devrites 3.0.6 → 3.1.0

package/engine/internal/install/install_test.go

@@ -4,14 +4,19 @@ import (
 	"archive/tar"
 	"bytes"
 	"compress/gzip"
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"io/fs"
+	"net/http"
+	"net/http/httptest"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/devrites/devrites/internal/testutil"
 )
@@ -254,7 +259,7 @@ func TestInstallKeepsClaudeMergeOwnershipAcrossReinstall(t *testing.T) {
 	if !exists(filepath.Join(target, filepath.FromSlash(markerRel))) {
 		t.Fatal("first install did not create the Claude hook merge marker")
 	}
-	if !readManifest(filepath.Join(target, ManifestName))[markerRel] {
+	if _, ok := readManifest(filepath.Join(target, ManifestName))[markerRel]; !ok {
 		t.Fatalf("first install did not record the Claude hook merge marker:\n%s", testutil.ReadFile(t, filepath.Join(target, ManifestName)))
 	}
 	runInstall(t, target, payload, func(o *Options) {})
@@ -325,18 +330,23 @@ func TestInstallBinaryUsesEngineHandoff(t *testing.T) {
 	payload := testPayload(t)
 	target := t.TempDir()
 	binDir := t.TempDir()
-	engine := filepath.Join(t.TempDir(), "devrites-engine")
-	engineBody := "#!/bin/sh\nif [ \"$1\" = version ]; then echo 1.2.3; exit 0; fi\necho handoff\n"
-	testutil.WriteExecutable(t, engine, engineBody)
+	engine := buildVersionBinary(t, "1.2.3")
+	engineBody, err := os.ReadFile(engine)
+	if err != nil {
+		t.Fatal(err)
+	}
 	t.Setenv("DEVRITES_ENGINE_CLI", engine)
 	t.Setenv("DEVRITES_BIN_DIR", binDir)
 	t.Setenv("DEVRITES_REF", "v1.2.3")
+	conflictDir := t.TempDir()
+	testutil.WriteExecutable(t, filepath.Join(conflictDir, engineBinaryName()), "conflict\n")
+	t.Setenv("PATH", conflictDir)
 
 	runInstall(t, target, payload, func(o *Options) {})
 
-	installed := filepath.Join(binDir, "devrites-engine")
-	if got := testutil.ReadFile(t, installed); got != engineBody {
-		t.Fatalf("installed binary did not come from DEVRITES_ENGINE_CLI handoff:\n%s", got)
+	installed := filepath.Join(binDir, engineBinaryName())
+	if got, err := os.ReadFile(installed); err != nil || !bytes.Equal(got, engineBody) {
+		t.Fatalf("installed binary did not come from DEVRITES_ENGINE_CLI handoff: %v", err)
 	}
 	info, err := os.Stat(installed)
 	if err != nil {
@@ -347,12 +357,116 @@ func TestInstallBinaryUsesEngineHandoff(t *testing.T) {
 	}
 }
 
+func TestAcquireBinaryBuildsWithoutVCSMetadata(t *testing.T) {
+	t.Setenv("DEVRITES_ENGINE_CLI", "")
+	t.Setenv("DEVRITES_UPDATE_BUNDLE", "")
+	t.Setenv("GOFLAGS", "-buildvcs=true")
+	source := t.TempDir()
+	if err := os.Mkdir(filepath.Join(source, ".git"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	testutil.WriteFile(t, filepath.Join(source, "engine", "go.mod"), "module github.com/devrites/devrites\n\ngo 1.23\n")
+	testutil.WriteFile(t, filepath.Join(source, "engine", "main.go"), "package main\nfunc main() {}\n")
+
+	r := runner{source: source}
+	staged, cleanup, err := r.acquireBinary("v1.2.3", githubBaseURL)
+	defer cleanup()
+	if err != nil {
+		t.Fatalf("acquireBinary with unavailable VCS metadata: %v", err)
+	}
+	if !exists(staged) {
+		t.Fatalf("acquireBinary did not build %s", staged)
+	}
+}
+
+func TestAcquireBinaryPrefersVerifiedReleaseOverStaleHandoff(t *testing.T) {
