skillrepo 2.0.0 → 3.1.0

package/src/test/mergers/uninstall-settings.test.mjs

@@ -0,0 +1,285 @@
+/**
+ * Unit tests for src/lib/removers/settings.mjs (#885).
+ *
+ * The settings remover filters the SessionStart hook array by the
+ * shared SESSION_HOOK_FINGERPRINT constant. It must:
+ *
+ *   1. Remove the SkillRepo hook when present
+ *   2. Preserve user-authored hooks (different commands)
+ *   3. Preserve hook GROUPS that contain only user-authored hooks
+ *   4. Clean up empty containers after the removal so the file
+ *      doesn't accumulate dead structure
+ *   5. Leave malformed/unexpected shapes alone — only touch entries
+ *      we can definitively identify as SkillRepo-owned
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { removeSettingsSessionHook } from "../../lib/removers/settings.mjs";
+import { SESSION_HOOK_FINGERPRINT } from "../../lib/artifact-registry.mjs";
+
+let sandbox;
+let originalCwd;
+
+function setup() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-unrm-settings-"));
+  originalCwd = process.cwd();
+  process.chdir(sandbox);
+  mkdirSync(join(sandbox, ".claude"), { recursive: true });
+}
+
+function teardown() {
+  process.chdir(originalCwd);
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+describe("removeSettingsSessionHook", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("is a no-op when settings.local.json does not exist", () => {
+    const result = removeSettingsSessionHook();
+    assert.equal(result.action, "skipped");
+  });
+
+  it("returns 'unchanged' when file exists with no hooks section (semantic fix, architect round-1)", () => {
+    // #884 round-1 review normalized the action values: "skipped"
+    // now means "couldn't run" (file missing, unparseable), while
+    // "unchanged" means "ran successfully, nothing to remove." A
+    // file that exists but has no hooks section is the latter case
+    // — the operation was a successful no-op, not a skip.
+    const content = JSON.stringify({ env: {} }, null, 2);
+    writeFileSync(".claude/settings.local.json", content);
+
+    const result = removeSettingsSessionHook();
+    assert.equal(result.action, "unchanged");
+    assert.equal(readFileSync(".claude/settings.local.json", "utf-8"), content);
+  });
+
+  it("removes the SkillRepo hook and cleans up the empty containers", () => {
+    writeFileSync(
+      ".claude/settings.local.json",
+      JSON.stringify(
+        {
+          hooks: {
+            SessionStart: [
+              {
+                hooks: [
+                  {
+                    type: "command",
+                    command: `/usr/local/bin/skillrepo update --session-hook 2>&1 || true`,
+                  },
+                ],
+              },
+            ],
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const result = removeSettingsSessionHook();
+    assert.equal(result.action, "removed");
+
+    const parsed = JSON.parse(
+      readFileSync(".claude/settings.local.json", "utf-8"),
+    );
+    // With the only hook removed, the hooks object itself is
+    // cleaned up — leaves a minimally-clean file.
+    assert.equal(parsed.hooks, undefined);
+  });
+
+  it("preserves user-authored hooks in the same group", () => {
+    writeFileSync(
+      ".claude/settings.local.json",
+      JSON.stringify(
+        {
+          hooks: {
+            SessionStart: [
+              {
+                hooks: [
+                  {
+                    type: "command",
+                    command: `echo "user-authored"`,
+                  },
+                  {
+                    type: "command",
+                    command: `/bin/skillrepo update --session-hook 2>&1 || true`,
+                  },
+                ],
+              },
+            ],
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const result = removeSettingsSessionHook();
+    assert.equal(result.action, "removed");
+
+    const parsed = JSON.parse(
+      readFileSync(".claude/settings.local.json", "utf-8"),
+    );
+    assert.equal(parsed.hooks.SessionStart.length, 1);
+    assert.equal(parsed.hooks.SessionStart[0].hooks.length, 1);
+    assert.match(
+      parsed.hooks.SessionStart[0].hooks[0].command,
+      /user-authored/,
+    );
+  });
+
+  it("preserves user-authored groups alongside SkillRepo's group", () => {
+    writeFileSync(
+      ".claude/settings.local.json",
+      JSON.stringify(
+        {
+          hooks: {
+            SessionStart: [
+              {
+                hooks: [
+                  { type: "command", command: "user-group-1-hook" },
+                ],
+              },
+              {
+                hooks: [
+                  {
+                    type: "command",
+                    command: `/bin/skillrepo update --session-hook 2>&1 || true`,
+                  },
+                ],
+              },
+              {
+                hooks: [
+                  { type: "command", command: "user-group-3-hook" },
+                ],
+              },
+            ],
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const result = removeSettingsSessionHook();
+    assert.equal(result.action, "removed");
+
+    const parsed = JSON.parse(
+      readFileSync(".claude/settings.local.json", "utf-8"),
+    );
+    assert.equal(parsed.hooks.SessionStart.length, 2);
+    assert.equal(
+      parsed.hooks.SessionStart[0].hooks[0].command,
+      "user-group-1-hook",
+    );
+    assert.equal(
+      parsed.hooks.SessionStart[1].hooks[0].command,
+      "user-group-3-hook",
+    );
+  });
+
+  it("returns 'unchanged' when no hook command contains the fingerprint", () => {
+    // File has hooks, but none of them are SkillRepo-owned. The
+    // operation ran; nothing to remove. "unchanged" not "skipped"
+    // per the architect-requested normalization.
