muse-crew 0.7.19 → 0.8.0

package/lib/test-publish-preflight.sh

@@ -0,0 +1,210 @@
+#!/usr/bin/env bash
+# test-publish-preflight.sh — regression tests for the npm publish
+# capability preflight (bugfix 2026-09-17): publish-npm.sh assumed the
+# author-machine publish helper path and failed cryptically AFTER the
+# version-bump release commit when npm publish was not configured.
+#
+# Covers:
+#   - structural: the PREFLIGHT block exists in lib/publish-npm.sh
+#     (extracted by anchor), sits after env validation and before the
+#     DRY_RUN block, checks the helper with -f/-r only (never -x — the
+#     helper is invoked as `python3 <path>`), and reads no wall clock or
+#     randomness.
+#   - full-script runs against a scratch repo:
+#       * NPM_PUBLISH_PY missing -> PUBLISH_SKIPPED=no-npm-publish + the
+#         actionable line, exit 0, HEAD unchanged, status clean, no tarball
+#       * fake helper whose --check reports CREDENTIAL_MISSING=custom.npm
+#         (exit 1) -> same skip outcome, exit 0, repo untouched
+#       * fake helper whose --check reports CREDENTIAL_OK=custom.npm
+#         (exit 0) with DRY_RUN=1 -> preflight passes through to
+#         PUBLISH_DRY_RUN=1 (asserts pass-through, not the mutation)
+#       * old helper that does not know --check (usage to stderr, exit 1,
+#         no CREDENTIAL markers) with DRY_RUN=1 -> no skip (fall-through
+#         preserved: unknown is not absent)
+#   - --check probe unit test against the real helper: on the author
+#     machine this expects exit 0 and exactly CREDENTIAL_OK=custom.npm.
+#     NOTE: this case depends on the `custom.npm` credential existing in
+#     the secure vault — on a machine without it the probe correctly
+#     reports CREDENTIAL_MISSING=custom.npm (exit 1) and this case fails.
+#     That is expected outside the author machine, not a regression.
+#   - bash -n syntax check on publish-npm.sh
+#
+# Anchors: `# PREFLIGHT-ANCHOR` ... `# PREFLIGHT-END` in lib/publish-npm.sh.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PUBLISH="$SCRIPT_DIR/publish-npm.sh"
+REAL_HELPER="$HOME/workspace/skills/npm/bin/npm-publish.py"
+
+pass=0
+fail_count=0
+ok() { echo "PASS: $1"; pass=$((pass + 1)); }
+no() { echo "FAIL: $1"; fail_count=$((fail_count + 1)); }
+
+TMPBASE="$(mktemp -d)"
+trap 'rm -rf "$TMPBASE"' EXIT
+
+# --- Scratch repo (Publish's REPO_PATH must be a git checkout) ---
+SCRATCH="$TMPBASE/repo"
+git init -q -b main "$SCRATCH"
+git -C "$SCRATCH" config user.email "test@crew"
+git -C "$SCRATCH" config user.name "crew-test"
+echo x > "$SCRATCH/f.txt"
+git -C "$SCRATCH" add -A && git -C "$SCRATCH" commit -qm init
+
+# --- Fake helpers ---
+cat > "$TMPBASE/helper-ok.py" <<'EOF'
+#!/usr/bin/env python3
+import sys
+if len(sys.argv) == 2 and sys.argv[1] == "--check":
+    print("CREDENTIAL_OK=custom.npm")
+    sys.exit(0)
+sys.exit(1)
+EOF
+cat > "$TMPBASE/helper-missing-cred.py" <<'EOF'
+#!/usr/bin/env python3
+import sys
+if len(sys.argv) == 2 and sys.argv[1] == "--check":
+    print("CREDENTIAL_MISSING=custom.npm")
+    sys.exit(1)
+sys.exit(1)
+EOF
+# An old helper that predates --check: usage to stderr, exit 1, no markers.
