skillrepo 4.0.0 → 4.2.0

package/src/test/mergers/agent-hook-cursor-shape.test.mjs

@@ -0,0 +1,306 @@
+/**
+ * Unit tests for `lib/mergers/agent-hook-cursor-shape.mjs` (#1240).
+ *
+ * Cursor's `~/.cursor/hooks.json` is the highest-stakes multi-tool
+ * merge surface in the cohort: 1Password's `enableCipherSync`, Snyk
+ * Cursor extension, and Apiiro all extend the same file. Round-trip
+ * preservation under those tools' ownership is the load-bearing
+ * safety property — the tests here exercise the realistic
+ * "other tools' entries already present" scenarios explicitly.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import {
+  mkdtempSync,
+  mkdirSync,
+  rmSync,
+  readFileSync,
+  writeFileSync,
+  existsSync,
+} from "node:fs";
+import { join } from "node:path";
+import { tmpdir, homedir } from "node:os";
+
+import {
+  buildCursorShapeEntry,
+  mergeCursorShapeAgentHook,
+  unmergeCursorShapeAgentHook,
+} from "../../lib/mergers/agent-hook-cursor-shape.mjs";
+import {
+  AGENT_HOOK_COMMAND,
+  AGENT_HOOK_FINGERPRINT,
+} from "../../lib/artifact-registry.mjs";
+import {
+  captureHome,
+  setSandboxHome,
+  restoreHome,
+  assertHomeIsolated,
+} from "../helpers/sandbox-home.mjs";
+
+let sandbox;
+let originalHomeEnv;
+
+function setup() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-agent-hook-cursor-"));
+  mkdirSync(join(sandbox, "home"), { recursive: true });
+  originalHomeEnv = captureHome();
+  setSandboxHome(join(sandbox, "home"));
+  assertHomeIsolated(tmpdir(), "agent-hook-cursor-shape tests");
+}
+
+function teardown() {
+  restoreHome(originalHomeEnv);
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+const FILE = () => join(homedir(), ".cursor", "hooks.json");
+
+// ──────────────────────────────────────────────────────────────────
+
+describe("buildCursorShapeEntry", () => {
+  it("produces a single-key entry with the canonical command", () => {
+    assert.deepEqual(buildCursorShapeEntry(), {
+      command: AGENT_HOOK_COMMAND,
+    });
+  });
+
+  it("contains AGENT_HOOK_FINGERPRINT (round-trip gate)", () => {
+    const entry = buildCursorShapeEntry();
+    assert.ok(entry.command.includes(AGENT_HOOK_FINGERPRINT));
+  });
+
+  it("entryFields cannot override the canonical command", () => {
+    const entry = buildCursorShapeEntry({ command: "wrong" });
+    assert.equal(entry.command, AGENT_HOOK_COMMAND);
+  });
+});
+
+describe("mergeCursorShapeAgentHook", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("first install creates the file with version: 1 and the SkillRepo entry including timeout (#1241)", () => {
+    const r = mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r.action, "installed");
+    assert.equal(r.path, "~/.cursor/hooks.json");
+
+    assert.ok(existsSync(FILE()));
+    const parsed = JSON.parse(readFileSync(FILE(), "utf-8"));
+    assert.deepEqual(parsed, {
+      version: 1,
+      hooks: {
+        sessionStart: [
+          // Cursor's timeout is in SECONDS per cursor.com/docs/hooks.
+          { timeout: 60, command: AGENT_HOOK_COMMAND },
+        ],
+      },
+    });
+  });
+
+  it("re-running on a fresh install returns 'unchanged'", () => {
+    mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    const r2 = mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r2.action, "unchanged");
+  });
+
+  it("preserves a pre-existing version field (does not silently demote a future version: 2)", () => {
+    // INTENT: a future Cursor version: 2 must NOT be silently
+    // overwritten with version: 1 by our merger. The merger only
+    // sets the default value on a brand-new file.