+    const content = JSON.stringify(
+      {
+        hooks: {
+          SessionStart: [
+            {
+              hooks: [
+                { type: "command", command: "some-other-tool" },
+              ],
+            },
+          ],
+        },
+      },
+      null,
+      2,
+    );
+    writeFileSync(".claude/settings.local.json", content);
+
+    const result = removeSettingsSessionHook();
+    assert.equal(result.action, "unchanged");
+    assert.equal(
+      readFileSync(".claude/settings.local.json", "utf-8"),
+      content,
+    );
+  });
+
+  it("returns 'unchanged' on an empty (zero-byte) settings file", () => {
+    // Code-reviewer round-1 flagged the empty-file case: a zero-byte
+    // settings.local.json (some tools create the file as a touch
+    // target) was producing "Cannot parse" errors. The guard at
+    // `raw.trim().length === 0` makes this explicit: empty file is
+    // a valid "unchanged" state, not an error.
+    writeFileSync(".claude/settings.local.json", "");
+
+    const result = removeSettingsSessionHook();
+    assert.equal(result.action, "unchanged");
+    assert.ok(!result.error, "empty file must not be treated as parse error");
+  });
+
+  it("tolerates malformed entries without throwing", () => {
+    // A hook entry missing the `command` field, or a non-object
+    // in the array, must not crash the remover — just be preserved
+    // untouched.
+    writeFileSync(
+      ".claude/settings.local.json",
+      JSON.stringify(
+        {
+          hooks: {
+            SessionStart: [
+              {
+                hooks: [
+                  { type: "command" /* no command field */ },
+                  "not even an object",
+                  {
+                    type: "command",
+                    command: `/bin/skillrepo update --session-hook`,
+                  },
+                ],
+              },
+            ],
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const result = removeSettingsSessionHook();
+    assert.equal(result.action, "removed");
+
+    const parsed = JSON.parse(
+      readFileSync(".claude/settings.local.json", "utf-8"),
+    );
+    // SkillRepo hook gone; the two malformed entries survive.
+    assert.equal(parsed.hooks.SessionStart[0].hooks.length, 2);
+  });
+
+  it("imports the same fingerprint constant the installer would", () => {
+    // This test locks in the single-source-of-truth contract: if a
+    // refactor ever moves the fingerprint elsewhere or drops it,
+    // this import breaks loudly and the architect tightening #3
+    // (bidirectional registry/merger mapping) fails at import time.
+    assert.equal(typeof SESSION_HOOK_FINGERPRINT, "string");
+    assert.ok(SESSION_HOOK_FINGERPRINT.length > 0);
+    assert.match(SESSION_HOOK_FINGERPRINT, /skillrepo/);
+  });
+
+  it("returns a structured error on unparseable JSON", () => {
+    writeFileSync(".claude/settings.local.json", "{ bad");
+
+    const result = removeSettingsSessionHook();
+    assert.equal(result.action, "skipped");
+    assert.ok(result.error);
+  });
+});

package/src/test/mergers/uninstall-vscode-mcp.test.mjs

@@ -0,0 +1,215 @@
+/**
+ * Unit tests for src/lib/removers/vscode-mcp.mjs (#885).
+ *
+ * VS Code's mcp.json is the complex case: two artifacts (server
+ * entry + input prompt) live in one file under different sections.
