multimodel-dev-os 3.0.1 → 3.2.0

package/tests/fixtures/proposals/no-operations.md

@@ -0,0 +1,18 @@
+---
+id: proposal-20260611-333333
+created_at: 2026-06-11T33:33:33Z
+title: No Operations Proposal
+problem: Vague proposal without machine readable block.
+evidence: N/A
+risk_level: low
+affected_files:
+  - README.md
+suggested_change: Edit README.md manually.
+verify_command: npm run verify
+rollback_plan: git checkout -- README.md
+approval_status: approved
+---
+
+# No Operations Proposal
+
+Please edit the README.md to describe the codebase in more detail.

package/tests/fixtures/proposals/path-traversal.md

@@ -0,0 +1,29 @@
+---
+id: proposal-20260611-000003
+created_at: 2026-06-11T00:00:03Z
+title: Path Traversal Proposal
+problem: Test directory traversal boundaries check.
+evidence: N/A
+risk_level: low
+affected_files:
+  - ../outside.md
+suggested_change: Modify file outside root.
+verify_command: npm run verify
+rollback_plan: N/A
+approval_status: approved
+---
+
+# Path Traversal Proposal
+
+```json
+{
+  "operations": [
+    {
+      "type": "create_file",
+      "path": "../outside-file.md",
+      "content": "outside content\n",
+      "overwrite": true
+    }
+  ]
+}
+```

package/tests/fixtures/proposals/pending-proposal.md

@@ -0,0 +1,29 @@
+---
+id: proposal-20260611-111111
+created_at: 2026-06-11T11:11:11Z
+title: Pending Proposal
+problem: Test pending proposal.
+evidence: N/A
+risk_level: low
+affected_files:
+  - tests/fixtures/custom-template-example/pending.md
+suggested_change: Create pending file.
+verify_command: npm run verify
+rollback_plan: rm tests/fixtures/custom-template-example/pending.md
+approval_status: pending
+---
+
+# Pending Proposal
+
+```json
+{
+  "operations": [
+    {
+      "type": "create_file",
+      "path": "tests/fixtures/custom-template-example/pending.md",
+      "content": "pending\n",
+      "overwrite": true
+    }
+  ]
+}
+```

package/tests/fixtures/proposals/protected-path.md

@@ -0,0 +1,29 @@
+---
+id: proposal-20260611-222222
+created_at: 2026-06-11T22:22:22Z
+title: Protected Path Proposal
+problem: Try to modify protected path.
+evidence: N/A
+risk_level: low
+affected_files:
+  - .env
+suggested_change: Modify .env file.
+verify_command: npm run verify
+rollback_plan: git checkout -- .env
+approval_status: approved
+---
+
+# Protected Path Proposal
+
+```json
+{
+  "operations": [
+    {
+      "type": "create_file",
+      "path": ".env",
+      "content": "SECRET_KEY=stolen\n",
+      "overwrite": true
+    }
+  ]
+}
+```

package/tests/fixtures/proposals/replace-multiple-without-allow.md

@@ -0,0 +1,30 @@
+---
+id: proposal-20260611-000005
+created_at: 2026-06-11T00:00:05Z
+title: Replace Multiple Without Allow Proposal
+problem: Test replace text matching multiple times without allow_multiple.
+evidence: N/A
+risk_level: low
+affected_files:
+  - tests/fixtures/custom-template-example/multiple.md
+suggested_change: Replace multiple occurrences without allow_multiple flag.
+verify_command: npm run verify
+rollback_plan: N/A
+approval_status: approved
+---
+
+# Replace Multiple Without Allow Proposal
+
+```json
+{
+  "operations": [
+    {
+      "type": "replace_text",
+      "path": "tests/fixtures/custom-template-example/multiple.md",
+      "find": "target",
+      "replace": "replaced",
+      "allow_multiple": false
+    }
+  ]
+}
+```

