skillrepo 4.3.0 → 4.5.0

package/src/test/commands/list.test.mjs

@@ -1,15 +1,24 @@
 /**
- * Unit/integration tests for src/commands/list.mjs (PR2 of #646).
+ * Unit/integration tests for src/commands/list.mjs.
+ *
+ * Originally covered the table render + --json basics (#679, PR2 of
+ * #646). Extended in #1555 with per-row drift state coverage:
+ *   - All four states (current / stale / missing / edited)
+ *   - Worst-state-wins rollup across detected vendors
+ *   - Library footer (4 ETag/last-sync cases)
+ *   - --json shape with new `state` + `placements[]` fields
  */
 
 import { describe, it, beforeEach, afterEach } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 
 import { runList } from "../../commands/list.mjs";
 import { CliError, EXIT_AUTH } from "../../lib/errors.mjs";
+import { computeSkillShas } from "../../lib/crypto-shas.mjs";
+import { globalLastSyncPath } from "../../lib/paths.mjs";
 import { createMockServer } from "../e2e/mock-server.mjs";
 import { createCaptureStream } from "../helpers/capture-stream.mjs";
 import {
@@ -176,3 +185,502 @@ describe("runList — error paths", () => {
     );
   });
 });
+
+// ── Drift state coverage (#1555) ────────────────────────────────────────
+//
+// These tests exercise the orchestration in list.mjs: the data sources
+// (library, .last-sync, detected agents, on-disk placements) come
+// together in `augmentSkill` to produce per-row `state` and the JSON
+// `placements[]` array. The lower-level state-classification and disk-
+// walk logic has its own exhaustive unit tests in drift.test.mjs and
+// placement-walk.test.mjs; here we verify the integration.
+
+const SKILL_MD_BODY = (name) =>
+  `---\nname: ${name}\ndescription: ${name} skill\n---\n\n# ${name}\n`;
+
+/**
+ * Force Claude Code to be the detected agent by setting CLAUDECODE
+ * (one of its registered env signals). Without forcing detection,
+ * the sandbox has no agents and every state is `missing`.
+ */
+function forceClaudeCodeDetected() {
+  process.env.CLAUDECODE = "1";
+}
+
+function unforceDetection() {
+  delete process.env.CLAUDECODE;
+}
+
+/**
+ * Seed a skill on disk at the claudeProject placement. Returns the
+ * SHAs computed from the seeded content — caller uses them when
+ * shaping the `.last-sync` baseline.
+ */
+function seedClaudeSkillOnDisk(skillName, files) {
+  const dir = join(process.cwd(), ".claude", "skills", skillName);
+  mkdirSync(dir, { recursive: true });
+  for (const file of files) {
+    const filePath = join(dir, ...file.path.split("/"));
+    mkdirSync(join(filePath, ".."), { recursive: true });
+    writeFileSync(filePath, file.content, "utf8");
+  }
+  return computeSkillShas(files);
+}
+
+/** Write a v2 .last-sync at the sandbox home. */
+function seedLastSync({ etag = '"v1"', syncedAt = "2025-01-01T00:00:00Z", skills = {} }) {
+  const stateDir = join(process.env.HOME, ".claude", "skillrepo");
+  mkdirSync(stateDir, { recursive: true });
+  writeFileSync(
+    globalLastSyncPath(),
+    JSON.stringify({ schemaVersion: 2, etag, syncedAt, skills }, null, 2),
+    "utf8",
+  );
+}
+
+describe("runList — drift state (#1555)", () => {
+  beforeEach(async () => {
+    await setup();
+    forceClaudeCodeDetected();
+  });
+  afterEach(async () => {
+    unforceDetection();
+    await teardown();
+  });
+
+  it("renders OK when SHA matches baseline and version matches library", async () => {
+    const files = [{ path: "SKILL.md", content: SKILL_MD_BODY("clean") }];
+    const shas = seedClaudeSkillOnDisk("clean", files);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/clean": {
+          version: "1.0.0",
+          skillMdSha256: shas.skillMdSha256,
+          filesSha256: shas.filesSha256,
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "clean", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    assert.match(out, /clean/);
+    // Non-TTY capture stream → ASCII tokens.