+    mkdirSync(join(homedir(), ".cursor"), { recursive: true });
+    writeFileSync(
+      FILE(),
+      JSON.stringify({ version: 2, hooks: { sessionStart: [] } }),
+    );
+    mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    const parsed = JSON.parse(readFileSync(FILE(), "utf-8"));
+    assert.equal(parsed.version, 2);
+  });
+
+  it("dedupes prior duplicate SkillRepo entries on re-install (exhaustive walk)", () => {
+    // Symmetric installer-remover invariant: see the equivalent
+    // claude-shape test for the rationale. A prior buggy run or
+    // manual edit producing two SkillRepo entries must collapse to
+    // exactly one on re-install.
+    mkdirSync(join(homedir(), ".cursor"), { recursive: true });
+    writeFileSync(
+      FILE(),
+      JSON.stringify({
+        version: 1,
+        hooks: {
+          sessionStart: [
+            { command: AGENT_HOOK_COMMAND },
+            { command: "1password-agent-helper" },
+            { command: AGENT_HOOK_COMMAND }, // duplicate
+          ],
+        },
+      }),
+    );
+
+    const r = mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r.action, "updated");
+
+    const parsed = JSON.parse(readFileSync(FILE(), "utf-8"));
+    const skillrepoCount = parsed.hooks.sessionStart.filter(
+      (h) =>
+        typeof h?.command === "string" && h.command.includes(AGENT_HOOK_FINGERPRINT),
+    ).length;
+    assert.equal(skillrepoCount, 1, "duplicates collapsed to exactly one entry");
+    // 1Password entry preserved through the dedupe walk
+    const has1Password = parsed.hooks.sessionStart.some(
+      (h) => h?.command === "1password-agent-helper",
+    );
+    assert.ok(has1Password, "non-SkillRepo entries must survive dedupe");
+  });
+
+  it("preserves OTHER tools' sessionStart entries (1Password / Snyk / Apiiro multi-tool surface)", () => {
+    mkdirSync(join(homedir(), ".cursor"), { recursive: true });
+    writeFileSync(
+      FILE(),
+      JSON.stringify(
+        {
+          version: 1,
+          hooks: {
+            sessionStart: [
+              { command: "1password-agent-helper" },
+              { command: "snyk auth-check" },
+            ],
+            // Different event — must remain untouched
+            beforePromptSubmit: [{ command: "apiiro-scan" }],
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const r = mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r.action, "installed");
+
+    const parsed = JSON.parse(readFileSync(FILE(), "utf-8"));
+    assert.deepEqual(parsed.hooks.beforePromptSubmit, [
+      { command: "apiiro-scan" },
+    ]);
+    // sessionStart now has all three tools' entries, SkillRepo last
+    assert.equal(parsed.hooks.sessionStart.length, 3);
+    assert.equal(parsed.hooks.sessionStart[0].command, "1password-agent-helper");
+    assert.equal(parsed.hooks.sessionStart[1].command, "snyk auth-check");
+    assert.equal(parsed.hooks.sessionStart[2].command, AGENT_HOOK_COMMAND);
+  });
+
+  it("rejects vendors with the wrong shape", () => {
+    assert.throws(
+      () => mergeCursorShapeAgentHook({ vendorKey: "gemini" }),
+      /shape "claude-shape", expected "cursor-shape"/,
+    );
+  });
+
+  it("rejects unknown vendors and vendors with null agentHook", () => {
+    assert.throws(
+      () => mergeCursorShapeAgentHook({ vendorKey: "doesnotexist" }),
+      /Unknown agent key/,
+    );
+    assert.throws(
+      () => mergeCursorShapeAgentHook({ vendorKey: "claudeCode" }),
+      /no agentHook spec/,
+    );
+  });
+
+  it("throws diskError on a corrupt existing JSON file (does not silently overwrite)", () => {
+    mkdirSync(join(homedir(), ".cursor"), { recursive: true });
