happyskills 1.20.0 → 1.21.0

package/src/commands/profile.test.js

@@ -0,0 +1,80 @@
+// Unit tests for `happyskills profile` (spec 260710-01 Decision 4 — full CLI
+// parity). Pure-helper coverage + the schema conformance case: the command's
+// declared errors/next_steps must reference only the CLOSED envelope enums.
+
+const test = require('node:test')
+const assert = require('node:assert/strict')
+
+const { collect_field_edits, parse_crop, sniff_content_type, schema } = require('./profile')
+const { UsageError } = require('../utils/errors')
+const { NEXT_STEP_ACTION_SET, NEXT_STEP_KIND_SET } = require('../constants/next_step_actions')
+const { ERROR_CODE_SET } = require('../constants/error_codes')
+const { COMMANDS } = require('../constants')
+
+test('collect_field_edits: undefined = untouched, "" = clear, values pass through', () => {
+	assert.deepEqual(collect_field_edits({}), {})
+	assert.deepEqual(collect_field_edits({ tagline: 'Ships skills' }), { tagline: 'Ships skills' })
+	assert.deepEqual(collect_field_edits({ tagline: '' }), { tagline: null })
+	assert.deepEqual(collect_field_edits({ website: 'https://x.example/' }), { website_url: 'https://x.example/' })
+	assert.deepEqual(collect_field_edits({ location: '' }), { location: null })
+})
+
+test('collect_field_edits: social flags fold into one social_links object ("" clears a key)', () => {
+	const fields = collect_field_edits({ github: 'https://github.com/n', twitter: '' })
+	assert.deepEqual(fields.social_links, { github: 'https://github.com/n', twitter: '' })
+})
+
+test('collect_field_edits: map visibility toggles + mutual exclusions', () => {
+	assert.deepEqual(collect_field_edits({ 'hide-map': true }), { expertise_map_hidden: true })
+	assert.deepEqual(collect_field_edits({ 'show-map': true }), { expertise_map_hidden: false })
+	assert.throws(() => collect_field_edits({ 'hide-map': true, 'show-map': true }), UsageError)
+	assert.throws(() => collect_field_edits({ readme: 'x', 'readme-file': 'y.md' }), UsageError)
+})
+
+test('collect_field_edits: a valueless string flag is a loud usage error, not a silent true', () => {
+	assert.throws(() => collect_field_edits({ tagline: true }), UsageError)
+})
+
+test('collect_field_edits: --pin parses names; "" empties the pinned set', () => {
+	assert.deepEqual(collect_field_edits({ pin: 'a, b ,c' }).__pin_names, ['a', 'b', 'c'])
+	assert.deepEqual(collect_field_edits({ pin: '' }).__pin_names, [])
+})
+
+test('parse_crop: x,y,size in 0..1, square must fit', () => {
+	assert.deepEqual(parse_crop('0.1,0.05,0.8'), { x: 0.1, y: 0.05, size: 0.8 })
+	assert.throws(() => parse_crop('0.6,0,0.5'), UsageError)
+	assert.throws(() => parse_crop('0,0'), UsageError)
+	assert.throws(() => parse_crop('a,b,c'), UsageError)
+})
+
+test('sniff_content_type: magic bytes only — extension and claims are never trusted', () => {
+	assert.equal(sniff_content_type(Buffer.from([0xff, 0xd8, 0xff, 0xe0, 0, 0, 0, 0, 0, 0, 0, 0])), 'image/jpeg')
+	assert.equal(sniff_content_type(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0])), 'image/png')
+	const webp = Buffer.alloc(16); webp.write('RIFF', 0, 'latin1'); webp.write('WEBP', 8, 'latin1')
+	assert.equal(sniff_content_type(webp), 'image/webp')
+	assert.equal(sniff_content_type(Buffer.from('<svg onload=x>....')), null)
+	assert.equal(sniff_content_type(Buffer.from('GIF89a..........')), null)
+})
+
+// ── schema conformance (the CLAUDE.md "conformance test + schema entry" gate) ─
+
+test('schema entry: registered command, closed-enum error codes and next_step actions only', () => {
+	assert.ok(COMMANDS.includes('profile'), 'profile is in the COMMANDS registry (schema --json includes it)')
+	assert.equal(schema.name, 'profile')
+	assert.equal(schema.mutation, true)
+	assert.ok(schema.purpose.length > 20)
+	for (const err of schema.errors) {
+		assert.ok(ERROR_CODE_SET.has(err.code), `${err.code} must be a closed-enum error code`)
+		if (err.next_step) {
+			assert.ok(NEXT_STEP_KIND_SET.has(err.next_step.kind), `${err.next_step.kind} must be a closed kind`)
+			assert.ok(NEXT_STEP_ACTION_SET.has(err.next_step.action), `${err.next_step.action} must be a closed action`)
+		}
+	}
+})
+
+test('schema entry: declares the full § II.4.3 parity surface as flags', () => {
+	const flag_names = schema.input.flags.map(f => f.name)
+	for (const expected of ['tagline', 'location', 'website', 'github', 'readme', 'readme-file', 'pin', 'hide-map', 'public', 'private', 'avatar', 'crop', 'json']) {
+		assert.ok(flag_names.includes(expected), `flag --${expected} must be declared`)
+	}
+})