+    assert.match(out, /\bOK\b/);
+    assert.match(out, /library in sync/);
+  });
+
+  it("renders STALE when library version is newer than synced version", async () => {
+    const files = [{ path: "SKILL.md", content: SKILL_MD_BODY("aging") }];
+    const shas = seedClaudeSkillOnDisk("aging", files);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/aging": {
+          version: "1.0.0",
+          skillMdSha256: shas.skillMdSha256,
+          filesSha256: shas.filesSha256,
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v2"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "aging", "1.1.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    assert.match(out, /\bSTALE\b/);
+    assert.match(out, /library has changed since last sync/);
+  });
+
+  it("renders EDIT when SHA differs from baseline but version matches", async () => {
+    // Seed the disk with one content, baseline with a DIFFERENT SHA —
+    // simulates the user hand-editing the SKILL.md after sync.
+    seedClaudeSkillOnDisk("touched", [
+      { path: "SKILL.md", content: SKILL_MD_BODY("touched-modified") },
+    ]);
+    // Baseline SHAs intentionally arbitrary; they won't match what's on
+    // disk because we used a different content string.
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/touched": {
+          version: "1.0.0",
+          skillMdSha256: "f".repeat(64),
+          filesSha256: "e".repeat(64),
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "touched", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    assert.match(out, /\bEDIT\b/);
+    // ETag matches AND drift exists → footer must reflect that.
+    assert.match(out, /library in sync — but \d+ skill/);
+  });
+
+  it("renders MISS when skill is in library but no on-disk placement", async () => {
+    // No seedClaudeSkillOnDisk → no dir on disk.
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/absent": {
+          version: "1.0.0",
+          skillMdSha256: "a".repeat(64),
+          filesSha256: "b".repeat(64),
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "absent", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    assert.match(out, /\bMISS\b/);
+  });
+
+  it("renders MISS when there is no .last-sync baseline (fresh install)", async () => {
+    // Seed on disk but NO baseline. Per the spec ("fresh install →
+    // missing everywhere") and computeSkillState's documented choice,
+    // we report missing rather than fabricating a `current` verdict.
+    seedClaudeSkillOnDisk("orphan", [
+      { path: "SKILL.md", content: SKILL_MD_BODY("orphan") },
+    ]);
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "orphan", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    assert.match(out, /\bMISS\b/);
+    assert.match(out, /No sync history on this machine/);
+  });
+
+  it("footer: ✓ library in sync when ETag matches and no drift", async () => {
+    const files = [{ path: "SKILL.md", content: SKILL_MD_BODY("clean") }];
+    const shas = seedClaudeSkillOnDisk("clean", files);
+    seedLastSync({
+      etag: '"match"',
+      skills: {
+        "alice/clean": {
+          version: "1.0.0",
+          skillMdSha256: shas.skillMdSha256,
+          filesSha256: shas.filesSha256,
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"match"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "clean", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    assert.match(stdout.text(), /library in sync — local skills up to date/);
+  });
+
+  it("footer: library has changed when ETag differs", async () => {
+    seedLastSync({ etag: '"old"', skills: {} });
+    server.setEtag('"new"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "any")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    assert.match(stdout.text(), /library has changed since last sync/);
+  });
+
+  it("--json includes state and placements per item; no library wrapper", async () => {
+    const files = [{ path: "SKILL.md", content: SKILL_MD_BODY("scripted") }];
+    const shas = seedClaudeSkillOnDisk("scripted", files);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/scripted": {
+          version: "1.0.0",
+          skillMdSha256: shas.skillMdSha256,
+          filesSha256: shas.filesSha256,
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "scripted", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl, "--json"], { stdout });
+    const json = JSON.parse(stdout.text());
+    // Bare array preserved.
+    assert.ok(Array.isArray(json));
+    assert.equal(json.length, 1);
+    const item = json[0];
+    assert.equal(item.owner, "alice");
+    assert.equal(item.name, "scripted");
+    assert.equal(item.version, "1.0.0");
+    // New fields.
+    assert.equal(item.state, "current");
+    assert.ok(Array.isArray(item.placements));
+    assert.equal(item.placements.length, 1);
+    assert.deepEqual(item.placements[0], {
+      vendor: "claudeCode",
+      scope: "project",
+      state: "current",
+      localVersion: "1.0.0",
+    });
+  });
+
+  it("--json does NOT include any library-level footer fields", async () => {
+    // Verify the JSON contract is purely the existing bare-array shape
+    // with additive per-item fields — no top-level `library`, no
+    // `syncStatus`, no `summary`. Existing consumers stay unchanged.
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "x")],
+      removals: [],
+      syncedAt: "x",
+    });
+    await runList(["--key", VALID_KEY, "--url", serverUrl, "--json"], { stdout });
+    const parsed = JSON.parse(stdout.text());
+    assert.ok(Array.isArray(parsed));
+    // No object wrapper, no extra top-level keys.
