magus-cli 7.12.2 → 7.14.0

package/src/__tests__/market-git.test.ts

@@ -0,0 +1,130 @@
+import { afterEach, expect, test } from "bun:test";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import {
+	classifyGitFailure,
+	gitEnv,
+	parseLsRemoteHead,
+	parseLsTree,
+	parseNameStatus,
+	unquoteCPath,
+} from "../services/git-write.js";
+import { classifyGhFailure } from "../services/github-cli.js";
+import { MarketFixture, sourceModule, write } from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test.each([
+	["fatal: Could not resolve host: github.com", "no-network"],
+	[
+		"Permission denied (publickey).\nfatal: Could not read from remote repository.",
+		"auth",
+	],
+	["remote: Permission to acme/market denied to teammate.", "denied"],
+	["! [rejected] HEAD -> main (non-fast-forward)", "rejected-non-ff"],
+	[
+		"remote: error: GH006: Protected branch update failed for refs/heads/main.\n! [remote rejected] main (hook declined)",
+		"rejected-protected",
+	],
+	["fatal: unrelated problem", "other"],
+] as const)("TEST-10 REQ-22 classifies git failure %s", (text, expected) =>
+	expect(classifyGitFailure(text, { timedOut: false })).toBe(expected),
+);
+
+test("TEST-10 REQ-22 timeouts retain signing context and git never prompts", () => {
+	expect(classifyGitFailure("", { timedOut: true })).toBe("timeout");
+	expect(classifyGitFailure("", { timedOut: true, signing: true })).toBe(
+		"signing-timeout",
+	);
+	const original = {
+		GIT_TERMINAL_PROMPT: "1",
+		GCM_INTERACTIVE: "always",
+		HOME: "test-home",
+	};
+	const env = gitEnv(original);
+	expect({
+		HOME: env.HOME,
+		GIT_TERMINAL_PROMPT: env.GIT_TERMINAL_PROMPT,
+		GCM_INTERACTIVE: env.GCM_INTERACTIVE,
+	}).toEqual({
+		HOME: "test-home",
+		GIT_TERMINAL_PROMPT: "0",
+		GCM_INTERACTIVE: "never",
+	});
+	expect(classifyGhFailure(4, "not logged in", false)).toBe("gh-auth");
+	expect(classifyGhFailure(1, "HTTP 404: Not Found", false)).toBe("not-found");
+	expect(classifyGhFailure(1, "Could not resolve host", false)).toBe(
+		"no-network",
+	);
+	expect(classifyGhFailure(null, "", true)).toBe("timeout");
+});
+
+test("TEST-11 REQ-22 parses remote HEAD without assuming main", () => {
+	const oid = "a".repeat(40);
+	expect(
+		parseLsRemoteHead(`ref: refs/heads/trunk\tHEAD\n${oid}\tHEAD\n`),
+	).toEqual({ branch: "trunk", commit: oid });
+	expect(parseLsRemoteHead("")).toEqual({ branch: null, commit: null });
+});
+test("TEST-11 REQ-22 NUL-delimited paths keep tabs, newlines and Unicode", () => {
+	const paths = ["space name.md", "tab\tname.md", "line\nname.md", "café.md"];
+	const tree = paths
+		.map((path, i) => `100644 blob ${String(i + 1).repeat(40)}\t${path}\0`)
+		.join("");
+	expect(parseLsTree(tree).map((entry) => entry.path)).toEqual(paths);
+	expect(parseNameStatus("D\0old name.md\0A\0new\nname.md\0")).toEqual([
+		{ status: "D", path: "old name.md" },
+		{ status: "A", path: "new\nname.md" },
+	]);
+	expect(unquoteCPath('"a\\tb"')).toBe("a\tb");
+	expect(unquoteCPath('"caf\\303\\251.md"')).toBe("café.md");
+});
+
+test("TEST-12 REQ-22 real hash-object ignores filters and writes no object/index", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	write(join(repo.author, ".gitattributes"), "*.md filter=must-not-run\n");
+	f.git(repo.author, "config", "filter.must-not-run.clean", "exit 99");
+	const file = join(repo.author, "new name.md");
+	write(file, "same bytes\n");
