skillrepo 4.0.0 → 4.2.0

package/src/test/commands/init.test.mjs

@@ -908,6 +908,287 @@ describe("runInit — session sync (#884)", () => {
   });
 });
 
+// ── runInit — cohort SessionStart hooks (#1240) ────────────────────
+//
+// Sibling step to the Claude session-hook block above. These tests
+// exercise the cohort installer wired in init.mjs step 6 alongside
+// `installSessionSyncHook`. The cohort installer writes user-scope
+// hook configs for Cursor / Gemini CLI / Codex CLI / VS Code +
+// Copilot — every selected vendor with a non-null `agentHook` spec.
+//
+// HOME isolation is the load-bearing safety property: the cohort
+// hooks live at `~/.<vendor>/...` so a sandbox HOME leak would
+// pollute the developer's real home. The setupWithShim helper
+// already overrides HOME / USERPROFILE; that's the gate.
+
+describe("runInit — cohort SessionStart hooks (#1240)", () => {
+  beforeEach(setupWithShim);
+  afterEach(teardownWithShim);
+
+  it("writes cohort hooks for every selected non-Claude vendor with --yes --agent", async () => {
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor,gemini,codex,copilot",
+        "--json",
+      ],
+      { stdout, stderr },
+    );
+
+    const json = JSON.parse(stdout.text());
+    assert.ok(
+      Array.isArray(json.sessionSync.cohortHooks),
+      "sessionSync.cohortHooks must be an array",
+    );
+    assert.equal(json.sessionSync.cohortHooks.length, 4);
+    for (const r of json.sessionSync.cohortHooks) {
+      assert.equal(
+        r.action,
+        "installed",
+        `expected install for ${r.vendorKey}, got ${r.action}`,
+      );
+    }
+
+    // Each vendor's file landed on disk under the sandbox HOME
+    const home = join(sandbox, "home");
+    assert.ok(existsSync(join(home, ".cursor", "hooks.json")));
+    assert.ok(existsSync(join(home, ".gemini", "settings.json")));
+    assert.ok(existsSync(join(home, ".codex", "hooks.json")));
+    assert.ok(
+      existsSync(
+        join(home, ".copilot", "hooks", "skillrepo-update.json"),
+      ),
+    );
+  });
+
+  it("each cohort hook command is `npx --yes skillrepo update --silent`", async () => {
+    // INTENT: the universal command is the single source of truth.
+    // A future refactor that drifts one vendor's command out of sync
+    // breaks the round-trip uninstall via the shared fingerprint.
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor,gemini",
+      ],
+      { stdout, stderr },
+    );
+
+    const home = join(sandbox, "home");
+
+    const cursor = JSON.parse(
+      readFileSync(join(home, ".cursor", "hooks.json"), "utf-8"),
+    );
+    assert.equal(
+      cursor.hooks.sessionStart[0].command,
+      "npx --yes skillrepo update --silent",
+    );
+    assert.equal(cursor.version, 1);
+
+    const gemini = JSON.parse(
+      readFileSync(join(home, ".gemini", "settings.json"), "utf-8"),
+    );
+    const geminiHook = gemini.hooks.SessionStart[0].hooks[0];
+    assert.equal(geminiHook.command, "npx --yes skillrepo update --silent");
+    assert.equal(geminiHook.type, "command");
+    assert.equal(geminiHook.timeout, 60000);
+  });
+
+  it("--no-session-sync skips ALL cohort hooks (semantics widened in #1240)", async () => {
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor,gemini",
+        "--no-session-sync",
+        "--json",
+      ],
+      { stdout, stderr },
+    );
+
+    const json = JSON.parse(stdout.text());
+    // No cohort hooks installed
+    assert.equal(json.sessionSync.cohortHooks.length, 0);
+
+    // Files do not exist
+    const home = join(sandbox, "home");
+    assert.ok(!existsSync(join(home, ".cursor", "hooks.json")));
+    assert.ok(!existsSync(join(home, ".gemini", "settings.json")));
+  });
+
+  it("re-running init is idempotent — exactly one cohort entry per vendor file", async () => {
+    const args = [
+      "--key", VALID_KEY,
+      "--url", serverUrl,
+      "--yes",
+      "--agent", "cursor,gemini",
+    ];