+cat > "$TMPBASE/helper-old.py" <<'EOF'
+#!/usr/bin/env python3
+import sys
+print("Usage: helper-old.py <tarball-path>", file=sys.stderr)
+sys.exit(1)
+EOF
+
+ACTIONABLE="npm publish not configured on this machine — see docs/guide.md#npm-releases; code changes are merged, nothing was versioned or published"
+
+# --- Structural: extract the shipped preflight block by anchor ---
+BLOCK="$TMPBASE/preflight.sh"
+sed -n '/# PREFLIGHT-ANCHOR/,/# PREFLIGHT-END/p' "$PUBLISH" > "$BLOCK"
+if grep -q 'PUBLISH_SKIPPED=no-npm-publish' "$BLOCK" \
+   && grep -q 'docs/guide.md#npm-releases' "$BLOCK" \
+   && grep -q 'exit 0' "$BLOCK"; then
+  ok "extracted PREFLIGHT block from publish-npm.sh"
+else
+  no "PREFLIGHT extraction failed (anchors missing)"
+fi
+
+# The helper is invoked as `python3 <path>`: -f/-r, never -x.
+if grep -q '\[ -f "\$NPM_PUBLISH_PY" \]' "$BLOCK" \
+   && grep -q '\[ -r "\$NPM_PUBLISH_PY" \]' "$BLOCK" \
+   && ! grep -q '\[ -x "\$NPM_PUBLISH_PY" \]' "$BLOCK"; then
+  ok "preflight checks -f/-r on the helper, never -x"
+else
+  no "preflight helper checks wrong (want -f/-r, no -x)"
+fi
+
+# No wall-clock or randomness in the preflight block.
+if ! grep -Eq '\$\(date|date \+|\$RANDOM' "$BLOCK"; then
+  ok "preflight block reads no wall clock and no randomness"
+else
+  no "preflight block contains clock/randomness"
+fi
+
+# Placement: after env validation, before the DRY_RUN block.
+VALIDATE_LINE="$(grep -n 'rev-parse --git-dir' "$PUBLISH" | head -1 | cut -d: -f1)"
+ANCHOR_LINE="$(grep -n '# PREFLIGHT-ANCHOR' "$PUBLISH" | head -1 | cut -d: -f1)"
+END_LINE="$(grep -n '# PREFLIGHT-END' "$PUBLISH" | head -1 | cut -d: -f1)"
+DRYRUN_LINE="$(grep -n 'DRY_RUN:-0}' "$PUBLISH" | head -1 | cut -d: -f1)"
+if [ -n "$VALIDATE_LINE" ] && [ -n "$ANCHOR_LINE" ] && [ -n "$END_LINE" ] \
+   && [ -n "$DRYRUN_LINE" ] \
+   && [ "$VALIDATE_LINE" -lt "$ANCHOR_LINE" ] \
+   && [ "$END_LINE" -lt "$DRYRUN_LINE" ]; then
+  ok "PREFLIGHT block sits after env validation, before DRY_RUN"
+else
+  no "PREFLIGHT placement wrong (validate=$VALIDATE_LINE anchor=$ANCHOR_LINE end=$END_LINE dryrun=$DRYRUN_LINE)"
+fi
+
+# Runner: full publish-npm.sh against the scratch repo. The preflight exits
+# before any mutation, so the repo needs no package.json.
+run_full() { # run_full <helper_path> [extra_env...]
+  local helper="$1"; shift
+  local run="$TMPBASE/run-$RANDOM"
+  mkdir -p "$run"
+  (
+    export TASK_ID="preflight-test" REPO_PATH="$SCRATCH" PKG="muse-crew" TARGET_VERSION="9.9.9"
+    export NPM_PUBLISH_PY="$helper"
+    # A bare `export` (empty "$@") would dump the environment to stdout and
+    # corrupt the captured run path — only export when extras are given.
+    if [ $# -gt 0 ]; then export "$@"; fi
+    bash "$PUBLISH" > "$run/out" 2>&1
+  )
+  local code=$?
