skillrepo 4.0.0 → 4.2.0

package/src/test/lib/artifact-registry.test.mjs

@@ -81,6 +81,27 @@ const MERGER_EXPECTED = Object.freeze({
   // know to look in the right place. Round-trip contracts are
   // verified in src/test/mergers/session-hook.test.mjs.
   "session-hook": ["settings-session-hook", "settings-session-hook-global"],
+  // Cohort SessionStart-hook installers added by #1240. Two installer
+  // modules — one per schema variant — both writing entries whose
+  // `command` field equals AGENT_HOOK_COMMAND so the shared
+  // `removers/agent-hooks.mjs` batch remover finds them via
+  // AGENT_HOOK_FINGERPRINT.
+  //
+  //   - claude-shape: nested `hooks.<Event>[i].hooks[j]` entries.
+  //     Used by Gemini CLI, Codex CLI, and VS Code + Copilot.
+  //   - cursor-shape: flat `hooks.<event>[i]` entries with a
+  //     root-level `version: 1`. Used by Cursor.
+  //
+  // Each writes one descriptor id per vendor it installs for; the
+  // dispatcher (`agent-hook-merge.mjs`) routes one vendor key per
+  // call but a single shape merger may be invoked for multiple
+  // vendors over the course of an init run.
+  "agent-hook-claude-shape": [
+    "agent-hook-gemini",
+    "agent-hook-codex",
+    "agent-hook-copilot",
+  ],
+  "agent-hook-cursor-shape": ["agent-hook-cursor"],
 });
 
 /**
@@ -100,6 +121,17 @@ const REMOVER_EXPECTED = Object.freeze({
   // local and global variants go through the same walk with the
   // settings remover's `{ global }` option.
   settings: ["settings-session-hook", "settings-session-hook-global"],
+  // Cohort SessionStart-hook batch remover added by #1240. One file
+  // covers all four cohort vendors — the dispatcher routes by
+  // `vendorKey` to the right shape-specific walker. The four
+  // descriptor ids are derived from AGENT_REGISTRY (one per vendor
+  // with non-null `agentHook`).
+  "agent-hooks": [
+    "agent-hook-cursor",
+    "agent-hook-gemini",
+    "agent-hook-codex",
+    "agent-hook-copilot",
+  ],
 });
 
 /**
@@ -250,12 +282,19 @@ describe("artifact-registry: drift enforcement", () => {
     // Catches a descriptor that uses a `kind` the dispatch table
     // doesn't understand — would produce a runtime "no remover
     // bound" error at uninstall time rather than a clean test failure.
+    //
+    // `agent-hook` was added in #1240 alongside the cohort
+    // SessionStart hook framework. Its dispatch lives in
+    // `commands/uninstall.mjs:runForDescriptor` (kind branch above
+    // the FILE_REMOVERS lookup) and routes to
+    // `removers/agent-hooks.mjs:removeAgentHookArtifact`.
     const VALID_KINDS = new Set([
       "json-key",
       "json-input",
       "line",
       "section",
       "directory",
+      "agent-hook",
     ]);
     for (const d of ARTIFACT_REGISTRY) {
       assert.ok(

package/src/test/lib/http.test.mjs

@@ -39,6 +39,7 @@ import {
   searchSkills,
   addSkillToLibrary,
   removeSkillFromLibrary,
+  pushSkill,
   isCliSource,
   CLI_SOURCE_VALUES,
 } from "../../lib/http.mjs";
@@ -795,7 +796,7 @@ describe("addSkillToLibrary", () => {
   it("returns { status: 'added' } on 201", async () => {
     const srv = await startServer((req, res) => {
       assert.equal(req.method, "POST");
-      assert.match(req.url, /^\/api\/v1\/library$/);
+      assert.match(req.url, /^\/api\/v1\/library\/refs$/);
       assert.equal(req.headers["content-type"], "application/json");
       jsonRes(res, 201, {
         added: {
@@ -988,6 +989,246 @@ describe("addSkillToLibrary", () => {
   });
 });
 
