magus-cli 0.0.0-placeholder → 7.0.0

package/src/__tests__/toolchain.test.ts

@@ -0,0 +1,232 @@
+import { describe, expect, test } from "bun:test";
+import {
+	PYTHON_CLI_INSTALLERS,
+	type PythonCliInstaller,
+	binInstallCommand,
+	binUpgradeCommand,
+	detectToolchains,
+	resolvePythonCliInstaller,
+} from "../services/toolchain.js";
+import type { ResolvedBin } from "../types/index.js";
+import { formatCommand } from "../utils/command-utils.js";
+
+/**
+ * Pin a Python installer explicitly in every `via: "pip"` assertion.
+ *
+ * The production default is resolved from PATH, so asserting a literal command
+ * would encode whatever happens to be installed on the machine running the
+ * suite — green here, red on a runner without uv.
+ */
+const byProbe = (probe: string): PythonCliInstaller => {
+	const found = PYTHON_CLI_INSTALLERS.find((i) => i.probe === probe);
+	if (!found) throw new Error(`no python installer with probe ${probe}`);
+	return found;
+};
+const UV = byProbe("uv");
+const PIPX = byProbe("pipx");
+const PY = byProbe("python3");
+
+describe("binInstallCommand", () => {
+	test("bun with and without a version pin", () => {
+		expect(
+			formatCommand(
+				binInstallCommand({
+					name: "claudish",
+					via: "bun",
+					package: "claudish",
+					version: "1.2.0",
+				}),
+			),
+		).toBe("bun install -g claudish@1.2.0");
+		expect(
+			formatCommand(binInstallCommand({ name: "claudish", via: "bun" })),
+		).toBe("bun install -g claudish");
+	});
+
+	test("the package name is ONE argv token, whatever is in it", () => {
+		// `bin.package` is hand-authored data — it arrives from
+		// `.claude/profiles.json` and from plugin `requires.bin`, committed by
+		// teammates and fetched from marketplaces, and nothing validates it.
+		// While commands were strings handed to `/bin/sh`, this string was four
+		// words and a command separator. As argv it cannot be anything but a
+		// (nonexistent) package name, so the install fails instead of running.
+		const evil = "a b; rm -rf /";
+		const cmd = binInstallCommand({ name: "x", via: "bun", package: evil });
+		expect(cmd.cmd).toBe("bun");
+		expect(cmd.args).toEqual(["install", "-g", evil]);
+		expect(cmd.args.at(-1)).toBe(evil); // unsplit: still exactly one token
+		// ...and rendering it for display quotes it rather than emitting syntax.
+		expect(formatCommand(cmd)).toBe("bun install -g 'a b; rm -rf /'");
+	});
+
+	test("a version pin joins the package as one token, not two", () => {
+		// Splitting `pkg@version` would ask the installer for two packages, the
+		// second of which is a version number.
+		const cmd = binInstallCommand({
+			name: "claudish",
+			via: "bun",
+			version: "1.2.0",
+		});
+		expect(cmd.args.at(-1)).toBe("claudish@1.2.0");
+	});
+
+	test("npm, pip, brew, go each render correctly", () => {
+		// Rendered, not raw, because these literals are also the display-
+		// neutrality claim: every token here is shell-safe, so `formatCommand`
+		// quotes nothing and the printed line is byte-identical to the string
+		// these builders returned before they returned argv.
+		expect(
+			formatCommand(binInstallCommand({ name: "x", via: "npm", package: "x" })),
+		).toBe("npm install -g x");
+		expect(
+			formatCommand(
+				binInstallCommand(
+					{ name: "aider", via: "pip", package: "aider", version: "0.1" },
+					UV,
+				),
+			),
+		).toBe("uv tool install aider==0.1");
+		expect(
+			formatCommand(
+				binInstallCommand({ name: "tmux", via: "brew", formula: "tmux" }),
+			),
+		).toBe("brew install tmux");
+		expect(
+			formatCommand(
+				binInstallCommand({ name: "t", via: "go", module: "github.com/x/t" }),
+			),
+		).toBe("go install github.com/x/t@latest");
+	});
+});
+
+describe("binUpgradeCommand", () => {
+	test("brew and pip do NOT reuse their install command", () => {
+		// This is the whole reason the function exists: `brew install` on an
+		// installed formula prints "already installed" and changes nothing, and
+		// `pip install` without --upgrade does the same. Reusing them would let
+		// `magus update` report success while advancing nothing.
