magus-cli 0.0.0-placeholder → 7.0.0

package/src/__tests__/marketplace-refresh.test.ts

@@ -0,0 +1,335 @@
+/**
+ * Tests for refreshRegisteredMarketplaces — the non-destructive marketplace clone
+ * refresh. These use REAL git repositories on purpose: the entire point of the
+ * rework is a real git property — `git pull --ff-only` advances a clone but NEVER
+ * deletes it on failure (unlike `claude plugin marketplace update`, which the repo
+ * deliberately bans; see marketplace-refresh.ts). Only a real pull can prove that,
+ * so the "clone survives a failed pull" cases here are the load-bearing ones.
+ */
+import { afterEach, beforeEach, describe, expect, it, mock } from "bun:test";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// --- Mock the marketplace registry (the only magus dep of the refresher) ---
+let configured: Record<string, { source: { source: string; repo?: string } }>;
+let autoUpdate: Record<string, boolean | undefined>;
+
+mock.module("../services/claude-settings.js", () => ({
+	getConfiguredMarketplaces: async () => configured,
+	getMarketplaceAutoUpdate: async (name: string) => autoUpdate[name],
+	// The refresher resolves clone paths via this helper; point it at our temp
+	// home so no real ~/.claude marketplace is ever touched. (Bun's os.homedir()
+	// ignores runtime $HOME changes, so mocking the helper is the reliable seam.)
+	getGlobalClaudeDir: () => path.join(tmp, ".claude"),
+}));
+
+const { refreshRegisteredMarketplaces, fastForwardCloneIfPresent } =
+	await import("../services/marketplace-refresh.js");
+
+const gh = (repo = "MadAppGang/magus") => ({
+	source: { source: "github", repo },
+});
+
+// git with a deterministic identity, no signing, `main` as default branch — so the
+// suite doesn't depend on the developer's global git config.
+const GIT_CFG = [
+	"-c",
+	"user.email=test@example.com",
+	"-c",
+	"user.name=test",
+	"-c",
+	"commit.gpgsign=false",
+	"-c",
+	"init.defaultBranch=main",
+];
+function git(cwd: string, ...args: string[]): string {
+	return execFileSync("git", [...GIT_CFG, ...args], { cwd, encoding: "utf8" });
+}
+
+let tmp: string;
+let mpRoot: string; // <tmp>/.claude/plugins/marketplaces (via mocked getGlobalClaudeDir)
+let origin: string; // bare origin repo standing in for the GitHub remote
+
+function writePluginJson(dir: string, version: string, pin: string) {
+	const p = path.join(dir, "plugins", "terminal");
+	fs.mkdirSync(p, { recursive: true });
+	fs.writeFileSync(
+		path.join(p, "plugin.json"),
+		JSON.stringify({ version, setup: { go: [pin] } }),
+	);
+}
+function readPin(dir: string): { version: string; pin: string } {
+	const j = JSON.parse(
+		fs.readFileSync(
+			path.join(dir, "plugins", "terminal", "plugin.json"),
+			"utf8",
+		),
+	);
+	return { version: j.version, pin: j.setup.go[0] };
+}
+/** Clone origin into the marketplace dir for `name`, at origin's current HEAD. */
+function installClone(name: string): string {
+	const dir = path.join(mpRoot, name);
+	git(tmp, "clone", origin, dir);
+	return dir;
+}
+/** Advance origin to a v2 (pinned) release, so installed clones become stale. */
+function publishV2() {
+	const pub = path.join(tmp, "pub");
+	git(tmp, "clone", origin, pub);
+	writePluginJson(pub, "4.1.2", "x@v1.6.2");
+	git(pub, "add", "-A");
+	git(pub, "commit", "-m", "v2 pinned");
+	git(pub, "push", "origin", "HEAD:main");
+	fs.rmSync(pub, { recursive: true, force: true });
+}
+
+beforeEach(() => {
+	tmp = fs.mkdtempSync(path.join(os.tmpdir(), "mp-refresh-"));
+	mpRoot = path.join(tmp, ".claude", "plugins", "marketplaces");
+	fs.mkdirSync(mpRoot, { recursive: true });
+
+	// Bare origin seeded at v1 (unpinned).
