skillrepo 4.8.0 → 4.8.2

package/src/test/lib/global-install.test.mjs

@@ -359,6 +359,140 @@ describe("installSkillrepoGlobally — happy path", () => {
   });
 });
 
+// ── installSkillrepoGlobally — synchronous + async spawn errors ──
+
+describe("installSkillrepoGlobally — spawn error edge paths", () => {
+  it("maps a SYNCHRONOUS non-ENOENT spawn throw to npm-nonzero", async () => {
+    // Some Node versions surface certain spawn failures synchronously.
+    // The catch around `spawn(...)` distinguishes ENOENT (→ enoent-npm)
+    // from everything else (→ npm-nonzero). This covers the non-ENOENT
+    // synchronous branch: a thrown error WITHOUT code "ENOENT".
+    const spawnThatThrows = () => {
+      throw Object.assign(new Error("EPERM: operation not permitted"), {
+        code: "EPERM",
+      });
+    };
+    const result = await installSkillrepoGlobally({
+      version: "3.1.2",
+      spawn: spawnThatThrows,
+      platform: "linux",
+    });
+    assert.equal(result.success, false);
+    assert.equal(result.errorCode, "npm-nonzero");
+    assert.match(result.error, /Failed to spawn npm/);
+    assert.match(result.error, /EPERM/);
+  });
+
+  it("maps a synchronous throw with no `code` field to npm-nonzero (defensive)", async () => {
+    // `err && err.code === "ENOENT"` short-circuits on a falsy code —
+    // a bare Error with no code lands on the generic npm-nonzero return.
+    const spawnThatThrows = () => {
+      throw new Error("weird synchronous failure");
+    };
+    const result = await installSkillrepoGlobally({
+      version: "3.1.2",
+      spawn: spawnThatThrows,
+      platform: "linux",
+    });
+    assert.equal(result.errorCode, "npm-nonzero");
+    assert.match(result.error, /weird synchronous failure/);
+  });
+
+  it("maps a SYNCHRONOUS ENOENT spawn throw to enoent-npm", async () => {
+    // Some Node versions throw ENOENT synchronously from spawn() rather
+    // than via the async `error` event. The synchronous catch must
+    // recognize `code === "ENOENT"` and return enoent-npm, identical to
+    // the async ENOENT path. Covers the `err.code === "ENOENT"` TRUE
+    // branch of the synchronous catch.
+    const spawnThatThrows = () => {
+      throw Object.assign(new Error("spawn npm ENOENT"), { code: "ENOENT" });
+    };
+    const result = await installSkillrepoGlobally({
+      version: "3.1.2",
+      spawn: spawnThatThrows,
+      platform: "linux",
+    });
+    assert.equal(result.success, false);
+    assert.equal(result.errorCode, "enoent-npm");
+    assert.match(result.error, /npm.*not found/i);
+  });
+
+  it("a synchronous throw of a message-less error falls back to String(err)", async () => {
+    // `err?.message ?? String(err)` — the `??` triggers only on
+    // null/undefined, so the message must be absent (not empty) to
+    // exercise the String() fallback. A thrown plain object with a
+    // non-ENOENT code and NO message reaches the npm-nonzero return via