+ * Both must be removed; sibling entries in both sections must
+ * survive.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { removeVscodeMcp } from "../../lib/removers/vscode-mcp.mjs";
+
+let sandbox;
+let originalCwd;
+
+function setup() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-unrm-vscode-"));
+  originalCwd = process.cwd();
+  process.chdir(sandbox);
+  mkdirSync(join(sandbox, ".vscode"), { recursive: true });
+}
+
+function teardown() {
+  process.chdir(originalCwd);
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+describe("removeVscodeMcp", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("is a no-op when .vscode/mcp.json does not exist", () => {
+    const result = removeVscodeMcp();
+    assert.equal(result.action, "skipped");
+  });
+
+  it("removes both servers.skillrepo AND the inputs entry in one pass", () => {
+    writeFileSync(
+      ".vscode/mcp.json",
+      JSON.stringify(
+        {
+          inputs: [
+            {
+              id: "skillrepo-api-key",
+              type: "promptString",
+              description: "SkillRepo key",
+              password: true,
+            },
+            {
+              id: "some-other-tool-key",
+              type: "promptString",
+              description: "Other tool key",
+              password: true,
+            },
+          ],
+          servers: {
+            skillrepo: {
+              type: "http",
+              url: "https://skillrepo.dev/api/mcp",
+              headers: { Authorization: "Bearer ${input:skillrepo-api-key}" },
+            },
+            anotherTool: {
+              type: "http",
+              url: "https://example.com",
+            },
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const result = removeVscodeMcp();
+    assert.equal(result.action, "removed");
+    assert.ok(result.removed.includes("servers.skillrepo"));
+    assert.ok(result.removed.includes("inputs[skillrepo-api-key]"));
+
+    const parsed = JSON.parse(readFileSync(".vscode/mcp.json", "utf-8"));
+    assert.equal(parsed.servers.skillrepo, undefined);
+    assert.ok(parsed.servers.anotherTool, "sibling server survives");
+    assert.equal(parsed.inputs.length, 1);
+    assert.equal(parsed.inputs[0].id, "some-other-tool-key");
+  });
+
+  it("removes the server entry only when the input is already absent", () => {
+    // A half-present state can happen if the user manually deleted
+    // the input prompt. The remover should still strip the server
+    // entry and report only what it actually removed.
+    writeFileSync(
+      ".vscode/mcp.json",
+      JSON.stringify(
+        {
+          inputs: [
+            { id: "some-other-tool-key", type: "promptString" },
+          ],
+          servers: {
+            skillrepo: { type: "http", url: "x" },
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const result = removeVscodeMcp();
+    assert.equal(result.action, "removed");
+    assert.ok(result.removed.includes("servers.skillrepo"));
+    assert.ok(!result.removed.includes("inputs[skillrepo-api-key]"));
+  });
+
+  it("removes the input entry only when the server is already absent", () => {
+    writeFileSync(
+      ".vscode/mcp.json",
+      JSON.stringify(
+        {
+          inputs: [
+            { id: "skillrepo-api-key", type: "promptString" },
+            { id: "keep-me", type: "promptString" },
+          ],
+          servers: {},
+        },
+        null,
+        2,
+      ),
+    );
+
+    const result = removeVscodeMcp();
+    assert.equal(result.action, "removed");
+    assert.ok(!result.removed.includes("servers.skillrepo"));
+    assert.ok(result.removed.includes("inputs[skillrepo-api-key]"));
+
+    const parsed = JSON.parse(readFileSync(".vscode/mcp.json", "utf-8"));
+    assert.equal(parsed.inputs.length, 1);
+    assert.equal(parsed.inputs[0].id, "keep-me");
+  });
+
+  it("is a no-op when neither artifact is present", () => {
+    const content = JSON.stringify(
+      {
+        inputs: [{ id: "other", type: "promptString" }],
+        servers: { anotherTool: { type: "http", url: "x" } },
+      },
+      null,
+      2,
+    );
+    writeFileSync(".vscode/mcp.json", content);
+
+    const result = removeVscodeMcp();
+    assert.equal(result.action, "skipped");
+    assert.equal(readFileSync(".vscode/mcp.json", "utf-8"), content);
+  });
+
+  it("returns a structured error on unparseable JSON", () => {
+    writeFileSync(".vscode/mcp.json", "not json at all");
+
+    const result = removeVscodeMcp();
+    assert.equal(result.action, "skipped");
+    assert.ok(result.error);
+  });
+
+  it("tolerates missing inputs array entirely", () => {
+    // A config that only has `servers` is valid per spec.