+	stale := filepath.Join(t.TempDir(), "devrites-engine")
+	testutil.WriteExecutable(t, stale, "#!/bin/sh\nif [ \"$1\" = version ]; then echo v1.2.2; fi\n")
+	t.Setenv("DEVRITES_ENGINE_CLI", stale)
+	t.Setenv("DEVRITES_UPDATE_BUNDLE", "")
+	t.Setenv("DEVRITES_REPO", "owner/repo")
+	tag := "v1.2.3"
+	asset := fmt.Sprintf("devrites-%s-%s", runtime.GOOS, runtime.GOARCH)
+	if runtime.GOOS == "windows" {
+		asset += ".exe"
+	}
+	path := "/owner/repo/releases/download/" + tag + "/" + asset
+	body := []byte("verified release binary")
+	sum := fmt.Sprintf("%x  %s\n", sha256.Sum256(body), asset)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		switch req.URL.Path {
+		case path:
+			_, _ = w.Write(body)
+		case path + ".sha256":
+			_, _ = w.Write([]byte(sum))
+		default:
+			http.NotFound(w, req)
+		}
+	}))
+	defer server.Close()
+
+	r := runner{releaseBinaryTag: tag}
+	staged, cleanup, err := r.acquireBinary(tag, server.URL)
+	defer cleanup()
+	if err != nil {
+		t.Fatalf("acquire verified release binary: %v", err)
+	}
+	got, err := os.ReadFile(staged)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, body) {
+		t.Fatalf("acquired binary = %q, want %q", got, body)
+	}
+}
+
+func TestAcquireBinaryRejectsReleaseChecksumMismatch(t *testing.T) {
+	t.Setenv("DEVRITES_ENGINE_CLI", "")
+	t.Setenv("DEVRITES_UPDATE_BUNDLE", "")
+	t.Setenv("DEVRITES_REPO", "owner/repo")
+	tag := "v1.2.3"
+	source := t.TempDir()
+	testutil.WriteFile(t, filepath.Join(source, "engine", "go.mod"), "module github.com/devrites/devrites\n\ngo 1.23\n")
+	testutil.WriteFile(t, filepath.Join(source, "engine", "main.go"), "package main\nfunc main() {}\n")
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		if strings.HasSuffix(req.URL.Path, ".sha256") {
+			_, _ = w.Write([]byte("deadbeef\n"))
+			return
+		}
+		_, _ = w.Write([]byte("tampered release binary"))
+	}))
+	defer server.Close()
+
+	r := runner{source: source, releaseBinaryTag: tag}
+	_, cleanup, err := r.acquireBinary(tag, server.URL)
+	defer cleanup()
+	if err == nil || !strings.Contains(err.Error(), "checksum mismatch") {
+		t.Fatalf("acquireBinary error = %v, want checksum mismatch", err)
+	}
+}
+
+func TestInstallBinaryFailsWhenPreparedUpdateCannotBeWritten(t *testing.T) {
+	prepared := filepath.Join(t.TempDir(), "devrites-engine")
+	testutil.WriteExecutable(t, prepared, "#!/bin/sh\nif [ \"$1\" = version ]; then echo 1.2.3; fi\n")
+	blocked := filepath.Join(t.TempDir(), "not-a-directory")
+	testutil.WriteFile(t, blocked, "file\n")
+	t.Setenv("DEVRITES_BIN_DIR", filepath.Join(blocked, "bin"))
+	t.Setenv("DEVRITES_REF", "v1.2.3")
+
+	r := runner{
+		opts:           DefaultOptions(ModeInstall),
+		preparedBinary: prepared,
+	}
+	if err := r.installBinary(); err == nil {
+		t.Fatal("installBinary accepted a prepared update it could not write")
+	}
+}
+
 func TestInstallBinaryWarnsWhenHooksCannotResolveEngine(t *testing.T) {
 	payload := testPayload(t)
 	target := t.TempDir()
 	binDir := t.TempDir()
-	engine := filepath.Join(t.TempDir(), "devrites-engine")
-	testutil.WriteExecutable(t, engine, "#!/bin/sh\nif [ \"$1\" = version ]; then echo 1.2.3; exit 0; fi\n")
+	engine := buildVersionBinary(t, "1.2.3")
 	pathDir := t.TempDir()
 	var stderr bytes.Buffer
 
