skillrepo 2.0.0 → 3.0.0

package/src/test/lib/identifier.test.mjs

@@ -0,0 +1,157 @@
+/**
+ * Unit tests for src/lib/identifier.mjs (PR2 of #646).
+ *
+ * Covers parseIdentifier and formatIdentifier for every documented
+ * accept/reject case. The identifier helper is the entry point for
+ * three commands (get, add, remove), so coverage here is the single
+ * source of truth for argument-validation correctness.
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import { parseIdentifier, formatIdentifier } from "../../lib/identifier.mjs";
+import { CliError, EXIT_VALIDATION } from "../../lib/errors.mjs";
+
+describe("parseIdentifier — accept", () => {
+  it("@owner/name canonical form", () => {
+    assert.deepEqual(parseIdentifier("@alice/pdf-helper"), {
+      owner: "alice",
+      name: "pdf-helper",
+    });
+  });
+
+  it("owner/name without leading @", () => {
+    assert.deepEqual(parseIdentifier("alice/pdf-helper"), {
+      owner: "alice",
+      name: "pdf-helper",
+    });
+  });
+
+  it("single-character segments", () => {
+    assert.deepEqual(parseIdentifier("@a/b"), { owner: "a", name: "b" });
+  });
+
+  it("digits in segments", () => {
+    assert.deepEqual(parseIdentifier("@user123/skill456"), {
+      owner: "user123",
+      name: "skill456",
+    });
+  });
+
+  it("hyphens within segments", () => {
+    assert.deepEqual(parseIdentifier("@my-org/my-skill"), {
+      owner: "my-org",
+      name: "my-skill",
+    });
+  });
+
+  it("trims surrounding whitespace", () => {
+    assert.deepEqual(parseIdentifier("  @alice/pdf-helper  "), {
+      owner: "alice",
+      name: "pdf-helper",
+    });
+  });
+
+  it("owner at the spec-max length (100 chars)", () => {
+    const owner = "a".repeat(100);
+    assert.deepEqual(parseIdentifier(`@${owner}/skill`), { owner, name: "skill" });
+  });
+
+  it("name at the spec-max length (64 chars)", () => {
+    const name = "a".repeat(64);
+    assert.deepEqual(parseIdentifier(`@alice/${name}`), { owner: "alice", name });
+  });
+});
+
+describe("parseIdentifier — reject", () => {
+  function expectReject(input, pattern) {
+    assert.throws(
+      () => parseIdentifier(input),
+      (err) => {
+        if (!(err instanceof CliError)) return false;
+        if (err.exitCode !== EXIT_VALIDATION) return false;
+        return pattern.test(err.message);
+      },
+      `Expected "${input}" to be rejected with /${pattern.source}/`,
+    );
+  }
+
+  it("rejects null", () => expectReject(null, /required/));
+  it("rejects undefined", () => expectReject(undefined, /required/));
+  it("rejects empty string", () => expectReject("", /required/));
+  it("rejects whitespace only", () => expectReject("   ", /required/));
+  it("rejects non-string (number)", () => expectReject(42, /required/));
+
+  it("rejects bare name (no slash)", () =>
+    expectReject("alice", /missing owner/));
+  it("rejects @bare-name", () =>
+    expectReject("@alice", /missing owner/));
+
+  it("rejects too many slashes", () =>
+    expectReject("@alice/foo/bar", /too many segments/));
+  it("rejects too many slashes (2 slashes)", () =>
+    expectReject("alice/foo/bar/baz", /too many segments/));
+
+  it("rejects empty owner", () =>
+    expectReject("@/name", /empty owner/));
+  it("rejects empty name", () =>
+    expectReject("@alice/", /empty name/));
+  it("rejects empty owner and empty name", () =>
+    expectReject("@/", /empty owner/));
+
