapes.broken.every((x) => /is not a JSON object/.test(x.error)),
-      shapes.broken.map((x) => x.file).join(','));
-
-    // A DIRECTORY occupying a descriptor's name: reported, not silently skipped, because it holds
-    // the name a chip would have and the PM needs to be told why the chip is missing.
-    const dh = home({ 'claude-work.json': WORK });
-    fs.mkdirSync(path.join(profilesDir(dh), 'claude-personal.json'));
-    const dr = readProfiles(dh);
-    ok('D7: a directory named like a descriptor is reported as a failed read, not skipped',
-      dr.profiles.length === 1 && dr.broken.length === 1 && /could not be read/.test(dr.broken[0].error),
-      dr.broken[0] && dr.broken[0].error);
-
-    // The trap in the return shape: zero good profiles with a non-empty `broken` is a FAILURE that
-    // a consumer testing only `profiles.length` would render as the calm empty state of A4.
-    const allBad = readProfiles(home({ 'a.json': '{', 'b.json': '{' }));
-    ok('D8: every descriptor broken → profiles is empty but absent stays FALSE and broken is populated',
-      allBad.ok === true && allBad.absent === false && allBad.profiles.length === 0 && allBad.broken.length === 2,
-      JSON.stringify({ absent: allBad.absent, profiles: allBad.profiles.length, broken: allBad.broken.length }));
-  }
-
-  // ── E. wrong-typed keys are rejected, never coerced ───────────────────────────────────────────
-  {
-    // The important one. Coercing a malformed `mcp` to [] would make profileLine print "no mcp
-    // servers declared in this profile" over a file that plainly declared one — a false statement
-    // manufactured from a real declaration, which is worse than the parse error it replaced.
-    const m = readProfiles(home({ 'p.json': { id: 'p', mcp: 'jira' } }));
-    ok('E1: a wrong-typed `mcp` is rejected — never silently emptied into "none declared"',
-      m.profiles.length === 0 && m.broken.length === 1 && /`mcp` is present but is not an array/.test(m.broken[0].error),
-      m.broken[0] && m.broken[0].error);
-    const m2 = readProfiles(home({ 'p.json': { id: 'p', mcp: ['jira', 7] } }));
-    ok('E2: an mcp array holding a non-string is rejected too', m2.profiles.length === 0 && m2.broken.length === 1);
-
-    const e1 = readProfiles(home({ 'p.json': { id: 'p', env: ['A=1'] } }));
-    ok('E3: a wrong-typed `env` is rejected (an array is not an environment overlay)',
-      () => e1.profiles.length === 0 && /`env` is present but is not an object/.test(e1.broken[0].error));
-    const e2 = readProfiles(home({ 'p.json': { id: 'p', env: { A: 1 } } }));
-    ok('E4: a non-string env VALUE is rejected — PMOS will not coerce a value it was not given',
-      () => e2.profiles.length === 0 && /`env.A` is not a string/.test(e2.broken[0].error),
-      () => e2.broken[0] && e2.broken[0].error);
-    const a1 = readProfiles(home({ 'p.json': { id: 'p', account: 42 } }));
-    ok('E5: a wrong-typed `account` is rejected rather than stringified into a plausible value',
-      () => a1.profiles.length === 0 && /`account` is present but is not a string/.test(a1.broken[0].error));
-    const l1 = readProfiles(home({ 'p.json': { id: 'p', label: '' } }));
-    ok('E6: an empty `label` is rejected rather than falling back and hiding the bad file',
-      () => l1.profiles.length === 0 && /`label` is present/.test(l1.broken[0].error));
-    // Keys PMOS does not use are ignored, not rejected — the descriptor format is the agent CLI's,
-    // and PMOS is a read-only guest in it (PRD non-goal 3).
