skillrepo 3.1.1 → 3.1.2

package/src/test/commands/session-sync-actions.test.mjs

@@ -0,0 +1,74 @@
+/**
+ * Unit tests for src/commands/session-sync-actions.mjs (#894 / v3.1.2).
+ *
+ * The action-enum module is tiny but it's the SINGLE SOURCE OF TRUTH
+ * for the `sessionSync.action` JSON field. Downstream consumers
+ * (CI scripts, programmatic callers) parse this enum. The tests
+ * below lock in:
+ *   1. The enum's keys (programmer-facing names) and values
+ *      (consumer-facing strings) are stable.
+ *   2. The set of valid values reflects all 8 documented actions.
+ *   3. The frozen object can't be silently mutated at runtime.
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  SessionSyncAction,
+  SESSION_SYNC_ACTION_VALUES,
+} from "../../commands/session-sync-actions.mjs";
+
+describe("SessionSyncAction enum", () => {
+  it("exposes all 8 documented action values with the exact wire strings", () => {
+    // Wire strings are what downstream consumers rely on; changing
+    // them is a breaking change. This test fails loudly on any
+    // accidental rename.
+    assert.equal(SessionSyncAction.Installed, "installed");
+    assert.equal(SessionSyncAction.Updated, "updated");
+    assert.equal(SessionSyncAction.Unchanged, "unchanged");
+    assert.equal(SessionSyncAction.OptedOut, "opted-out");
+    assert.equal(SessionSyncAction.Declined, "declined");
+    assert.equal(SessionSyncAction.NotApplicable, "not-applicable");
+    assert.equal(SessionSyncAction.Skipped, "skipped");
+    assert.equal(SessionSyncAction.Failed, "failed");
+  });
+
+  it("is frozen (cannot be mutated at runtime)", () => {
+    // Without the freeze, a runtime monkey-patch could change the
+    // wire value of an action and silently break downstream consumers.
+    assert.throws(
+      () => {
+        SessionSyncAction.Installed = "different";
+      },
+      TypeError,
+      "SessionSyncAction must be frozen",
+    );
+  });
+
+  it("SESSION_SYNC_ACTION_VALUES contains all 8 wire strings", () => {
+    assert.equal(SESSION_SYNC_ACTION_VALUES.length, 8);
+    for (const value of [
+      "installed",
+      "updated",
+      "unchanged",
+      "opted-out",
+      "declined",
+      "not-applicable",
+      "skipped",
+      "failed",
+    ]) {
+      assert.ok(
+        SESSION_SYNC_ACTION_VALUES.includes(value),
+        `expected SESSION_SYNC_ACTION_VALUES to contain "${value}"`,
+      );
+    }
+  });
+
+  it("SESSION_SYNC_ACTION_VALUES is frozen (cannot push, pop, or splice)", () => {
+    assert.throws(
+      () => SESSION_SYNC_ACTION_VALUES.push("new-action"),
+      /frozen|mutate|read-?only|extensible/i,
+    );
+  });
+});

