skillrepo 3.2.0 → 4.1.0

package/src/test/e2e/cli-cohort-hooks.test.mjs

@@ -0,0 +1,393 @@
+/**
+ * E2E permutation matrix for the cohort SessionStart hooks (#1240).
+ *
+ * Spawns the real CLI binary and asserts on the user-visible result —
+ * what files land at what paths, what JSON shape they have, what the
+ * `--json` summary reports, and whether `uninstall --global` reverses
+ * everything cleanly.
+ *
+ * The harness mirrors `cli-agent-permutations.test.mjs` exactly:
+ * shared mock server for the library endpoint, per-test mkdtemp for
+ * cwd + HOME, and a `runCli` helper that always resolves with
+ * stdout / stderr / status.
+ *
+ * The gap this file closes is the user-layer: "after I run init with
+ * --agent cursor,gemini, what's actually in ~/.cursor/hooks.json and
+ * ~/.gemini/settings.json on disk?" The unit tests prove the
+ * mergers' shape contracts; the integration tests prove the
+ * dispatcher's filesystem behavior; this test proves the binary
+ * actually exercises both end-to-end.
+ *
+ * NOTE on `npx --yes` and the hook command: the universal hook
+ * command is `npx --yes skillrepo update --silent`. Invoking `npx`
+ * inside the test would either fetch from npm (slow, network-
+ * dependent) or fail in offline CI. We do NOT execute the hook
+ * command in this test — we only verify it was WRITTEN correctly to
+ * disk. Verifying execution end-to-end requires a global install,
+ * which the smoke-test script (`scripts/smoke-cohort-hooks.sh`)
+ * exercises out-of-band.
+ */
+
+import { describe, it, before, after, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import {
+  mkdtempSync,
+  rmSync,
+  existsSync,
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+} from "node:fs";
+import { join, dirname, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { execFile } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+import { createMockServer } from "./mock-server.mjs";
+import { AGENT_HOOK_COMMAND } from "../../lib/artifact-registry.mjs";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const CLI_BIN = resolve(__dirname, "../../../bin/skillrepo.mjs");
+const VALID_KEY = "sk_live_test_e2e";
+
+let server;
+let port;
+let tempDir;
+let tempHome;
+
+function makeSkill(owner, name) {
+  return {
+    owner,
+    name,
+    version: "1.0.0",
+    description: `${name} description`,
+    files: [
+      {
+        path: "SKILL.md",
+        content: `---\nname: ${name}\ndescription: ${name} description\n---\n\nbody\n`,
+        sha256: "x",
+        size: 100,
+        contentType: "text/markdown",
+      },
+    ],
+    updatedAt: "2025-01-01T00:00:00Z",
+  };
+}
+
+function runCli(args, extraEnv = {}) {
+  return new Promise((resolve) => {
+    execFile(
+      process.execPath,
+      [CLI_BIN, ...args],
+      {
+        cwd: tempDir,
+        encoding: "utf-8",
+        timeout: 15_000,
+        env: {
+          ...process.env,
+          HOME: tempHome,
+          USERPROFILE: tempHome, // Windows isolation
+          NO_COLOR: "1",
+          NODE_NO_WARNINGS: "1",
+          SKILLREPO_ACCESS_KEY: "",
+          SKILLREPO_TIMEOUT_MS: "5000",
+          ...extraEnv,
+        },
+      },
+      (err, stdout, stderr) => {
+        resolve({
+          stdout: stdout ?? "",
+          stderr: stderr ?? "",
+          status: err ? err.code ?? 1 : 0,
+        });
+      },
+    );
+  });
+}
+
+describe("CLI E2E — cohort SessionStart hooks (#1240)", () => {
+  before(async () => {
+    server = createMockServer({});
+    port = await server.start();
+  });
+
+  after(async () => {
+    if (server) await server.stop();
+  });
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "cli-e2e-cohort-"));
+    tempHome = mkdtempSync(join(tmpdir(), "cli-e2e-cohort-home-"));
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "demo-skill")],
+      removals: [],
+      syncedAt: "x",
+    });
+    server.setEtag(null);
+    server.clearSkillResponses();
+    server.setSearchResponse({
+      skills: [],
+      pagination: { total: 0, limit: 20, offset: 0 },
+    });
+  });
+
+  afterEach(() => {
+    if (tempDir) rmSync(tempDir, { recursive: true, force: true });
+    if (tempHome) rmSync(tempHome, { recursive: true, force: true });
+  });
+
+  // ── Per-vendor file shape verification ─────────────────────────
+
+  it("init --agent cursor writes ~/.cursor/hooks.json with cursor-shape JSON", async () => {
+    const r = await runCli([
+      "init",
+      "--key", VALID_KEY,
+      "--url", `http://127.0.0.1:${port}`,