-    const extra = readProfiles(home({ 'p.json': { id: 'p', someFutureKey: { deep: true } } }));
-    ok('E7: keys PMOS does not use are ignored, not treated as corruption',
-      extra.profiles.length === 1 && extra.broken.length === 0);
-  }
-
-  // ── F. profileLine — R6's sentences and R7's forbidden phrase ─────────────────────────────────
-  {
-    const h = home({ 'claude-work.json': WORK, 'claude-personal.json': PERSONAL });
-    const r = readProfiles(h);
-    const work = r.profiles.find((p) => p.id === 'claude-work');
-    const personal = r.profiles.find((p) => p.id === 'claude-personal');
-
-    ok('F1: R6 — a profile with an overlay and declared mcp states what was applied and what was declared',
-      profileLine(work) === 'profile: claude-work — applied 4 environment variables · mcp declared by the profile: jira confluence slack gworkspace',
-      profileLine(work));
-    ok('F2: R7 — a profile declaring no mcp says so as a fact about the FILE, never "mcp: none"',
-      profileLine(personal) === 'profile: claude-personal — applied 2 environment variables · no mcp servers declared in this profile',
-      profileLine(personal));
-    ok('F3: the count is pluralised — one variable is not "1 environment variables"',
-      /applied 1 environment variable · /.test(profileLine({ id: 'p', mcp: [], env: { A: '1' } })),
-      profileLine({ id: 'p', mcp: [], env: { A: '1' } }));
-
-    // The case the PRD names as the failure that looks like success: a chip was picked, a terminal
-    // opened, and nothing was applied. The line has to say that out loud.
-    const noEnv = { id: 'claude-work', label: 'claude-work', mcp: ['jira'], env: null };
-    ok('F4: a profile declaring NO env overlay says so — the failure that would otherwise look like success',
-      profileLine(noEnv) === "profile: claude-work — the profile declares no environment overlay; this session runs with the workspace's default environment",
-      profileLine(noEnv));
-    // `env: {}` and a missing `env` key differ on disk and are identical to the PM: nothing was
-    // applied. They must converge on the sentence about consequence, not diverge into a count.
-    ok('F5: an empty `env: {}` gets the same sentence as a missing env key, never "applied 0 …"',
-      profileLine({ id: 'p', mcp: [], env: {} }) === profileLine({ id: 'p', mcp: [], env: null }) &&
-      /declares no environment overlay/.test(profileLine({ id: 'p', mcp: [], env: {} })),
-      profileLine({ id: 'p', mcp: [], env: {} }));
-    ok('F6: "applied 0" never appears in any line', !/applied 0 /.test(profileLine({ id: 'p', mcp: [], env: {} })));
-
-    // The three no-descriptor cases, kept apart by the argument's own type because a session record
-    // is JSON and `undefined` (key absent) survives it differently from `null`.
-    ok('F7: an absent recorded profile reads "not recorded" — PMOS did not start this pane',
-      profileLine(undefined) === 'profile: not recorded — PMOS did not start this pane', profileLine(undefined));
-    ok('F8: an explicit null reads "none was chosen", which is a different fact from "not recorded"',
-      profileLine(null) === 'no profile — none was chosen for this session' && profileLine(null) !== profileLine(undefined),
-      profileLine(null));
-    ok('F9: with a read proving the machine has none configured, the line says so',
-      profileLine(null, readProfiles(home(null))) === 'no profile — none was chosen (no profiles are configured on this machine)',
-      profileLine(null, readProfiles(home(null))));
-    ok('F10: an empty-but-present directory also supports "none are configured"',
-      profileLine(null, readProfiles(home({}))) === 'no profile — none was chosen (no profiles are configured on this machine)');
-    // …but a read that FAILED, or one that found broken files, does not support that claim: the
-    // profiles may well be configured and unreadable. Claiming none exist would be inventing.
