magus-cli 7.12.2 → 7.14.0

package/src/__tests__/market-content.test.ts

@@ -0,0 +1,183 @@
+import { afterEach, expect, test } from "bun:test";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+	ID,
+	MANIFEST,
+	MarketFixture,
+	PLUGIN_MANIFEST,
+	SKILL,
+	SKILL_REL,
+	readJson,
+	sourceModule,
+	write,
+	writeJson,
+} from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test("TEST-21 REQ-8 plugin creation commits the specified layout; deletion commits only that plugin", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	f.register(repo);
+	const before = f.head(repo);
+
+	const created = f.market([
+		"plugin",
+		"create",
+		"new-kit@acme",
+		"--description",
+		"New tools",
+		"--yes",
+	]);
+
+	expect(created.code).toBe(0);
+	const plugin = f.remoteJson(
+		repo,
+		"plugins/new-kit/.claude-plugin/plugin.json",
+	);
+	expect(plugin).toEqual({
+		name: "new-kit",
+		version: "0.1.0",
+		description: "New tools",
+		author: { name: "acme" },
+	});
+	expect(f.remoteJson(repo, MANIFEST).plugins).toContainEqual({
+		name: "new-kit",
+		source: "./plugins/new-kit",
+		description: "New tools",
+		version: "0.1.0",
+	});
+	expect(f.head(repo)).not.toBe(before);
+	const afterCreate = f.head(repo);
+
+	const deleted = f.market(["plugin", "delete", "new-kit@acme", "--yes"]);
+
+	expect(deleted.code).toBe(0);
+	expect(f.head(repo)).not.toBe(afterCreate);
+	expect(f.remotePaths(repo)).not.toContain(
+		"plugins/new-kit/.claude-plugin/plugin.json",
+	);
+	expect(f.remoteFile(repo, SKILL_REL)).toBe(SKILL.trimEnd());
+	f.assertOwned();
+}, 60_000);
+
+test("TEST-21 REQ-8 external plugin sources are not writable targets", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	const manifest = readJson(join(repo.author, MANIFEST));
+	manifest.plugins[0].source = { source: "github", repo: "other/repo" };
+	writeJson(join(repo.author, MANIFEST), manifest);
+	f.push(repo);
+	f.register(repo);
+	write(join(f.folder("project", "new-skill"), "SKILL.md"), "New skill\n");
+	const head = f.head(repo);
+
+	const r = f.market(["skill", "add", "new-skill", "--plugin", ID, "--yes"]);
+
+	expect(r.code).toBe(1);
+	expect(r.result.error?.code).toBe("external-plugin");
+	expect(f.head(repo)).toBe(head);
+	f.assertOwned();
+}, 30_000);
+
+test.each(["project", "global"] as const)(
+	"TEST-22 REQ-9 adds a %s skill, then commits skill removal without deleting the last local copy",
+	(from) => {
+		f = new MarketFixture();
+		const repo = f.seed();
+		f.register(repo);
+		f.install();
+		const folder = f.folder(from, "new-skill");
+		write(
+			join(folder, "SKILL.md"),
+			"---\nname: new-skill\n---\nA new skill.\n",
+		);
+		const before = f.head(repo);
+
+		const added = f.market([
+			"skill",
+			"add",
+			"new-skill",
+			"--plugin",
+			ID,
+			"--from",
+			from,
+			"--keep-local",
+			"--yes",
+		]);
+
+		expect(added.code).toBe(0);
+		expect(added.result.version).toEqual({ from: "0.3.1", to: "0.3.2" });
+		expect(f.head(repo)).not.toBe(before);
+		expect(
+			f.remoteFile(repo, "plugins/review-kit/skills/new-skill/SKILL.md"),
+		).toContain("A new skill.");
+		expect(f.remoteJson(repo, MANIFEST).plugins[0].version).toBe("0.3.2");
+		expect(f.remoteJson(repo, PLUGIN_MANIFEST).version).toBe("0.3.2");
+
+		const removed = f.market([
+			"skill",
+			"remove",
+			"new-skill",
+			"--plugin",
+			ID,
+			"--yes",
+		]);
+
+		expect(removed.code).toBe(0);
+		expect(f.remotePaths(repo)).not.toContain(
+			"plugins/review-kit/skills/new-skill/SKILL.md",
+		);
