skillrepo 4.8.0 → 4.8.2

package/src/test/commands/publish.test.mjs

@@ -22,6 +22,7 @@ import {
   EXIT_VALIDATION,
   EXIT_AUTH,
   EXIT_SCOPE,
+  EXIT_NETWORK,
 } from "../../lib/errors.mjs";
 import { createMockServer } from "../e2e/mock-server.mjs";
 import { createCaptureStream } from "../helpers/capture-stream.mjs";
@@ -191,11 +192,11 @@ describe("runPublish — error paths", () => {
     });
   });
 
-  it("403 plan_limit → CliError EXIT_VALIDATION (NOT authError), billing hint surfaces", async () => {
+  it("403 plan_limit → CliError EXIT_VALIDATION (NOT authError), no CLI-side hint", async () => {
     // Real-world regression scenario: an account over its skill
     // quota tries to publish. Server returns 403 with code
     // `plan_limit`. The CLI MUST classify this as exit 5
-    // validation with the billing hint, NOT exit 2 authError
+    // validation with the self-contained server message, NOT exit 2 authError
     // ("contact support") — a pre-review version of the code
     // consumed the 403 body and let mapErrorResponse re-parse, but
     // the body was empty by then so plan_limit fell through to
@@ -210,7 +211,7 @@ describe("runPublish — error paths", () => {
     await assert.rejects(runPublish(baseArgv(), { stdout }), (err) => {
       assert.ok(err instanceof CliError);
       assert.equal(err.exitCode, EXIT_VALIDATION);
-      assert.match(err.hint ?? "", /Upgrade your plan|billing/);
+      assert.equal(err.hint, undefined); // server plan_limit message is self-contained (#2239)
       return true;
     });
   });
@@ -276,6 +277,66 @@ describe("runPublish — error paths", () => {
       (err) => err instanceof CliError && err.exitCode === EXIT_AUTH,
     );
   });
+
+  it("extra positional argument → CliError EXIT_VALIDATION 'Unexpected extra argument'", async () => {
+    // The arg parser accepts exactly ONE positional (the identifier).
+    // A second positional must be rejected before any HTTP call —
+    // `publish` takes a single @owner/name. The identifier comes
+    // first so the parser sees the SECOND token as the surplus arg.
+    await assert.rejects(
+      runPublish(
+        [`@alice/my-skill`, `@alice/other`, "--key", VALID_KEY, "--url", serverUrl],
+        { stdout },
+      ),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_VALIDATION &&
+        /Unexpected extra argument/.test(err.message),
+    );
+  });
+
+  it("generic 403 with a `scope` code (not publish_not_permitted/plan_limit) → CliError EXIT_SCOPE", async () => {
+    // setSkillVisibility's inline 403 dispatch (http.mjs ~1254) mirrors
+    // mapErrorResponse: any code containing "scope" maps to scopeError
+    // (exit 4), NOT authError (exit 2). This is the documented contract
+    // — assert it directly so a regression to authError is caught. The
+    // code here ("insufficient_scope") is neither publish_not_permitted
+    // nor plan_limit, so it takes the generic-scope branch.
+    server.setPublishResponse("alice", "my-skill", {
+      status: 403,
+      body: {
+        error: "Your access key lacks the registry:write scope.",
+        code: "insufficient_scope",
+      },
+    });
+    await assert.rejects(runPublish(baseArgv(), { stdout }), (err) => {
+      assert.ok(err instanceof CliError);
+      assert.equal(err.exitCode, EXIT_SCOPE);
+      assert.match(err.hint ?? "", /write-scoped key/);
+      return true;
+    });
+  });
+
+  it("200 with an unexpected `action` value → networkError EXIT_NETWORK", async () => {
+    // A 200 whose `action` is none of published/unpublished/unchanged
+    // is a protocol violation — the server promised a known
+    // discriminant. setSkillVisibility (http.mjs ~1212) throws a
+    // networkError naming the bogus action. Assert exit 1 and that the
+    // message surfaces the unexpected value, not a silent success.
+    server.setPublishResponse("alice", "my-skill", {
+      status: 200,
+      body: {
+        action: "teleported",
+        skill: { owner: "alice", name: "my-skill" },
+      },
+    });
+    await assert.rejects(runPublish(baseArgv(), { stdout }), (err) => {
+      assert.ok(err instanceof CliError);
+      assert.equal(err.exitCode, EXIT_NETWORK);
+      assert.match(err.message, /unexpected action "teleported"/);
+      return true;
+    });
+  });
 });
 