-    const failedRead = readProfiles('');
-    ok('F11: a FAILED read never licenses "no profiles are configured on this machine"',
-      profileLine(null, failedRead) === 'no profile — none was chosen for this session',
-      profileLine(null, failedRead));
-    ok('F12: a read that found only BROKEN descriptors does not claim none are configured',
-      profileLine(null, readProfiles(home({ 'a.json': '{' }))) === 'no profile — none was chosen for this session');
-
-    // A bare id string cannot support "applied N variables" — what was applied is a fact about the
-    // descriptor. R9's respawn case depends on this refusal.
-    ok('F13: a bare id string is refused, not rendered — what was applied is a fact about the descriptor',
-      profileLine('claude-work') === 'profile: unreadable — the recorded value is not a profile descriptor',
-      profileLine('claude-work'));
-    ok('F14: garbage input yields a stated-unreadable line rather than a throw or a false claim',
-      profileLine(42) === profileLine('x') && profileLine([]) === profileLine('x') &&
-      profileLine({ mcp: [] }) === 'profile: unreadable — the recorded descriptor names no profile',
-      profileLine({ mcp: [] }));
-
-    // R7 as a standing regression over EVERY line this module can emit.
-    const everyLine = [
-      profileLine(work), profileLine(personal), profileLine(noEnv), profileLine(undefined),
-      profileLine(null), profileLine(null, r), profileLine('x'), profileLine({ mcp: [] }),
-      profileLine({ id: 'p', mcp: [], env: { A: '1' } }),
-    ];
-    ok('F15a: R7 — the phrase "mcp: none" appears in none of the lines these descriptors produce',
-      everyLine.every((l) => !/mcp:\s*none/i.test(l)), `${everyLine.length} lines checked`);
-    // …and the claim F15a used to make — "no line this module CAN produce" — is not something nine
-    // sampled descriptors can establish. It is a claim about the module, so assert it about the
-    // module: the phrase must not exist as a literal anywhere the formatter could emit it. That is
-    // the whole space, because the only other route into a line is PM-authored text echoed from a
-    // descriptor's own `label`/`mcp` — a profile literally named "mcp: none" quotes the PM back to
-    // themself, which is not the module asserting a fact about the world and is not what R7 bans.
-    // Sampling had been dressed as exhaustiveness; the fix is to test the right object, not to
-    // widen the sample.
-    const src = fs.readFileSync(path.join(__dirname, 'lib', 'profiles.js'), 'utf8');
-    const emittable = src.split('\n')
-      .filter((l) => !/^\s*(\*|\/\/|\/\*)/.test(l))       // prose ABOUT the ban is not the ban
-      .join('\n');
-    ok('F15b: R7 REGRESSION — "mcp: none" is not a literal anywhere the formatter could emit it',
-      !/mcp:\s*none/i.test(emittable), 'lib/profiles.js scanned, comments excluded');
-    ok('F16: no line claims a connection, a status or a sync time (no MCP client exists)',
-      everyLine.every((l) => !/connected|synced|last sync|reachable|online/i.test(l)));
-    ok('F17: every line is a non-empty single line — nothing renders blank',
-      everyLine.every((l) => typeof l === 'string' && l.trim().length > 0 && !l.includes('\n')));
-  }
-} finally {
-  cleanup();
-}
-
-const failed = results.filter((r) => !r.cond);
-console.log(`\n${results.length - failed.length}/${results.length} checks passed`);
-if (failed.length) console.log('failed:\n  ' + failed.map((f) => f.name).join('\n  '));
-
-// A run that ended early — a throw outside a thunk, an early return — would otherwise print a
-// green fraction of a shrunken denominator. Report the shortfall as a failure in its own right.
-if (results.length < EXPECTED_CHECKS) {
-  console.log(`\n✗ SUITE TRUNCATED: ${results.length} checks ran, ${EXPECTED_CHECKS} expected — ` +
-    'the run ended early, so this result is not a pass.');
-  process.exit(1);
-}
-process.exit(failed.length ? 1 : 0);