+    assert.equal(parsed.constructor, Array);
+  });
+
+  it("renders worst-state-wins when multiple vendors are detected", async () => {
+    // claudeCode is detected via CLAUDECODE env var; force cursor too
+    // via its documented CURSOR_AGENT env signal. Seed the same skill
+    // in Claude's placement only — cursor will see it as MISSING and
+    // the rollup must therefore be MISSING (worst state wins).
+    process.env.CURSOR_AGENT = "1";
+    try {
+      const files = [{ path: "SKILL.md", content: SKILL_MD_BODY("split") }];
+      const shas = seedClaudeSkillOnDisk("split", files);
+      seedLastSync({
+        etag: '"v1"',
+        skills: {
+          "alice/split": {
+            version: "1.0.0",
+            skillMdSha256: shas.skillMdSha256,
+            filesSha256: shas.filesSha256,
+            syncedAt: "x",
+          },
+        },
+      });
+      server.setEtag('"v1"');
+      server.setLibraryResponse({
+        skills: [makeSkill("alice", "split", "1.0.0")],
+        removals: [],
+        syncedAt: "x",
+      });
+
+      await runList(["--key", VALID_KEY, "--url", serverUrl, "--json"], { stdout });
+      const [item] = JSON.parse(stdout.text());
+      // Rollup is MISSING because cursor's placement is missing.
+      assert.equal(item.state, "missing");
+      // Both vendors appear in placements with their own state.
+      const claude = item.placements.find((p) => p.vendor === "claudeCode");
+      const cursor = item.placements.find((p) => p.vendor === "cursor");
+      assert.ok(claude, "claudeCode placement must be present");
+      assert.ok(cursor, "cursor placement must be present");
+      assert.equal(claude.state, "current");
+      assert.equal(cursor.state, "missing");
+    } finally {
+      delete process.env.CURSOR_AGENT;
+    }
+  });
+
+  it("--json drift counter and human drift counter both reflect rollup", async () => {
+    // Two skills, one drifted, one clean. Verify the "1 needs
+    // attention" footer count + the JSON state field.
+    const cleanFiles = [{ path: "SKILL.md", content: SKILL_MD_BODY("clean") }];
+    const cleanShas = seedClaudeSkillOnDisk("clean", cleanFiles);
+    const driftFiles = [{ path: "SKILL.md", content: SKILL_MD_BODY("drift") }];
+    seedClaudeSkillOnDisk("drift", driftFiles);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/clean": {
+          version: "1.0.0",
+          skillMdSha256: cleanShas.skillMdSha256,
+          filesSha256: cleanShas.filesSha256,
+          syncedAt: "x",
+        },
+        "alice/drift": {
+          version: "1.0.0",
+          // Wrong SHA → drift detected as `edited`.
+          skillMdSha256: "0".repeat(64),
+          filesSha256: "0".repeat(64),
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [
+        makeSkill("alice", "clean", "1.0.0"),
+        makeSkill("alice", "drift", "1.0.0"),
+      ],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const human = stdout.text();
+    assert.match(human, /2 skills in your library/);
+    assert.match(human, /1 needs attention/);
+  });
+
+  it("no detected agents → all rows MISS, friendly message at top + no-sync footer", async () => {
+    // Don't force any agent detection — sandbox should have none.
+    // Critically, do NOT call seedLastSync here: writing the state
+    // file creates `~/.claude/skillrepo/`, and the existence of
+    // `~/.claude` is one of claudeCode's documented detection
+    // signals (`{ type: "home", value: ".claude" }`). The test
+    // would then see Claude Code as detected. The "no agents"
+    // scenario means: no .claude/ in HOME, no .agents/ anywhere,
+    // no env-var hints. seedLastSync's side effects defeat that.
+    unforceDetection();
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "lonely", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    assert.match(out, /No agents detected in this project/);
+    assert.match(out, /\bMISS\b/);
+    // Footer assertion (Phase 4 L4): without `.last-sync`, the
+    // "no sync history" footer must fire — same code path as the
+    // fresh-install test, but here we lock in that BOTH messages
+    // appear together so a regression that suppresses one but not
+    // the other is caught.
+    assert.match(out, /No sync history on this machine/);
+  });
+
+  it("renders MISS when .last-sync exists but has no entry for this skill", async () => {
+    // Real-world case: a teammate added a new skill to the library
+    // between our last `update` and this `list`. The library
+    // response includes the new skill, our `.last-sync` does not.