+	origin = path.join(tmp, "origin.git");
+	const seed = path.join(tmp, "seed");
+	git(tmp, "init", "--bare", origin);
+	git(tmp, "clone", origin, seed);
+	writePluginJson(seed, "4.0.3", "x@latest");
+	git(seed, "add", "-A");
+	git(seed, "commit", "-m", "v1");
+	git(seed, "push", "origin", "HEAD:main");
+	fs.rmSync(seed, { recursive: true, force: true });
+
+	configured = {};
+	autoUpdate = {};
+});
+
+afterEach(() => {
+	fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+describe("refreshRegisteredMarketplaces — the fix (CLAIM #1)", () => {
+	it("fast-forwards a stale clone so a newly pinned setup.go becomes visible", async () => {
+		const dir = installClone("magus");
+		expect(readPin(dir).pin).toBe("x@latest"); // stale on-disk clone
+		publishV2(); // a release lands upstream
+
+		configured = { magus: gh() };
+		const r = await refreshRegisteredMarketplaces();
+
+		expect(r.refreshed).toEqual(["magus"]);
+		expect(r.failed).toEqual([]);
+		// The whole point: the version-aware installer now sees the pin on disk.
+		expect(readPin(dir)).toEqual({ version: "4.1.2", pin: "x@v1.6.2" });
+	});
+
+	it("refreshes when autoUpdate is undefined (default on)", async () => {
+		installClone("magus");
+		publishV2();
+		configured = { magus: gh() };
+		const r = await refreshRegisteredMarketplaces();
+		expect(r.refreshed).toEqual(["magus"]);
+	});
+});
+
+describe("refreshRegisteredMarketplaces — non-destructive on failure (the rework's reason)", () => {
+	it("leaves the clone intact when the remote is unreachable (never deleted)", async () => {
+		const dir = installClone("magus");
+		git(
+			dir,
+			"remote",
+			"set-url",
+			"origin",
+			path.join(tmp, "does-not-exist.git"),
+		);
+		configured = { magus: gh() };
+
+		const r = await refreshRegisteredMarketplaces();
+
+		expect(r.failed).toEqual(["magus"]);
+		expect(fs.existsSync(dir)).toBe(true); // NOT deleted — the destructive mode is gone
+		expect(readPin(dir).pin).toBe("x@latest"); // content untouched
+	});
+
+	it("fails safely when history diverged (ff-only refuses to merge), clone intact", async () => {
+		const dir = installClone("magus");
+		// A local commit the upstream doesn't have → not fast-forwardable.
+		writePluginJson(dir, "4.0.3", "x@local");
+		git(dir, "add", "-A");
+		git(dir, "commit", "-m", "local divergence");
+		publishV2(); // upstream also moves → histories diverge
+
+		configured = { magus: gh() };
+		const r = await refreshRegisteredMarketplaces();
+
+		expect(r.failed).toEqual(["magus"]);
+		expect(fs.existsSync(dir)).toBe(true);
+		expect(readPin(dir).pin).toBe("x@local"); // local work preserved
+	});
+
+	it("refreshes healthy clones even when another fails (parallel, isolated)", async () => {
+		const good = installClone("good");
+		const bad = installClone("bad");
+		git(bad, "remote", "set-url", "origin", path.join(tmp, "nope.git"));
+		publishV2();
+
+		configured = { good: gh(), bad: gh("c/d") };
+		const r = await refreshRegisteredMarketplaces();
+
+		expect(r.refreshed).toEqual(["good"]);
+		expect(r.failed).toEqual(["bad"]);
+		expect(fs.existsSync(bad)).toBe(true);
+		expect(readPin(good).pin).toBe("x@v1.6.2");
+	});
+});
+
+describe("refreshRegisteredMarketplaces — selection & skips", () => {
+	it("skips a clone with uncommitted local changes (never clobbers them)", async () => {
+		const dir = installClone("magus");
+		publishV2();
+		// Uncommitted edit to a tracked file.
+		writePluginJson(dir, "4.0.3", "x@dirty");
+		configured = { magus: gh() };
+
+		const r = await refreshRegisteredMarketplaces();
+
+		expect(r.skipped).toEqual(["magus"]);
+		expect(r.refreshed).toEqual([]);
+		expect(readPin(dir).pin).toBe("x@dirty"); // preserved, not fast-forwarded
+	});
+
+	it("skips a registered marketplace whose clone is not on disk", async () => {
+		configured = { magus: gh() }; // never installed
+		const r = await refreshRegisteredMarketplaces();
+		expect(r.skipped).toEqual(["magus"]);
+		expect(r.failed).toEqual([]);
+	});
+
+	it("skips non-github sources", async () => {
+		configured = { local: { source: { source: "local" } } };
+		const r = await refreshRegisteredMarketplaces();
+		expect(r.refreshed).toEqual([]);
+		expect(r.skipped).toEqual(["local"]);
+	});
+
+	it("reports a marketplace with autoUpdate === false separately from ordinary skips", async () => {
+		// Not lumped into `skipped`: opting out here freezes the catalog, so the
+		// marketplace's plugins read as up to date forever. The caller has to be
+		// able to tell the user, which it cannot do if this looks like "no clone
+		// on disk". A real magus clone sat 11 days behind exactly this way.