+	const before = f.git(repo.author, "ls-files", "--stage");
+	const got = f.value<{ ok: boolean; value: string[] }>(
+		`const g = await import(${JSON.stringify(sourceModule("services/git-write.js"))}); console.log(JSON.stringify(await g.hashObject(${JSON.stringify(repo.author)}, [${JSON.stringify(file)}])));`,
+	);
+	expect(got.ok).toBe(true);
+	expect(got.value).toEqual([
+		f.git(repo.author, "hash-object", "--no-filters", "--", file),
+	]);
+	expect(f.git(repo.author, "ls-files", "--stage")).toBe(before);
+	expect(
+		f.run([f.gitBinary, "cat-file", "-e", got.value[0]!], repo.author).code,
+	).not.toBe(0);
+}, 30_000);
+
+test("TEST-12 REQ-31 disposable sync cleans untracked/ignored files and preserves history", () => {
+	f = new MarketFixture();
+	const repo = f.seed({ extras: { ".gitignore": "*.scratch\n" } });
+	f.register(repo);
+	f.ok(["fetch", "acme"]);
+	const working = f.working(repo);
+	write(join(working, "leftover.scratch"), "must not commit\n");
+	write(join(working, "untracked.txt"), "must not commit\n");
+	write(join(working, "README.md"), "dirty disposable copy\n");
+	write(join(repo.author, "new.md"), "teammate\n");
+	const head = f.push(repo);
+	const cloneHead = f.git(f.clone(repo), "rev-parse", "HEAD");
+
+	const r = f.market(["fetch", "acme"]);
+
+	expect(r.code).toBe(0);
+	expect(f.git(working, "rev-parse", "HEAD")).toBe(head);
+	expect(f.git(working, "rev-parse", "--is-shallow-repository")).toBe("false");
+	expect(existsSync(join(working, "leftover.scratch"))).toBe(false);
+	expect(existsSync(join(working, "untracked.txt"))).toBe(false);
+	expect(f.git(f.clone(repo), "rev-parse", "HEAD")).toBe(cloneHead);
+	f.assertOwned();
+}, 30_000);

package/src/__tests__/market-identity.test.ts

@@ -0,0 +1,127 @@
+import { afterEach, expect, test } from "bun:test";
+import { mkdirSync, symlinkSync } from "node:fs";
+import { join } from "node:path";
+import { readMarker, withMarker } from "../services/market-marker.js";
+import {
+	isTrustedIn,
+	normaliseSource,
+	sameSource,
+} from "../services/market-registry.js";
+import { MarketFixture, sourceModule, writeJson } from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test("TEST-07 REQ-5 setting the company marker preserves unrelated manifest metadata", () => {
+	const manifest = {
+		name: "acme",
+		owner: { name: "Team" },
+		metadata: { pluginRoot: "./plugins", description: "Keep this" },
+		plugins: [],
+	};
+	const before = JSON.stringify(manifest);
+	const marked = withMarker(manifest);
+
+	expect(readMarker(manifest)).toBe(false);
+	expect(readMarker(marked)).toBe(true);
+	expect(marked.metadata).toEqual({
+		pluginRoot: "./plugins",
+		description: "Keep this",
+		magus: { schema: 1, company: true },
+	});
+	expect(JSON.stringify(manifest)).toBe(before);
+	expect(readMarker(null)).toBe(false);
+	expect(
+		readMarker({ metadata: { magus: { schema: 1, company: false } } }),
+	).toBe(false);
+});
+
+test.each([
+	["acme/market", "acme/market"],
+	["https://github.com/acme/market.git", "acme/market"],
+	["https://github.com/acme/market/", "acme/market"],
+	["git@github.com:acme/market.git", "acme/market"],
+	["ssh://git@github.com/acme/market.git", "acme/market"],
+	[
+		"https://git.example.invalid/Team/Repo.git",
+		"https://git.example.invalid/Team/Repo.git",
+	],
+])("TEST-08 REQ-33 normalises source %s", (input, expected) =>
+	expect(normaliseSource(input)).toBe(expected),
