kcg-code 0.0.0-stage → 0.2.0

package/src/server/services/__tests__/skill-install-jobs.test.ts

@@ -0,0 +1,245 @@
+/**
+ * Unit test Skill_Install_Jobs — registry & refresh di-mock.
+ */
+import { describe, expect, test } from "bun:test";
+import type { Result } from "../../result";
+import { createSkillInstallJobs, FINISHED_TTL_MS, MAX_LOG_LINES } from "../skill-install-jobs";
+import type { InstallResult, SkillsRegistry } from "../skills-registry";
+
+interface Harness {
+  jobs: ReturnType<typeof createSkillInstallJobs>;
+  setTime: (t: number) => void;
+  release: (res: Result<InstallResult>) => void;
+  emit: (line: string) => void;
+  refreshCalls: string[];
+  /** Agent yang diteruskan ke `registry.install` per panggilan. */
+  installAgents: (readonly string[] | undefined)[];
+}
+
+/**
+ * Registry palsu: instalasi "menggantung" sampai `release` dipanggil — atau
+ * sampai signal dibatalkan (meniru proses CLI yang dibunuh).
+ */
+function harness(refreshed = true): Harness {
+  let t = 1000;
+  let emitFn: (line: string) => void = () => {};
+  let releaseFn: (res: Result<InstallResult>) => void = () => {};
+  const refreshCalls: string[] = [];
+  const installAgents: (readonly string[] | undefined)[] = [];
+  const registry: SkillsRegistry = {
+    search: async () => ({ ok: true, data: [] }),
+    audit: async () => ({ ok: true, data: { audits: null, overall: null } }),
+    install: (_path, _source, _skill, onLine, signal, agentTypes) =>
+      new Promise((resolve) => {
+        installAgents.push(agentTypes);
+        emitFn = (l) => onLine?.(l);
+        releaseFn = resolve;
+        signal?.addEventListener("abort", () =>
+          resolve({ ok: false, error: "SKILL_INSTALL_CANCELLED" }),
+        );
+      }),
+  };
+  const jobs = createSkillInstallJobs({
+    registry,
+    refreshSkills: async (projectId, agentType) => {
+      refreshCalls.push(agentType === "opencode" ? projectId : `${projectId}:${agentType}`);
+      return { ok: true, data: { refreshed } };
+    },
+    validate: (source, skill) => source === "a/b" && !skill.startsWith("-"),
+    now: () => t,
+  });
+  return {
+    jobs,
+    setTime: (v) => {
+      t = v;
+    },
+    release: (r) => releaseFn(r),
+    emit: (l) => emitFn(l),
+    refreshCalls,
+    installAgents,
+  };
+}
+
+const input = {
+  projectId: "p1",
+  projectName: "Proj",
+  projectPath: "/proj",
+  source: "a/b",
+  skillId: "c",
+};
+
+describe("createSkillInstallJobs", () => {
+  test("agentTypes diteruskan ke instalasi & refresh tiap agent (default opencode)", async () => {
+    const h = harness();
+    const a = h.jobs.start({ ...input, agentTypes: ["opencode", "claude-code"] });
+    expect(a.ok && a.data.agentTypes).toEqual(["opencode", "claude-code"]);
+    h.release({ ok: true, data: { name: "c", path: null } });
+    if (a.ok) await h.jobs.settled(a.data.id);
+    const b = h.jobs.start(input);
+    expect(b.ok && b.data.agentTypes).toEqual(["opencode"]);
+    h.release({ ok: true, data: { name: "c", path: null } });
+    if (b.ok) await h.jobs.settled(b.data.id);
+    expect(h.installAgents).toEqual([["opencode", "claude-code"], ["opencode"]]);
+    expect(h.refreshCalls).toEqual(["p1", "p1:claude-code", "p1"]);
+  });
+
+  test("job berjalan, log bertahap via from, sukses + refresh", async () => {
+    const h = harness();