+		installClone("magus");
+		publishV2();
+		configured = { magus: gh() };
+		autoUpdate = { magus: false };
+		const r = await refreshRegisteredMarketplaces();
+		expect(r.refreshed).toEqual([]);
+		expect(r.autoUpdateDisabled).toEqual(["magus"]);
+		expect(r.skipped).toEqual([]);
+	});
+
+	it("honors the skip set (already handled this run)", async () => {
+		installClone("magus");
+		installClone("other");
+		publishV2();
+		configured = { magus: gh(), other: gh("x/y") };
+
+		const r = await refreshRegisteredMarketplaces(["magus"]);
+
+		expect(r.refreshed).toEqual(["other"]);
+		expect(r.refreshed).not.toContain("magus");
+		expect(r.skipped).not.toContain("magus"); // skip = not touched at all
+	});
+});
+
+describe("refreshRegisteredMarketplaces — progress taps", () => {
+	it("reports the eligible set before pulling, then each clone as it settles", async () => {
+		// The whole reason these exist: this call is the slowest thing on the
+		// update path and used to report only once every clone had settled.
+		installClone("magus");
+		installClone("other");
+		publishV2();
+		configured = { magus: gh(), other: gh("x/y") };
+
+		const started: string[][] = [];
+		const settled: Array<[string, string]> = [];
+		const r = await refreshRegisteredMarketplaces([], {
+			onStart: (names) => started.push([...names]),
+			onSettled: (name, status) => settled.push([name, status]),
+		});
+
+		expect(started).toHaveLength(1);
+		expect(started[0]!.sort()).toEqual(["magus", "other"]);
+		// One event per eligible clone, and the statuses agree with the result.
+		expect(settled.map(([n]) => n).sort()).toEqual(["magus", "other"]);
+		expect(settled.every(([, s]) => s === "refreshed")).toBe(true);
+		expect(r.refreshed.sort()).toEqual(["magus", "other"]);
+	});
+
+	it("excludes an autoUpdate-disabled marketplace from the denominator", async () => {
+		// The progress meter's total comes from onStart. Counting a marketplace
+		// that is never pulled would leave the bar permanently short.
+		installClone("magus");
+		installClone("other");
+		publishV2();
+		configured = { magus: gh(), other: gh("x/y") };
+		autoUpdate = { magus: false };
+
+		const started: string[][] = [];
+		await refreshRegisteredMarketplaces([], {
+			onStart: (names) => started.push([...names]),
+		});
+
+		expect(started[0]).toEqual(["other"]);
+	});
+
+	it("a throwing observer cannot fail the refresh", async () => {
+		// onSettled fires inside the Promise.all fan-out, so an unguarded throw
+		// would reject the batch — turning a display bug into a failed refresh
+		// and breaking this function's documented "never throws" contract.
+		installClone("magus");
+		publishV2();
+		configured = { magus: gh() };
+
+		const r = await refreshRegisteredMarketplaces([], {
+			onStart: () => {
+				throw new Error("display exploded");
+			},
+			onSettled: () => {
+				throw new Error("display exploded again");
+			},
+		});
+
+		expect(r.refreshed).toEqual(["magus"]);
+		expect(r.failed).toEqual([]);
+	});
+});
+
+describe("fastForwardCloneIfPresent — single-clone helper (shared with claude-cli recovery)", () => {
+	it("returns 'absent' when no clone is on disk (caller then clones via add)", async () => {
+		expect(await fastForwardCloneIfPresent("magus")).toBe("absent");
+	});
+
+	it("returns 'refreshed' and advances a stale clone", async () => {
+		const dir = installClone("magus");
+		publishV2();
+		expect(await fastForwardCloneIfPresent("magus")).toBe("refreshed");
+		expect(readPin(dir).pin).toBe("x@v1.6.2");
+	});
+
+	it("returns 'failed' (never throws, clone intact) when the remote is unreachable", async () => {
+		const dir = installClone("magus");
+		git(dir, "remote", "set-url", "origin", path.join(tmp, "gone.git"));
+		expect(await fastForwardCloneIfPresent("magus")).toBe("failed");
+		expect(fs.existsSync(dir)).toBe(true);
+	});
+
+	it("returns 'skipped' for a dirty clone (never clobbers local edits)", async () => {
+		const dir = installClone("magus");
+		publishV2();
+		writePluginJson(dir, "4.0.3", "x@dirty");
+		expect(await fastForwardCloneIfPresent("magus")).toBe("skipped");
+		expect(readPin(dir).pin).toBe("x@dirty");
+	});
+});

package/src/__tests__/marketplace-version.test.ts

@@ -0,0 +1,84 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import {
+	clearMarketplaceCache,
+	fetchMarketplacePlugins,
+	getMarketplaceVersion,
+} from "../services/marketplace-fetcher";
+
+/**
+ * Coverage for capturing a marketplace's `metadata.version` during a fetch.