+// ── pushSkill (#1455 multipart upsert) ─────────────────────────────────
+
+describe("pushSkill", () => {
+  const SKILL_MD = "---\nname: my-skill\ndescription: t\n---\n\nbody\n";
+
+  /**
+   * Helper: read the request's Content-Type and verify it's multipart;
+   * accept the body without parsing. Tests assert on the response shape
+   * the helper returns and on headers / URL.
+   */
+  function makePushServer(handler) {
+    return startServer(handler);
+  }
+
+  it("hits POST /api/v1/library with multipart Content-Type", async () => {
+    const srv = await makePushServer((req, res) => {
+      assert.equal(req.method, "POST");
+      assert.match(req.url, /^\/api\/v1\/library$/);
+      assert.match(req.headers["content-type"] ?? "", /multipart\/form-data/);
+      jsonRes(res, 201, {
+        action: "created",
+        bump: null,
+        skill: { owner: "mock", name: "my-skill", version: "1.0" },
+      });
+    });
+    try {
+      await pushSkill(srv.url, VALID_KEY, {
+        files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+      });
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("sends an Idempotency-Key header on every request (auto-generated)", async () => {
+    let observedKey;
+    const srv = await makePushServer((req, res) => {
+      observedKey = req.headers["idempotency-key"];
+      jsonRes(res, 201, {
+        action: "created",
+        bump: null,
+        skill: { owner: "mock", name: "my-skill", version: "1.0" },
+      });
+    });
+    try {
+      await pushSkill(srv.url, VALID_KEY, {
+        files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+      });
+      assert.ok(observedKey, "Idempotency-Key header should be present");
+      assert.ok(observedKey.length >= 16, "Auto-generated key should be reasonably long");
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("threads an explicit idempotencyKey through to the header", async () => {
+    let observedKey;
+    const srv = await makePushServer((req, res) => {
+      observedKey = req.headers["idempotency-key"];
+      jsonRes(res, 201, {
+        action: "created",
+        bump: null,
+        skill: { owner: "mock", name: "my-skill", version: "1.0" },
+      });
+    });
+    try {
+      await pushSkill(srv.url, VALID_KEY, {
+        files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+        idempotencyKey: "custom-key-abc",
+      });
+      assert.equal(observedKey, "custom-key-abc");
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("returns { action: 'created', bump: null, skill } on 201", async () => {
+    const srv = await makePushServer((req, res) => {
+      jsonRes(res, 201, {
+        action: "created",
+        bump: null,
+        skill: { owner: "mock", name: "my-skill", version: "1.0" },
+      });
+    });
+    try {
+      const result = await pushSkill(srv.url, VALID_KEY, {
+        files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+      });
+      assert.equal(result.action, "created");
+      assert.equal(result.bump, null);
+      assert.equal(result.skill.version, "1.0");
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("returns { action: 'updated', bump: 'minor' | 'major' } on 200 update", async () => {
+    const srv = await makePushServer((req, res) => {
+      jsonRes(res, 200, {
+        action: "updated",
+        bump: "minor",
+        skill: { owner: "mock", name: "my-skill", version: "1.1" },
+      });
+    });
+    try {
+      const result = await pushSkill(srv.url, VALID_KEY, {
+        files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+      });
+      assert.equal(result.action, "updated");
+      assert.equal(result.bump, "minor");
+      assert.equal(result.skill.version, "1.1");
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("returns { action: 'unchanged', bump: null } on 200 no-op", async () => {
+    const srv = await makePushServer((req, res) => {
+      jsonRes(res, 200, {
+        action: "unchanged",
+        bump: null,
+        skill: { owner: "mock", name: "my-skill", version: "1.0" },
+      });
+    });
+    try {
+      const result = await pushSkill(srv.url, VALID_KEY, {
+        files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+      });
+      assert.equal(result.action, "unchanged");
+      assert.equal(result.bump, null);
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("throws networkError on 2xx with unknown `action` (server contract violation)", async () => {
+    const srv = await makePushServer((req, res) => {
+      jsonRes(res, 200, {
+        action: "weird",
+        skill: { owner: "x", name: "x", version: "1.0" },
+      });
+    });
+    try {
+      await assert.rejects(
+        () =>
+          pushSkill(srv.url, VALID_KEY, {
+            files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+          }),
+        (err) =>
+          err instanceof CliError && err.exitCode === EXIT_NETWORK,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("maps 403 plan_limit through mapErrorResponse to validationError", async () => {
+    const srv = await makePushServer((req, res) => {
+      jsonRes(res, 403, {
+        error: "Plan limit reached",
+        code: "plan_limit",
+      });
+    });
+    try {
+      await assert.rejects(
+        () =>
+          pushSkill(srv.url, VALID_KEY, {
+            files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+          }),
+        (err) =>
+          err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("maps 413 payload_too_large through mapErrorResponse", async () => {
+    const srv = await makePushServer((req, res) => {
+      jsonRes(res, 413, {
+        error: "Payload exceeds limit",
+        code: "payload_too_large",
+      });
+    });
+    try {
+      await assert.rejects(
+        () =>
+          pushSkill(srv.url, VALID_KEY, {
+            files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+          }),
+        (err) => err instanceof CliError,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("retries on transient 5xx (Idempotency-Key makes retry safe)", async () => {
+    let calls = 0;
+    const srv = await makePushServer((req, res) => {
+      calls++;
+      if (calls === 1) {
+        jsonRes(res, 503, { error: "transient" });
+        return;
+      }
+      jsonRes(res, 201, {
+        action: "created",
+        bump: null,
+        skill: { owner: "mock", name: "my-skill", version: "1.0" },
+      });
+    });
+    try {
+      const result = await pushSkill(srv.url, VALID_KEY, {
+        files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+      });
+      assert.equal(result.action, "created");
+      assert.ok(calls >= 2, "Should have retried at least once");
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("guards against empty serverUrl / apiKey via the cross-cutting check", async () => {
+    await assert.rejects(
+      () =>
+        pushSkill("", VALID_KEY, {
+          files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+        }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+    await assert.rejects(
+      () =>
+        pushSkill("http://x", "", {
+          files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+        }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_AUTH,
+    );
+  });
+});
+
 // ── removeSkillFromLibrary (PR3a) ──────────────────────────────────────
 