+  echo "$code" > "$run/code"
+  echo "$run"
+}
+
+repo_state() { # prints "HEAD=<sha> STATUS=<porcelain-lines> TGZ=<count>"
+  local head status tgz
+  head="$(git -C "$SCRATCH" rev-parse HEAD)"
+  status="$(git -C "$SCRATCH" status --porcelain | wc -l)"
+  tgz="$(find "$SCRATCH" -maxdepth 1 -name '*.tgz' | wc -l)"
+  echo "HEAD=$head STATUS=$status TGZ=$tgz"
+}
+
+# --- Case 1: helper missing -> clean skip, exit 0, repo untouched ---
+BEFORE="$(repo_state)"
+RUN="$(run_full /nonexistent/path.py)"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"; AFTER="$(repo_state)"
+if [ "$CODE" -eq 0 ] && [[ "$OUT" == *"PUBLISH_SKIPPED=no-npm-publish"* ]] \
+   && [[ "$OUT" == *"$ACTIONABLE"* ]] \
+   && [[ "$OUT" != *"PUBLISH_FAILED"* ]] && [[ "$OUT" != *"PUBLISH_COMPLETE"* ]] \
+   && [ "$BEFORE" = "$AFTER" ]; then
+  ok "helper missing: skips with marker + actionable line, exit 0, repo untouched"
+else
+  no "helper missing: code=$CODE state=$BEFORE/$AFTER out='$OUT'"
+fi
+
+# --- Case 2: helper present, credential missing -> same skip, repo untouched ---
+BEFORE="$(repo_state)"
+RUN="$(run_full "$TMPBASE/helper-missing-cred.py")"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"; AFTER="$(repo_state)"
+if [ "$CODE" -eq 0 ] && [[ "$OUT" == *"PUBLISH_SKIPPED=no-npm-publish"* ]] \
+   && [[ "$OUT" == *"$ACTIONABLE"* ]] \
+   && [[ "$OUT" != *"PUBLISH_FAILED"* ]] && [[ "$OUT" != *"PUBLISH_COMPLETE"* ]] \
+   && [ "$BEFORE" = "$AFTER" ]; then
+  ok "credential missing: skips with marker + actionable line, exit 0, repo untouched"
+else
+  no "credential missing: code=$CODE state=$BEFORE/$AFTER out='$OUT'"
+fi
+
+# --- Case 3: credential present + DRY_RUN=1 -> preflight passes through ---
+RUN="$(run_full "$TMPBASE/helper-ok.py" DRY_RUN=1)"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"
+if [ "$CODE" -eq 0 ] && [[ "$OUT" == *"PUBLISH_DRY_RUN=1"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]]; then
+  ok "credential present: preflight passes through to PUBLISH_DRY_RUN=1"
+else
+  no "credential present: code=$CODE out='$OUT'"
+fi
+
+# --- Case 4: old helper without --check -> no skip (fall-through) ---
+RUN="$(run_full "$TMPBASE/helper-old.py" DRY_RUN=1)"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"
+if [ "$CODE" -eq 0 ] && [[ "$OUT" == *"PUBLISH_DRY_RUN=1"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]]; then
+  ok "old helper (no --check): unknown, not absent — falls through, no skip"
+else
+  no "old helper: code=$CODE out='$OUT'"
+fi
+
+# --- Case 5: real helper --check probe (author machine: credential present) ---
+CHECK_OUT="$(python3 "$REAL_HELPER" --check 2>&1)"
+CHECK_CODE=$?