+  it("rejects uppercase in owner", () =>
+    expectReject("@Alice/skill", /lowercase alphanumeric/));
+  it("rejects uppercase in name", () =>
+    expectReject("@alice/PdfHelper", /lowercase alphanumeric/));
+  it("rejects underscore", () =>
+    expectReject("@alice/pdf_helper", /lowercase alphanumeric/));
+  it("rejects spaces in name", () =>
+    expectReject("@alice/pdf helper", /lowercase alphanumeric/));
+  it("rejects period", () =>
+    expectReject("@alice/pdf.helper", /lowercase alphanumeric/));
+
+  it("rejects leading hyphen in owner", () =>
+    expectReject("@-alice/skill", /must not start or end with a hyphen/));
+  it("rejects trailing hyphen in owner", () =>
+    expectReject("@alice-/skill", /must not start or end with a hyphen/));
+  it("rejects leading hyphen in name", () =>
+    expectReject("@alice/-skill", /must not start or end with a hyphen/));
+  it("rejects trailing hyphen in name", () =>
+    expectReject("@alice/skill-", /must not start or end with a hyphen/));
+
+  it("rejects consecutive hyphens in owner", () =>
+    expectReject("@a--b/skill", /consecutive hyphens/));
+  it("rejects consecutive hyphens in name", () =>
+    expectReject("@alice/a--b", /consecutive hyphens/));
+
+  it("rejects owner over 100 chars", () => {
+    const owner = "a".repeat(101);
+    expectReject(`@${owner}/skill`, /owner exceeds 100/);
+  });
+  it("rejects name over 64 chars", () => {
+    const name = "a".repeat(65);
+    expectReject(`@alice/${name}`, /name exceeds 64/);
+  });
+
+  it("rejects path traversal in name", () => {
+    // Slash is the segment delimiter so this hits "too many segments"
+    // first, but the test confirms there's no path through the
+    // validator that would let `..` reach a downstream consumer.
+    expectReject("@alice/../etc", /too many segments/);
+  });
+});
+
+describe("formatIdentifier", () => {
+  it("formats canonical @owner/name", () => {
+    assert.equal(
+      formatIdentifier({ owner: "alice", name: "pdf-helper" }),
+      "@alice/pdf-helper",
+    );
+  });
+
+  it("round-trips parse + format", () => {
+    const parsed = parseIdentifier("@alice/pdf-helper");
+    assert.equal(formatIdentifier(parsed), "@alice/pdf-helper");
+  });
+});

package/src/test/lib/mcp-merge.test.mjs

@@ -0,0 +1,345 @@
+/**
+ * Unit tests for src/lib/mcp-merge.mjs (PR3b of #646).
+ *
+ * Exercises the per-vendor merge + prompt + failure-handling flow.
+ * Uses the existing createCaptureStream helper to observe stdout,
+ * and monkey-patches the `prompt.mjs` `confirm` function via module
+ * import caching to control the user's y/n responses.
+ *
+ * NOTE on prompt mocking: `prompt.mjs` exports `confirm` which reads
+ * from a readline interface by default. To avoid spawning a readline
+ * and hanging the test, we always pass `yes: true` in most tests,
+ * and for the "user declined" tests we monkey-patch the module's
+ * `confirm` export before each test and restore it after.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { mergeMcpForVendors, printManualMcpInstructions } from "../../lib/mcp-merge.mjs";
+import { createCaptureStream } from "../helpers/capture-stream.mjs";
+
+let sandbox;
+let originalCwd;
+let originalHome;
+let stdout;
+let stderr;
+
+/**
+ * Create a `confirmFn` stub that records its calls and returns the
+ * configured answer(s). Each call pops the next answer from the
+ * provided array; if the array is empty, defaults to `true`.