package/tests/fixtures/registry-overrides/README.md

@@ -0,0 +1,20 @@
+# Registry Overrides Test Fixture Guide
+
+This fixture folder demonstrates and validates overriding the default model/adapter/template registries using custom YAML files and the `--registry` flag.
+
+## Files Structure
+
+For testing registry overrides, you can specify custom templates/adapters files:
+
+* `custom-templates.yaml`: Defines mock template profiles.
+* `custom-adapters.yaml`: Defines mock adapters setup.
+
+## Usage in Testing
+
+```bash
+# List templates from the custom templates fixture file
+node bin/multimodel-dev-os.js templates --registry tests/fixtures/registry-overrides/custom-templates.yaml
+
+# Run validations on a custom template entry
+node bin/multimodel-dev-os.js validate-template my-mock-template --registry tests/fixtures/registry-overrides/custom-templates.yaml
+```

package/tests/smoke/README.md

@@ -0,0 +1,37 @@
+# Smoke Tests Playbook
+
+Follow these quick manual verification commands to assert the functional integrity of `multimodel-dev-os` before pushing tag releases.
+
+---
+
+## 1. Quick Verification Pipeline
+
+Run the following actions sequentially inside a target sandbox:
+
+```bash
+# 1. Inspect version parameters and command menu
+node bin/multimodel-dev-os.js --help
+
+# 2. View all built-in configurations
+node bin/multimodel-dev-os.js templates
+
+# 3. Inspect a specific template's specifications
+node bin/multimodel-dev-os.js show-template nextjs-saas
+
+# 4. Dry-run scaffold inside the current repository
+node bin/multimodel-dev-os.js init --template general-app --dry-run
+
+# 5. Execute strict validation lints
+node bin/multimodel-dev-os.js validate --target .
+
+# 6. Execute diagnostic doctor checkups
+node bin/multimodel-dev-os.js doctor --target .
+```
+
+---
+
+## 2. Dry-Run Verification
+
+Assert that no physical files are created when running the `--dry-run` parameter:
+- Verify stdout logs indicate `[DRY-RUN] Would create...`
+- Confirm `git status` reports zero untracked files or modifications.

package/tests/smoke/cli-smoke.md

@@ -0,0 +1,49 @@
+# CLI Smoke Test Specification
+
+This document lists the essential CLI commands to execute when verifying the MultiModel Dev OS installation stability.
+
+## Sanity Commands
+
+```bash
+# Verify help output
+node bin/multimodel-dev-os.js --help
+
+# List templates
+node bin/multimodel-dev-os.js templates
+node bin/multimodel-dev-os.js templates --json
+
+# List models and adapters
+node bin/multimodel-dev-os.js models --json
+node bin/multimodel-dev-os.js adapters --json
+
+# List active skills
+node bin/multimodel-dev-os.js skills
+```
+
+## Validation & Doctor Commands
+
+```bash
+# Validate built-in resources
+node bin/multimodel-dev-os.js validate-template nextjs-saas
+node bin/multimodel-dev-os.js validate-adapter cursor
+node bin/multimodel-dev-os.js validate-skill custom-skill.example
+
+# Validate all registry entries
+node bin/multimodel-dev-os.js validate --all-registries
+
+# Release advisory checkup
+node bin/multimodel-dev-os.js doctor --release
+
+# Token budget checks
+node bin/multimodel-dev-os.js doctor --tokens --threshold 100KB
+```
+
+## Initialization Dry-Runs
+
+```bash
+# Dry-run general app init
+node bin/multimodel-dev-os.js init --dry-run --template general-app
+
+# Dry-run with adapter injections
+node bin/multimodel-dev-os.js init --dry-run --template nextjs-saas -a cursor -a claude
+```