@@ -370,6 +484,18 @@ func TestInstallBinaryWarnsWhenHooksCannotResolveEngine(t *testing.T) {
 	}
 }
 
+func buildVersionBinary(t *testing.T, version string) string {
+	t.Helper()
+	dir := t.TempDir()
+	source := filepath.Join(dir, "main.go")
+	testutil.WriteFile(t, source, fmt.Sprintf("package main\nimport \"fmt\"\nfunc main() { fmt.Println(%q) }\n", version))
+	binary := filepath.Join(dir, engineBinaryName())
+	if out, err := exec.Command("go", "build", "-o", binary, source).CombinedOutput(); err != nil {
+		t.Fatalf("build test engine: %v\n%s", err, out)
+	}
+	return binary
+}
+
 func TestBinaryCandidatesSkipsUnsetBinDir(t *testing.T) {
 	t.Setenv("DEVRITES_BIN_DIR", "")
 
@@ -451,6 +577,361 @@ printf '{"hooks":{"Stop":[{"hooks":[{"type":"command","command":"devrites-engine
 	}
 }
 
+func TestManagedFilePolicy(t *testing.T) {
+	t.Setenv("DEVRITES_NO_BINARY", "1")
+	const rel = ".claude/skills/rite/SKILL.md"
+
+	t.Run("refresh preserves customized unless forced", func(t *testing.T) {
+		payload := testPayload(t)
+		target := t.TempDir()
+		runInstall(t, target, payload, func(o *Options) {})
+		dest := filepath.Join(target, filepath.FromSlash(rel))
+		testutil.WriteFile(t, dest, "customized\n")
+		testutil.WriteFile(t, filepath.Join(payload, "claude", "skills", "rite", "SKILL.md"), "new\n")
+
+		err := applyInstall(target, payload, false, false, nil)
+		if err == nil || !strings.Contains(err.Error(), "--force") {
+			t.Fatalf("customized refresh error = %v, want --force remediation", err)
+		}
+		if got := testutil.ReadFile(t, dest); got != "customized\n" {
+			t.Fatalf("default refresh changed customized file: %q", got)
+		}
+
+		var out bytes.Buffer
+		if err := applyInstall(target, payload, true, true, &out); err != nil {
+			t.Fatal(err)
+		}
+		if !strings.Contains(out.String(), "[overwrite(force-customized)] "+rel) {
+			t.Fatalf("forced dry-run did not predict overwrite:\n%s", out.String())
+		}
+		if got := testutil.ReadFile(t, dest); got != "customized\n" {
+			t.Fatalf("dry-run changed customized file: %q", got)
+		}
+
+		if err := applyInstall(target, payload, true, false, nil); err != nil {
+			t.Fatal(err)
+		}
+		if got := testutil.ReadFile(t, dest); got != "new\n" {
+			t.Fatalf("forced refresh = %q, want new payload", got)
+		}
+	})
+
+	t.Run("legacy manifest requires force", func(t *testing.T) {
+		payload := testPayload(t)
+		target := t.TempDir()
+		runInstall(t, target, payload, func(o *Options) {})
+		manifest := filepath.Join(target, ManifestName)
+		lines := strings.Split(testutil.ReadFile(t, manifest), "\n")
+		var next []string
+		for _, line := range lines {
+			if !strings.HasPrefix(line, "# managed: "+rel+" ") {
+				next = append(next, line)
+			}
+		}
+		testutil.WriteFile(t, manifest, strings.Join(next, "\n"))
+
+		err := applyInstall(target, payload, false, false, nil)
+		if err == nil || !strings.Contains(err.Error(), "legacy manifest entry") {
+			t.Fatalf("legacy refresh error = %v", err)
+		}
+		if err := applyInstall(target, payload, true, false, nil); err != nil {
+			t.Fatalf("forced legacy refresh: %v", err)
+		}
+	})
+
+	t.Run("missing is recreated and absent uninstall is a no-op", func(t *testing.T) {
+		payload := testPayload(t)
+		target := t.TempDir()