+);
+
+test("TEST-08 REQ-33 relative directories resolve against the project and real parent", () => {
+	f = new MarketFixture();
+	const directory = join(f.root, "repo-directory");
+	mkdirSync(directory);
+	symlinkSync(directory, join(f.project, "market-link"));
+	expect(normaliseSource("./market-link", f.project)).toBe(directory);
+	expect(normaliseSource("./not-created", f.project)).toBe(
+		join(f.project, "not-created"),
+	);
+	expect(normaliseSource(new URL(`file://${directory}`).href)).toBe(
+		new URL(`file://${directory}`).href,
+	);
+});
+
+test("TEST-08 REQ-33 GitHub case is equivalent but paths and other URLs are exact", () => {
+	expect(sameSource("Acme/Claude-Market", "acme/claude-market")).toBe(true);
+	expect(
+		sameSource(
+			normaliseSource("https://github.com/Acme/Market.git"),
+			normaliseSource("git@github.com:acme/market.git"),
+		),
+	).toBe(true);
+	f = new MarketFixture();
+	expect(sameSource(join(f.root, "Repo"), join(f.root, "repo"))).toBe(false);
+	expect(
+		sameSource(
+			"https://git.example.invalid/Team/Repo",
+			"https://git.example.invalid/team/repo",
+		),
+	).toBe(false);
+});
+
+test("TEST-09 REQ-5 a trusted name must match the registered source", () => {
+	const list = {
+		schema: 1,
+		marketplaces: { acme: { source: "acme/market", via: "connect" as const } },
+	};
+	expect(isTrustedIn(list, "acme", "Acme/Market")).toBe(true);
+	expect(isTrustedIn(list, "acme", "attacker/market")).toBe(false);
+	expect(isTrustedIn(list, "other", "acme/market")).toBe(false);
+	expect(isTrustedIn(list, "acme", null)).toBe(false);
+});
+
+test.each([
+	{ marker: true, trust: false, sourceMatches: true, company: false },
+	{ marker: false, trust: true, sourceMatches: true, company: false },
+	{ marker: true, trust: true, sourceMatches: false, company: false },
+	{ marker: true, trust: true, sourceMatches: true, company: true },
+])(
+	"TEST-09 REQ-5 REQ-28 company identity is marker AND source-bound trust: %j",
+	({ marker, trust, sourceMatches, company }) => {
+		f = new MarketFixture(true);
+		const repo = f.seed({ marker });
+		f.register(repo, { trust });
+		if (!sourceMatches)
+			writeJson(join(f.config, "magus-market", "trusted.json"), {
+				schema: 1,
+				marketplaces: { acme: { source: "different/market", via: "connect" } },
+			});
+		const before = f.snapshot();
+
+		const companies = f.value<Array<{ name: string }>>(
+			`const m = await import(${JSON.stringify(sourceModule("services/market-registry.js"))}); console.log(JSON.stringify(await m.listCompanyMarketplaces()));`,
+		);
+
+		expect(companies.map((m) => m.name)).toEqual(company ? ["acme"] : []);
+		expect(f.snapshot()).toEqual(before);
+		expect(f.journal()).toEqual([]);
+		f.assertOwned();
+	},
+	30_000,
+);

package/src/__tests__/market-install.test.ts

@@ -0,0 +1,143 @@
+import { afterEach, expect, test } from "bun:test";
+import { join } from "node:path";
+import {
+	ID,
+	MANIFEST,
+	MarketFixture,
+	PLUGIN_MANIFEST,
+	readJson,
+	sourceModule,
+	writeJson,
+} from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+function advance(scopes: string[], target = "0.3.2") {
+	return f!.value<{
+		outcome: string;
+		loaded: string | null;
+		installs: Array<{
+			scope: string;
+			status: string;
+			to: string | null;
+			loaded: string | null;
+			fix?: string;
+			message?: string;
+		}>;
+	}>(