+    // String(err).
+    const spawnThatThrows = () => {
+      throw { code: "EOTHER" }; // no `message` property at all
+    };
+    const result = await installSkillrepoGlobally({
+      version: "3.1.2",
+      spawn: spawnThatThrows,
+      platform: "linux",
+    });
+    assert.equal(result.errorCode, "npm-nonzero");
+    assert.match(result.error, /Failed to spawn npm/);
+  });
+
+  it("maps an ASYNC non-ENOENT error event (e.g. EACCES at spawn) to npm-nonzero", async () => {
+    // makeMockSpawn fires the `error` event when `error` is set. An
+    // error whose code is NOT ENOENT hits the spawn-error branch
+    // (`settle({ kind: "spawn-error" })` → npm-nonzero "Failed to run npm").
+    const eacces = Object.assign(new Error("spawn EACCES"), { code: "EACCES" });
+    const spawn = makeMockSpawn({ error: eacces });
+    const result = await installSkillrepoGlobally({
+      version: "3.1.2",
+      spawn,
+      platform: "linux",
+    });
+    assert.equal(result.success, false);
+    assert.equal(result.errorCode, "npm-nonzero");
+    assert.match(result.error, /Failed to run npm/);
+    assert.match(result.error, /EACCES/);
+  });
+
+  it("an async error event with no message falls back to String(err)", async () => {
+    // `err?.message ?? String(err)` — `??` only triggers on
+    // null/undefined, so the error object must have NO message property
+    // (absent, not empty) to exercise the String() fallback in the
+    // spawn-error path.
+    const weird = { code: "EOTHER" }; // no `message` key
+    const spawn = makeMockSpawn({ error: weird });
+    const result = await installSkillrepoGlobally({
+      version: "3.1.2",
+      spawn,
+      platform: "linux",
+    });
+    assert.equal(result.errorCode, "npm-nonzero");
+    assert.match(result.error, /Failed to run npm/);
+  });
+
+  it("path-not-updated on Windows appends the new-terminal PATH addendum", async () => {
+    // When npm exits 0 but no stable binary is found AND the platform is
+    // Windows, the error message carries the Windows-specific addendum
+    // about PATH not refreshing in the current terminal. Covers the
+    // `isWindows` true branch of the platformAddendum ternary.
+    const spawn = makeMockSpawn({ exitCode: 0 });
+    const originalPath = process.env.PATH;
+    process.env.PATH = "/nonexistent/dir";
+    try {
+      const result = await installSkillrepoGlobally({
+        version: "3.1.2",
+        spawn,
+        platform: "win32",
+      });
+      assert.equal(result.success, false);
+      assert.equal(result.errorCode, "path-not-updated");
+      assert.match(result.error, /On Windows/);
+      assert.match(result.error, /new PowerShell or cmd\.exe window/);
+    } finally {
+      if (originalPath === undefined) delete process.env.PATH;
+      else process.env.PATH = originalPath;
+    }
+  });
+});
+
 // ── resolveGlobalBinary — npx-cache filtering ───────────────────
 