+    // Per spec: "no baseline → missing." The user runs `update` to
+    // get the new skill.
+    //
+    // This locks in Phase 4 M2's gap: previous tests only covered
+    // the no-`.last-sync`-file case. The partial-map case shares
+    // the code path but exercises the per-skill lookup, not the
+    // file-existence check.
+    const files = [{ path: "SKILL.md", content: SKILL_MD_BODY("known") }];
+    const shas = seedClaudeSkillOnDisk("known", files);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        // Only `known` is in the map. `new-skill` is not.
+        "alice/known": {
+          version: "1.0.0",
+          skillMdSha256: shas.skillMdSha256,
+          filesSha256: shas.filesSha256,
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [
+        makeSkill("alice", "known", "1.0.0"),
+        makeSkill("alice", "new-skill", "0.1.0"),
+      ],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl, "--json"], { stdout });
+    const json = JSON.parse(stdout.text());
+    const known = json.find((s) => s.name === "known");
+    const newer = json.find((s) => s.name === "new-skill");
+    assert.equal(known.state, "current");
+    // `new-skill` has no baseline in the map → MISSING per the
+    // computeSkillState contract, even though it's a brand-new
+    // skill that's never been on disk.
+    assert.equal(newer.state, "missing");
+  });
+
+  it("renders MISS when .last-sync entry has wrong-typed fields (validateBaselineShape guard)", async () => {
+    // PR #1566 removed the lookupSkill / getLastSyncSkillEntry
+    // helpers and replaced the per-entry shape guard with
+    // validateBaselineShape inside list.mjs. The removed helper tests
+    // covered partial / wrong-type entries; nothing replaced them
+    // at the list layer. This test re-establishes that property:
+    // a `.last-sync` file with a syntactically valid `skills` map
+    // but per-entry fields of the wrong type must NOT crash
+    // computeSkillState (e.g., via semver.gt receiving a number),
+    // and must render the affected skill as MISSING — the
+    // conservative verdict for cache state we cannot trust.
+    seedClaudeSkillOnDisk("weird", [
+      { path: "SKILL.md", content: SKILL_MD_BODY("weird") },
+    ]);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        // Per-entry shape is malformed: version is a number, SHAs
+        // are wrong types. readLastSync's top-level coercion does
+        // NOT touch per-entry shapes — that's validateBaselineShape's
+        // job.
+        "alice/weird": {
+          version: 42,
+          skillMdSha256: true,
+          filesSha256: null,
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "weird", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl, "--json"], { stdout });
+    const [item] = JSON.parse(stdout.text());
+    assert.equal(item.state, "missing");
+    // Sanity: no crash, output parses cleanly, the per-vendor
+    // placement also reports missing.
+    assert.equal(item.placements[0].state, "missing");
+    // `localVersion` should be null since the baseline was rejected.
+    assert.equal(item.placements[0].localVersion, null);
+  });
+});

package/src/test/lib/config.test.mjs

@@ -206,6 +206,39 @@ describe("writeConfig", () => {
     assert.equal(mode, 0o600, `Expected 0o600, got ${mode.toString(8)}`);
   });
 
+  // Telemetry opt-in/out flag persistence (#1539). The field is only
+  // written when the caller explicitly sets it (boolean) — omitting
+  // means "no preference recorded" and the telemetry module treats
+  // that as the opt-out-friendly default of enabled.
+  it("persists telemetry=true when explicitly set", () => {
+    writeConfig({
+      apiKey: "sk_live_abc",
+      serverUrl: "https://example.com",
+      telemetry: true,
+    });
+    const raw = JSON.parse(readFileSync(globalConfigPath(), "utf-8"));
+    assert.equal(raw.telemetry, true);
+  });
+
+  it("persists telemetry=false when explicitly set", () => {
+    writeConfig({
+      apiKey: "sk_live_abc",
+      serverUrl: "https://example.com",
+      telemetry: false,
+    });
+    const raw = JSON.parse(readFileSync(globalConfigPath(), "utf-8"));
+    assert.equal(raw.telemetry, false);
+  });
+
+  it("does NOT write a telemetry field when omitted (preserves no-preference state)", () => {
+    writeConfig({
+      apiKey: "sk_live_abc",
+      serverUrl: "https://example.com",
+    });
+    const raw = JSON.parse(readFileSync(globalConfigPath(), "utf-8"));
+    assert.equal("telemetry" in raw, false);
+  });
+
   it("throws validationError on missing apiKey", () => {
     assert.throws(
       () => writeConfig({ serverUrl: "https://example.com" }),