+if [ "$CHECK_CODE" -eq 0 ] && [ "$CHECK_OUT" = "CREDENTIAL_OK=custom.npm" ]; then
+  ok "real helper --check: CREDENTIAL_OK=custom.npm, exit 0, nothing else printed"
+else
+  no "real helper --check: code=$CHECK_CODE out='$CHECK_OUT' (expected CREDENTIAL_OK=custom.npm — this case is credential-dependent; see header)"
+fi
+
+bash -n "$PUBLISH" && ok "publish-npm.sh syntax OK" || no "publish-npm.sh syntax"
+
+echo ""
+echo "$pass passed, $fail_count failed"
+exit $((fail_count > 0))

package/lib/test-worktree-backend.sh

@@ -147,7 +147,57 @@ echo "$out" | grep -q '^MERGED: ' || fail "integrate-test: no MERGED line (no re
 echo "$out" | grep -q '^NO_REMOTE: ' || fail "integrate-test: no NO_REMOTE line: $out"
 "$CREW_LIB/merge-lock.sh" release "int2" >/dev/null || fail "integrate-test: lock release (no remote) failed"
 
-rm -rf "$T2" "$T3"
+# Prefix resolution (task 4e1a1bba, 2026-09-17): a Build agent created the
+# branch with raw git as task/<8-char id>, bypassing prepare, so the
+# registry is empty. resolve-branch must find it by id-prefix enumeration;
+# inspect/integrate/cleanup must operate on the real branch, never on a
+# reconstructed task/<full-id>.
+T4=/tmp/crew-git-prefix-test
+rm -rf "$T4"
+mkdir -p "$T4"
+git init -q -b main "$T4/repo"
+git -C "$T4/repo" config user.email test@test.t
+git -C "$T4/repo" config user.name test
+echo base > "$T4/repo/f.txt"
+echo ".worktrees/" > "$T4/repo/.gitignore"
+git -C "$T4/repo" add -A
+git -C "$T4/repo" commit -qm base
+export CREW_REPO="$T4/repo"
+
+fullid="51aaa9fe-9cb5-4a4f-acfc-72092fcf0899"
+shortid="51aaa9fe"
+# Raw-git branch creation, like the Build agent: no registry entry.
+git -C "$T4/repo" branch "task/$shortid"
+[ -f "$T4/repo/.worktrees/.registry/$fullid" ] && fail "prefix-test: registry should be empty for this fixture"
+out=$(bash "$LIFECYCLE" resolve-branch "$fullid") || fail "prefix-test: resolve-branch failed: $out"
+[ "$out" = "task/$shortid" ] || fail "prefix-test: resolve-branch returned '$out', expected task/$shortid"
+
+# inspect operates on the real branch (no "branch ... does not exist")
+out=$(bash "$LIFECYCLE" inspect "$fullid") || fail "prefix-test: inspect failed on abbreviated branch: $out"
+echo "$out" | grep -q "=== Branch: task/$shortid ===" || fail "prefix-test: inspect used the wrong branch"
+
+# verify-merge vacuous-pass on the merged-prefix branch tip == main
+out=$(bash "$LIFECYCLE" verify-merge "$fullid") || fail "prefix-test: verify-merge failed on abbreviated branch: $out"
+
+# cleanup deletes the real abbreviated branch, not a reconstructed one
+out=$(bash "$LIFECYCLE" cleanup "$fullid") || fail "prefix-test: cleanup failed: $out"
+git -C "$T4/repo" rev-parse --verify "task/$shortid" >/dev/null 2>&1 && fail "prefix-test: cleanup left the abbreviated branch behind"
+
+# Ambiguous prefixes fail closed (exit non-zero), never guess
+fullid2="deadbeef-1111-2222-3333-444455556666"
+git -C "$T4/repo" branch "task/deadbeef"
+git -C "$T4/repo" branch "task/deadbeef-1111"
+if bash "$LIFECYCLE" resolve-branch "$fullid2" >/dev/null 2>&1; then
+  fail "prefix-test: resolve-branch guessed on ambiguous prefix"
+fi
+git -C "$T4/repo" branch -D "task/deadbeef" "task/deadbeef-1111" >/dev/null
+
+# No branch at all: resolve-branch falls back to the canonical name so
+# callers keep their "branch X does not exist" failure
+out=$(bash "$LIFECYCLE" resolve-branch "$fullid") || fail "prefix-test: resolve-branch failed with no branch present"
+[ "$out" = "task/$fullid" ] || fail "prefix-test: resolve-branch returned '$out', expected canonical fallback task/$fullid"
+
+rm -rf "$T2" "$T3" "$T4"
 export CREW_REPO="$T"
 rm -rf "$T"
 echo "worktree-backend: OK"