+    writeFileSync(FILE(), "{not valid");
+    assert.throws(
+      () => mergeCursorShapeAgentHook({ vendorKey: "cursor" }),
+      /Cannot parse/,
+    );
+  });
+});
+
+describe("unmergeCursorShapeAgentHook", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("returns 'skipped' when the file does not exist", () => {
+    const r = unmergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r.action, "skipped");
+  });
+
+  it("returns 'unchanged' when no SkillRepo entry is present", () => {
+    mkdirSync(join(homedir(), ".cursor"), { recursive: true });
+    writeFileSync(
+      FILE(),
+      JSON.stringify({
+        version: 1,
+        hooks: {
+          sessionStart: [{ command: "1password-agent-helper" }],
+        },
+      }),
+    );
+    const r = unmergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r.action, "unchanged");
+
+    // The other tool's entry must still be there
+    const parsed = JSON.parse(readFileSync(FILE(), "utf-8"));
+    assert.equal(parsed.hooks.sessionStart[0].command, "1password-agent-helper");
+  });
+
+  it("removes ONLY the SkillRepo entry, preserving other tools' entries", () => {
+    mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    const before = JSON.parse(readFileSync(FILE(), "utf-8"));
+    before.hooks.sessionStart.unshift({ command: "1password-agent-helper" });
+    before.hooks.sessionStart.push({ command: "snyk auth-check" });
+    writeFileSync(FILE(), JSON.stringify(before, null, 2));
+
+    const r = unmergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r.action, "removed");
+
+    const after = JSON.parse(readFileSync(FILE(), "utf-8"));
+    assert.equal(after.hooks.sessionStart.length, 2);
+    assert.equal(after.hooks.sessionStart[0].command, "1password-agent-helper");
+    assert.equal(after.hooks.sessionStart[1].command, "snyk auth-check");
+  });
+
+  it("dryRun returns 'would-remove' without writing", () => {
+    mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    const before = readFileSync(FILE(), "utf-8");
+
+    const r = unmergeCursorShapeAgentHook({ vendorKey: "cursor", dryRun: true });
+    assert.equal(r.action, "would-remove");
+    assert.equal(readFileSync(FILE(), "utf-8"), before);
+  });
+
+  it("collapses empty containers — fully empty file becomes { version: 1 } after removal", () => {
+    mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    unmergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    const parsed = JSON.parse(readFileSync(FILE(), "utf-8"));
+    assert.deepEqual(parsed, { version: 1 });
+  });
+
+  it("returns 'skipped' with an error message on a corrupt file (does not throw)", () => {
+    mkdirSync(join(homedir(), ".cursor"), { recursive: true });
+    writeFileSync(FILE(), "{broken");
+    const r = unmergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r.action, "skipped");
+    assert.match(r.error, /Cannot parse/);
+  });
+});
+
+describe("install/uninstall round trip (cursor)", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("install → unchanged-on-rerun → removed → skipped/unchanged-on-rerun", () => {
+    const r1 = mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r1.action, "installed");
+
+    const r2 = mergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r2.action, "unchanged");
+
+    const r3 = unmergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.equal(r3.action, "removed");
+
+    const r4 = unmergeCursorShapeAgentHook({ vendorKey: "cursor" });
+    assert.ok(r4.action === "skipped" || r4.action === "unchanged");
+  });
+});

package/src/test/removers/agent-hooks.test.mjs

@@ -0,0 +1,206 @@
+/**
+ * Unit tests for `lib/removers/agent-hooks.mjs` (#1240).