+    const started = h.jobs.start(input);
+    expect(started.ok).toBe(true);
+    if (!started.ok) return;
+    const id = started.data.id;
+    expect(started.data.status).toBe("running");
+
+    h.emit("line 1");
+    h.emit("line 2");
+    const first = h.jobs.get(id, 0);
+    expect(first?.lines).toEqual(["line 1", "line 2"]);
+    expect(first?.job.lineCount).toBe(2);
+
+    h.emit("line 3");
+    const next = h.jobs.get(id, 2);
+    expect(next?.from).toBe(2);
+    expect(next?.lines).toEqual(["line 3"]);
+
+    h.release({ ok: true, data: { name: "c", path: "/proj/.agents/skills/c" } });
+    await h.jobs.settled(id);
+    const done = h.jobs.get(id, 3);
+    expect(done?.job.status).toBe("succeeded");
+    expect(done?.job.refreshed).toBe(true);
+    expect(done?.job.installedPath).toBe("/proj/.agents/skills/c");
+    expect(done?.job.finishedAt).not.toBeNull();
+    expect(done?.lines.at(-1)).toBe("✓ Installed c.");
+    expect(h.refreshCalls).toEqual(["p1"]);
+  });
+
+  test("gagal -> status failed + kode error, tanpa refresh", async () => {
+    const h = harness();
+    const started = h.jobs.start(input);
+    if (!started.ok) throw new Error("start gagal");
+    h.release({ ok: false, error: "SKILL_INSTALL_FAILED" });
+    await h.jobs.settled(started.data.id);
+    const log = h.jobs.get(started.data.id);
+    expect(log?.job.status).toBe("failed");
+    expect(log?.job.error).toBe("SKILL_INSTALL_FAILED");
+    expect(log?.lines.at(-1)).toBe("✗ Installation failed.");
+    expect(h.refreshCalls).toHaveLength(0);
+  });
+
+  test("refresh dilewati (chat aktif) -> refreshed false + pesan", async () => {
+    const h = harness(false);
+    const started = h.jobs.start(input);
+    if (!started.ok) throw new Error("start gagal");
+    h.release({ ok: true, data: { name: "c", path: null } });
+    await h.jobs.settled(started.data.id);
+    const log = h.jobs.get(started.data.id);
+    expect(log?.job.refreshed).toBe(false);
+    expect(log?.lines.at(-1)).toContain("reloads skills automatically when it finishes");
+  });
+
+  test("markRefreshed: job sukses tertunda di Project itu jadi aktif + dicatat", async () => {
+    const h = harness(false);
+    const started = h.jobs.start(input);
+    if (!started.ok) throw new Error("start gagal");
+    h.release({ ok: true, data: { name: "c", path: null } });
+    await h.jobs.settled(started.data.id);
+
+    h.jobs.markRefreshed("p-lain");
+    expect(h.jobs.get(started.data.id)?.job.refreshed).toBe(false);
+
+    h.jobs.markRefreshed("p1");
+    const log = h.jobs.get(started.data.id);
+    expect(log?.job.refreshed).toBe(true);
+    expect(log?.lines.at(-1)).toBe("✓ Chat finished — c is now active.");
+    // Idempoten: tidak menambah baris lagi.
+    h.jobs.markRefreshed("p1");
+    expect(h.jobs.get(started.data.id)?.job.lineCount).toBe(log?.job.lineCount);
+  });
+
+  test("validasi & satu job berjalan per Project", async () => {
+    const h = harness();
+    expect(h.jobs.start({ ...input, skillId: "--global" })).toEqual({
+      ok: false,
+      error: "INVALID_SKILL_ID",
+    });
+    const first = h.jobs.start(input);
+    expect(first.ok).toBe(true);
+    expect(h.jobs.start({ ...input, skillId: "d" })).toEqual({
+      ok: false,
+      error: "SKILL_INSTALL_IN_PROGRESS",
+    });
+    // Project lain tetap boleh.