+    await runInit(args, { stdout, stderr });
+    stdout.clear();
+    await runInit([...args, "--json"], { stdout, stderr });
+
+    // Second run reports unchanged for every cohort vendor
+    const json = JSON.parse(stdout.text());
+    for (const r of json.sessionSync.cohortHooks) {
+      assert.equal(r.action, "unchanged", `${r.vendorKey} should be unchanged`);
+    }
+
+    // Cursor file has exactly one SkillRepo entry, not two
+    const home = join(sandbox, "home");
+    const cursor = JSON.parse(
+      readFileSync(join(home, ".cursor", "hooks.json"), "utf-8"),
+    );
+    const skillrepoEntries = cursor.hooks.sessionStart.filter((h) =>
+      h.command?.includes("skillrepo update --silent"),
+    );
+    assert.equal(skillrepoEntries.length, 1);
+  });
+
+  it("does NOT install cohort hooks for vendors not in the selected list", async () => {
+    // --agent cursor only → gemini/codex/copilot files must NOT exist
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor",
+        "--json",
+      ],
+      { stdout, stderr },
+    );
+
+    const home = join(sandbox, "home");
+    assert.ok(existsSync(join(home, ".cursor", "hooks.json")));
+    assert.ok(!existsSync(join(home, ".gemini", "settings.json")));
+    assert.ok(!existsSync(join(home, ".codex", "hooks.json")));
+    assert.ok(
+      !existsSync(join(home, ".copilot", "hooks", "skillrepo-update.json")),
+    );
+
+    const json = JSON.parse(stdout.text());
+    assert.equal(json.sessionSync.cohortHooks.length, 1);
+    assert.equal(json.sessionSync.cohortHooks[0].vendorKey, "cursor");
+  });
+
+  it("does NOT install cohort hooks for windsurf or cline (deferred per agent registry)", async () => {
+    // Windsurf and Cline are deliberately excluded from the cohort
+    // installer per the registry's `agentHook: null`. A user
+    // selecting them should get file-based skill placement but NO
+    // hook-config writes.
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "windsurf,cline",
+        "--json",
+      ],
+      { stdout, stderr },
+    );
+
+    const home = join(sandbox, "home");
+    assert.ok(!existsSync(join(home, ".cline", "hooks.json")));
+    // Windsurf has no hook config file by spec
+    const json = JSON.parse(stdout.text());
+    assert.equal(json.sessionSync.cohortHooks.length, 0);
+  });
+
+  it("Copilot install surfaces a Preview-status warning to the user (#1244)", async () => {
+    // INTENT: GitHub currently labels Copilot's hook system as
+    // Preview. The init step-6 cohort flow adds a one-time `p.warning`
+    // when Copilot was among the installed vendors so a user knows
+    // the hook schema may shift before GA. This test locks the warning
+    // to the installed-Copilot path.
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "copilot",
+      ],
+      { stdout, stderr },
+    );
+    assert.match(
+      stdout.text(),
+      /Copilot.*Preview/,
+      "Copilot's Preview-status caveat must surface on a successful copilot install",
+    );
+  });
+
+  it("Preview warning does NOT fire when Copilot is not selected", async () => {
+    // INTENT: the warning is Copilot-specific. Installing for cohort
+    // vendors WITHOUT Copilot must not surface the Preview note.
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor,gemini",
+      ],
+      { stdout, stderr },
+    );
+    assert.doesNotMatch(
+      stdout.text(),
+      /Preview/,
+      "Preview warning is Copilot-specific and must NOT fire for cursor/gemini installs",
+    );
+  });
+
+  it("init JSON output's cohortHooks array reports per-vendor failures with reason (#1239 coverage gap 44)", async () => {
+    // INTENT: when a per-vendor cohort install fails (e.g. corrupt
+    // existing hook config), the failure must surface in
+    // `sessionSync.cohortHooks[].action === "failed"` with a `reason`
+    // field. Force a failure by pre-seeding Cursor's hook file with
+    // invalid JSON so the merger throws diskError.