+      "--yes",
+      "--agent", "cursor",
+      "--json",
+    ]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+
+    const filePath = join(tempHome, ".cursor", "hooks.json");
+    assert.ok(existsSync(filePath));
+    const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+    assert.equal(parsed.version, 1);
+    assert.equal(parsed.hooks.sessionStart[0].command, AGENT_HOOK_COMMAND);
+
+    const json = JSON.parse(r.stdout);
+    assert.equal(json.sessionSync.cohortHooks.length, 1);
+    assert.equal(json.sessionSync.cohortHooks[0].vendorKey, "cursor");
+    assert.equal(json.sessionSync.cohortHooks[0].action, "installed");
+  });
+
+  it("init --agent gemini writes ~/.gemini/settings.json with claude-shape + timeout: 60000", async () => {
+    const r = await runCli([
+      "init",
+      "--key", VALID_KEY,
+      "--url", `http://127.0.0.1:${port}`,
+      "--yes",
+      "--agent", "gemini",
+      "--json",
+    ]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+
+    const filePath = join(tempHome, ".gemini", "settings.json");
+    assert.ok(existsSync(filePath));
+    const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+    const inner = parsed.hooks.SessionStart[0].hooks[0];
+    assert.equal(inner.command, AGENT_HOOK_COMMAND);
+    assert.equal(inner.type, "command");
+    assert.equal(inner.timeout, 60000);
+  });
+
+  it("init --agent codex writes ~/.codex/hooks.json with timeout: 60 seconds (#1243)", async () => {
+    // Codex's timeout is in SECONDS per the Codex hooks source.
+    // Distinct from Gemini's milliseconds. Verified against
+    // codex-rs/hooks/.
+    const r = await runCli([
+      "init",
+      "--key", VALID_KEY,
+      "--url", `http://127.0.0.1:${port}`,
+      "--yes",
+      "--agent", "codex",
+      "--json",
+    ]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+
+    const filePath = join(tempHome, ".codex", "hooks.json");
+    assert.ok(existsSync(filePath));
+    const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+    const inner = parsed.hooks.SessionStart[0].hooks[0];
+    assert.equal(inner.command, AGENT_HOOK_COMMAND);
+    assert.equal(inner.type, "command");
+    assert.equal(inner.timeout, 60);
+    // No matcher on Codex group — that's Gemini-specific (#1242)
+    assert.equal(parsed.hooks.SessionStart[0].matcher, undefined);
+  });
+
+  it("init --agent copilot writes ~/.copilot/hooks/skillrepo-update.json with lowercase sessionStart event (#1244)", async () => {
+    // Copilot's spec uses lowercase `sessionStart` per VS Code +
+    // Copilot's hook docs. Distinct from Gemini and Codex's
+    // uppercase. Per-tool single file (no merge concerns within).
+    const r = await runCli([
+      "init",
+      "--key", VALID_KEY,
+      "--url", `http://127.0.0.1:${port}`,
+      "--yes",
+      "--agent", "copilot",
+      "--json",
+    ]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+
+    const filePath = join(tempHome, ".copilot", "hooks", "skillrepo-update.json");
+    assert.ok(existsSync(filePath), "Copilot per-tool hook file must exist");
+    const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+    // Lowercase event name (Phase 4 fix)
+    assert.ok(Array.isArray(parsed.hooks.sessionStart));
+    assert.equal(parsed.hooks.SessionStart, undefined);
+    const inner = parsed.hooks.sessionStart[0].hooks[0];
+    assert.equal(inner.command, AGENT_HOOK_COMMAND);
+    assert.equal(inner.type, "command");
+    assert.equal(inner.timeout, 60);
+  });
+
+  // ── Multi-vendor combined run ──────────────────────────────────
+
+  it("init --agent cursor,gemini,codex,copilot writes all four hook files", async () => {
+    const r = await runCli([
+      "init",
+      "--key", VALID_KEY,
+      "--url", `http://127.0.0.1:${port}`,
+      "--yes",
+      "--agent", "cursor,gemini,codex,copilot",
+      "--json",
+    ]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+
+    assert.ok(existsSync(join(tempHome, ".cursor", "hooks.json")));
+    assert.ok(existsSync(join(tempHome, ".gemini", "settings.json")));
+    assert.ok(existsSync(join(tempHome, ".codex", "hooks.json")));
+    assert.ok(
+      existsSync(join(tempHome, ".copilot", "hooks", "skillrepo-update.json")),
+    );
+
+    const json = JSON.parse(r.stdout);
+    assert.equal(json.sessionSync.cohortHooks.length, 4);
+    for (const h of json.sessionSync.cohortHooks) {
+      assert.equal(h.action, "installed");
+    }
+  });
+
+  // ── --no-session-sync escape hatch ─────────────────────────────