package/tests/unit/build-output.test.js

@@ -0,0 +1,40 @@
+import { describe, it, expect } from 'vitest';
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { execSync } from 'child_process';
+
+describe('Build Output Verification', () => {
+  const buildPath = join(process.cwd(), 'bin', 'multimodel-dev-os.js');
+
+  it('should compile the output file successfully', () => {
+    expect(existsSync(buildPath)).toBe(true);
+  });
+
+  it('should contain exactly one shebang at the top', () => {
+    const content = readFileSync(buildPath, 'utf8');
+    const totalShebangs = (content.match(/#!/g) || []).length;
+    
+    expect(content.startsWith('#!/usr/bin/env node')).toBe(true);
+    expect(totalShebangs).toBe(1);
+  });
+
+  it('should contain the generation warning header', () => {
+    const content = readFileSync(buildPath, 'utf8');
+    expect(content).toContain('// Generated from src/. Do not edit directly.');
+  });
+
+  it('should not contain dangerous registry URL interpolation', () => {
+    const content = readFileSync(buildPath, 'utf8');
+    
+    const hasUnsafeSync = content.includes("mod.get('${targetUrl}'") || (content.includes('execSync(`node -e "') && content.includes('${targetUrl}'));
+    expect(hasUnsafeSync).toBe(false);
+    
+    expect(content).toContain('execFileSync(process.execPath');
+  });
+
+  it('should be completely fresh and match the source modules', () => {
+    expect(() => {
+      execSync('node scripts/check-build-fresh.js', { stdio: 'ignore' });
+    }).not.toThrow();
+  });
+});

package/tests/unit/catalog-loader.test.js

@@ -0,0 +1,44 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { loadCatalogFromSource, loadCatalog } from '../../src/catalog/loader.js';
+import { existsSync, mkdirSync, writeFileSync, rmSync } from 'fs';
+import { join } from 'path';
+
+describe('Catalog Loader', () => {
+  const tempDir = join(process.cwd(), 'temp-catalog-test');
+  const localCatalogDir = join(tempDir, '.ai', 'plugins');
+  const localCatalogFile = join(localCatalogDir, 'catalog.yaml');
+
+  beforeAll(() => {
+    mkdirSync(localCatalogDir, { recursive: true });
+  });
+
+  afterAll(() => {
+    if (existsSync(tempDir)) {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it('should load bundled catalog from fallback or global if no target is specified', () => {
+    const catalog = loadCatalog();
+    expect(catalog).toBeDefined();
+    expect(Array.isArray(catalog.plugins)).toBe(true);
+  });
+
+  it('should load local catalog when source is "local"', () => {
+    const localYaml = `
+catalog:
+  plugins:
+    - name: local-plugin
+      slug: local-slug
+      version: 1.0.0
+      description: local test
+      author: test
+    `;
+    writeFileSync(localCatalogFile, localYaml, 'utf8');
+
+    const result = loadCatalogFromSource('local', { target: tempDir });
+    expect(result.plugins).toHaveLength(1);
+    expect(result.plugins[0].name).toBe('local-plugin');
+    expect(result.plugins[0]._source).toBe('local');
+  });
+});