+    expect(h.jobs.start({ ...input, projectId: "p2" }).ok).toBe(true);
+    expect(
+      h.jobs
+        .list()
+        .map((j) => j.projectId)
+        .sort(),
+    ).toEqual(["p1", "p2"]);
+  });
+
+  test("log dibatasi MAX_LOG_LINES; from lama -> truncated", () => {
+    const h = harness();
+    const started = h.jobs.start(input);
+    if (!started.ok) throw new Error("start gagal");
+    for (let i = 0; i < MAX_LOG_LINES + 10; i++) h.emit(`l${i}`);
+    const log = h.jobs.get(started.data.id, 0);
+    expect(log?.truncated).toBe(true);
+    expect(log?.from).toBe(10);
+    expect(log?.lines).toHaveLength(MAX_LOG_LINES);
+    expect(log?.lines[0]).toBe("l10");
+    expect(log?.job.lineCount).toBe(MAX_LOG_LINES + 10);
+  });
+
+  test("job selesai dibuang setelah TTL; id tak dikenal -> null", async () => {
+    const h = harness();
+    const started = h.jobs.start(input);
+    if (!started.ok) throw new Error("start gagal");
+    h.release({ ok: true, data: { name: "c", path: null } });
+    await h.jobs.settled(started.data.id);
+    expect(h.jobs.list()).toHaveLength(1);
+    h.setTime(1000 + FINISHED_TTL_MS + 1);
+    expect(h.jobs.list()).toHaveLength(0);
+    expect(h.jobs.get(started.data.id)).toBeNull();
+    expect(h.jobs.get("nope")).toBeNull();
+  });
+
+  test("cancel: job berjalan -> cancelled, tanpa refresh; kedua kali -> false", async () => {
+    const h = harness();
+    const started = h.jobs.start(input);
+    if (!started.ok) throw new Error("start gagal");
+    const id = started.data.id;
+    expect(h.jobs.cancel(id)).toBe(true);
+    expect(h.jobs.cancel(id)).toBe(false);
+    await h.jobs.settled(id);
+    const log = h.jobs.get(id);
+    expect(log?.job.status).toBe("cancelled");
+    expect(log?.job.error).toBe("SKILL_INSTALL_CANCELLED");
+    expect(log?.lines).toContain("Cancelling…");
+    expect(log?.lines.at(-1)).toBe("✗ Installation cancelled.");
+    expect(h.refreshCalls).toHaveLength(0);
+    // Project bebas lagi setelah dibatalkan.
+    expect(h.jobs.start(input).ok).toBe(true);
+    expect(h.jobs.cancel("nope")).toBe(false);
+  });
+
+  test("cancelAll: membatalkan semua job berjalan dan menunggu selesai", async () => {
+    const h = harness();
+    const a = h.jobs.start(input);
+    const b = h.jobs.start({ ...input, projectId: "p2" });
+    if (!a.ok || !b.ok) throw new Error("start gagal");
+    await h.jobs.cancelAll();
+    expect(h.jobs.get(a.data.id)?.job.status).toBe("cancelled");
+    expect(h.jobs.get(b.data.id)?.job.status).toBe("cancelled");
+  });
+
+  test("lastOutputAt diperbarui tiap baris", () => {
+    const h = harness();
+    const started = h.jobs.start(input);
+    if (!started.ok) throw new Error("start gagal");
+    expect(started.data.lastOutputAt).toBe(1000);
+    h.setTime(5000);
+    h.emit("x");
+    expect(h.jobs.get(started.data.id)?.job.lastOutputAt).toBe(5000);
+  });
+});

package/src/server/services/__tests__/skills-registry.test.ts

@@ -0,0 +1,365 @@
+/**
+ * Unit test Skills_Registry (skills.sh + CLI `skills`) — fetch & spawn di-mock,
+ * tanpa jaringan maupun proses nyata.