+		runInstall(t, target, payload, func(o *Options) {})
+		dest := filepath.Join(target, filepath.FromSlash(rel))
+		if err := os.Remove(dest); err != nil {
+			t.Fatal(err)
+		}
+		if err := applyInstall(target, payload, false, false, nil); err != nil {
+			t.Fatal(err)
+		}
+		if !exists(dest) {
+			t.Fatal("refresh did not recreate missing managed file")
+		}
+		if err := os.Remove(dest); err != nil {
+			t.Fatal(err)
+		}
+		runUninstall(t, target)
+	})
+
+	t.Run("foreign is preserved unless forced", func(t *testing.T) {
+		payload := testPayload(t)
+		target := t.TempDir()
+		dest := filepath.Join(target, filepath.FromSlash(rel))
+		testutil.WriteFile(t, dest, "mine\n")
+		runInstall(t, target, payload, func(o *Options) {})
+		if got := testutil.ReadFile(t, dest); got != "mine\n" {
+			t.Fatalf("default install overwrote foreign file: %q", got)
+		}
+		if err := applyInstall(target, payload, true, false, nil); err != nil {
+			t.Fatal(err)
+		}
+		if got := testutil.ReadFile(t, dest); got != "claude rite\n" {
+			t.Fatalf("forced install did not replace foreign file: %q", got)
+		}
+	})
+}
+
+func TestManagedPruneAndUninstallPolicy(t *testing.T) {
+	t.Setenv("DEVRITES_NO_BINARY", "1")
+	const staleRel = ".claude/skills/stale/SKILL.md"
+
+	t.Run("prune", func(t *testing.T) {
+		payload := testPayload(t)
+		target := t.TempDir()
+		runInstall(t, target, payload, func(o *Options) {})
+		stale := filepath.Join(target, filepath.FromSlash(staleRel))
+		testutil.WriteFile(t, stale, "owned\n")
+		addManifestRecord(t, filepath.Join(target, ManifestName), staleRel, []byte("owned\n"))
+		testutil.WriteFile(t, stale, "customized\n")
+
+		err := applyInstall(target, payload, false, false, nil)
+		if err == nil || !strings.Contains(err.Error(), staleRel) || !exists(stale) {
+			t.Fatalf("default prune error = %v, exists = %t", err, exists(stale))
+		}
+		var out bytes.Buffer
+		if err := applyInstall(target, payload, true, true, &out); err != nil {
+			t.Fatal(err)
+		}
+		if !strings.Contains(out.String(), "[prune(force-customized)] "+staleRel) || !exists(stale) {
+			t.Fatalf("forced prune dry-run mismatch:\n%s", out.String())
+		}
+		if err := applyInstall(target, payload, true, false, nil); err != nil {
+			t.Fatal(err)
+		}
+		if exists(stale) {
+			t.Fatal("forced prune kept customized dropped file")
+		}
+	})
+
+	t.Run("uninstall", func(t *testing.T) {
+		payload := testPayload(t)
+		target := t.TempDir()
+		runInstall(t, target, payload, func(o *Options) {})
+		dest := filepath.Join(target, ".claude", "skills", "rite", "SKILL.md")
+		testutil.WriteFile(t, dest, "customized\n")
+
+		opts := DefaultOptions(ModeUninstall)
+		opts.Target = target
+		opts.KeepBinary = true
+		opts.Stdout = &bytes.Buffer{}
+		opts.Stderr = &bytes.Buffer{}
+		err := Apply(opts)
+		if err == nil || !strings.Contains(err.Error(), "--force") || !exists(dest) {
+			t.Fatalf("default uninstall error = %v, exists = %t", err, exists(dest))
+		}
+
+		var out bytes.Buffer
+		opts.Force = true
+		opts.DryRun = true
+		opts.Stdout = &out
+		if err := Apply(opts); err != nil {
+			t.Fatal(err)
+		}
+		if !strings.Contains(out.String(), "[remove(force-customized)] .claude/skills/rite/SKILL.md") || !exists(dest) {