+		expect(
+			formatCommand(
+				binUpgradeCommand({ name: "tmux", via: "brew", formula: "tmux" }),
+			),
+		).toBe("brew upgrade tmux");
+		expect(
+			formatCommand(
+				binUpgradeCommand({ name: "aider", via: "pip", package: "aider" }, PY),
+			),
+		).toBe("python3 -m pip install --user --upgrade aider");
+		expect(
+			formatCommand(
+				binUpgradeCommand({ name: "aider", via: "pip", package: "aider" }, UV),
+			),
+		).toBe("uv tool install --force --upgrade aider");
+	});
+
+	test("every Python installer distinguishes install from upgrade", () => {
+		// The same trap as brew: `uv tool install` on an already-installed tool
+		// is a no-op, so reusing the install command would report success while
+		// advancing nothing.
+		for (const python of PYTHON_CLI_INSTALLERS) {
+			const bin = { name: "aider", via: "pip" as const, package: "aider" };
+			// Compared RENDERED. Two `Command` objects are never `toBe`-equal —
+			// they are distinct references — so comparing them directly would be
+			// an assertion that cannot fail.
+			expect(formatCommand(binUpgradeCommand(bin, python))).not.toBe(
+				formatCommand(binInstallCommand(bin, python)),
+			);
+		}
+	});
+});
+
+describe("resolvePythonCliInstaller", () => {
+	test("never emits a bare `pip`", () => {
+		// The bug this exists for: `pip` is frequently a zsh ALIAS for pip3 and
+		// no such executable exists. Commands were spawned through /bin/sh, which
+		// sources no profile, so this died with `/bin/sh: pip: command not found`
+		// on a machine where typing `pip` at a prompt works.
+		//
+		// Now that a command is argv, `cmd` is the exact executable that gets
+		// looked up on PATH — so asserting on it is asserting on the syscall,
+		// not on a string a shell might later re-read.
+		for (const python of PYTHON_CLI_INSTALLERS) {
+			for (const cmd of [python.install("x"), python.upgrade("x")]) {
+				expect(cmd.cmd).not.toBe("pip");
+				expect(cmd.cmd).toBe(python.probe);
+			}
+		}
+	});
+
+	test("prefers an isolated-venv installer over the system interpreter", () => {
+		// `pip install` into a Homebrew interpreter is refused outright by PEP
+		// 668 (`externally-managed-environment`), so uv and pipx must outrank it.
+		const order = PYTHON_CLI_INSTALLERS.map((i) => i.probe);
+		expect(order.indexOf("uv")).toBeLessThan(order.indexOf("python3"));
+		expect(order.indexOf("pipx")).toBeLessThan(order.indexOf("python3"));
+	});
+
+	test("always resolves to something, and to one of the known options", () => {
+		// Returning null would force every caller to handle "no installer",
+		// which in practice means printing nothing and silently skipping.
+		const resolved = resolvePythonCliInstaller();
+		expect(PYTHON_CLI_INSTALLERS).toContain(resolved);
+	});
+
+	test("a version pin is expressed in the installer's own syntax", () => {
+		expect(
+			formatCommand(
+				binInstallCommand({ name: "a", via: "pip", version: "1.2" }, UV),
+			),
+		).toBe("uv tool install a==1.2");
+		expect(
+			formatCommand(
+				binInstallCommand({ name: "a", via: "pip", version: "1.2" }, PIPX),
+			),
+		).toBe("pipx install a==1.2");
+		// `a==1.2` is one token. Two would ask uv to install a package called
+		// "1.2".
+		expect(
+			binInstallCommand({ name: "a", via: "pip", version: "1.2" }, UV).args,
+		).toEqual(["tool", "install", "a==1.2"]);
+	});
+
+	test("bun and npm state @latest explicitly, so the printed command reads true", () => {
+		expect(
+			formatCommand(binUpgradeCommand({ name: "claudish", via: "bun" })),
+		).toBe("bun install -g claudish@latest");
+		expect(
+			formatCommand(binUpgradeCommand({ name: "x", via: "npm", package: "x" })),
+		).toBe("npm install -g x@latest");
+	});
+
+	test("go installs the module at latest", () => {
+		expect(
+			formatCommand(
+				binUpgradeCommand({ name: "t", via: "go", module: "github.com/x/t" }),
+			),
+		).toBe("go install github.com/x/t@latest");
+	});
+});
+
+describe("detectToolchains", () => {
+	test("groups bins by installer and reports requiredBy + presence", async () => {
+		const bins: ResolvedBin[] = [
+			{ name: "claudish", via: "bun", sources: ["a"] },
+			{ name: "mnemex", via: "bun", sources: ["b"] },
+			{ name: "tmux", via: "brew", sources: ["c"] },
+		];
+		const statuses = await detectToolchains(bins);
+		const bun = statuses.find((s) => s.name === "bun")!;
+		const brew = statuses.find((s) => s.name === "brew")!;
+		expect(bun.requiredBy.sort()).toEqual(["claudish", "mnemex"]);
+		expect(brew.requiredBy).toEqual(["tmux"]);
+		// bun/brew are bootstrappable; the field is populated.