package/src/test/helpers/mock-spawn.mjs

@@ -0,0 +1,121 @@
+/**
+ * Mock spawn factory for v3.1.2 global-install tests.
+ *
+ * `installSkillrepoGlobally` accepts an injected `spawn` so tests
+ * never actually shell out to npm. This helper produces spawn stubs
+ * that mimic `child_process.spawn`'s event-emitter shape:
+ *
+ *   {
+ *     stdout: EventEmitter | undefined,
+ *     stderr: EventEmitter | undefined,
+ *     on: (event, cb) => this,
+ *     kill: () => void,
+ *   }
+ *
+ * The factory returns the spawn function directly. A `.calls` array
+ * is attached as a side property so tests can assert how spawn was
+ * invoked (cmd name, args, options).
+ *
+ * Behavioral knobs:
+ *   - exitCode (number)        : the close event fires with this code.
+ *   - error (Error)            : if set, fires the `error` event
+ *                                instead of `close`. Use for ENOENT
+ *                                tests (`{ code: "ENOENT" }`).
+ *   - stderrText (string)      : emitted as a single Buffer chunk on
+ *                                the child's stderr stream. Used by
+ *                                EACCES + npm-nonzero categorization
+ *                                tests.
+ *   - hang (boolean)           : never fires `close` or `error`.
+ *                                Used for timeout tests.
+ *   - asyncDelayMs (number)    : delay before firing close/error.
+ *                                Default 0 (uses process.nextTick).
+ *
+ * Tests do NOT use `child_process.spawn` directly — they import this
+ * helper and pass its return value as `spawn` to
+ * `installSkillrepoGlobally({ spawn })`.
+ */
+
+import { EventEmitter } from "node:events";
+
+/**
+ * @typedef {Object} MockSpawnOptions
+ * @property {number} [exitCode=0]
+ * @property {Error & {code?: string}} [error]
+ * @property {string} [stderrText]
+ * @property {boolean} [hang]
+ * @property {number} [asyncDelayMs=0]
+ */
+
+/**
+ * Build a spawn stub. The returned function has shape:
+ *   (cmd: string, args: string[], opts: object) => ChildProcessMock
+ *
+ * @param {MockSpawnOptions} [options]
+ * @returns {Function & { calls: Array<{cmd: string, args: string[], opts: object}>, killed: boolean }}
+ */
+export function makeMockSpawn(options = {}) {
+  const {
+    exitCode = 0,
+    error = null,
+    stderrText = "",
+    hang = false,
+    asyncDelayMs = 0,
+  } = options;
+
+  const calls = [];
+
+  function mockSpawn(cmd, args, opts) {
+    calls.push({ cmd, args, opts });
+
+    // Mimic child_process.ChildProcess shape via plain EventEmitter.
+    // We create the streams unconditionally so the production code's
+    // `if (child.stderr)` checks work consistently.
+    const stdout = new EventEmitter();
+    const stderr = new EventEmitter();
+    const child = new EventEmitter();
+    child.stdout = stdout;
+    child.stderr = stderr;
+    child.kill = () => {
+      mockSpawn.killed = true;
+    };
+    // (`mockSpawn.killed` is initialized to `false` once on the
+    // outer factory below — we deliberately do NOT re-initialize
+    // here because re-initializing on every spawn call would
+    // overwrite `true` if the same spawn instance were called
+    // twice and the first call's kill had already fired.)
+
+    if (hang) {
+      // Never emit close or error. Caller's timeout will fire.
+      return child;
+    }
+
+    const fire = () => {
+      // Emit stderr data BEFORE close so production code sees the
+      // text in the buffer when categorizing the failure.
+      if (stderrText) {
+        stderr.emit("data", Buffer.from(stderrText, "utf-8"));
+      }
+      if (error) {
+        child.emit("error", error);
+      } else {
+        child.emit("close", exitCode);
+      }
+    };
+
+    if (asyncDelayMs > 0) {
+      setTimeout(fire, asyncDelayMs);
+    } else {
+      // process.nextTick mimics spawn's "events fire on next tick"
+      // contract — production code's `child.on("close", ...)`
+      // attaches listeners synchronously after spawn returns, and
+      // the events arrive on the next tick. setImmediate also works
+      // but is one tick later than necessary.
+      process.nextTick(fire);
+    }
+    return child;
+  }
+
+  mockSpawn.calls = calls;
+  mockSpawn.killed = false;
+  return mockSpawn;
+}

package/src/test/lib/cli-config.test.mjs

@@ -17,7 +17,8 @@ import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 
-import { resolveFlags, effectiveVendors, isNpxInvocation } from "../../lib/cli-config.mjs";
+import { resolveFlags, effectiveVendors } from "../../lib/cli-config.mjs";
+import { isTransientRunnerInvocation } from "../../lib/transient-runners.mjs";
 import { CliError, EXIT_AUTH, EXIT_VALIDATION } from "../../lib/errors.mjs";
 import {
   captureHome,
@@ -412,7 +413,7 @@ describe("effectiveVendors", () => {
   });
 });
 
-// ── isNpxInvocation ───────────────────────────────────────────────────
+// ── isTransientRunnerInvocation ───────────────────────────────────────────────────
 //
 // The helper detects whether the CLI was launched via `npx skillrepo`
 // vs. a stable global install. v3.1.0 shipped a bug where the session-
@@ -420,7 +421,7 @@ describe("effectiveVendors", () => {
 // as a stable install location — this helper is the fix mechanism.
 // Three independent signals are checked; any one is sufficient.
 