+ */
+import { describe, expect, test } from "bun:test";
+import {
+  buildInstallArgs,
+  cleanOutputLine,
+  createSkillsRegistry,
+  defaultSpawn,
+  installEnv,
+  isValidSkillId,
+  isValidSource,
+  normalizeQuery,
+  parseAuditResponse,
+  parseInstallOutput,
+  parseSearchResponse,
+  SKILLS_CLI_VERSION,
+  type SpawnFn,
+} from "../skills-registry";
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+/** Fetch mock yang mencatat URL dan membalas lewat `handler`. */
+function mockFetch(handler: (url: string) => Response) {
+  const urls: string[] = [];
+  const fn = (async (input: RequestInfo | URL) => {
+    const url = String(input);
+    urls.push(url);
+    return handler(url);
+  }) as typeof fetch;
+  return { fn, urls };
+}
+
+describe("validasi", () => {
+  test("source GitHub owner/repo & domain well-known diterima", () => {
+    expect(isValidSource("vercel-labs/agent-skills")).toBe(true);
+    expect(isValidSource("anthropics/skills")).toBe(true);
+    expect(isValidSource("mintlify.com")).toBe(true);
+  });
+
+  test("source berbahaya / tak valid ditolak", () => {
+    for (const bad of [
+      "",
+      "owner",
+      "owner/repo/extra",
+      "../etc/passwd",
+      "owner/..",
+      "-rf/repo",
+      "owner/repo;rm -rf /",
+      "owner/repo --global",
+      "https://github.com/a/b",
+      "owner/re po",
+    ]) {
+      expect(isValidSource(bad)).toBe(false);
+    }
+  });
+
+  test("skillId aman diterima; opsi CLI / traversal ditolak", () => {
+    expect(isValidSkillId("find-skills")).toBe(true);
+    expect(isValidSkillId("vercel_react.v2")).toBe(true);
+    for (const bad of ["", "-g", "--global", ".hidden", "a/b", "a..b", "a b", "*"]) {
+      expect(isValidSkillId(bad)).toBe(false);
+    }
+  });
+
+  test("normalizeQuery: trim, rapatkan spasi, batas 2-100 karakter", () => {
+    expect(normalizeQuery("  react   native ")).toBe("react native");
+    expect(normalizeQuery("a")).toBeNull();
+    expect(normalizeQuery("   ")).toBeNull();
+    expect(normalizeQuery("x".repeat(101))).toBeNull();
+  });
+});
+
+describe("parsing", () => {
+  test("parseSearchResponse: map, buang tak valid & duplikat, urut installs", () => {
+    const out = parseSearchResponse({
+      skills: [
+        { id: "a/b/low", source: "a/b", skillId: "low", name: "Low", installs: 5 },
+        { id: "a/b/high", source: "a/b", skillId: "high", name: "High", installs: 900 },
+        { id: "a/b/high", source: "a/b", skillId: "high", name: "High", installs: 900 },
+        { source: "bad source", skillId: "x", installs: 1 },
+        { source: "a/b", skillId: "--global", installs: 1 },
+        { source: "a/b", skillId: "noname", installs: -3 },
+        "junk",
+      ],
+    });
+    expect(out.map((s) => s.skillId)).toEqual(["high", "low", "noname"]);
+    expect(out[0]).toEqual({
+      id: "a/b/high",
+      name: "High",
+      source: "a/b",
+      skillId: "high",
+      installs: 900,
+      url: "https://skills.sh/a/b/high",
+    });
+    expect(out[2]?.name).toBe("noname");
+    expect(out[2]?.installs).toBe(0);
+    expect(parseSearchResponse(null)).toEqual([]);
+    expect(parseSearchResponse({ skills: "nope" })).toEqual([]);
+  });
+