+    const home = join(sandbox, "home");
+    mkdirSync(join(home, ".cursor"), { recursive: true });
+    writeFileSync(
+      join(home, ".cursor", "hooks.json"),
+      "{not valid json",
+    );
+
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor,gemini",
+        "--json",
+      ],
+      { stdout, stderr },
+    );
+    const json = JSON.parse(stdout.text());
+
+    const cursorResult = json.sessionSync.cohortHooks.find(
+      (h) => h.vendorKey === "cursor",
+    );
+    assert.equal(
+      cursorResult.action,
+      "failed",
+      "cursor install must report failed when its config is corrupt",
+    );
+    assert.match(
+      cursorResult.reason,
+      /Cannot parse/,
+      "failure reason must be actionable (parse error mentions the file)",
+    );
+
+    // Critical: sibling vendor still installed despite cursor's failure
+    const geminiResult = json.sessionSync.cohortHooks.find(
+      (h) => h.vendorKey === "gemini",
+    );
+    assert.equal(
+      geminiResult.action,
+      "installed",
+      "Gemini install must succeed even when Cursor's failed (per-vendor isolation)",
+    );
+  });
+});
+
 // ── v3.1.1 patch fixes: init UX bugs surfaced by real-world npx use ──
 //
 // Real-user `npx skillrepo@latest init` session surfaced four bugs in

package/src/test/commands/push.test.mjs

@@ -0,0 +1,289 @@
+/**
+ * Unit / integration tests for `src/commands/push.mjs` (#1455).
+ *
+ * Runs against the mock server which exposes `POST /api/v1/library`
+ * (multipart upsert). The mock doesn't actually parse multipart — it
+ * just checks the Content-Type and serves either a configured response
+ * (via `setPushResponse`) or a default 201 LibraryPushResponse.
+ *
+ * Coverage: happy paths (created / updated / unchanged), JSON output,
+ * missing-path / missing-SKILL.md errors, invalid frontmatter,
+ * idempotency-key flag.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { runPush } from "../../commands/push.mjs";
+import { CliError, EXIT_VALIDATION } from "../../lib/errors.mjs";
+import { createMockServer } from "../e2e/mock-server.mjs";
+import { createCaptureStream } from "../helpers/capture-stream.mjs";
+import {
+  captureHome,
+  setSandboxHome,
+  restoreHome,
+} from "../helpers/sandbox-home.mjs";
+
+let sandbox;
+let server;
+let serverUrl;
+let originalCwd;
+let originalHomeEnv;
+let stdout;
+const VALID_KEY = "sk_live_test";
+
+const VALID_SKILL_MD = `---
+name: my-skill
+description: A skill exercising the push command
+---
+
+# my-skill
+
+body
+`;
+
+function file(rel, content = "x") {
+  const abs = join(sandbox, "skill", rel);
+  mkdirSync(join(abs, ".."), { recursive: true });
+  writeFileSync(abs, content);
+}
+
+async function setup() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-cmd-push-"));
+  mkdirSync(join(sandbox, "skill"), { recursive: true });
+  mkdirSync(join(sandbox, "home"), { recursive: true });
+  originalCwd = process.cwd();
+  originalHomeEnv = captureHome();
+  process.chdir(sandbox);
+  setSandboxHome(join(sandbox, "home"));
+  delete process.env.SKILLREPO_ACCESS_KEY;
+
+  server = createMockServer({});
+  const port = await server.start();
+  serverUrl = `http://127.0.0.1:${port}`;
+
+  stdout = createCaptureStream();
+}
+
+async function teardown() {
+  if (server) await server.stop();
+  process.chdir(originalCwd);
+  restoreHome(originalHomeEnv);
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+  server = null;
+}
+
+describe("runPush — happy paths", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("pushes a fresh skill (default response: 201 created)", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    file("references/intro.md", "intro");
+
+    await runPush(
+      ["--key", VALID_KEY, "--url", serverUrl, "skill"],
+      { stdout },
+    );
+
+    assert.match(stdout.text(), /Created @mock\/test-skill/);
+  });
+
+  it("--json prints action / bump / owner / name / version / filesUploaded", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    file("references/intro.md", "intro");
+
+    await runPush(
+      ["--key", VALID_KEY, "--url", serverUrl, "--json", "skill"],
+      { stdout },
+    );
+
+    const json = JSON.parse(stdout.text());
+    assert.equal(json.action, "created");
+    assert.equal(json.owner, "mock");
+    assert.equal(json.name, "test-skill");
+    assert.equal(json.version, "1.0");
+    // SKILL.md + 1 supporting file = 2 (the walker includes SKILL.md as
+    // a regular file per the agentskills.io spec).