package/src/commands/publish.js

@@ -11,7 +11,7 @@ const { collect_files } = require('../utils/file_collector')
 const { resolve_skill_dir, resolve_skill_owner } = require('../utils/resolve_skill')
 const { find_project_root } = require('../config/paths')
 const { read_lock, get_all_locked_skills } = require('../lock/reader')
-const { write_lock, update_lock_skills } = require('../lock/writer')
+const { mutate_lock, update_lock_skills } = require('../lock/writer')
 const { hash_directory } = require('../lock/integrity')
 const { verify_lock_disk_consistency } = require('../lock/verify')
 const { validate_skill_md } = require('../validation/skill_md_rules')
@@ -323,12 +323,10 @@ const run = (args) => catch_errors('Publish failed', async () => {
 		if (!hash_err && integrity) updated_entry.integrity = integrity
 		delete updated_entry.merge_parents
 		delete updated_entry.conflict_files
-		const updated_skills = update_lock_skills(lock_data_to_use, { [existing_lock_key]: updated_entry })
-		await write_lock(project_root, updated_skills)
+		await mutate_lock(project_root, (current) => update_lock_skills(current, { [existing_lock_key]: updated_entry }))
 		post_publish_entry = updated_entry
 	} else {
-		const updated_skills = update_lock_skills(lock_data_to_use, { [full_name]: new_entry })
-		await write_lock(project_root, updated_skills)
+		await mutate_lock(project_root, (current) => update_lock_skills(current, { [full_name]: new_entry }))
 		post_publish_entry = new_entry
 	}
 

package/src/commands/pull.js

@@ -13,7 +13,7 @@ const { merge_changelog } = require('../merge/changelog_merge')
 const { hash_blob } = require('../utils/git_hash')
 const { satisfies } = require('../utils/semver')
 const { read_lock, get_all_locked_skills } = require('../lock/reader')
-const { write_lock, update_lock_skills } = require('../lock/writer')
+const { mutate_lock, update_lock_skills } = require('../lock/writer')
 const { hash_directory } = require('../lock/integrity')
 const { verify_lock_disk_consistency } = require('../lock/verify')
 const { find_project_root, lock_root, skills_dir, skill_install_dir } = require('../config/paths')
@@ -298,8 +298,8 @@ const run = (args) => catch_errors('Pull failed', async () => {
 		}
 		delete updated_entry.merge_parents
 		delete updated_entry.conflict_files
-		const merged_skills = update_lock_skills(lock_data, { [skill_name]: updated_entry })
-		const [wl_err] = await write_lock(lock_root(is_global, project_root), merged_skills)
+		const merged_skills = (current) => update_lock_skills(current, { [skill_name]: updated_entry })
+		const [wl_err] = await mutate_lock(lock_root(is_global, project_root), merged_skills)
 		if (wl_err) { spinner.fail('Failed to write lock file'); throw wl_err[0] }
 
 		// Post-write verification — see installer.js for the rationale.
@@ -549,8 +549,8 @@ const run = (args) => catch_errors('Pull failed', async () => {
 		delete updated_entry.conflict_files
 		updated_entry.merge_parents = [lock_entry.base_commit, cmp_data.head_commit]
 	}
-	const merged_skills = update_lock_skills(lock_data, { [skill_name]: updated_entry })
-	const [wl_err] = await write_lock(lock_root(is_global, project_root), merged_skills)
+	const merged_skills = (current) => update_lock_skills(current, { [skill_name]: updated_entry })
+	const [wl_err] = await mutate_lock(lock_root(is_global, project_root), merged_skills)
 	if (wl_err) { spinner.fail('Failed to write lock file'); throw wl_err[0] }
 