+		`const m = await import(${JSON.stringify(sourceModule("services/market-install.js"))}); console.log(JSON.stringify(await m.advanceViaCli(${JSON.stringify(ID)}, ${JSON.stringify(scopes)}, ${JSON.stringify(f!.project)}, ${JSON.stringify(target)})));`,
+	);
+}
+function bumpClone() {
+	const repo = f!.seed();
+	f!.register(repo);
+	return {
+		repo,
+		bump() {
+			const manifest = readJson(join(repo.author, MANIFEST));
+			manifest.plugins[0].version = "0.3.2";
+			writeJson(join(repo.author, MANIFEST), manifest);
+			const plugin = readJson(join(repo.author, PLUGIN_MANIFEST));
+			plugin.version = "0.3.2";
+			writeJson(join(repo.author, PLUGIN_MANIFEST), plugin);
+			f!.push(repo);
+			f!.git(f!.clone(repo), "pull", "--ff-only");
+		},
+	};
+}
+
+test.each([
+	{ order: ["user", "project"] as const },
+	{ order: ["project", "user"] as const },
+])(
+	"TEST-14 REQ-14 both registry orders converge after every scope moves: %j",
+	({ order }) => {
+		f = new MarketFixture();
+		const { bump } = bumpClone();
+		for (const scope of order) f.install(ID, scope);
+		bump();
+
+		const r = advance(["user", "project"]);
+
+		expect(r.outcome).toBe("ok");
+		expect(r.loaded).toBe("0.3.2");
+		expect(
+			r.installs.map((row) => ({
+				scope: row.scope,
+				status: row.status,
+				to: row.to,
+				loaded: row.loaded,
+			})),
+		).toEqual([
+			{ scope: "user", status: "updated", to: "0.3.2", loaded: "0.3.2" },
+			{ scope: "project", status: "updated", to: "0.3.2", loaded: "0.3.2" },
+		]);
+		f.assertOwned();
+	},
+	60_000,
+);
+test("TEST-14 REQ-14 a missing row becomes an installed row at the requested cwd", () => {
+	f = new MarketFixture();
+	const { bump } = bumpClone();
+	bump();
+
+	const r = advance(["project"]);
+
+	expect(r.outcome).toBe("ok");
+	expect(f.version(ID, "project")).toBe("0.3.2");
+	f.assertOwned();
+}, 30_000);
+test("TEST-14 REQ-14 a misdirected update fails its own row even when another row moved", () => {
+	f = new MarketFixture();
+	const { bump } = bumpClone();
+	const other = join(f.root, "other-checkout");
+	f.git(f.project, "worktree", "add", "-b", "other", other);
+	f.install(ID, "project", other);
+	f.install(ID, "project");
+	bump();
+	f.setModes({ misdirect: true });
+
+	const r = advance(["project"]);
+
+	expect(r.outcome).toBe("partial");
+	expect(r.installs[0]?.status).toBe("failed");
+	expect(r.installs[0]?.fix).toContain("magus update");
+	expect(f.version(ID, "project")).toBe("0.3.1");
+	f.assertOwned();
+}, 60_000);
+test("TEST-14 REQ-14 a moved row with an older effective loader is partial", () => {
+	f = new MarketFixture();
+	const { bump } = bumpClone();
+	const other = join(f.root, "other-checkout");
+	f.git(f.project, "worktree", "add", "-b", "other", other);
+	f.install(ID, "project", other);
+	f.install(ID, "project");
+	bump();
+
+	const r = advance(["project"]);
+
+	expect(r.installs[0]?.status).toBe("updated");
+	expect(r.loaded).toBe("0.3.1");
+	expect(r.outcome).toBe("partial");
+	expect(r.installs[0]?.loaded).toBe("0.3.1");
+	expect(f.version(ID, "project", other)).toBe("0.3.1");
+	f.assertOwned();
+}, 60_000);
+test("TEST-14 REQ-14 not-found errors stay failures without registry recovery", () => {
+	f = new MarketFixture();
+	const { bump } = bumpClone();
+	f.install();
+	bump();
+	f.setModes({ failInstall: "Plugin not found in marketplace" });
+
+	const r = advance(["user"]);
+
+	expect(r.outcome).toBe("partial");