+    assert.equal(json.filesUploaded, 2);
+    assert.equal(json.bump, null);
+  });
+
+  it("reports 'updated' with bump when server returns action=updated", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 200,
+      body: {
+        action: "updated",
+        bump: "minor",
+        skill: {
+          owner: "alice",
+          name: "my-skill",
+          version: "1.1",
+          description: "A skill exercising the push command",
+          keywords: [],
+          updatedAt: new Date().toISOString(),
+          etag: '"alice/my-skill@0"',
+          contextSignals: null,
+          files: [],
+          filesIncomplete: false,
+        },
+      },
+    });
+
+    await runPush(
+      ["--key", VALID_KEY, "--url", serverUrl, "skill"],
+      { stdout },
+    );
+
+    assert.match(stdout.text(), /Released @alice\/my-skill v1\.1.*minor bump/);
+  });
+
+  it("reports 'no changes' when server returns action=unchanged", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 200,
+      body: {
+        action: "unchanged",
+        bump: null,
+        skill: {
+          owner: "alice",
+          name: "my-skill",
+          version: "1.0",
+          description: "A skill exercising the push command",
+          keywords: [],
+          updatedAt: new Date().toISOString(),
+          etag: '"alice/my-skill@0"',
+          contextSignals: null,
+          files: [],
+          filesIncomplete: false,
+        },
+      },
+    });
+
+    await runPush(
+      ["--key", VALID_KEY, "--url", serverUrl, "skill"],
+      { stdout },
+    );
+
+    assert.match(stdout.text(), /No changes — @alice\/my-skill is already at v1\.0/);
+  });
+});
+
+describe("runPush — input validation", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("errors when no path is provided", async () => {
+    await assert.rejects(
+      runPush(["--key", VALID_KEY, "--url", serverUrl], { stdout }),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_VALIDATION &&
+        /Missing skill directory path/.test(err.message),
+    );
+  });
+
+  it("errors when the path doesn't exist", async () => {
+    await assert.rejects(
+      runPush(
+        ["--key", VALID_KEY, "--url", serverUrl, "./does-not-exist"],
+        { stdout },
+      ),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_VALIDATION &&
+        /Path not found/.test(err.message),
+    );
+  });
+
+  it("errors when the path is a file, not a directory", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    await assert.rejects(
+      runPush(
+        ["--key", VALID_KEY, "--url", serverUrl, "skill/SKILL.md"],
+        { stdout },
+      ),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_VALIDATION &&
+        /Not a directory/.test(err.message),
+    );
+  });
+
+  it("errors when SKILL.md is missing", async () => {
+    // Empty `skill/` directory — no SKILL.md.
+    await assert.rejects(
+      runPush(
+        ["--key", VALID_KEY, "--url", serverUrl, "skill"],
+        { stdout },
+      ),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_VALIDATION &&
+        /No SKILL\.md at skill\/SKILL\.md/.test(err.message),
+    );
+  });
+
+  it("errors when SKILL.md frontmatter is missing the `name` field", async () => {
+    file("SKILL.md", "---\ndescription: only description\n---\n\nbody\n");
+    await assert.rejects(
+      runPush(
+        ["--key", VALID_KEY, "--url", serverUrl, "skill"],
+        { stdout },
+      ),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_VALIDATION &&
+        /SKILL\.md is missing the required `name` field/.test(err.message),
+    );
+  });
+
+  it("errors when SKILL.md frontmatter is malformed YAML", async () => {
+    file("SKILL.md", "---\nname: [unclosed\n---\n");
+    await assert.rejects(
+      runPush(
+        ["--key", VALID_KEY, "--url", serverUrl, "skill"],
+        { stdout },
+      ),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+});
+
+describe("runPush — flags", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("--idempotency-key requires a value", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    await assert.rejects(
+      runPush(
+        ["--key", VALID_KEY, "--url", serverUrl, "--idempotency-key"],
+        { stdout },
+      ),
+      (err) => /Missing value for --idempotency-key/.test(err.message),
+    );
+  });
+
+  it("accepts --idempotency-key + path together", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    await runPush(
+      [
+        "--key",
+        VALID_KEY,
+        "--url",
+        serverUrl,
+        "--idempotency-key",
+        "test-key-123",
+        "skill",
+      ],
+      { stdout },
+    );
+    // Default server response is 201 created.
+    assert.match(stdout.text(), /Created @mock\/test-skill/);
+  });
+});