+ */
+function makeConfirmFn(answers = []) {
+  const calls = [];
+  const fn = async (prompt, defaultYes) => {
+    calls.push({ prompt, defaultYes });
+    return answers.length > 0 ? answers.shift() : true;
+  };
+  fn.calls = calls;
+  return fn;
+}
+
+function setupSandbox() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-mcpmerge-"));
+  mkdirSync(join(sandbox, "project"), { recursive: true });
+  mkdirSync(join(sandbox, "home"), { recursive: true });
+  originalCwd = process.cwd();
+  originalHome = process.env.HOME;
+  process.chdir(join(sandbox, "project"));
+  process.env.HOME = join(sandbox, "home");
+  stdout = createCaptureStream();
+  stderr = createCaptureStream();
+}
+
+function teardownSandbox() {
+  process.chdir(originalCwd);
+  process.env.HOME = originalHome;
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+// ── mergeMcpForVendors — happy path with --yes ─────────────────────────
+
+describe("mergeMcpForVendors — happy path", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("creates .mcp.json when it does not exist (claudeCode)", async () => {
+    const results = await mergeMcpForVendors({
+      vendors: ["claudeCode"],
+      mcpUrl: "https://skillrepo.dev/api/mcp",
+      yes: true,
+      io: { stdout, stderr },
+    });
+
+    assert.equal(results.length, 1);
+    assert.equal(results[0].outcome, "merged");
+    assert.equal(results[0].action, "created");
+
+    const mcp = JSON.parse(readFileSync(join(process.cwd(), ".mcp.json"), "utf-8"));
+    assert.ok(mcp.mcpServers?.skillrepo);
+    assert.equal(mcp.mcpServers.skillrepo.type, "http");
+    assert.equal(mcp.mcpServers.skillrepo.url, "https://skillrepo.dev/api/mcp");
+  });
+
+  it("merges into existing .mcp.json preserving other servers", async () => {
+    writeFileSync(
+      join(process.cwd(), ".mcp.json"),
+      JSON.stringify({
+        mcpServers: {
+          "other-server": { type: "http", url: "https://other.example" },
+        },
+      }),
+    );
+
+    await mergeMcpForVendors({
+      vendors: ["claudeCode"],
+      mcpUrl: "https://skillrepo.dev/api/mcp",
+      yes: true,
+      io: { stdout, stderr },
+    });
+
+    const mcp = JSON.parse(readFileSync(join(process.cwd(), ".mcp.json"), "utf-8"));
+    assert.ok(mcp.mcpServers.skillrepo);
+    assert.ok(mcp.mcpServers["other-server"], "existing server should be preserved");
+
+    // Preview message should mention the preserved server
+    assert.match(stdout.text(), /other-server/);
+  });
+
+  it("handles multiple vendors in one call", async () => {
+    const results = await mergeMcpForVendors({
+      vendors: ["claudeCode", "cursor"],
+      mcpUrl: "https://skillrepo.dev/api/mcp",
+      yes: true,
+      io: { stdout, stderr },
+    });
+    assert.equal(results.length, 2);
+    assert.equal(results[0].outcome, "merged");
+    assert.equal(results[1].outcome, "merged");
+  });
+
+  it("returns empty array for empty vendor list", async () => {
+    const results = await mergeMcpForVendors({
+      vendors: [],
+      mcpUrl: "https://skillrepo.dev/api/mcp",
+      yes: true,
+      io: { stdout, stderr },
+    });
+    assert.deepEqual(results, []);
+  });
+});
+
+// ── mergeMcpForVendors — preview strings ───────────────────────────────
+
+describe("mergeMcpForVendors — preview messages", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("previews 'will create' for a missing file", async () => {
+    await mergeMcpForVendors({
+      vendors: ["claudeCode"],
+      mcpUrl: "https://x.com/mcp",
+      yes: true,
+      io: { stdout, stderr },
+    });
+    assert.match(stdout.text(), /will create/);
+  });
+
+  it("previews 'will update existing' when skillrepo entry already present", async () => {
+    writeFileSync(
+      join(process.cwd(), ".mcp.json"),
+      JSON.stringify({
+        mcpServers: {
+          skillrepo: { type: "http", url: "https://old.example" },
+        },
+      }),
+    );
+    await mergeMcpForVendors({
+      vendors: ["claudeCode"],
+      mcpUrl: "https://new.example/mcp",
+      yes: true,
+      io: { stdout, stderr },
+    });
+    assert.match(stdout.text(), /update existing/);
+  });
+
+  it("previews warning for invalid JSON (merge will throw)", async () => {
+    writeFileSync(join(process.cwd(), ".mcp.json"), "not json {{{");
+    const results = await mergeMcpForVendors({
+      vendors: ["claudeCode"],
+      mcpUrl: "https://x.com/mcp",