 describe("removeSkillFromLibrary", () => {

package/src/test/lib/skill-walk.test.mjs

@@ -0,0 +1,127 @@
+/**
+ * Unit tests for `walkSkillFiles` (#1455).
+ *
+ * Verifies the walker's exclusion + path-normalization rules:
+ *   - Hidden files / dirs (anything starting with `.`) are excluded
+ *   - `node_modules` directories are excluded
+ *   - Root `SKILL.md` is INCLUDED (uploaded uniformly with other files
+ *     per the agentskills.io spec)
+ *   - Returned paths are POSIX-style + sorted
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { walkSkillFiles } from "../../lib/skill-walk.mjs";
+
+let sandbox;
+
+beforeEach(() => {
+  sandbox = mkdtempSync(join(tmpdir(), "skillrepo-walk-"));
+});
+
+afterEach(() => {
+  rmSync(sandbox, { recursive: true, force: true });
+});
+
+function file(rel, content = "x") {
+  const abs = join(sandbox, rel);
+  mkdirSync(join(abs, ".."), { recursive: true });
+  writeFileSync(abs, content);
+}
+
+describe("walkSkillFiles", () => {
+  it("returns all skill files in deterministic (sorted) order", async () => {
+    file("SKILL.md", "---\nname: x\n---\n");
+    file("references/intro.md");
+    file("scripts/run.sh");
+    file("assets/logo.png");
+
+    const walked = await walkSkillFiles(sandbox);
+    const paths = walked.map((f) => f.relativePath);
+    // `localeCompare` sorts uppercase after lowercase, so SKILL.md
+    // lands last among entries with no subdir prefix.
+    assert.deepEqual(paths, [
+      "assets/logo.png",
+      "references/intro.md",
+      "scripts/run.sh",
+      "SKILL.md",
+    ]);
+  });
+
+  it("includes root SKILL.md as a regular file (agentskills.io spec)", async () => {
+    file("SKILL.md", "---\nname: x\n---\n");
+    file("references/a.md");
+
+    const walked = await walkSkillFiles(sandbox);
+    const paths = walked.map((f) => f.relativePath);
+    assert.ok(paths.includes("SKILL.md"));
+    assert.deepEqual(paths, ["references/a.md", "SKILL.md"]);
+  });
+
+  it("excludes hidden files and dirs at every depth", async () => {
+    file("SKILL.md");
+    file(".env");
+    file(".git/HEAD");
+    file(".vscode/settings.json");
+    file("references/.DS_Store");
+    file("references/.hidden/secret");
+    file("references/foo.md");
+
+    const walked = await walkSkillFiles(sandbox);
+    const paths = walked.map((f) => f.relativePath);
+    assert.deepEqual(paths, ["references/foo.md", "SKILL.md"]);
+  });
+
+  it("excludes node_modules directories", async () => {
+    file("SKILL.md");
+    file("node_modules/foo/index.js");
+    file("scripts/node_modules/bar/index.js");
+    file("references/intro.md");
+
+    const walked = await walkSkillFiles(sandbox);
+    const paths = walked.map((f) => f.relativePath);
+    assert.deepEqual(paths, ["references/intro.md", "SKILL.md"]);
+  });
+
+  it("uses POSIX forward-slash paths even on Windows-style separators", async () => {
+    file("SKILL.md");
+    file("references/nested/deep.md");
+
+    const walked = await walkSkillFiles(sandbox);
+    const paths = walked.map((f) => f.relativePath);
+    for (const p of paths) {
+      assert.ok(!p.includes("\\"), `Path ${p} contains backslash`);
+    }
+    assert.ok(paths.includes("SKILL.md"));
+    assert.ok(paths.includes("references/nested/deep.md"));
+  });
+
+  it("returns just SKILL.md when the directory has only SKILL.md + hidden files", async () => {
+    file("SKILL.md");
+    file(".env");
+    file(".git/HEAD");
+
+    const walked = await walkSkillFiles(sandbox);
+    const paths = walked.map((f) => f.relativePath);
+    assert.deepEqual(paths, ["SKILL.md"]);
+  });
+
+  it("returns absolute paths + sizes for each file", async () => {
+    file("SKILL.md", "ab");
+    file("references/a.md", "abc");
+
+    const walked = await walkSkillFiles(sandbox);
+    assert.equal(walked.length, 2);
+    const refEntry = walked.find((f) => f.relativePath === "references/a.md");
+    assert.ok(refEntry);
+    assert.ok(refEntry.absolutePath.startsWith(sandbox));
+    assert.equal(refEntry.size, 3);
+    const skillEntry = walked.find((f) => f.relativePath === "SKILL.md");
+    assert.ok(skillEntry);
+    assert.equal(skillEntry.size, 2);
+  });
+});