+    writeFileSync(
+      ".vscode/mcp.json",
+      JSON.stringify({ servers: { skillrepo: { url: "x" } } }, null, 2),
+    );
+
+    const result = removeVscodeMcp();
+    assert.equal(result.action, "removed");
+    assert.deepEqual(result.removed, ["servers.skillrepo"]);
+  });
+
+  it("is idempotent — second call is a no-op", () => {
+    writeFileSync(
+      ".vscode/mcp.json",
+      JSON.stringify(
+        {
+          inputs: [{ id: "skillrepo-api-key", type: "promptString" }],
+          servers: { skillrepo: { url: "x" } },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const first = removeVscodeMcp();
+    assert.equal(first.action, "removed");
+
+    const second = removeVscodeMcp();
+    assert.equal(second.action, "skipped");
+  });
+
+  it("dryRun does not modify the file and reports both removals in preview", () => {
+    const content = JSON.stringify(
+      {
+        inputs: [{ id: "skillrepo-api-key", type: "promptString" }],
+        servers: { skillrepo: { url: "x" } },
+      },
+      null,
+      2,
+    );
+    writeFileSync(".vscode/mcp.json", content);
+
+    const result = removeVscodeMcp({ dryRun: true });
+    assert.equal(result.action, "would-remove");
+    assert.ok(result.removed.includes("servers.skillrepo"));
+    assert.ok(result.removed.includes("inputs[skillrepo-api-key]"));
+    assert.equal(readFileSync(".vscode/mcp.json", "utf-8"), content);
+  });
+});

package/src/test/mergers/uninstall-windsurf-mcp.test.mjs

@@ -0,0 +1,122 @@
+/**
+ * Unit tests for src/lib/removers/windsurf-mcp.mjs (#885).
+ *
+ * Windsurf is global-scope — the config lives at
+ * `~/.codeium/windsurf/mcp_config.json` regardless of project. Tests
+ * stub HOME so the remover targets a sandbox rather than the real
+ * user directory. The sandboxing is CRITICAL: without the HOME
+ * override a test run that creates a fake mcp_config.json would
+ * persist after teardown and the test itself would touch the
+ * developer's real Windsurf config.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import {
+  mkdtempSync,
+  mkdirSync,
+  rmSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { removeWindsurfMcp } from "../../lib/removers/windsurf-mcp.mjs";
+
+let sandbox;
+let originalHome;
+let mcpConfigPath;
+
+function setup() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-unrm-windsurf-"));
+  originalHome = process.env.HOME;
+  process.env.HOME = sandbox;
+  // Sanity guard: asserting the override worked BEFORE any remover
+  // runs is cheap insurance against forgetting to restore HOME in a
+  // previous test's teardown or a parallel test cross-contamination.
+  assert.ok(
+    process.env.HOME.startsWith(tmpdir()),
+    "HOME must point inside tmpdir before any filesystem write",
+  );
+  mcpConfigPath = join(sandbox, ".codeium", "windsurf", "mcp_config.json");
+  mkdirSync(join(sandbox, ".codeium", "windsurf"), { recursive: true });
+}
+
+function teardown() {
+  process.env.HOME = originalHome;
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+describe("removeWindsurfMcp", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("is a no-op when the global config does not exist", () => {
+    // Don't create the file; the directory exists but not the file.
+    const result = removeWindsurfMcp();
+    assert.equal(result.action, "skipped");
+  });
+
+  it("removes only skillrepo, preserves siblings", () => {
+    writeFileSync(
+      mcpConfigPath,
+      JSON.stringify(
+        {
+          mcpServers: {
+            skillrepo: { serverUrl: "x", headers: {} },
+            anotherTool: { serverUrl: "y" },
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const result = removeWindsurfMcp();
+    assert.equal(result.action, "removed");
+    assert.equal(result.path, "~/.codeium/windsurf/mcp_config.json");
+
+    const parsed = JSON.parse(readFileSync(mcpConfigPath, "utf-8"));
+    assert.equal(parsed.mcpServers.skillrepo, undefined);
+    assert.ok(parsed.mcpServers.anotherTool);
+  });
+
+  it("returns a structured error on unparseable JSON", () => {
+    writeFileSync(mcpConfigPath, "{ broken");
+
+    const result = removeWindsurfMcp();
+    assert.equal(result.action, "skipped");
+    assert.ok(result.error);
+  });
+
+  it("is idempotent — second call is a no-op", () => {
+    writeFileSync(
+      mcpConfigPath,
+      JSON.stringify(
+        { mcpServers: { skillrepo: { serverUrl: "x", headers: {} } } },
+        null,
+        2,
+      ),
+    );
+
+    const first = removeWindsurfMcp();
+    assert.equal(first.action, "removed");
+
+    const second = removeWindsurfMcp();
+    assert.equal(second.action, "skipped");
+  });
+
+  it("dryRun does not modify the file", () => {
+    const content = JSON.stringify(
+      { mcpServers: { skillrepo: { serverUrl: "x" } } },
+      null,
+      2,
+    );
+    writeFileSync(mcpConfigPath, content);
+
+    const result = removeWindsurfMcp({ dryRun: true });
+    assert.equal(result.action, "would-remove");
+    assert.equal(readFileSync(mcpConfigPath, "utf-8"), content);
+  });
+});