-describe("isNpxInvocation", () => {
+describe("isTransientRunnerInvocation", () => {
   let originalArgv;
   let originalNpmCommand;
   let originalUnderscore;
@@ -443,7 +444,7 @@ describe("isNpxInvocation", () => {
 
   it("returns false for a vanilla node invocation", () => {
     process.argv = ["/usr/local/bin/node", "/usr/local/bin/skillrepo"];
-    assert.equal(isNpxInvocation(), false);
+    assert.equal(isTransientRunnerInvocation(), false);
   });
 
   it("detects npx via the argv[1] _npx cache path", () => {
@@ -453,7 +454,7 @@ describe("isNpxInvocation", () => {
       "/usr/local/bin/node",
       "/Users/alice/.npm/_npx/dc129a78aca3fc9c/node_modules/.bin/skillrepo",
     ];
-    assert.equal(isNpxInvocation(), true);
+    assert.equal(isTransientRunnerInvocation(), true);
   });
 
   it("does NOT treat npm_command=exec as an npx signal (false-positive guard)", () => {
@@ -471,13 +472,13 @@ describe("isNpxInvocation", () => {
     // var, the invocation must be treated as a stable install.
     process.argv = ["/usr/local/bin/node", "/some/other/path/skillrepo"];
     process.env.npm_command = "exec";
-    assert.equal(isNpxInvocation(), false);
+    assert.equal(isTransientRunnerInvocation(), false);
   });
 
   it("detects npx via the _ env var ending in /npx (legacy fallback)", () => {
     process.argv = ["/usr/local/bin/node", "/path/skillrepo"];
     process.env._ = "/usr/local/bin/npx";
-    assert.equal(isNpxInvocation(), true);
+    assert.equal(isTransientRunnerInvocation(), true);
   });
 
   it("handles Windows _npx path separator", () => {
@@ -485,7 +486,7 @@ describe("isNpxInvocation", () => {
       "C:\\Program Files\\nodejs\\node.exe",
       "C:\\Users\\alice\\.npm\\_npx\\abc123\\node_modules\\.bin\\skillrepo",
     ];
-    assert.equal(isNpxInvocation(), true);
+    assert.equal(isTransientRunnerInvocation(), true);
   });
 