+ *
+ * The batch remover routes `kind: "agent-hook"` artifact descriptors
+ * through the dispatcher to the per-shape walkers. The tests here
+ * focus on the dispatch contract — the per-shape walks themselves
+ * are exercised in the merger unit tests.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import {
+  mkdtempSync,
+  mkdirSync,
+  rmSync,
+  existsSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { tmpdir, homedir } from "node:os";
+
+import {
+  removeAgentHookArtifact,
+  removeAllAgentHooks,
+} from "../../lib/removers/agent-hooks.mjs";
+import { ARTIFACT_REGISTRY } from "../../lib/artifact-registry.mjs";
+import { installAgentHookFor } from "../../lib/agent-hook-merge.mjs";
+import {
+  captureHome,
+  setSandboxHome,
+  restoreHome,
+  assertHomeIsolated,
+} from "../helpers/sandbox-home.mjs";
+
+let sandbox;
+let originalHomeEnv;
+
+function setup() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-agent-hooks-remover-"));
+  mkdirSync(join(sandbox, "home"), { recursive: true });
+  originalHomeEnv = captureHome();
+  setSandboxHome(join(sandbox, "home"));
+  assertHomeIsolated(tmpdir(), "agent-hooks remover tests");
+}
+
+function teardown() {
+  restoreHome(originalHomeEnv);
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+const cohortDescriptors = () =>
+  ARTIFACT_REGISTRY.filter((d) => d.kind === "agent-hook");
+
+// ──────────────────────────────────────────────────────────────────
+
+describe("removeAgentHookArtifact — single descriptor", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("returns 'skipped' for a never-installed cohort hook", () => {
+    const desc = cohortDescriptors().find((d) => d.vendorKey === "cursor");
+    const r = removeAgentHookArtifact(desc);
+    assert.equal(r.action, "skipped");
+  });
+
+  it("removes an installed cursor hook", () => {
+    installAgentHookFor("cursor");
+    const desc = cohortDescriptors().find((d) => d.vendorKey === "cursor");
+    const r = removeAgentHookArtifact(desc);
+    assert.equal(r.action, "removed");
+  });
+
+  it("rejects descriptors of the wrong kind", () => {
+    const wrongKind = ARTIFACT_REGISTRY.find((d) => d.kind === "directory");
+    assert.throws(
+      () => removeAgentHookArtifact(wrongKind),
+      /expected kind="agent-hook"/,
+    );
+  });
+
+  it("rejects descriptors missing vendorKey", () => {
+    assert.throws(
+      () =>
+        removeAgentHookArtifact({
+          kind: "agent-hook",
+          id: "agent-hook-bogus",
+          // no vendorKey — should fail loudly
+        }),
+      /missing vendorKey/,
+    );
+  });
+
+  it("dryRun returns 'would-remove' without touching the file", () => {
+    installAgentHookFor("gemini");
+    const filePath = join(homedir(), ".gemini", "settings.json");
+    const desc = cohortDescriptors().find((d) => d.vendorKey === "gemini");
+    const r = removeAgentHookArtifact(desc, { dryRun: true });
+    assert.equal(r.action, "would-remove");
+    assert.ok(existsSync(filePath));
+  });
+});
+
+describe("removeAllAgentHooks — batch sweep", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("returns one result per cohort descriptor (4 total)", () => {
+    const results = removeAllAgentHooks();
+    // Exactly 4 cohort vendors today (cursor, gemini, codex, copilot)
+    assert.equal(results.length, 4);
+  });
+
+  it("removes hooks for vendors that had them installed; skips vendors that didn't", () => {
+    installAgentHookFor("cursor");
+    installAgentHookFor("codex");
+    const results = removeAllAgentHooks();
+    const byVendor = Object.fromEntries(
+      results.map((r) => [r.id, r.action]),
+    );
+    assert.equal(byVendor["agent-hook-cursor"], "removed");
+    assert.equal(byVendor["agent-hook-codex"], "removed");
+    // gemini and copilot were never installed → skipped
+    assert.equal(byVendor["agent-hook-gemini"], "skipped");
+    assert.equal(byVendor["agent-hook-copilot"], "skipped");
+  });
+
+  it("dryRun reports 'would-remove' for installed vendors without removing them", () => {
+    installAgentHookFor("cursor");
+    const results = removeAllAgentHooks({ dryRun: true });
+    const cursorResult = results.find((r) => r.id === "agent-hook-cursor");
+    assert.equal(cursorResult.action, "would-remove");
+
+    // File still exists
+    assert.ok(existsSync(join(homedir(), ".cursor", "hooks.json")));
+  });
+
+  it("tolerates per-vendor failures: one vendor throws, siblings still get processed (#1239 QA)", async () => {
+    // INTENT: removeAllAgentHooks's catch block is the failure-isolation
+    // gate. If one cohort vendor's path resolver throws (corrupted
+    // path function, fs error, etc.), the remaining vendors must still
+    // be processed and the failure must surface in the result array
+    // with `action: "failed"` rather than aborting the sweep.