 // ── runUnpublish ────────────────────────────────────────────────────────
@@ -417,4 +478,76 @@ describe("runUnpublish — error paths", () => {
         /Missing skill identifier/.test(err.message),
     );
   });
+
+  it("401 unauthorized → CliError EXIT_AUTH", async () => {
+    // Mirror the publish-side 401 vector. A 401 on unpublish flows
+    // through mapErrorResponse (http.mjs ~305) → authError → exit 2.
+    server.setUnpublishResponse("alice", "my-skill", {
+      status: 401,
+      body: { error: "Invalid access key" },
+    });
+    await assert.rejects(
+      runUnpublish(baseArgv(), { stdout }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_AUTH,
+    );
+  });
+
+  it("403 unpublish_not_permitted → CliError EXIT_SCOPE (code confirmed)", async () => {
+    // The unpublish 403 endpoint-permission code is
+    // `unpublish_not_permitted` (http.mjs ~1241, VisibilityResultForbidden
+    // typedef ~1145). It maps to the `forbidden` outcome → scopeError
+    // → exit 4. Asserts the exit-code mapping for the bare code without
+    // the hint-dedup detail covered by the action-only-hint test above.
+    server.setUnpublishResponse("alice", "my-skill", {
+      status: 403,
+      body: {
+        error: "You do not have permission to unpublish this skill.",
+        code: "unpublish_not_permitted",
+      },
+    });
+    await assert.rejects(
+      runUnpublish(baseArgv(), { stdout }),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_SCOPE &&
+        /canPublish/.test(err.hint ?? ""),
+    );
+  });
+
+  it("403 plan_limit → CliError EXIT_VALIDATION (NOT authError), no CLI-side hint", async () => {
+    // Same shared `setSkillVisibility` 403 dispatch as publish: a
+    // plan_limit 403 must classify as exit 5 validation with the
+    // self-contained server message, never exit 2 authError. Mirrors the publish-side
+    // regression guard for the unpublish verb.
+    server.setUnpublishResponse("alice", "my-skill", {
+      status: 403,
+      body: {
+        error: "You are over your library skill quota.",
+        code: "plan_limit",
+      },
+    });
+    await assert.rejects(runUnpublish(baseArgv(), { stdout }), (err) => {
+      assert.ok(err instanceof CliError);
+      assert.equal(err.exitCode, EXIT_VALIDATION);
+      assert.equal(err.hint, undefined); // server plan_limit message is self-contained (#2239)
+      return true;
+    });
+  });
+
+  it("extra positional argument → CliError EXIT_VALIDATION 'Unexpected extra argument'", async () => {
+    // `unpublish` takes a single @owner/name. A second positional is
+    // rejected by the arg parser before any HTTP call (unpublish.mjs
+    // acceptPositional, ~49). The identifier comes first; the SECOND
+    // token is the surplus arg.
+    await assert.rejects(
+      runUnpublish(
+        [`@alice/my-skill`, `@alice/other`, "--key", VALID_KEY, "--url", serverUrl],
+        { stdout },
+      ),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_VALIDATION &&
+        /Unexpected extra argument/.test(err.message),
+    );
+  });
 });

package/src/test/commands/push.test.mjs

@@ -18,7 +18,12 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 
 import { runPush } from "../../commands/push.mjs";
-import { CliError, EXIT_VALIDATION } from "../../lib/errors.mjs";
+import {
+  CliError,
+  EXIT_AUTH,
+  EXIT_SCOPE,
+  EXIT_VALIDATION,
+} from "../../lib/errors.mjs";
 import { createMockServer } from "../e2e/mock-server.mjs";
 import { createCaptureStream } from "../helpers/capture-stream.mjs";
 import {
@@ -142,6 +147,52 @@ describe("runPush — happy paths", () => {
     assert.match(stdout.text(), /Released @alice\/my-skill v1\.1.*minor bump/);
   });
 