+
+  it("init --no-session-sync skips ALL cohort hooks (semantics widened in #1240)", async () => {
+    const r = await runCli([
+      "init",
+      "--key", VALID_KEY,
+      "--url", `http://127.0.0.1:${port}`,
+      "--yes",
+      "--no-session-sync",
+      "--agent", "cursor,gemini,codex,copilot",
+      "--json",
+    ]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+
+    // None of the hook files should exist
+    assert.ok(!existsSync(join(tempHome, ".cursor", "hooks.json")));
+    assert.ok(!existsSync(join(tempHome, ".gemini", "settings.json")));
+    assert.ok(!existsSync(join(tempHome, ".codex", "hooks.json")));
+    assert.ok(
+      !existsSync(join(tempHome, ".copilot", "hooks", "skillrepo-update.json")),
+    );
+
+    const json = JSON.parse(r.stdout);
+    assert.equal(json.sessionSync.cohortHooks.length, 0);
+  });
+
+  // ── Idempotency on re-run ──────────────────────────────────────
+
+  it("re-running init with the same flags reports unchanged for every cohort vendor", async () => {
+    const baseArgs = [
+      "init",
+      "--key", VALID_KEY,
+      "--url", `http://127.0.0.1:${port}`,
+      "--yes",
+      "--agent", "cursor,gemini",
+    ];
+    const r1 = await runCli(baseArgs);
+    assert.equal(r1.status, 0, `first init stderr: ${r1.stderr}`);
+
+    const r2 = await runCli([...baseArgs, "--json"]);
+    assert.equal(r2.status, 0, `second init stderr: ${r2.stderr}`);
+    const json = JSON.parse(r2.stdout);
+    for (const h of json.sessionSync.cohortHooks) {
+      assert.equal(h.action, "unchanged", `${h.vendorKey} should be unchanged`);
+    }
+  });
+
+  // ── Multi-tool merge surface ───────────────────────────────────
+
+  it("init --agent cursor preserves a pre-existing 1Password entry in ~/.cursor/hooks.json", async () => {
+    // Seed the hook file with a "1Password" entry before init runs.
+    // The cohort installer must add the SkillRepo entry alongside
+    // without removing the pre-existing one.
+    mkdirSync(join(tempHome, ".cursor"), { recursive: true });
+    writeFileSync(
+      join(tempHome, ".cursor", "hooks.json"),
+      JSON.stringify(
+        {
+          version: 1,
+          hooks: { sessionStart: [{ command: "1password-agent-helper" }] },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const r = await runCli([
+      "init",
+      "--key", VALID_KEY,
+      "--url", `http://127.0.0.1:${port}`,
+      "--yes",
+      "--agent", "cursor",
+    ]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+
+    const parsed = JSON.parse(
+      readFileSync(join(tempHome, ".cursor", "hooks.json"), "utf-8"),
+    );
+    assert.equal(parsed.hooks.sessionStart.length, 2);
+    assert.equal(
+      parsed.hooks.sessionStart[0].command,
+      "1password-agent-helper",
+    );
+    assert.equal(parsed.hooks.sessionStart[1].command, AGENT_HOOK_COMMAND);
+  });
+
+  // ── Uninstall round-trip ──────────────────────────────────────
+
+  it("uninstall --global --yes removes every cohort hook the previous init wrote", async () => {
+    // Install all four
+    const init = await runCli([
+      "init",
+      "--key", VALID_KEY,
+      "--url", `http://127.0.0.1:${port}`,
+      "--yes",
+      "--agent", "cursor,gemini,codex,copilot",
+    ]);
+    assert.equal(init.status, 0, `init stderr: ${init.stderr}`);
+
+    // Confirm files exist
+    const files = [
+      join(tempHome, ".cursor", "hooks.json"),
+      join(tempHome, ".gemini", "settings.json"),
+      join(tempHome, ".codex", "hooks.json"),
+      join(tempHome, ".copilot", "hooks", "skillrepo-update.json"),
+    ];
+    for (const f of files) assert.ok(existsSync(f), `${f} must exist before uninstall`);
+
+    // Run uninstall --global --yes
+    const uninstall = await runCli([
+      "uninstall",
+      "--global",
+      "--yes",
+      "--json",
+    ]);
+    assert.equal(uninstall.status, 0, `uninstall stderr: ${uninstall.stderr}`);
+
+    // Each cohort hook is no longer present in its file.
+    // The file may or may not exist depending on whether uninstall
+    // walked it down to {} or left an empty container — both are
+    // valid post-uninstall states. What matters is no SkillRepo
+    // command remains.
+    for (const f of files) {
+      if (!existsSync(f)) continue;
+      const content = readFileSync(f, "utf-8");
+      assert.ok(
+        !content.includes("skillrepo update --silent"),
+        `${f} still contains a SkillRepo command after uninstall`,
+      );
+    }
+  });
+});