 	// Post-merge verification — surface any disagreement between the new lock
@@ -695,8 +695,8 @@ const resolve_pending_conflicts = ({ skill_dir, lock_entry, lock_data, skill_nam
 		}
 		if (unresolved.length > 0) updated_entry.conflict_files = unresolved
 		else delete updated_entry.conflict_files
-		const merged_skills = update_lock_skills(lock_data, { [skill_name]: updated_entry })
-		const [wl_err] = await write_lock(lock_root(is_global, project_root), merged_skills)
+		const merged_skills = (current) => update_lock_skills(current, { [skill_name]: updated_entry })
+		const [wl_err] = await mutate_lock(lock_root(is_global, project_root), merged_skills)
 		if (wl_err) throw wl_err[0]
 
 		const status = unresolved.length > 0 ? 'conflicts' : 'merged'

package/src/commands/reconcile.js

@@ -2,7 +2,6 @@ const path = require('path')
 const fs = require('fs')
 const { error: { catch_errors, wrap_errors: e } } = require('puffy-core')
 const { read_lock, get_all_locked_skills } = require('../lock/reader')
-const { write_lock, update_lock_skills } = require('../lock/writer')
 const { verify_lock_disk_consistency, detect_ahead_state } = require('../lock/verify')
 const { write_manifest } = require('../manifest/writer')
 const { read_manifest } = require('../manifest/reader')
@@ -45,7 +44,10 @@ const ACTION_NEXT_STEPS = {
 }
 
 const resolve_lock_entry = (raw, project_root, is_global) => catch_errors('Failed to resolve lock entry', async () => {
-	const [, lock_data] = await read_lock(lock_root(is_global, project_root))
+	const [lock_data_err, lock_data] = await read_lock(lock_root(is_global, project_root))
+	// A corrupt lock must not be read as "nothing installed" — that lie would have us
+	// report an empty project, or reinstall over a lock we simply failed to parse.
+	if (lock_data_err) throw e('Failed to read the lock file', lock_data_err)
 	if (!lock_data) return { full: null, lock_entry: null, lock_data: null }
 	const all = get_all_locked_skills(lock_data)
 	let full = raw

package/src/commands/release.js

@@ -155,7 +155,10 @@ const orchestrate = (args) => catch_errors('Release failed', async () => {
 	if (manifest_err) throw e('No skill.json found', manifest_err)
 
 	// Resolve lock entry (if any) for ahead detection + version inference.
-	const [, lock_data] = await read_lock(project_root)
+	const [lock_data_err, lock_data] = await read_lock(project_root)
+	// A corrupt lock must not be read as "nothing installed" — that lie would have us
+	// report an empty project, or reinstall over a lock we simply failed to parse.
+	if (lock_data_err) throw e('Failed to read the lock file', lock_data_err)
 	const all_locked = lock_data ? get_all_locked_skills(lock_data) : {}
 	const lock_key = Object.keys(all_locked).find(k => k.endsWith(`/${skill_name}`)) || skill_name
 	const lock_entry = all_locked[lock_key] || null

package/src/commands/schema.js

@@ -11,7 +11,7 @@
 // so there's no drift.
 
 const path = require('path')
-const { error: { catch_errors } } = require('puffy-core')
+const { error: { catch_errors, wrap_errors: e } } = require('puffy-core')
 const { COMMANDS, COMMAND_ALIASES, CLI_VERSION, SKILL_JSON } = require('../constants')
 const { read_lock, get_all_locked_skills } = require('../lock/reader')
 const { skills_dir, skill_install_dir, find_project_root, lock_root } = require('../config/paths')
@@ -127,7 +127,10 @@ const load_command_schema = (name) => {
 const read_installed_manifests = (is_global) => catch_errors('Failed to read installed skills', async () => {
 	const project_root = find_project_root()
 	const base_dir = skills_dir(is_global, project_root)
-	const [, lock_data] = await read_lock(lock_root(is_global, project_root))
+	const [lock_data_err, lock_data] = await read_lock(lock_root(is_global, project_root))
+	// A corrupt lock must not be read as "nothing installed" — that lie would have us
+	// report an empty project, or reinstall over a lock we simply failed to parse.
+	if (lock_data_err) throw e('Failed to read the lock file', lock_data_err)
 	const locked = get_all_locked_skills(lock_data)
 	const entries = await Promise.all(Object.keys(locked).map(async (slug) => {
 		const short = slug.split('/')[1] || slug