+	expect(r.installs[0]?.status).toBe("failed");
+	expect(r.installs[0]?.fix).toContain("magus update");
+	expect(f.version()).toBe("0.3.1");
+	f.assertOwned();
+}, 30_000);

package/src/__tests__/market-layout.test.ts

@@ -0,0 +1,206 @@
+import { describe, expect, test } from "bun:test";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+	type OwnerCandidate,
+	addPluginEntry,
+	compareSkillTrees,
+	currentVersion,
+	excludedByShape,
+	findSkillOwners,
+	inDomain,
+	nextVersion,
+	pluginDirFor,
+	pluginRelDir,
+	removePluginEntry,
+	sameFiles,
+	setEntryVersion,
+	treeHash,
+	validPackageName,
+	validSkillName,
+} from "../services/market-layout.js";
+
+describe("marketplace layout and versions", () => {
+	test.each([
+		[{ version: "1.2.3" }, {}, "1.2.3", "1.2.4"],
+		[{}, { version: "2.3.4" }, "2.3.4", "2.3.5"],
+		[{ version: "3.0.9" }, { version: "9.0.0" }, "3.0.9", "3.0.10"],
+		[{}, {}, null, "0.0.1"],
+		[null, null, null, "0.0.1"],
+	] as const)(
+		"TEST-01 REQ-12 uses plugin then entry version: %j / %j",
+		(plugin, entry, current, next) => {
+			expect(currentVersion(plugin, entry)).toBe(current);
+			expect(nextVersion(current)).toBe(next);
+		},
+	);
+	test.each(["1", "1.2", "v1.2.3", "1.2.3-beta", "invalid"])(
+		"TEST-01 REQ-12 does not guess a patch for %s",
+		(value) => expect(nextVersion(value)).toBeNull(),
+	);
+	test("TEST-01 REQ-12 changes manifest entries without mutating their input", () => {
+		const original = {
+			name: "acme",
+			metadata: { description: "Team" },
+			plugins: [{ name: "kit", source: "./kit", version: "1.0.0" }],
+		};
+		const before = JSON.stringify(original);
+
+		const updated = setEntryVersion(original, "kit", "1.0.1");
+		const added = addPluginEntry(original, {
+			name: "other",
+			source: "./other",
+		});
+		const removed = removePluginEntry(original, "kit");
+
+		expect(updated.plugins).toEqual([
+			{ name: "kit", source: "./kit", version: "1.0.1" },
+		]);
+		expect(added.plugins).toHaveLength(2);
+		expect(removed.plugins).toEqual([]);
+		expect(JSON.stringify(original)).toBe(before);
+	});
+	test.each([
+		["./plugins/kit", undefined, "plugins/kit"],
+		["kit", "./plugins", "plugins/kit"],
+		["kit", "plugins", "plugins/kit"],
+		[".", undefined, ""],
+		["./nested/../kit", undefined, "kit"],
+		["kit", undefined, null],
+		["plugins/kit", undefined, null],
+		["../outside", undefined, null],
+		["kit", "../outside", null],
+		[{ source: "github", repo: "someone/kit" }, undefined, null],
+		["https://example.invalid/kit.git", undefined, null],
+	] as const)(
+		"TEST-02 REQ-35 resolves source %j with pluginRoot %j",
+		(source, pluginRoot, expected) => {
+			const root = join(tmpdir(), "marketplace-root");
+			expect(pluginRelDir(source, pluginRoot)).toBe(expected);
+			expect(pluginDirFor(root, source, pluginRoot)).toBe(
+				expected === null ? null : join(root, expected),
+			);
+		},
+	);
+	test("TEST-02 REQ-35 rejects an absolute source even when it is below the root", () => {
+		const root = join(tmpdir(), "marketplace-root");
+		expect(pluginDirFor(root, join(root, "kit"))).toBeNull();
+	});
+	test.each(["kit", "review-kit", "acme1"])(
+		"TEST-03 REQ-21 accepts package name %s",
+		(name) => {
+			expect(validPackageName(name)).toBe(true);
+			expect(validSkillName(name)).toBe(true);
+		},
+	);
+	test.each(["", ".", "..", "../review", "a/b", "a/../../review"])(