package/tests/unit/path-safety.test.js

@@ -0,0 +1,62 @@
+import { describe, it, expect } from 'vitest';
+import { isSafePath, shouldIgnorePath } from '../../src/core/security.js';
+
+describe('Path Safety and Ignore Engine', () => {
+  describe('isSafePath', () => {
+    const policy = {
+      allowed_write_roots: ['.ai/', 'adapters/'],
+      blocked_paths: ['.env', '.npmrc', '.git/', 'node_modules/', 'package.json', 'package-lock.json']
+    };
+
+    it('should allow paths under allowed write roots', () => {
+      expect(isSafePath('.ai/plugins/my-plugin.yaml', policy)).toBe(true);
+      expect(isSafePath('adapters/vscode/settings.json', policy)).toBe(true);
+    });
+
+    it('should reject paths outside allowed write roots', () => {
+      expect(isSafePath('src/cli/main.js', policy)).toBe(false);
+      expect(isSafePath('index.js', policy)).toBe(false);
+    });
+
+    it('should reject paths with directory traversal', () => {
+      expect(isSafePath('.ai/plugins/../../index.js', policy)).toBe(false);
+      expect(isSafePath('adapters/../package.json', policy)).toBe(false);
+    });
+
+    it('should reject absolute paths', () => {
+      expect(isSafePath('/etc/passwd', policy)).toBe(false);
+      expect(isSafePath('C:/Windows/System32', policy)).toBe(false);
+    });
+
+    it('should reject blacklisted paths', () => {
+      expect(isSafePath('.ai/plugins/.env', policy)).toBe(false);
+      expect(isSafePath('adapters/.npmrc', policy)).toBe(false);
+      expect(isSafePath('adapters/node_modules/foo', policy)).toBe(false);
+    });
+  });
+
+  describe('shouldIgnorePath', () => {
+    it('should ignore dependency and git folders', () => {
+      expect(shouldIgnorePath('node_modules/lodash/index.js')).toBe(true);
+      expect(shouldIgnorePath('.git/config')).toBe(true);
+      expect(shouldIgnorePath('dist/bundle.js')).toBe(true);
+    });
+
+    it('should ignore generated runtime memory files', () => {
+      expect(shouldIgnorePath('.ai/intelligence/memory.hash.json')).toBe(true);
+      expect(shouldIgnorePath('.ai/intelligence/feedback-log.jsonl')).toBe(true);
+    });
+
+    it('should ignore credential and secret files', () => {
+      expect(shouldIgnorePath('.env')).toBe(true);
+      expect(shouldIgnorePath('src/.env.production')).toBe(true);
+      expect(shouldIgnorePath('key.pem')).toBe(true);
+      expect(shouldIgnorePath('id_rsa')).toBe(true);
+    });
+
+    it('should not ignore standard application source files', () => {
+      expect(shouldIgnorePath('src/core/yaml.js')).toBe(false);
+      expect(shouldIgnorePath('README.md')).toBe(false);
+    });
+  });
+});

package/tests/unit/plugin-manifest.test.js

@@ -0,0 +1,94 @@
+import { describe, it, expect } from 'vitest';
+import { validatePluginManifest } from '../../src/plugin/manifest.js';
+
+describe('Plugin Manifest Validator', () => {
+  it('should accept a completely valid plugin manifest', () => {
+    const manifest = {
+      name: 'My Test Plugin',
+      slug: 'my-test-plugin',
+      version: '1.0.0',
+      description: 'A valid test plugin description',
+      author: 'Tester',
+      allowed_file_patterns: ['.ai/plugins/config.yaml', 'adapters/vscode/settings.json']
+    };
+
+    const result = validatePluginManifest(manifest);
+    expect(result.success).toBe(true);
+    expect(result.errors).toHaveLength(0);
+  });
+
+  it('should reject missing metadata keys', () => {
+    const manifest = {
+      name: 'My Test Plugin',
+      version: '1.0.0',
+      description: 'A description',
+      author: 'Tester'
+      // slug is missing
+    };
+
+    const result = validatePluginManifest(manifest);
+    expect(result.success).toBe(false);
+    expect(result.errors).toContain('Missing required key: slug');
+  });
+
+  it('should reject invalid slug formats', () => {
+    const manifest = {
+      name: 'My Test Plugin',
+      slug: 'invalid slug here',
+      version: '1.0.0',
+      description: 'A description',
+      author: 'Tester'
+    };
+
+    const result = validatePluginManifest(manifest);
+    expect(result.success).toBe(false);
+    expect(result.errors).toContain("Key 'slug' must be alphanumeric with dashes or underscores only");
+  });
+
+  it('should reject patterns writing outside allowed write roots', () => {
+    const manifest = {
+      name: 'My Test Plugin',
+      slug: 'my-test-plugin',
+      version: '1.0.0',
+      description: 'A description',
+      author: 'Tester',
+      allowed_file_patterns: ['src/cli/main.js'] // not in .ai/ or adapters/
+    };
+
+    const result = validatePluginManifest(manifest);
+    expect(result.success).toBe(false);
+    expect(result.errors[0]).toContain('violates safety boundaries');
+  });
+
+  it('should reject patterns containing traversal or leading slash', () => {
+    const manifest = {
+      name: 'My Test Plugin',
+      slug: 'my-test-plugin',
+      version: '1.0.0',
+      description: 'A description',
+      author: 'Tester',
+      allowed_file_patterns: ['.ai/plugins/../../index.js', '/.ai/plugins/test.yaml']
+    };
+
+    const result = validatePluginManifest(manifest);
+    expect(result.success).toBe(false);
+    expect(result.errors).toHaveLength(2);
+    expect(result.errors[0]).toContain('violates safety boundaries');
+    expect(result.errors[1]).toContain('violates safety boundaries');
+  });
+
+  it('should reject patterns containing blacklisted files', () => {
+    const manifest = {
+      name: 'My Test Plugin',
+      slug: 'my-test-plugin',
+      version: '1.0.0',
+      description: 'A description',
+      author: 'Tester',
+      allowed_file_patterns: ['.ai/plugins/.env', 'adapters/package.json']
+    };
+
+    const result = validatePluginManifest(manifest);
+    expect(result.success).toBe(false);
+    expect(result.errors).toHaveLength(2);
+  });
+});