+			t.Fatalf("forced uninstall dry-run mismatch:\n%s", out.String())
+		}
+		opts.DryRun = false
+		if err := Apply(opts); err != nil {
+			t.Fatal(err)
+		}
+		if exists(dest) {
+			t.Fatal("forced uninstall kept customized managed file")
+		}
+	})
+}
+
+func TestManagedPathsRejectLinksAndRaces(t *testing.T) {
+	t.Setenv("DEVRITES_NO_BINARY", "1")
+	if runtime.GOOS == "windows" {
+		t.Skip("creating symlinks requires privileges on Windows; the same confinement code runs there")
+	}
+	for _, tc := range []struct {
+		name string
+		link func(target, outside string) error
+	}{
+		{
+			name: "final symlink",
+			link: func(target, outside string) error {
+				dest := filepath.Join(target, ".claude", "skills", "rite", "SKILL.md")
+				if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+					return err
+				}
+				return os.Symlink(filepath.Join(outside, "sentinel"), dest)
+			},
+		},
+		{
+			name: "ancestor symlink",
+			link: func(target, outside string) error {
+				return os.Symlink(outside, filepath.Join(target, ".agents"))
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			payload := testPayload(t)
+			target := t.TempDir()
+			outside := t.TempDir()
+			testutil.WriteFile(t, filepath.Join(outside, "sentinel"), "outside\n")
+			if err := tc.link(target, outside); err != nil {
+				t.Fatal(err)
+			}
+			err := applyInstall(target, payload, true, false, nil)
+			if err == nil || !strings.Contains(err.Error(), "refusing") {
+				t.Fatalf("linked install error = %v", err)
+			}
+			if got := testutil.ReadFile(t, filepath.Join(outside, "sentinel")); got != "outside\n" {
+				t.Fatalf("linked install changed outside file: %q", got)
+			}
+		})
+	}
+
+	t.Run("recheck detects change", func(t *testing.T) {
+		target := t.TempDir()
+		const rel = "managed.txt"
+		testutil.WriteFile(t, filepath.Join(target, rel), "before\n")
+		r := runner{target: target, preflight: map[string]pathSnapshot{}}
+		if _, err := r.rememberPath(rel); err != nil {
+			t.Fatal(err)
+		}
+		testutil.WriteFile(t, filepath.Join(target, rel), "after\n")
+		if err := r.recheckPath(rel); err == nil || !strings.Contains(err.Error(), "changed after preflight") {
+			t.Fatalf("recheck error = %v", err)
+		}
+	})
+}
+
+func TestVerifyEngineBinary(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("shell fixtures are Unix-only")
+	}
+	for _, tc := range []struct {
+		name string
+		body string
+		want string
+		ok   bool
+	}{
+		{name: "exact", body: "echo v1.2.3", want: "1.2.3", ok: true},
+		{name: "wrong", body: "echo 1.2.4", want: "1.2.3"},
+		{name: "dev", body: "echo dev", want: "1.2.3"},
+		{name: "multiline", body: "printf '1.2.3\\nextra\\n'", want: "1.2.3"},
+		{name: "empty", body: ":", want: "1.2.3"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "engine")
+			testutil.WriteExecutable(t, path, "#!/bin/sh\n"+tc.body+"\n")
+			_, err := verifyEngineBinary(path, tc.want, time.Second)
+			if (err == nil) != tc.ok {
+				t.Fatalf("verifyEngineBinary error = %v, ok = %t", err, tc.ok)
+			}
+		})
+	}
+	t.Run("timeout", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "engine")
+		testutil.WriteExecutable(t, path, "#!/bin/sh\nsleep 2\n")
+		_, err := verifyEngineBinary(path, "1.2.3", 20*time.Millisecond)