+		"TEST-03 REQ-21 rejects traversal name %j",
+		(name) => {
+			expect(validPackageName(name)).toBe(false);
+			expect(validSkillName(name)).toBe(false);
+		},
+	);
+});
+
+describe("skill ownership and comparisons", () => {
+	test("TEST-04 REQ-25 returns both owners and excludes external plugin sources", () => {
+		const candidates: OwnerCandidate[] = [
+			{
+				marketplace: "acme",
+				plugins: [
+					{ name: "kit", dir: "plugins/kit" },
+					{ name: "external", dir: null },
+				],
+				paths: new Set([
+					"plugins/kit/skills/review/SKILL.md",
+					"skills/review/SKILL.md",
+				]),
+			},
+			{
+				marketplace: "beta",
+				plugins: [{ name: "root-kit", dir: "" }],
+				paths: new Set(["skills/review/SKILL.md"]),
+			},
+		];
+		expect(findSkillOwners(candidates, "review").sort()).toEqual([
+			"kit@acme",
+			"root-kit@beta",
+		]);
+		expect(findSkillOwners(candidates, "missing")).toEqual([]);
+	});
+	test.each([
+		[null, "a", "a", "same"],
+		["old", "a", "a", "same"],
+		["a", "a", "a", "same"],
+		["a", "b", "a", "plugin-newer"],
+		["a", "a", "b", "fast"],
+		[null, "a", "b", "no-base"],
+		["a", "b", "c", "conflict"],
+	] as const)(
+		"TEST-05 REQ-11 compares base=%s theirs=%s ours=%s as %s",
+		(base, theirs, ours, state) => {
+			expect(compareSkillTrees(base, theirs, ours)).toBe(state);
+		},
+	);
+	test("TEST-05 REQ-30 file hashes ignore order but distinguish path, deletion and bytes", () => {
+		const a = [
+			{ path: "SKILL.md", oid: "a".repeat(40) },
+			{ path: "notes.md", oid: "b".repeat(40) },
+		];
+		const before = JSON.stringify(a);
+
+		expect(sameFiles(a, [...a].reverse())).toBe(true);
+		expect(treeHash(a)).toBe(treeHash([...a].reverse()));
+		expect(sameFiles(a, a.slice(0, 1))).toBe(false);
+		expect(treeHash(a)).not.toBe(
+			treeHash([{ ...a[0]!, oid: "c".repeat(40) }, a[1]!]),
+		);
+		expect(treeHash(a)).not.toBe(
+			treeHash([{ ...a[0]!, path: "renamed.md" }, a[1]!]),
+		);
+		expect(JSON.stringify(a)).toBe(before);
+	});
+	test.each([
+		["SKILL.md", false, null],
+		["references/rules.md", false, null],
+		[".env", false, "dotfile"],
+		["deep/.private/x", false, "dotfile"],
+		["node_modules/a/x", false, "node_modules"],
+		["deep/node_modules/a/x", false, "node_modules"],
+		["link.md", true, "symlink"],
+	] as const)("TEST-06 REQ-21 excludes %s by shape", (path, link, reason) => {
+		expect(excludedByShape(path, link)).toBe(reason);
+		expect(
+			inDomain(path, link ? "120000" : "100644", new Set(), new Set()),
+		).toBe(reason === null);
+	});
+	test("TEST-06 REQ-30 applies identical exclusions to files absent on one side", () => {
+		const base = [
+			{ path: "SKILL.md", oid: "a".repeat(40) },
+			{ path: ".gitkeep", oid: "b".repeat(40) },
+			{ path: "ignored.md", oid: "c".repeat(40) },
+			{ path: "destination.tmp", oid: "d".repeat(40) },
+		];
+		const filter = (paths: typeof base) =>
+			paths.filter((file) =>
+				inDomain(
+					file.path,
+					"100644",
+					new Set(["ignored.md"]),
+					new Set(["destination.tmp"]),
+				),
+			);
+		const ours = base.slice(0, 1);
+		expect(
+			compareSkillTrees(
+				treeHash(filter(base)),
+				treeHash(filter(base)),
+				treeHash(filter(ours)),
+			),
+		).toBe("same");
+		expect(inDomain("references/link", "120000", new Set(), new Set())).toBe(
+			false,
+		);
+		expect(inDomain("run.sh", "100755", new Set(), new Set())).toBe(true);
+	});
+});