+ *
+ * The plugins TUI header renders "Name vX.Y.Z (count)" when a marketplace
+ * declares a version, so `fetchMarketplacePlugins` must stash the version and
+ * expose it via `getMarketplaceVersion`. Marketplaces without a version must
+ * yield `undefined` rather than crashing or leaking a stray "vundefined".
+ */
+
+const realFetch = globalThis.fetch;
+
+function mockFetchOnce(body: unknown): void {
+	globalThis.fetch = (async () =>
+		new Response(JSON.stringify(body), {
+			status: 200,
+			headers: { "content-type": "application/json" },
+		})) as typeof fetch;
+}
+
+describe("fetchMarketplacePlugins — metadata.version capture", () => {
+	beforeEach(() => {
+		clearMarketplaceCache();
+	});
+
+	afterEach(() => {
+		globalThis.fetch = realFetch;
+		clearMarketplaceCache();
+	});
+
+	it("captures metadata.version so getMarketplaceVersion returns it", async () => {
+		mockFetchOnce({
+			metadata: { version: "8.0.0" },
+			plugins: [{ name: "dev", description: "Dev workflow" }],
+		});
+
+		await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+
+		expect(getMarketplaceVersion("magus")).toBe("8.0.0");
+	});
+
+	it("yields undefined when marketplace.json has no metadata.version", async () => {
+		mockFetchOnce({
+			plugins: [{ name: "core", description: "Anthropic core plugin" }],
+		});
+
+		await fetchMarketplacePlugins("official", "anthropics/official");
+
+		expect(getMarketplaceVersion("official")).toBeUndefined();
+	});
+
+	it("yields undefined for a marketplace with metadata but no version field", async () => {
+		mockFetchOnce({
+			metadata: { description: "no version here" },
+			plugins: [{ name: "core", description: "" }],
+		});
+
+		await fetchMarketplacePlugins("no-version", "owner/no-version");
+
+		expect(getMarketplaceVersion("no-version")).toBeUndefined();
+	});
+
+	it("clears captured versions on clearMarketplaceCache", async () => {
+		mockFetchOnce({
+			metadata: { version: "1.0.0" },
+			plugins: [],
+		});
+
+		await fetchMarketplacePlugins(
+			"magus-marketing",
+			"MadAppGang/magus-marketing",
+		);
+		expect(getMarketplaceVersion("magus-marketing")).toBe("1.0.0");
+
+		clearMarketplaceCache();
+		expect(getMarketplaceVersion("magus-marketing")).toBeUndefined();
+	});
+});

package/src/__tests__/marketplaces.test.ts

@@ -0,0 +1,128 @@
+import { describe, expect, it } from "bun:test";
+import {
+	defaultMarketplaces,
+	deprecatedMarketplaces,
+	getAllMarketplaces,
+} from "../data/marketplaces.js";
+import type { LocalMarketplace } from "../services/local-marketplace.js";
+
+describe("marketplaces", () => {
+	it("uses the canonical Superpowers marketplace by default", () => {
+		const superpowers = defaultMarketplaces.find(
+			(mp) => mp.name === "superpowers-marketplace",
+		);
+
+		expect(superpowers).toBeDefined();
+		expect(superpowers?.displayName).toBe("Superpowers");
+		expect(superpowers?.source.repo).toBe("obra/superpowers-marketplace");
+		expect(superpowers?.featured).toBe(true);
+		expect(deprecatedMarketplaces.superpowers).toBe("superpowers-marketplace");
+	});
+
+	it("hides stale local superpowers entries behind the canonical marketplace", () => {
+		const local = new Map<string, LocalMarketplace>([
+			[
+				"superpowers",
+				{
+					name: "superpowers-dev",
+					description: "Development marketplace",
+					gitRepo: "obra/superpowers",
+					plugins: [],
+				},
+			],
+		]);
+
+		const names = getAllMarketplaces(local).map((mp) => mp.name);
+
+		expect(names).toContain("superpowers-marketplace");
+		expect(names).not.toContain("superpowers");
+	});
+});
+
+/**
+ * The community marketplaces added alongside the Magus channels.