+  test("parseAuditResponse: overall = status terburuk; status asing -> warn", () => {
+    const res = parseAuditResponse({
+      audits: [
+        { provider: "Socket", status: "pass", summary: "No alerts" },
+        { provider: "Snyk", status: "warn", summary: "Med", riskLevel: "MEDIUM" },
+        { provider: "Odd", status: "weird" },
+        { status: "fail" },
+      ],
+    });
+    expect(res.overall).toBe("warn");
+    expect(res.audits?.map((a) => [a.provider, a.status])).toEqual([
+      ["Socket", "pass"],
+      ["Snyk", "warn"],
+      ["Odd", "warn"],
+    ]);
+    expect(
+      parseAuditResponse({
+        audits: [
+          { provider: "X", status: "fail" },
+          { provider: "Y", status: "pass" },
+        ],
+      }).overall,
+    ).toBe("fail");
+    expect(parseAuditResponse({ audits: [] })).toEqual({ audits: null, overall: null });
+  });
+
+  test("buildInstallArgs: array argumen dengan versi CLI terpin", () => {
+    expect(buildInstallArgs("a/b", "c")).toEqual([
+      "bunx",
+      `skills@${SKILLS_CLI_VERSION}`,
+      "add",
+      "a/b",
+      "--skill",
+      "c",
+      "--agent",
+      "opencode",
+      "-y",
+      "--json",
+    ]);
+  });
+
+  test("buildInstallArgs: beberapa agent setelah satu --agent", () => {
+    const args = buildInstallArgs("a/b", "c", ["opencode", "claude-code"]);
+    const i = args.indexOf("--agent");
+    expect(args.slice(i, i + 4)).toEqual(["--agent", "opencode", "claude-code", "-y"]);
+  });
+
+  test("parseInstallOutput: JSON setelah teks lain; status harus installed/updated", () => {
+    const ok = parseInstallOutput(
+      'log line\n[{"name":"c","status":"installed","path":"/p/.agents/skills/c"}]',
+      "c",
+    );
+    expect(ok).toEqual({ ok: true, data: { name: "c", path: "/p/.agents/skills/c" } });
+    expect(parseInstallOutput("no json", "c").ok).toBe(false);
+    expect(parseInstallOutput("[not json", "c").ok).toBe(false);
+    expect(parseInstallOutput('[{"name":"c","status":"failed"}]', "c").ok).toBe(false);
+    expect(parseInstallOutput("[]", "c").ok).toBe(false);
+  });
+});
+
+describe("cleanOutputLine", () => {
+  test("buang ANSI, OSC, dan karakter kontrol; trim kanan", () => {
+    expect(cleanOutputLine("\u001b[1;32mok\u001b[0m  ")).toBe("ok");
+    expect(cleanOutputLine("\u001b]8;;https://x\u0007link\u001b]8;;\u0007")).toBe("link");
+    expect(cleanOutputLine("a\u0008b\tc")).toBe("ab\tc");
+    expect(cleanOutputLine("\u001b[?25l◇  Done")).toBe("◇  Done");
+  });
+});
+
+describe("createSkillsRegistry", () => {
+  test("search memanggil /api/search, hasil di-cache 60 detik", async () => {
+    let t = 0;
+    const f = mockFetch(() =>
+      jsonResponse({ skills: [{ source: "a/b", skillId: "c", name: "c", installs: 1 }] }),
+    );
+    const reg = createSkillsRegistry({ fetch: f.fn, now: () => t });
+
+    const r1 = await reg.search(" React ");
+    expect(r1.ok && r1.data[0]?.id).toBe("a/b/c");
+    expect(f.urls[0]).toBe("https://skills.sh/api/search?q=React&limit=50");
+
+    await reg.search("react");
+    expect(f.urls).toHaveLength(1);
+
+    t = 61_000;
+    await reg.search("react");
+    expect(f.urls).toHaveLength(2);
+  });
+
+  test("search: query pendek ditolak tanpa fetch; 429 & error dipetakan", async () => {