+      yes: true,
+      io: { stdout, stderr },
+    });
+    assert.match(stdout.text(), /invalid JSON/);
+    // The merge should fail, not merge
+    assert.equal(results[0].outcome, "failed");
+  });
+});
+
+// ── mergeMcpForVendors — user declined ─────────────────────────────────
+
+describe("mergeMcpForVendors — user declined", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("records 'skipped' outcome when user answers no", async () => {
+    const confirmFn = makeConfirmFn([false]);
+    const results = await mergeMcpForVendors({
+      vendors: ["claudeCode"],
+      mcpUrl: "https://x.com/mcp",
+      yes: false, // NOT --yes — will call confirmFn
+      io: { stdout, stderr },
+      confirmFn,
+    });
+
+    assert.equal(results[0].outcome, "skipped");
+    assert.equal(results[0].reason, "user declined");
+    assert.equal(confirmFn.calls.length, 1);
+  });
+
+  it("processes multiple vendors with mixed answers", async () => {
+    // Say "yes" to Claude Code, "no" to Cursor
+    const confirmFn = makeConfirmFn([true, false]);
+    const results = await mergeMcpForVendors({
+      vendors: ["claudeCode", "cursor"],
+      mcpUrl: "https://x.com/mcp",
+      yes: false,
+      io: { stdout, stderr },
+      confirmFn,
+    });
+    assert.equal(results[0].outcome, "merged");
+    assert.equal(results[1].outcome, "skipped");
+    assert.equal(confirmFn.calls.length, 2);
+  });
+});
+
+// ── mergeMcpForVendors — failures don't abort ──────────────────────────
+
+describe("mergeMcpForVendors — failure handling", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("one vendor failure doesn't abort the others", async () => {
+    // Corrupt the claudeCode config so its merger throws
+    writeFileSync(join(process.cwd(), ".mcp.json"), "not json {{{");
+
+    const results = await mergeMcpForVendors({
+      vendors: ["claudeCode", "cursor"],
+      mcpUrl: "https://x.com/mcp",
+      yes: true,
+      io: { stdout, stderr },
+    });
+
+    assert.equal(results.length, 2);
+    assert.equal(results[0].outcome, "failed");
+    assert.equal(results[1].outcome, "merged"); // cursor still succeeds
+  });
+
+  it("records 'failed' with reason for unknown vendor", async () => {
+    const results = await mergeMcpForVendors({
+      vendors: ["jetbrains"],
+      mcpUrl: "https://x.com/mcp",
+      yes: true,
+      io: { stdout, stderr },
+    });
+    assert.equal(results[0].outcome, "failed");
+    assert.match(results[0].reason, /Unknown vendor/);
+  });
+
+  it("handles the three-way interleaving: merge + fail + skip (round-1 gap fix)", async () => {
+    // Architect's round-1 review called out that the most complex
+    // scenario — one vendor succeeds, one fails with corrupt JSON,
+    // one is declined by the user — was not tested. This test
+    // locks that interleaving.
+    //
+    // Setup:
+    //   claudeCode → corrupt .mcp.json → merge throws → "failed"
+    //   cursor     → user declines      → "skipped"
+    //   windsurf   → no existing file   → "merged"
+    writeFileSync(join(process.cwd(), ".mcp.json"), "not json {{{");
+
+    // With `yes: false`, confirmFn IS invoked for every vendor —
+    // the merger only throws AFTER the user says yes. The answers
+    // below map vendor-by-vendor:
+    //   claudeCode → yes (then underlying merger throws → failed)
+    //   cursor     → no  (user declined → skipped)
+    //   windsurf   → yes (merger succeeds → merged)
+    const confirmFn = makeConfirmFn([true, false, true]);
+
+    const results = await mergeMcpForVendors({
+      vendors: ["claudeCode", "cursor", "windsurf"],
+      mcpUrl: "https://x.com/mcp",
+      yes: false,
+      io: { stdout, stderr },
+      confirmFn,
+    });
+
+    assert.equal(results.length, 3);
+    assert.equal(results[0].vendor, "claudeCode");
+    assert.equal(results[0].outcome, "failed");
+    assert.match(results[0].reason, /invalid JSON/i);
+
+    assert.equal(results[1].vendor, "cursor");
+    assert.equal(results[1].outcome, "skipped");
+    assert.equal(results[1].reason, "user declined");
+
+    assert.equal(results[2].vendor, "windsurf");
+    assert.equal(results[2].outcome, "merged");
+
+    // confirmFn should have been called 3 times
+    assert.equal(confirmFn.calls.length, 3);
+  });
+
+  it("dedupes duplicate vendors (round-1 review fix)", async () => {
+    // --ide claude,claude used to run the merger twice. Now dedupes.