+		expect(f.remoteJson(repo, MANIFEST).plugins[0].version).toBe("0.3.3");
+		expect(f.remoteJson(repo, PLUGIN_MANIFEST).version).toBe("0.3.3");
+		expect(readFileSync(join(folder, "SKILL.md"), "utf8")).toContain(
+			"A new skill.",
+		);
+		expect(removed.result.localCopy?.action).toBe("kept");
+		const base = f.value(
+			`const b=await import(${JSON.stringify(sourceModule("services/market-bases.js"))}); console.log(JSON.stringify(b.readBase(${JSON.stringify(folder)})));`,
+		);
+		expect(base).toBeNull();
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test("TEST-22 REQ-23 adding an existing skill rejects the collision without a commit", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	f.register(repo);
+	write(join(f.folder(), "SKILL.md"), SKILL);
+	const head = f.head(repo);
+
+	const r = f.market(["skill", "add", "review", "--plugin", ID, "--yes"]);
+
+	expect(r.code).toBe(1);
+	expect(r.result.error?.code).toBe("name-taken");
+	expect(JSON.stringify(r.result)).toContain("publish");
+	expect(f.head(repo)).toBe(head);
+	expect(existsSync(f.folder())).toBe(true);
+	f.assertOwned();
+}, 30_000);
+
+test("TEST-23 REQ-10 skill edit refuses an existing local target", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	f.register(repo);
+	write(join(f.folder(), "SKILL.md"), "Do not overwrite me\n");
+	const head = f.head(repo);
+
+	const r = f.market(["skill", "edit", "review", "--plugin", ID, "--yes"]);
+
+	expect(r.code).toBe(1);
+	expect(r.result.error?.code).toBe("name-taken");
+	expect(readFileSync(join(f.folder(), "SKILL.md"), "utf8")).toBe(
+		"Do not overwrite me\n",
+	);
+	expect(f.head(repo)).toBe(head);
+}, 30_000);

package/src/__tests__/market-delivery.test.ts

@@ -0,0 +1,308 @@
+import { afterEach, expect, test } from "bun:test";
+import { chmodSync, existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+	EDITED,
+	ID,
+	MarketFixture,
+	SKILL_REL,
+	expectPublished,
+	write,
+} from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test("TEST-46 REQ-22 publish honours the isolated repository's required signing instead of bypassing it", async () => {
+	f = new MarketFixture();
+	const repo = await f.prepared();
+	const head = f.head(repo);
+	const signer = join(f.bin, "test-signer");
+	write(
+		signer,
+		`#!${process.execPath} --no-env-file\nprocess.stderr.write('Test signer refused approval\\n'); process.exit(1);\n`,
+	);
+	chmodSync(signer, 0o755);
+	f.git(f.root, "config", "--global", "gpg.program", signer);
+	f.git(f.root, "config", "--global", "gpg.format", "openpgp");
+	f.git(f.root, "config", "--global", "commit.gpgsign", "true");
+
+	const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+
+	expect(r.code).toBe(1);
+	expect(f.head(repo)).toBe(head);
+	expect(f.version()).toBe("0.3.1");
+	expect(existsSync(f.folder())).toBe(true);
+	f.assertOwned();
+}, 60_000);
+
+test.each(["protected", "fork"] as const)(
+	"TEST-28 REQ-13 %s PR preserves default branch, install and local copy",
+	async (kind) => {
+		f = new MarketFixture();
+		const repo = await f.prepared();
+		const head = f.head(repo);
+		if (kind === "protected") f.protect(repo);
+		else
+			f.setModes({
+				push: false,
+				forks: true,
+				forkName: "teammate/renamed-market",
+			});
+
+		const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+
+		expect(r.code).toBe(0);
+		expect(r.result.outcome).toBe("pull-request");
+		expect(r.result.pullRequest).toMatch(
+			/^https:\/\/github\.com\/acme\/market\/pull\//,
+		);
+		expect(f.head(repo)).toBe(head);