+		if err == nil || !strings.Contains(err.Error(), "timed out") {
+			t.Fatalf("timeout error = %v", err)
+		}
+	})
+}
+
+func TestInstallBinaryRollsBackVerificationFailure(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("shell fixture is Unix-only; backup/restore portability is covered separately")
+	}
+	for _, hadOld := range []bool{false, true} {
+		t.Run(fmt.Sprintf("had-old-%t", hadOld), func(t *testing.T) {
+			binDir := t.TempDir()
+			dest := filepath.Join(binDir, "devrites-engine")
+			old := "#!/bin/sh\nif [ \"$1\" = version ]; then echo 1.0.0; fi\n"
+			if hadOld {
+				testutil.WriteExecutable(t, dest, old)
+				if err := os.Chmod(dest, 0o700); err != nil {
+					t.Fatal(err)
+				}
+			}
+			staged := filepath.Join(t.TempDir(), "devrites-engine")
+			body := fmt.Sprintf("#!/bin/sh\nif [ \"$1\" = version ]; then case \"$0\" in %q) echo 1.2.4;; *) echo 1.2.3;; esac; fi\n", dest)
+			testutil.WriteExecutable(t, staged, body)
+			t.Setenv("DEVRITES_BIN_DIR", binDir)
+			t.Setenv("DEVRITES_REF", "v1.2.3")
+			t.Setenv("PATH", t.TempDir())
+			r := runner{opts: DefaultOptions(ModeInstall), preparedBinary: staged}
+
+			err := r.installBinary()
+			wantOutcome := "bad binary removed"
+			if hadOld {
+				wantOutcome = "previous binary restored"
+			}
+			if err == nil || !strings.Contains(err.Error(), wantOutcome) {
+				t.Fatalf("installBinary error = %v", err)
+			}
+			if hadOld {
+				if got := testutil.ReadFile(t, dest); got != old {
+					t.Fatalf("rollback bytes = %q, want old binary", got)
+				}
+				info, statErr := os.Stat(dest)
+				if statErr != nil {
+					t.Fatal(statErr)
+				}
+				if info.Mode().Perm() != 0o700 {
+					t.Fatalf("rollback mode = %v, want 0700", info.Mode().Perm())
+				}
+			} else if exists(dest) {
+				t.Fatal("failed first install left bad binary")
+			}
+		})
+	}
+}
+
+func TestBackupRestoreBinaryIsPlatformSafe(t *testing.T) {
+	dest := filepath.Join(t.TempDir(), "devrites-engine")
+	testutil.WriteFile(t, dest, "old\n")
+	if err := os.Chmod(dest, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	backup, mode, hadOld, err := backupBinary(dest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(backup)
+	if filepath.Dir(backup) != filepath.Dir(dest) {
+		t.Fatalf("backup %s is not beside %s", backup, dest)
+	}
+	testutil.WriteFile(t, dest, "bad\n")
+	if err := restoreBinary(dest, backup, mode, hadOld); err != nil {
+		t.Fatal(err)
+	}
+	if got := testutil.ReadFile(t, dest); got != "old\n" {
+		t.Fatalf("restored bytes = %q", got)
+	}
+}
+
+func applyInstall(target, payload string, force, dryRun bool, out *bytes.Buffer) error {
+	opts := DefaultOptions(ModeInstall)
+	opts.Target = target
+	opts.PayloadDir = payload
+	opts.Force = force
+	opts.DryRun = dryRun
+	if out == nil {
+		out = &bytes.Buffer{}
+	}
+	opts.Stdout = out
+	opts.Stderr = &bytes.Buffer{}
+	return Apply(opts)
+}
+
+func addManifestRecord(t *testing.T, manifest, rel string, data []byte) {
+	t.Helper()
+	hash := fmt.Sprintf("sha256:%x", sha256.Sum256(data))
+	testutil.AppendFile(t, manifest, "# managed: "+rel+" "+hash+"\n"+rel+"\n")
+}
+
 func runInstall(t *testing.T, target, payload string, mutate func(*Options)) {
 	t.Helper()
 	opts := DefaultOptions(ModeInstall)