+    const f = mockFetch(() => jsonResponse({ error: "x" }, 429));
+    const reg = createSkillsRegistry({ fetch: f.fn });
+    expect(await reg.search("a")).toEqual({ ok: false, error: "INVALID_SKILL_QUERY" });
+    expect(f.urls).toHaveLength(0);
+    expect(await reg.search("react")).toEqual({ ok: false, error: "SKILLS_RATE_LIMITED" });
+
+    const broken = createSkillsRegistry({
+      fetch: (async () => {
+        throw new Error("offline");
+      }) as unknown as typeof fetch,
+    });
+    const res = await broken.search("react");
+    expect(!res.ok && res.error.startsWith("SKILLS_SEARCH_FAILED")).toBe(true);
+  });
+
+  test("audit: URL v1, 404 -> tanpa audit, id tak valid ditolak", async () => {
+    const f = mockFetch((url) =>
+      url.endsWith("/none")
+        ? jsonResponse({ error: "not_found" }, 404)
+        : jsonResponse({ audits: [{ provider: "Socket", status: "pass", summary: "ok" }] }),
+    );
+    const reg = createSkillsRegistry({ fetch: f.fn });
+
+    const ok = await reg.audit("a/b", "c");
+    expect(ok.ok && ok.data.overall).toBe("pass");
+    expect(f.urls[0]).toBe("https://skills.sh/api/v1/skills/audit/a/b/c");
+
+    const none = await reg.audit("a/b", "none");
+    expect(none).toEqual({ ok: true, data: { audits: null, overall: null } });
+
+    expect(await reg.audit("../x", "c")).toEqual({ ok: false, error: "INVALID_SKILL_ID" });
+    expect(f.urls).toHaveLength(2);
+  });
+
+  test("install: spawn di direktori Project dengan argumen tervalidasi", async () => {
+    const calls: { args: string[]; cwd: string }[] = [];
+    const spawn: SpawnFn = async (args, cwd) => {
+      calls.push({ args, cwd });
+      return {
+        exitCode: 0,
+        stdout: '[{"name":"c","status":"installed","path":"/proj/.agents/skills/c"}]',
+        stderr: "",
+      };
+    };
+    const reg = createSkillsRegistry({ spawn });
+    const res = await reg.install("/proj", "a/b", "c");
+    expect(res).toEqual({ ok: true, data: { name: "c", path: "/proj/.agents/skills/c" } });
+    expect(calls).toEqual([{ args: buildInstallArgs("a/b", "c"), cwd: "/proj" }]);
+
+    expect(await reg.install("/proj", "a/b", "--global")).toEqual({
+      ok: false,
+      error: "INVALID_SKILL_ID",
+    });
+    expect(calls).toHaveLength(1);
+  });
+
+  test("install: onLine menerima perintah + output CLI yang sudah dibersihkan", async () => {
+    const spawn: SpawnFn = async (_args, _cwd, _t, onLine) => {
+      onLine?.("\u001b[32m◇  Installed\u001b[0m");
+      onLine?.("");
+      onLine?.("");
+      onLine?.("done");
+      return { exitCode: 0, stdout: '[{"name":"c","status":"installed"}]', stderr: "" };
+    };
+    const lines: string[] = [];
+    const reg = createSkillsRegistry({ spawn });
+    await reg.install("/proj", "a/b", "c", (l) => lines.push(l));
+    expect(lines).toEqual([
+      `$ ${buildInstallArgs("a/b", "c").join(" ")}`,
+      "◇  Installed",
+      "",
+      "done",
+    ]);
+  });
+
+  test("install: exit != 0 -> gagal; instalasi paralel di Project sama ditolak", async () => {
+    let release: () => void = () => {};
+    const gate = new Promise<void>((r) => {
+      release = r;
+    });
+    let exitCode = 0;
+    const spawn: SpawnFn = async () => {