package/tests/unit/prepublish-guard.test.js

@@ -0,0 +1,35 @@
+import { describe, it, expect } from 'vitest';
+import { execSync } from 'child_process';
+import { join } from 'path';
+
+describe('Prepublish Guard', () => {
+  const guardPath = join(process.cwd(), 'scripts', 'prepublish-guard.js');
+
+  it('should block publish when MMDO_ALLOW_PUBLISH is not set', () => {
+    try {
+      execSync(`node "${guardPath}"`, {
+        stdio: 'pipe',
+        env: {
+          ...process.env,
+          MMDO_ALLOW_PUBLISH: 'false' // explicitly set to false to override any ambient env
+        }
+      });
+      throw new Error('Prepublish guard did not block the publish.');
+    } catch (err) {
+      expect(err.status).toBe(1);
+      expect(err.stderr.toString()).toContain('Publishing requires explicit release approval');
+    }
+  });
+
+  it('should allow publish when MMDO_ALLOW_PUBLISH=true for stable version >= 2', () => {
+    const output = execSync(`node "${guardPath}"`, {
+      env: {
+        ...process.env,
+        MMDO_ALLOW_PUBLISH: 'true',
+        MMDO_ALLOW_PRERELEASE_PUBLISH: undefined
+      },
+      encoding: 'utf8'
+    });
+    expect(output).toContain('Prepublish guard passed');
+  });
+});

package/tests/unit/registry-policy.test.js

@@ -0,0 +1,46 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { loadRegistryPolicy } from '../../src/core/policy.js';
+import { existsSync, mkdirSync, writeFileSync, rmSync } from 'fs';
+import { join } from 'path';
+
+describe('Registry Policy Engine', () => {
+  const tempDir = join(process.cwd(), 'temp-policy-test');
+  const policySubdir = join(tempDir, '.ai', 'policies');
+  const policyFile = join(policySubdir, 'registry-policy.yaml');
+
+  beforeAll(() => {
+    mkdirSync(policySubdir, { recursive: true });
+  });
+
+  afterAll(() => {
+    if (existsSync(tempDir)) {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it('should load default policy fields if no file is found', () => {
+    const policy = loadRegistryPolicy('non-existent-directory-random-path');
+    expect(policy.allow_remote_registries).toBe(false);
+    expect(policy.allow_http_localhost).toBe(false);
+    expect(policy.require_checksum).toBe(true);
+    expect(policy.allowed_write_roots).toEqual(['.ai/', 'adapters/']);
+  });
+
+  it('should override default fields with written policy configurations', () => {
+    const yamlConfig = `
+allow_remote_registries: true
+allow_http_localhost: true
+require_checksum: false
+max_plugin_files: 50
+    `;
+    writeFileSync(policyFile, yamlConfig, 'utf8');
+
+    const policy = loadRegistryPolicy(tempDir);
+    expect(policy.allow_remote_registries).toBe(true);
+    expect(policy.allow_http_localhost).toBe(true);
+    expect(policy.require_checksum).toBe(false);
+    expect(policy.max_plugin_files).toBe(50);
+    // Unspecified fields should keep defaults
+    expect(policy.max_registry_cache_size_kb).toBe(512);
+  });
+});