+  it("--json falls back to frontmatter name + null owner/version when server omits `skill`", async () => {
+    // The server can return a documented action with a null/absent
+    // `skill` (e.g. a minimal 201). The JSON reporter must degrade
+    // gracefully: owner/version → null, name → the SKILL.md frontmatter
+    // name. This covers the `result.skill?.owner ?? null`,
+    // `?? frontmatter.name`, and `?? null` branches in --json mode.
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 201,
+      body: { action: "created", bump: null, skill: null },
+    });
+
+    await runPush(
+      ["--key", VALID_KEY, "--url", serverUrl, "--json", "skill"],
+      { stdout },
+    );
+
+    const json = JSON.parse(stdout.text());
+    assert.equal(json.action, "created");
+    assert.equal(json.owner, null, "owner falls back to null when skill is absent");
+    assert.equal(json.name, "my-skill", "name falls back to the frontmatter name");
+    assert.equal(json.version, null, "version falls back to null");
+  });
+
+  it("human output falls back to @?/<frontmatter-name> and v1.0 when server omits `skill` (created)", async () => {
+    // Mirror of the --json fallback test for the human report path:
+    // `@${owner ?? "?"}/${name ?? frontmatter.name}` and the created
+    // branch's `version ?? "1.0"`.
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 201,
+      body: { action: "created", bump: null, skill: null },
+    });
+
+    await runPush(
+      ["--key", VALID_KEY, "--url", serverUrl, "skill"],
+      { stdout },
+    );
+
+    assert.match(
+      stdout.text(),
+      /Created @\?\/my-skill v1\.0 \(1 file\)/,
+      "human report uses @?/<frontmatter-name> and the v1.0 version fallback",
+    );
+  });
+
   it("reports 'no changes' when server returns action=unchanged", async () => {
     file("SKILL.md", VALID_SKILL_MD);
     server.setPushResponse({
@@ -286,4 +337,232 @@ describe("runPush — flags", () => {
     // Default server response is 201 created.
     assert.match(stdout.text(), /Created @mock\/test-skill/);
   });
+
+  it("rejects a second positional argument with EXIT_VALIDATION", async () => {
+    // `resolveFlags`' acceptPositional callback claims the first bare
+    // arg as the skill path; a second bare arg has nowhere to go and
+    // must fail loudly rather than be silently dropped. The dispatch
+    // happens during argv parsing — before any directory stat or HTTP
+    // — so no SKILL.md fixture is required.
+    await assert.rejects(
+      runPush(
+        ["--key", VALID_KEY, "--url", serverUrl, "./dir", "extra"],
+        { stdout },
+      ),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_VALIDATION &&
+        /Unexpected extra argument/.test(err.message),
+    );
+  });
+});
+
+// ── runPush — server-side error mapping (through the command) ──────────
+//
+// Every case below configures the mock's POST /api/v1/library response
+// via `setPushResponse` and drives the FULL command path
+// (`runPush` → `pushSkill` → `mapErrorResponse`). The assertions pin the
+// exit code each documented server outcome MUST surface, per the
+// `mapErrorResponse` 401/403/404/429/5xx taxonomy in `src/lib/http.mjs`
+// and the exit-code matrix in `src/lib/errors.mjs`. These mirror the
+// `pushSkill` unit tests in `src/test/lib/http.test.mjs` but exercise the
+// command wrapper rather than the raw lib function.
+
+describe("runPush — server error mapping", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("maps server 401 to EXIT_AUTH", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 401,
+      body: { error: "Invalid access key", code: "unauthorized" },
+    });
+    await assert.rejects(
+      runPush(["--key", VALID_KEY, "--url", serverUrl, "skill"], { stdout }),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_AUTH &&
+        /Invalid access key/.test(err.message),
+    );
+  });
+
+  it("maps server 403 scope to EXIT_SCOPE", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 403,
+      body: { error: "Write scope required", code: "scope_required" },
+    });
+    await assert.rejects(
+      runPush(["--key", VALID_KEY, "--url", serverUrl, "skill"], { stdout }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_SCOPE,
+    );
+  });
+
+  it("maps server 403 plan_limit to EXIT_VALIDATION (NOT auth)", async () => {
+    // mapErrorResponse explicitly disambiguates plan_limit from the
+    // generic-403 authError path so the user sees the plan-limit message, not
+    // a "contact support" hint. Mirrors the http.test.mjs assertion.
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 403,
+      body: {
+        error: "Your free plan allows up to 5 library skills.",
+        code: "plan_limit",
+      },
+    });
+    await assert.rejects(
+      runPush(["--key", VALID_KEY, "--url", serverUrl, "skill"], { stdout }),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_VALIDATION &&
+        /plan/i.test(err.message),
+    );
+  });
+
+  it("maps server 409 source_conflict to EXIT_VALIDATION (generic 4xx)", async () => {
+    // 409 has no dedicated branch in mapErrorResponse — it falls
+    // through to the generic-4xx `validationError(message)` return.
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 409,
+      body: {