+		expect(f.version()).toBe("0.3.1");
+		expect(readFileSync(join(f.folder(), "SKILL.md"), "utf8")).toBe(EDITED);
+		if (r.result.localCopy !== undefined)
+			expect(r.result.localCopy.action).toBe("kept");
+		const remote =
+			kind === "protected"
+				? repo.bare
+				: join(f.root, "remotes", "teammate", "renamed-market.git");
+		const branches = f
+			.git(
+				f.root,
+				"--git-dir",
+				remote,
+				"for-each-ref",
+				"--format=%(refname:short)",
+				"refs/heads",
+			)
+			.split("\n");
+		const branch = branches.find((name) => name.startsWith("magus/"));
+		expect(branch).toBeDefined();
+		expect(
+			f.git(f.root, "--git-dir", remote, "show", `${branch}:${SKILL_REL}`),
+		).toBe(EDITED.trimEnd());
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test.each([
+	{ modes: { push: false, forks: false }, error: "fork-not-allowed" },
+	{
+		modes: {
+			push: false,
+			forks: true,
+			forkName: "other/market",
+			forkParent: "acme/market",
+		},
+		error: null,
+	},
+	{
+		modes: {
+			push: false,
+			forks: true,
+			forkName: "teammate/market",
+			forkParent: "wrong/parent",
+		},
+		error: null,
+	},
+])(
+	"TEST-28 REQ-13 refused or misidentified forks never receive a publish: %j",
+	async ({ modes, error }) => {
+		f = new MarketFixture();
+		const repo = await f.prepared();
+		f.setModes(modes);
+		const head = f.head(repo);
+
+		const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+
+		expect(r.code).toBe(1);
+		expect(r.result.outcome).toBe("failed");
+		if (error) expect(r.result.error?.code).toBe(error);
+		expect(f.head(repo)).toBe(head);
+		expect(f.version()).toBe("0.3.1");
+		expect(existsSync(f.folder())).toBe(true);
+		if ("forkName" in modes) {
+			const fork = join(f.root, "remotes", `${modes.forkName}.git`);
+			if (existsSync(fork))
+				expect(
+					f.git(
+						f.root,
+						"--git-dir",
+						fork,
+						"for-each-ref",
+						"--format=%(refname:short)",
+						"refs/heads",
+					),
+				).toBe("main");
+		}
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test.each([false, true])(
+	"TEST-28 REQ-13 a denied push cannot silently change target to a fork; gh missing=%s",
+	async (missingGh) => {
+		f = new MarketFixture();
+		const repo = await f.prepared();
+		f.protect(repo, true);
+		if (missingGh) f.missingGh();
+		const head = f.head(repo);
+
+		const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+
+		expect(r.code).toBe(1);
+		expect(r.result.error?.code).toBe("no-access");
+		expect(f.head(repo)).toBe(head);
+		expect(f.version()).toBe("0.3.1");
+		expect(existsSync(join(f.root, "remotes", "teammate"))).toBe(false);
+		expect(existsSync(f.folder())).toBe(true);
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test("TEST-28 REQ-32 a failed PR after branch push never claims nothing changed", async () => {
+	f = new MarketFixture();
+	const repo = await f.prepared();
+	f.protect(repo);
+	f.setModes({ prFail: true });
+	const head = f.head(repo);
+
+	const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+
+	expect(r.code).toBe(1);
+	expect(r.result.message.toLowerCase()).not.toContain("nothing changed");
+	expect(
+		f.git(
+			f.root,
+			"--git-dir",
+			repo.bare,
+			"for-each-ref",
+			"--format=%(refname:short)",
+			"refs/heads",
+		),
+	).toContain("magus/");
+	expect(f.head(repo)).toBe(head);
+	expect(existsSync(f.folder())).toBe(true);
+	f.assertOwned();
+}, 60_000);
+
+test.each([
+	{ order: ["user", "project"] as const },
+	{ order: ["project", "user"] as const },
+])(