package/src/test/e2e/cli-commands.test.mjs

@@ -432,7 +432,9 @@ describe("CLI E2E — read commands", () => {
   // ── PR3b: init ──────────────────────────────────────────────────
 
   it("init writes config + MCP + runs first sync (happy path)", async () => {
-    // Create a .claude/ marker so detectIdes finds claudeCode
+    // Create a .claude/ marker so detection finds claudeCode (the
+    // Phase 3 picker pre-checks the Claude Code row when its signal
+    // fires).
     mkdirSync(join(tempDir, ".claude"), { recursive: true });
 
     const r = await runCli([
@@ -468,28 +470,52 @@ describe("CLI E2E — read commands", () => {
     assert.equal(json.account.slug, "mock");
   });
 
-  it("init --ide claude works in empty dir (headless CI scenario)", async () => {
+  it("init --agent claude works in empty dir (non-interactive scenario)", async () => {
     const r = await runCli([
       "init",
       "--key", VALID_KEY,
       "--url", `http://127.0.0.1:${port}`,
       "--yes",
-      "--ide", "claude",
+      "--agent", "claude",
     ]);
     assert.equal(r.status, 0, `stderr: ${r.stderr}`);
     assert.ok(existsSync(join(tempDir, ".mcp.json")));
   });
 
-  it("init with no IDEs detected and no --ide exits 5", async () => {
-    // No .claude marker, no --ide flag
-    const r = await runCli([
-      "init",
-      "--key", VALID_KEY,
-      "--url", `http://127.0.0.1:${port}`,
-      "--yes",
-    ]);
-    assert.equal(r.status, 5);
-    assert.match(r.stderr, /No IDEs detected/);
+  it("init in an empty dir under --yes configures both default targets (#1236)", async () => {
+    // Phase 3 (#1236) replaced the "No agent targets detected → refuse"
+    // branch with the two-row picker. Under --yes with no detection
+    // signals, both rows are pre-checked (the spec rationale: writing
+    // a few KB the user didn't strictly need is trivial; CI running
+    // `init --yes` on a fresh clone and writing nothing is broken
+    // automation). The CLI must succeed and configure both targets.
+    //
+    // The env-var clears below force the genuine "no signal" state.
+    // The test host's shell may have CLAUDECODE=1 (Claude Code
+    // session), CURSOR_AGENT=1, etc. — without clearing those, the
+    // subprocess detection would pre-fire, defeating the test.
+    const r = await runCli(
+      [
+        "init",
+        "--key", VALID_KEY,
+        "--url", `http://127.0.0.1:${port}`,
+        "--yes",
+        "--json",
+      ],
+      {
+        CLAUDECODE: "",
+        CURSOR_AGENT: "",
+        CURSOR_CLI: "",
+        GEMINI_CLI: "",
+        CLINE_ACTIVE: "",
+      },
+    );
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    const json = JSON.parse(r.stdout);
+    assert.equal(json.action, "initialized");
+    // Both targets present: claudeCode + the cohort.
+    assert.ok(json.vendors.includes("claudeCode"));
+    assert.ok(json.vendors.length > 1, "cohort vendors must also be configured");
   });
 
   it("init with 401 from validate exits 2", async () => {