   it("does NOT false-positive on a path containing 'npx' substring but not in _npx cache", () => {
@@ -493,7 +494,63 @@ describe("isNpxInvocation", () => {
     // check matches `/_npx/` specifically (with leading slash), not
     // substring "npx", so this should be safely negative.
     process.argv = ["/usr/local/bin/node", "/opt/npxtools/bin/skillrepo"];
-    assert.equal(isNpxInvocation(), false);
+    assert.equal(isTransientRunnerInvocation(), false);
+  });
+
+  // ── v3.1.2: extended detection for pnpx, yarn dlx, bunx ──────────
+
+  it("detects pnpm dlx invocation via cache substring '/dlx-'", () => {
+    // pnpm dlx caches in `<store>/dlx-<hash>/...` per-invocation.
+    process.argv = [
+      "/usr/local/bin/node",
+      "/Users/alice/.local/share/pnpm/store/dlx-abc123/node_modules/.bin/skillrepo",
+    ];
+    assert.equal(isTransientRunnerInvocation(), true);
+  });
+
+  it("detects pnpm dlx invocation on Windows", () => {
+    process.argv = [
+      "C:\\Program Files\\nodejs\\node.exe",
+      "C:\\Users\\alice\\AppData\\Local\\pnpm\\store\\dlx-abc123\\node_modules\\.bin\\skillrepo.cmd",
+    ];
+    assert.equal(isTransientRunnerInvocation(), true);
+  });
+
+  it("detects yarn berry dlx invocation via '/.yarn/berry/' cache substring", () => {
+    process.argv = [
+      "/usr/local/bin/node",
+      "/Users/alice/project/.yarn/berry/cache/skillrepo-npm-3.1.2-abc/node_modules/skillrepo/bin/skillrepo.mjs",
+    ];
+    assert.equal(isTransientRunnerInvocation(), true);
+  });
+
+  it("detects bunx invocation via '/.bun/install/cache/' cache substring", () => {
+    process.argv = [
+      "/usr/local/bin/node",
+      "/Users/alice/.bun/install/cache/skillrepo@3.1.2/node_modules/.bin/skillrepo",
+    ];
+    assert.equal(isTransientRunnerInvocation(), true);
+  });
+
+  it("detects pnpx via process.env._ suffix", () => {
+    process.argv = ["/usr/local/bin/node", "/somewhere/skillrepo"];
+    process.env._ = "/usr/local/bin/pnpx";
+    assert.equal(isTransientRunnerInvocation(), true);
+  });
+
+  it("detects bunx via process.env._ suffix", () => {
+    process.argv = ["/usr/local/bin/node", "/somewhere/skillrepo"];
+    process.env._ = "/Users/alice/.bun/bin/bunx";
+    assert.equal(isTransientRunnerInvocation(), true);
+  });
+
+  it("does NOT false-positive on a directory name containing 'dlx' that is not pnpm dlx", () => {
+    // E.g. `/Users/alice/dlx-utils/bin/skillrepo` — the substring is
+    // present but it's not in a pnpm cache. The fingerprint requires
+    // a leading separator so `/dlx-` matches a path SEGMENT named
+    // `dlx-...`, which a user-named directory wouldn't typically be.
+    process.argv = ["/usr/local/bin/node", "/Users/alice/utility-dlx/bin/skillrepo"];
+    assert.equal(isTransientRunnerInvocation(), false);
   });
 });
 

package/src/test/lib/cli-version.test.mjs

@@ -0,0 +1,47 @@
+/**
+ * Unit tests for src/lib/cli-version.mjs (#894 / v3.1.2).
+ *
+ * Tiny module, tiny suite — but the cases below lock in the
+ * contract that `installSkillrepoGlobally({ version })` depends on.
+ * If the version read silently regressed (returned undefined,
+ * stale, or threw on a valid tarball), every npx user's
+ * auto-install would silently fail or pin to garbage.
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+import { getCliVersion } from "../../lib/cli-version.mjs";
+
+describe("getCliVersion", () => {
+  it("returns the version string from the CLI's own package.json", () => {
+    // FACT-based: read the package.json the same way the SUT does,
+    // then compare. If the version field changes (e.g. v3.1.3
+    // bump), this test passes automatically — it's not a literal
+    // assertion against "3.1.2", which would create churn on every
+    // version bump.
+    const pkgUrl = new URL(
+      "../../../package.json",
+      import.meta.url,
+    );
+    const pkg = JSON.parse(readFileSync(pkgUrl, "utf-8"));
+    assert.equal(getCliVersion(), pkg.version);
+  });
+
+  it("returns a valid semver-shaped string (X.Y.Z)", () => {
+    // Defense against a future regression where the package.json
+    // version is corrupted to a non-string (boolean, number,
+    // object). The CLI install command would silently produce
+    // garbage like `npm install -g skillrepo@true` without this
+    // shape check.
+    const v = getCliVersion();
+    assert.equal(typeof v, "string");
+    assert.match(v, /^\d+\.\d+\.\d+/);
+  });
+
+  it("returns a non-empty string", () => {
+    const v = getCliVersion();
+    assert.ok(v.length > 0, "version must be non-empty");
+  });
+});