+	"TEST-29 REQ-14 USER and PROJECT publishes succeed in registry order %j",
+	({ order }) => {
+		f = new MarketFixture();
+		const repo = f.seed();
+		f.register(repo);
+		for (const scope of order) f.install(ID, scope);
+		f.edit();
+		write(join(f.folder(), "SKILL.md"), EDITED);
+
+		const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+
+		expect(r.code).toBe(0);
+		expect(r.result.outcome).toBe("ok");
+		expect(r.result.installs?.map((row) => row.status)).toEqual([
+			"updated",
+			"updated",
+		]);
+		expect(r.result.installs?.every((row) => row.loaded === "0.3.2")).toBe(
+			true,
+		);
+		expect(existsSync(f.folder())).toBe(false);
+		expectPublished(f, repo);
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test.each(["cli-error", "dirty-clone", "misdirected"] as const)(
+	"TEST-29 REQ-14 install move %s is partial after a real push and keeps the edit",
+	async (mode) => {
+		f = new MarketFixture();
+		const repo = await f.prepared();
+		if (mode === "cli-error")
+			f.setModes({ failInstall: "Plugin not found in marketplace" });
+		if (mode === "dirty-clone")
+			write(
+				join(f.clone(repo), "README.md"),
+				"Local changes in Claude's clone\n",
+			);
+		if (mode === "misdirected") {
+			const other = join(f.root, "other-project");
+			f.git(f.project, "worktree", "add", "-b", "other", other);
+			f.install(ID, "project", other);
+			f.install(ID, "project");
+			f.setModes({ misdirect: true });
+		}
+
+		const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+
+		expect(r.code).toBe(1);
+		expect(r.result.outcome).toBe("partial");
+		expect(r.result.error?.code).toBe("install-failed");
+		expect(r.result.installs?.some((row) => row.status === "failed")).toBe(
+			true,
+		);
+		expect(
+			r.result.installs
+				?.filter((row) => row.status === "failed")
+				.every((row) => row.fix?.includes("magus update")),
+		).toBe(true);
+		expect(r.result.localCopy?.action).toBe("kept");
+		expect(readFileSync(join(f.folder(), "SKILL.md"), "utf8")).toBe(EDITED);
+		expectPublished(f, repo);
+		expect(r.result.message.toLowerCase()).not.toContain("nothing changed");
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test.each([
+	{ mode: "missing", exit: 1, error: "gh-missing" },
+	{ mode: "auth", exit: 4, error: "gh-auth" },
+	{ mode: "network", exit: 1, error: "no-network" },
+])(
+	"TEST-46 REQ-22 create handles gh $mode with exit $exit",
+	({ mode, exit, error }) => {
+		f = new MarketFixture();
+		if (mode === "missing") f.missingGh();
+		if (mode === "auth") f.setModes({ auth: false });
+		if (mode === "network") f.setModes({ ghNetwork: true });
+		const before = f.snapshot();
+
+		const r = f.market(["create", "acme/new-market", "--private", "--yes"]);
+
+		expect(r.code).toBe(exit);
+		expect(r.result.error?.code).toBe(error);
+		expect(f.snapshot()).toEqual(before);
+		f.assertOwned();
+	},
+	30_000,
+);
+
+test("TEST-46 REQ-22 validation failure never pushes or removes the source", async () => {
+	f = new MarketFixture();
+	const repo = await f.prepared();
+	const head = f.head(repo);
+	f.setModes({ validateFail: true });
+
+	const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+
+	expect(r.code).toBe(1);
+	expect(r.result.error?.code).toBe("validate-failed");
+	expect(f.head(repo)).toBe(head);
+	expect(existsSync(f.folder())).toBe(true);
+	expect(f.git(f.working(repo), "diff", "--name-only")).toBe("");
+	expect(
+		f.git(f.working(repo), "ls-files", "--others", "--exclude-standard"),
+	).toBe("");
+	f.assertOwned();
+}, 60_000);