+        error: "A skill with this name is owned by another source.",
+        code: "source_conflict",
+      },
+    });
+    await assert.rejects(
+      runPush(["--key", VALID_KEY, "--url", serverUrl, "skill"], { stdout }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("maps server 422 idempotency_key_reused to EXIT_VALIDATION", async () => {
+    // 422 has no dedicated branch either — generic-4xx → validationError.
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 422,
+      body: {
+        error: "Idempotency key was reused with a different request body.",
+        code: "idempotency_key_reused",
+      },
+    });
+    await assert.rejects(
+      runPush(["--key", VALID_KEY, "--url", serverUrl, "skill"], { stdout }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("maps server 413 payload_too_large to EXIT_VALIDATION (generic 4xx)", async () => {
+    // 413 has NO explicit branch in mapErrorResponse (only 401/403/404/
+    // 429/5xx are special-cased). It therefore falls through to the
+    // generic-4xx `return validationError(message)` → exit 5. This pins
+    // the ACTUAL produced code; if the source ever grows a dedicated
+    // 413 branch with a different exit code, this fails and forces a
+    // conscious update.
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 413,
+      body: { error: "Payload exceeds the 4.5MB limit.", code: "payload_too_large" },
+    });
+    await assert.rejects(
+      runPush(["--key", VALID_KEY, "--url", serverUrl, "skill"], { stdout }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+});
+
+// ── runPush — multipart wire format ────────────────────────────────────
+//
+// The mock server doesn't parse multipart; `getLastPostBody()` returns
+// the RAW request body. For a multipart push the body is the
+// `multipart/form-data` byte stream (undici serializes the FormData),
+// which JSON.parse can't handle, so the mock stores it verbatim as a
+// string. We assert the wire format directly against that raw string:
+// a part for SKILL.md, a part whose Content-Disposition filename carries
+// the nested POSIX relative path (RFC 7578), and that the client sent a
+// multipart/form-data Content-Type.
+
+describe("runPush — multipart wire format", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("encodes SKILL.md + nested file with RFC 7578 filename paths", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    file("references/intro.md", "intro body");
+
+    await runPush(
+      ["--key", VALID_KEY, "--url", serverUrl, "skill"],
+      { stdout },
+    );
+
+    // Sanity: the push succeeded (default 201 created response).
+    assert.match(stdout.text(), /Created @mock\/test-skill/);
+
+    const rawBody = server.getLastPostBody();
+    assert.equal(
+      typeof rawBody,
+      "string",
+      "multipart body should be captured as a raw string (JSON.parse fails on multipart)",
+    );
+
+    // Every part is appended under the `files` field name.
+    assert.match(
+      rawBody,
+      /Content-Disposition: form-data; name="files"/,
+      "expected a multipart part for the `files` field",
+    );
+
+    // The root SKILL.md must carry filename="SKILL.md" (no path prefix);
+    // the server identifies SKILL.md by exact-match filename.
+    assert.match(
+      rawBody,
+      /filename="SKILL\.md"/,
+      "expected a part whose Content-Disposition filename is exactly SKILL.md",
+    );
+
+    // The nested file must preserve its POSIX skill-relative path in the
+    // filename parameter (RFC 7578) so the server reconstructs the tree.
+    assert.match(
+      rawBody,
+      /filename="references\/intro\.md"/,
+      "expected the nested file's filename to carry the relative path references/intro.md",
+    );
+
+    // The raw bytes of the nested file must be in the body.
+    assert.ok(
+      rawBody.includes("intro body"),
+      "expected the nested file content to be present in the multipart body",
+    );
+  });
+
+  it("sends a multipart/form-data Content-Type (server accepts; boundary present)", async () => {
+    file("SKILL.md", VALID_SKILL_MD);
+    file("references/intro.md", "intro body");
+
+    // The mock's POST /api/v1/library handler returns 400
+    // invalid_multipart UNLESS the inbound Content-Type includes
+    // `multipart/form-data` (see mock-server.mjs). A successful 201 is
+    // therefore positive proof the client set that Content-Type — if
+    // pushSkill had set Content-Type to JSON (or omitted the boundary so
+    // undici couldn't infer multipart), this would surface as a
+    // validationError, not a "Created" success.
+    await runPush(
+      ["--key", VALID_KEY, "--url", serverUrl, "skill"],
+      { stdout },
+    );
+    assert.match(stdout.text(), /Created @mock\/test-skill/);
+
+    // Belt-and-suspenders at the wire level: undici emits a boundary
+    // delimiter (`--<boundary>`) before each part, which proves the body
+    // is genuinely multipart-encoded and not, say, a raw JSON blob the
+    // server happened to accept.
+    const rawBody = server.getLastPostBody();
+    assert.equal(typeof rawBody, "string");
+    assert.match(
+      rawBody,
+      /^--[-A-Za-z0-9]+\r?\n/m,
+      "expected a multipart boundary delimiter at the start of a part",
+    );
+  });
 });