+ *
+ * `name` is not cosmetic: plugin ids are built as `${plugin.name}@${mpName}`
+ * (plugin-manager.ts), so it MUST equal the upstream
+ * .claude-plugin/marketplace.json "name" field. A mismatch fails at install
+ * time with "not found in marketplace", nowhere near the typo that caused it.
+ *
+ * Verify against upstream with:
+ *   gh api repos/<repo>/contents/.claude-plugin/marketplace.json \
+ *     -H "Accept: application/vnd.github.raw" | jq -r '.name'
+ */
+const COMMUNITY_MARKETPLACES: ReadonlyArray<[name: string, repo: string]> = [
+	["mattpocock", "mattpocock/skills"],
+	["ecc", "affaan-m/everything-claude-code"],
+	["ponytail", "DietrichGebert/ponytail"],
+	["addy-agent-skills", "addyosmani/agent-skills"],
+	["humanizer", "blader/humanizer"],
+	["opendesign", "manalkaff/opendesign"],
+	// A fork, not the original: cursor/plugins keeps every manifest under
+	// `.cursor-plugin/` and carries no `.claude-plugin/marketplace.json`, so
+	// Claude Code cannot resolve it at all.
+	["open-pstack", "ericlitman/open-pstack"],
+];
+
+describe("community marketplaces", () => {
+	it.each(COMMUNITY_MARKETPLACES)(
+		"%s points at the repo whose manifest declares that name",
+		(name, repo) => {
+			const mp = defaultMarketplaces.find((m) => m.name === name);
+			expect(mp).toBeDefined();
+			expect(mp?.source.repo).toBe(repo);
+		},
+	);
+
+	it.each(COMMUNITY_MARKETPLACES)(
+		"%s is visible by default via the always-show gate",
+		(name) => {
+			const mp = defaultMarketplaces.find((m) => m.name === name);
+			// plugin-manager's gate: configured || official || featured || owned.
+			// Without one of these the entry is only a name-to-repo mapping and
+			// never appears, which is a silent no-op rather than a failure.
+			expect(mp?.official || mp?.featured || mp?.owned).toBe(true);
+		},
+	);
+
+	it.each(COMMUNITY_MARKETPLACES)(
+		"%s claims neither Anthropic nor MadAppGang ownership",
+		(name) => {
+			const mp = defaultMarketplaces.find((m) => m.name === name);
+			// `official` badges it as Anthropic-managed; `owned` sorts it above
+			// everything as a MadAppGang channel. Both would be a false claim.
+			expect(mp?.official).toBeUndefined();
+			expect(mp?.owned).toBeUndefined();
+		},
+	);
+
+	it("introduces no duplicate marketplace name or repo", () => {
+		const names = defaultMarketplaces.map((m) => m.name);
+		const repos = defaultMarketplaces.map((m) => m.source.repo.toLowerCase());
+
+		expect(new Set(names).size).toBe(names.length);
+		expect(new Set(repos).size).toBe(repos.length);
+	});
+
+	it("surfaces every community marketplace through getAllMarketplaces", () => {
+		const names = getAllMarketplaces().map((mp) => mp.name);
+
+		for (const [name] of COMMUNITY_MARKETPLACES) {
+			expect(names).toContain(name);
+		}
+	});
+
+	it("keeps the Magus channels sorted above the community ones", () => {
+		const order = getAllMarketplaces().map((mp) => mp.name);
+		const lastMagus = Math.max(
+			order.indexOf("magus"),
+			order.indexOf("magus-marketing"),
+			order.indexOf("magus-alpha"),
+		);
+		const firstCommunity = Math.min(
+			...COMMUNITY_MARKETPLACES.map(([name]) => order.indexOf(name)),
+		);
+
+		expect(lastMagus).toBeLessThan(firstCommunity);
+	});
+});