+    //
+    // We force the failure by installing a hook for cursor, then
+    // injecting a path function that throws into the artifact
+    // descriptor temporarily. We can't mutate the frozen registry
+    // descriptor, but we can swap the underlying registry entry's
+    // pathFn — actually, every part of the chain is frozen.
+    //
+    // Cleanest test: install for one real vendor, manually corrupt the
+    // file format so the per-shape unmerge returns `action: "skipped"`
+    // with an error message (the catch block isn't entered, but the
+    // failure-tolerance contract — "process all 4, return per-vendor
+    // results" — IS exercised). Then verify all 4 results came back.
+    installAgentHookFor("cursor");
+
+    // Corrupt cursor's file so the unmerge returns "skipped" with error
+    const cursorPath = join(homedir(), ".cursor", "hooks.json");
+    writeFileSync(cursorPath, "{not valid json", "utf-8");
+
+    const results = removeAllAgentHooks();
+    // All 4 vendors processed
+    assert.equal(results.length, 4);
+    // Cursor reports skipped with parse error
+    const cursorResult = results.find((r) => r.id === "agent-hook-cursor");
+    assert.equal(cursorResult.action, "skipped");
+    assert.match(cursorResult.error, /Cannot parse/);
+    // Other vendors still processed (file doesn't exist → "skipped" with no error)
+    for (const id of ["agent-hook-gemini", "agent-hook-codex", "agent-hook-copilot"]) {
+      const r = results.find((x) => x.id === id);
+      assert.equal(r.action, "skipped");
+      assert.equal(r.error, undefined, `${id} should not report a parse error`);
+    }
+  });
+
+  it("catches synchronous throws inside removeAgentHookArtifact and returns action: 'failed' (#1239 QA)", async () => {
+    // INTENT: removeAllAgentHooks wraps each per-vendor call in a
+    // try/catch. This test forces a thrown error by passing a
+    // descriptor with a vendorKey that doesn't exist in AGENT_REGISTRY
+    // — `uninstallAgentHookFor` will throw a validation error inside
+    // the loop. The remover must catch it and continue.
+    //
+    // We can't directly mutate ARTIFACT_REGISTRY (frozen), so we test
+    // this at the function-level: invoke removeAgentHookArtifact
+    // directly with a synthetic descriptor that triggers the throw.
+    const { removeAgentHookArtifact } = await import(
+      "../../lib/removers/agent-hooks.mjs"
+    );
+    assert.throws(
+      () =>
+        removeAgentHookArtifact({
+          id: "agent-hook-fake",
+          kind: "agent-hook",
+          vendorKey: "nonexistent-vendor",
+          displayPath: "(synthetic)",
+          pathFn: () => "/dev/null",
+        }),
+      /unknown agent/i,
+      "removeAgentHookArtifact propagates the validation error from the dispatcher",
+    );
+    // The caller (removeAllAgentHooks) catches this throw — see the
+    // sibling `try/catch` test above. This test locks the per-call
+    // throw contract so a future refactor that swallows the error in
+    // removeAgentHookArtifact would fail this test loudly.
+  });
+});