+    const results = await mergeMcpForVendors({
+      vendors: ["claudeCode", "claudeCode", "cursor", "cursor"],
+      mcpUrl: "https://x.com/mcp",
+      yes: true,
+      io: { stdout, stderr },
+    });
+    assert.equal(results.length, 2, "duplicates should be removed");
+    assert.equal(results[0].vendor, "claudeCode");
+    assert.equal(results[1].vendor, "cursor");
+  });
+});
+
+// ── mergeMcpForVendors — input validation ──────────────────────────────
+
+describe("mergeMcpForVendors — input validation", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("throws when mcpUrl is missing", async () => {
+    await assert.rejects(
+      () => mergeMcpForVendors({ vendors: ["claudeCode"], yes: true, io: { stdout, stderr } }),
+      (err) => /mcpUrl is required/.test(err.message),
+    );
+  });
+
+  it("throws when mcpUrl is empty string", async () => {
+    await assert.rejects(
+      () => mergeMcpForVendors({ vendors: ["claudeCode"], mcpUrl: "", yes: true, io: { stdout, stderr } }),
+      (err) => /mcpUrl is required/.test(err.message),
+    );
+  });
+});
+
+// ── printManualMcpInstructions ─────────────────────────────────────────
+
+describe("printManualMcpInstructions", () => {
+  it("prints a copy-pasteable MCP config blob", () => {
+    const out = createCaptureStream();
+    printManualMcpInstructions("https://skillrepo.dev/api/mcp", { stdout: out });
+    const text = out.text();
+    assert.match(text, /mcpServers/);
+    assert.match(text, /skillrepo/);
+    assert.match(text, /https:\/\/skillrepo\.dev\/api\/mcp/);
+    assert.match(text, /SKILLREPO_ACCESS_KEY/);
+  });
+});

package/src/test/lib/paths.test.mjs

@@ -0,0 +1,83 @@
+/**
+ * Unit tests for the new paths.mjs exports added in PR1 of #646.
+ *
+ * The pre-existing exports (claudeMcpJson, cursorMcpJson, etc.) are
+ * exercised indirectly by the existing mergers tests; this file
+ * focuses on the new skill placement + gitignore exports.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir, homedir } from "node:os";
+
+import {
+  claudeSkillsProject,
+  claudeSkillsGlobal,
+  projectSkillsFallback,
+  projectSkillsFallbackRoot,
+  claudeSkillsProjectRoot,
+  claudeSkillsGlobalRoot,
+  gitignorePath,
+} from "../../lib/paths.mjs";
+
+let sandbox;
+let originalCwd;
+let originalHome;
+
+function setupSandbox() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-paths-"));
+  mkdirSync(join(sandbox, "project"), { recursive: true });
+  mkdirSync(join(sandbox, "home"), { recursive: true });
+  originalCwd = process.cwd();
+  originalHome = process.env.HOME;
+  process.chdir(join(sandbox, "project"));
+  process.env.HOME = join(sandbox, "home");
+}
+
+function teardownSandbox() {
+  process.chdir(originalCwd);
+  process.env.HOME = originalHome;
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+describe("paths.mjs — skill placement targets", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("claudeSkillsProject is under cwd/.claude/skills/<name>", () => {
+    const dir = claudeSkillsProject("pdf-helper");
+    assert.equal(dir, join(process.cwd(), ".claude", "skills", "pdf-helper"));
+  });
+
+  it("claudeSkillsGlobal is under HOME/.claude/skills/<name>", () => {
+    const dir = claudeSkillsGlobal("pdf-helper");
+    // homedir() reads HOME on POSIX so respects our sandbox
+    assert.equal(dir, join(homedir(), ".claude", "skills", "pdf-helper"));
+  });
+
+  it("projectSkillsFallback is under cwd/skills/<name>", () => {
+    const dir = projectSkillsFallback("pdf-helper");
+    assert.equal(dir, join(process.cwd(), "skills", "pdf-helper"));
+  });
+
+  it("claudeSkillsProjectRoot is the parent of project-local skills", () => {
+    const root = claudeSkillsProjectRoot();
+    assert.equal(root, join(process.cwd(), ".claude", "skills"));
+  });
+
+  it("claudeSkillsGlobalRoot is the parent of personal skills", () => {
+    const root = claudeSkillsGlobalRoot();
+    assert.equal(root, join(homedir(), ".claude", "skills"));
+  });
+
+  it("projectSkillsFallbackRoot is the parent of fallback skills", () => {
+    const root = projectSkillsFallbackRoot();
+    assert.equal(root, join(process.cwd(), "skills"));
+  });
+
+  it("gitignorePath is at cwd/.gitignore", () => {
+    assert.equal(gitignorePath(), join(process.cwd(), ".gitignore"));
+  });
+});