package/tests/unit/registry-url-validation.test.js

@@ -0,0 +1,64 @@
+import { describe, it, expect } from 'vitest';
+import { validateRegistryUrl } from '../../src/registry/validation.js';
+
+describe('Registry URL Validation', () => {
+  it('should accept valid HTTPS URLs', () => {
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml')).not.toThrow();
+    expect(() => validateRegistryUrl('https://raw.githubusercontent.com/user/repo/main/catalog.yaml')).not.toThrow();
+  });
+
+  it('should reject empty or non-string URLs', () => {
+    expect(() => validateRegistryUrl(null)).toThrow('Registry URL must be a non-empty string.');
+    expect(() => validateRegistryUrl('')).toThrow('Registry URL must be a non-empty string.');
+    expect(() => validateRegistryUrl(123)).toThrow('Registry URL must be a non-empty string.');
+  });
+
+  it('should reject URLs with whitespace or control characters', () => {
+    expect(() => validateRegistryUrl('https://example.com/cat alog.yaml')).toThrow('whitespace or control characters');
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml\n')).toThrow('whitespace or control characters');
+  });
+
+  it('should reject URLs containing quotes or backticks', () => {
+    expect(() => validateRegistryUrl("https://example.com/catalog.yaml'")).toThrow('quotes or backticks');
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml"')).toThrow('quotes or backticks');
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml`')).toThrow('quotes or backticks');
+  });
+
+  it('should reject URLs containing shell metacharacters', () => {
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml;echo')).toThrow('shell metacharacters');
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml&foo')).toThrow('shell metacharacters');
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml$foo')).toThrow('shell metacharacters');
+  });
+
+  it('should reject malformed URLs', () => {
+    expect(() => validateRegistryUrl('not-a-url')).toThrow('malformed or invalid');
+  });
+
+  it('should reject URLs containing credentials', () => {
+    expect(() => validateRegistryUrl('https://user:password@example.com/catalog.yaml')).toThrow('credentials');
+    expect(() => validateRegistryUrl('https://user@example.com/catalog.yaml')).toThrow('credentials');
+  });
+
+  it('should reject non-HTTPS remote URLs by default', () => {
+    expect(() => validateRegistryUrl('http://example.com/catalog.yaml')).toThrow('Only HTTPS is permitted');
+    expect(() => validateRegistryUrl('ftp://example.com/catalog.yaml')).toThrow('Only HTTPS is permitted');
+  });
+
+  describe('Localhost HTTP Allowance', () => {
+    it('should reject HTTP localhost by default', () => {
+      expect(() => validateRegistryUrl('http://localhost/catalog.yaml')).toThrow('Only HTTPS is permitted');
+      expect(() => validateRegistryUrl('http://127.0.0.1/catalog.yaml')).toThrow('Only HTTPS is permitted');
+    });
+
+    it('should allow HTTP localhost if policy explicitly allows it', () => {
+      const policy = { allow_http_localhost: true };
+      expect(() => validateRegistryUrl('http://localhost/catalog.yaml', policy)).not.toThrow();
+      expect(() => validateRegistryUrl('http://127.0.0.1/catalog.yaml', policy)).not.toThrow();
+    });
+
+    it('should still reject HTTP non-localhost even if policy allows HTTP localhost', () => {
+      const policy = { allow_http_localhost: true };
+      expect(() => validateRegistryUrl('http://example.com/catalog.yaml', policy)).toThrow('Only HTTPS is permitted');
+    });
+  });
+});