+      await gate;
+      return { exitCode, stdout: '[{"name":"c","status":"installed"}]', stderr: "boom" };
+    };
+    const reg = createSkillsRegistry({ spawn });
+
+    const first = reg.install("/proj", "a/b", "c");
+    expect(await reg.install("/proj", "a/b", "d")).toEqual({
+      ok: false,
+      error: "SKILL_INSTALL_IN_PROGRESS",
+    });
+    release();
+    expect((await first).ok).toBe(true);
+
+    exitCode = 1;
+    expect(await reg.install("/proj", "a/b", "c")).toEqual({
+      ok: false,
+      error: "SKILL_INSTALL_FAILED",
+    });
+  });
+
+  test("install: signal dibatalkan -> SKILL_INSTALL_CANCELLED; exit null -> TIMEOUT", async () => {
+    const lines: string[] = [];
+    const ctrl = new AbortController();
+    const spawnAbort: SpawnFn = async (_a, _c, _t, _l, signal) => {
+      ctrl.abort();
+      expect(signal?.aborted).toBe(true);
+      return { exitCode: null, stdout: "", stderr: "" };
+    };
+    const reg = createSkillsRegistry({ spawn: spawnAbort });
+    expect(await reg.install("/p", "a/b", "c", (l) => lines.push(l), ctrl.signal)).toEqual({
+      ok: false,
+      error: "SKILL_INSTALL_CANCELLED",
+    });
+    expect(lines.at(-1)).toBe("Cancelled.");
+
+    const spawnTimeout: SpawnFn = async () => ({ exitCode: null, stdout: "", stderr: "" });
+    const reg2 = createSkillsRegistry({ spawn: spawnTimeout });
+    expect(await reg2.install("/p", "a/b", "c")).toEqual({
+      ok: false,
+      error: "SKILL_INSTALL_TIMEOUT",
+    });
+  });
+});
+
+describe("installEnv", () => {
+  test("mematikan telemetry & prompt git; env lain dipertahankan", () => {
+    const env = installEnv({ PATH: "/bin", HOME: "/h", DROP: undefined });
+    expect(env.PATH).toBe("/bin");
+    expect(env.HOME).toBe("/h");
+    expect("DROP" in env).toBe(false);
+    expect(env.DISABLE_TELEMETRY).toBe("1");
+    expect(env.GIT_TERMINAL_PROMPT).toBe("0");
+    expect(env.GIT_HTTP_LOW_SPEED_TIME).toBe("30");
+  });
+});
+
+describe("defaultSpawn (proses nyata)", () => {
+  // Regresi: proses cucu (git) yang memegang pipe membuat instalasi menggantung
+  // walau proses langsung sudah dibunuh. Kill process group harus mengakhirinya.
+  const hang = ["sh", "-c", "sh -c 'sleep 30' & echo started >&2; wait"];
+
+  test("pembatalan membunuh seluruh process group, termasuk cucu", async () => {
+    const ctrl = new AbortController();
+    const lines: string[] = [];
+    const t0 = Date.now();
+    setTimeout(() => ctrl.abort(), 200);
+    const res = await defaultSpawn(hang, "/tmp", 60_000, (l) => lines.push(l), ctrl.signal);
+    expect(Date.now() - t0).toBeLessThan(5_000);
+    expect(res.exitCode).toBeNull();
+    expect(lines).toContain("started");
+  });
+
+  test("timeout membunuh seluruh process group", async () => {
+    const t0 = Date.now();
+    const res = await defaultSpawn(hang, "/tmp", 300);
+    expect(Date.now() - t0).toBeLessThan(5_000);
+    expect(res.exitCode).toBeNull();
+  });
+
+  test("proses normal: exit code & stdout diteruskan", async () => {
+    const res = await defaultSpawn(["sh", "-c", "echo out; echo err >&2; exit 3"], "/tmp", 5_000);
+    expect(res.exitCode).toBe(3);
+    expect(res.stdout).toBe("out\n");
+    expect(res.stderr).toBe("err\n");
+  });
+});