+		expect(bun.bootstrap).toContain("bun.sh");
+		expect(typeof bun.present).toBe("boolean");
+		// stable order: bun before brew
+		expect(statuses.map((s) => s.name)).toEqual(["bun", "brew"]);
+	});
+
+	test("returns only toolchains actually needed (empty for no bins)", async () => {
+		expect(await detectToolchains([])).toEqual([]);
+	});
+});

package/src/__tests__/ui-version-writers.test.ts

@@ -0,0 +1,88 @@
+/**
+ * The UI records a plugin version only through a function that read it back.
+ *
+ * `installedPluginVersions` is magus's own bookkeeping — the Claude CLI does
+ * not maintain it — and `install --check` reads it to decide whether a machine
+ * has drifted from its profile. So a version written from an EXPECTATION rather
+ * than from disk is not a cosmetic inaccuracy: the drift gate ends up comparing
+ * a number against a copy of itself and reporting clean forever. That is what
+ * PluginsScreen's install branches did, via a local `saveVersionForScope`
+ * helper that duplicated `plugin-manager.ts`'s scope dispatcher and took the
+ * version as a parameter.
+ *
+ * Deleting the helper removed the UI's *ability* to make that mistake. This
+ * test is what keeps it removed: a screen may still install and update, but
+ * only through `installPluginInScope`, which reads the version off disk and
+ * writes nothing when it cannot.
+ *
+ * A source scan rather than a behavioural test because these are `.tsx` screens
+ * this suite cannot render. It encodes the rule directly instead of the symptom
+ * — the precedent for source-scanning guards here is
+ * `uppercase-keybindings.test.ts`.
+ */
+
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import fs from "fs-extra";
+
+const UI_DIR = path.join(import.meta.dir, "..", "ui");
+
+/** The version writers that take the number on trust from their caller. */
+const RAW_WRITERS = [
+	"saveGlobalInstalledPluginVersion",
+	"saveLocalInstalledPluginVersion",
+	"saveInstalledPluginVersion",
+	"saveInstalledPluginVersionForScope",
+];
+
+async function uiSourceFiles(dir: string): Promise<string[]> {
+	const out: string[] = [];
+	for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+		const full = path.join(dir, entry.name);
+		if (entry.isDirectory()) out.push(...(await uiSourceFiles(full)));
+		else if (/\.tsx?$/.test(entry.name)) out.push(full);
+	}
+	return out;
+}
+
+const isComment = (line: string) => {
+	const t = line.trim();
+	return t.startsWith("//") || t.startsWith("*") || t.startsWith("/*");
+};
+
+describe("no UI file writes a plugin version it did not read back", () => {
+	test("the raw version writers are absent from src/ui", async () => {
+		const files = await uiSourceFiles(UI_DIR);
+		expect(files.length).toBeGreaterThan(10); // guard: the walk found real files
+
+		const offenders: string[] = [];
+		for (const file of files) {
+			const text = await fs.readFile(file, "utf8");
+			text.split("\n").forEach((line, i) => {
+				if (isComment(line)) return;
+				for (const writer of RAW_WRITERS) {
+					// Word-bounded: `saveInstalledPluginVersion` is a prefix of
+					// `saveInstalledPluginVersionForScope`, and both are banned, so a
+					// substring match would just double-report the same line.
+					if (new RegExp(`\\b${writer}\\b`).test(line)) {
+						offenders.push(
+							`${path.relative(UI_DIR, file)}:${i + 1}  ${line.trim()}`,
+						);
+					}
+				}
+			});
+		}
+
+		expect(offenders).toEqual([]);
+	});
+
+	test("the guard can actually fail", () => {
+		// Negative control. The assertion above passes trivially if the walk or
+		// the pattern is broken, and a guard that cannot fail is not evidence.
+		const line = "\t\t\tawait saveGlobalInstalledPluginVersion(id, version);";
+		expect(isComment(line)).toBe(false);
+		expect(RAW_WRITERS.some((w) => new RegExp(`\\b${w}\\b`).test(line))).toBe(
+			true,
+		);
+	});
+});