 describe("resolveGlobalBinary — transient-cache filtering", () => {

package/src/test/lib/http-timeout.test.mjs

@@ -0,0 +1,114 @@
+/**
+ * Timeout-branch coverage for `src/lib/http.mjs`'s `safeFetch`.
+ *
+ * `DEFAULT_TIMEOUT_MS` is evaluated ONCE at module import from
+ * `SKILLREPO_TIMEOUT_MS`, so the timeout branches can't be flipped
+ * inside the main http.test.mjs process (the module is already cached
+ * with the default 30s). This file sets the env var BEFORE a
+ * cache-busting dynamic import (`?bust=` makes a distinct ESM module
+ * key) so each scenario gets a fresh module evaluation:
+ *
+ *   - `SKILLREPO_TIMEOUT_MS=50` + a slow server → the AbortController
+ *     fires, `safeFetch` maps the AbortError to a networkError with the
+ *     "timed out" hint (covers the `err.name === "AbortError"` branch
+ *     and the finite-timeout `setTimeout` + `clearTimeout` branch).
+ *   - `SKILLREPO_TIMEOUT_MS=0` → `DEFAULT_TIMEOUT_MS === Infinity`, so
+ *     `safeFetch` skips installing the timer entirely (covers the
+ *     `Number.isFinite(DEFAULT_TIMEOUT_MS)` false branch and the
+ *     `timeoutId !== null` false branch in the finally).
+ *
+ * Each import is isolated; the module's other behavior is covered by
+ * http.test.mjs. We point at `getSkill` (a single read endpoint) to
+ * keep the surface minimal.
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { once } from "node:events";
+
+import { CliError, EXIT_NETWORK } from "../../lib/errors.mjs";
+
+const VALID_KEY = "sk_live_timeout_test";
+
+/** Spin up a server whose response is delayed by `delayMs`. */
+async function startSlowServer(delayMs) {
+  const server = createServer((req, res) => {
+    setTimeout(() => {
+      res.statusCode = 200;
+      res.setHeader("Content-Type", "application/json");
+      res.end(JSON.stringify({ skill: { owner: "a", name: "b", files: [] } }));
+    }, delayMs);
+  });
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  const { port } = server.address();
+  return {
+    url: `http://127.0.0.1:${port}`,
+    close: () =>
+      new Promise((resolve) => {
+        // Force-destroy any lingering sockets (aborted client fetches +
+        // undici keep-alive) so `server.close` can't hang waiting for the
+        // pending response timer to drain. Without this, the slow-server
+        // connection a client aborted at 50ms keeps `close` blocked until
+        // the server's own delay elapses — and on Windows it could hang
+        // indefinitely.
+        server.closeAllConnections?.();
+        server.close(() => resolve());
+      }),
+  };
+}
+
+/** Import a fresh copy of http.mjs with the current env honored. */
+async function freshHttp() {
+  return import(`../../lib/http.mjs?bust=${Date.now()}-${Math.random()}`);
+}
+
+// Skipped on Windows: these exercise AbortController timing + local-server
+// teardown, which are timing-sensitive on the Windows runner (a no-timeout
+// fetch / a slow-server `close` can hang the 10-minute CLI-Windows job).
+// The branches under test (finite-timeout abort, Infinity = no-timer) are
+// platform-agnostic and fully covered on the Linux/macOS CI run.
+describe("safeFetch — timeout branches", { skip: process.platform === "win32" }, () => {
+  it("a slow server past SKILLREPO_TIMEOUT_MS surfaces a 'timed out' networkError", { timeout: 20_000 }, async () => {
+    const prev = process.env.SKILLREPO_TIMEOUT_MS;
+    process.env.SKILLREPO_TIMEOUT_MS = "50";
+    const mod = await freshHttp();
+    // The server delays well past the 50ms cap so the AbortController
+    // fires on every attempt.
+    const srv = await startSlowServer(2000);
+    try {
+      await assert.rejects(
+        () => mod.getSkill(srv.url, VALID_KEY, "a", "b"),
+        (err) =>
+          err instanceof CliError &&
+          err.exitCode === EXIT_NETWORK &&
+          /timed out/.test(err.message) &&
+          typeof err.hint === "string" &&
+          /SKILLREPO_TIMEOUT_MS/.test(err.hint),
+      );
+    } finally {
+      if (prev === undefined) delete process.env.SKILLREPO_TIMEOUT_MS;
+      else process.env.SKILLREPO_TIMEOUT_MS = prev;
+      await srv.close();
+    }
+  });
+
+  it("SKILLREPO_TIMEOUT_MS=0 disables the timer (Infinity) and lets a request complete", { timeout: 20_000 }, async () => {
+    const prev = process.env.SKILLREPO_TIMEOUT_MS;
+    process.env.SKILLREPO_TIMEOUT_MS = "0";
+    const mod = await freshHttp();
+    // No timer is installed (DEFAULT_TIMEOUT_MS === Infinity), so even a
+    // slightly-delayed response succeeds rather than aborting.
+    const srv = await startSlowServer(20);
+    try {
+      const result = await mod.getSkill(srv.url, VALID_KEY, "a", "b");
+      assert.ok(result, "request must complete with the timeout disabled");
+      assert.equal(result.owner, "a");
+    } finally {
+      if (prev === undefined) delete process.env.SKILLREPO_TIMEOUT_MS;
+      else process.env.SKILLREPO_TIMEOUT_MS = prev;
+      await srv.close();
+    }
+  });
+});