unbound-cli 1.16.19 → 1.16.21

package/test/tool-detect.test.js

@@ -0,0 +1,438 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { Command } = require('commander');
+const childProcess = require('child_process');
+const { detectInstalledTools, allUserHomes, accountHomes, TOOL_SIGNALS } = require('../src/toolDetect');
+
+// Detection runs against a throwaway home so the result never depends on what
+// the machine running the tests has installed.
+// `links` maps a path to the path it points at, both relative to the fixture root.
+function fixture(files = [], links = {}) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-detect-'));
+  const home = path.join(root, 'home');
+  fs.mkdirSync(home, { recursive: true });
+  for (const rel of files) {
+    const p = path.join(root, rel);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, '');
+  }
+  for (const [rel, target] of Object.entries(links)) {
+    const p = path.join(root, rel);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.symlinkSync(path.join(root, target), p);
+  }
+  const opts = (extra = {}) => ({
+    platform: 'darwin',
+    homes: [home],
+    pathDirs: [path.join(root, 'path')],
+    machineBinDirs: [path.join(root, 'global-bin')],
+    osPackageBinDirs: [],
+    ...extra,
+  });
+  return { root, home, opts };
+}
+
+test('an empty device does not detect pi', () => {
+  const { opts } = fixture();
+  assert.deepEqual(detectInstalledTools(['pi'], opts()), { detected: [], missing: ['pi'] });
+});
+
+test('files pi writes for itself detect it', () => {
+  for (const marker of ['home/.pi/agent/auth.json', 'home/.pi/agent/sessions/x.jsonl']) {
+    const { opts } = fixture([marker]);
+    assert.deepEqual(detectInstalledTools(['pi'], opts()), { detected: ['pi'], missing: [] }, marker);
+  }
+});
+
+test('a pi binary detects it: per-user bin dir, nvm, PATH, machine-wide', () => {
+  for (const bin of [
+    'home/.pi/agent/bin/pi', // where pi's own installer puts it
+    'home/.local/bin/pi',
+    'home/.nvm/versions/node/v22.1.0/bin/pi',
+    'path/pi',
+    'global-bin/pi',
+  ]) {
+    const { opts } = fixture([bin]);
+    assert.deepEqual(detectInstalledTools(['pi'], opts()).detected, ['pi'], bin);
+  }
+});
+
+// Debian and Ubuntu ship a digits-of-pi calculator at /usr/bin/pi. A regular
+// file in a dir the OS package manager owns is the OS's own program.
+test('a plain file named pi in an OS package dir is not the agent', () => {
+  const { root, opts } = fixture(['usr-bin/pi']);
+  const usrBin = path.join(root, 'usr-bin');
+  for (const where of ['machineBinDirs', 'pathDirs']) {
+    const result = detectInstalledTools(['pi'], opts({ [where]: [usrBin], osPackageBinDirs: [usrBin] }));
+    assert.deepEqual(result.detected, [], where);
+  }
+});
+
+test('pi linked into an OS package dir detects it', () => {
+  // npm with its prefix at /usr links the agent into /usr/bin.
+  const cli = 'usr-lib/node_modules/pi-coding-agent/dist/cli.js';
+  const { root, opts } = fixture([cli], { 'usr-bin/pi': cli });
+  const usrBin = path.join(root, 'usr-bin');
+  const result = detectInstalledTools(['pi'], opts({ machineBinDirs: [usrBin], osPackageBinDirs: [usrBin] }));
+  assert.deepEqual(result.detected, ['pi']);
+});
+
+test('an OS package dir reached through a link is still one', () => {
+  // /bin is a link to /usr/bin on a merged-usr system.
+  const { root, opts } = fixture(['usr-bin/pi'], { bin: 'usr-bin' });
+  const result = detectInstalledTools(['pi'], opts({
+    pathDirs: [path.join(root, 'bin')], osPackageBinDirs: [path.join(root, 'usr-bin')],
+  }));
+  assert.deepEqual(result.detected, []);
+});
+
+test('a link whose target is gone is not a signal', () => {
+  const { opts } = fixture([], { 'global-bin/pi': 'uninstalled/cli.js' });
+  assert.deepEqual(detectInstalledTools(['pi'], opts()).detected, []);
+});
+
+// The regression that matters: a device where `unbound setup pi` ran before has
+// Unbound's own extension under pi's config dir. That must not count.
+test('files written by Unbound\'s own setup are not install signals', () => {
+  const { opts } = fixture([
+    'home/.pi/agent/extensions/unbound/index.js',
+    'home/.pi/agent/extensions/unbound/index.ts',
+    'home/.unbound/config.json',
+  ]);
+  assert.deepEqual(detectInstalledTools(['pi'], opts()), { detected: [], missing: ['pi'] });
+});
+
+test('windows binaries are matched by their .exe/.cmd/.ps1 shims', () => {
+  for (const shim of ['pi.cmd', 'pi.exe', 'pi.ps1']) {
+    const { opts } = fixture([`home/AppData/Roaming/npm/${shim}`]);
+    assert.deepEqual(detectInstalledTools(['pi'], opts()).detected, [], shim);
+    assert.deepEqual(detectInstalledTools(['pi'], opts({ platform: 'win32' })).detected, ['pi'], shim);
+  }
+});
+
+test('all-users scope finds pi when only another user has it', () => {
+  const { root, home, opts } = fixture(['other/.local/bin/pi']);
+  assert.deepEqual(detectInstalledTools(['pi'], opts()).detected, []);
+  assert.deepEqual(detectInstalledTools(['pi'], opts({ homes: [home, path.join(root, 'other')] })).detected, ['pi']);
+});
+
+// ---- a place that could not be inspected ----
+// Absent and unreadable are different answers. Reporting the second as the
+// first skipped setup on exactly the devices where nothing could be ruled out.
+function withStatFailingUnder(blocked, code, run) {
+  const real = fs.statSync;
+  fs.statSync = (p, ...rest) => {
+    if (String(p).startsWith(blocked)) throw Object.assign(new Error(`${code}: ${p}`), { code });
+    return real(p, ...rest);
+  };
+  try {
+    return run();
+  } finally {
+    fs.statSync = real;
+  }
+}
+
+test('a home that cannot be inspected throws instead of reporting pi missing', () => {
+  for (const code of ['EACCES', 'EPERM', 'EIO']) {
+    const { root, home, opts } = fixture();
+    const locked = path.join(root, 'locked');
+    fs.mkdirSync(locked);
+    assert.throws(
+      () => withStatFailingUnder(locked, code, () => detectInstalledTools(['pi'], opts({ homes: [home, locked] }))),
+      { code },
+    );
+  }
+});
+
+test('a signal found elsewhere wins over a home that cannot be inspected', () => {
+  const { root, home, opts } = fixture(['home/.pi/agent/auth.json']);
+  const locked = path.join(root, 'locked');
+  fs.mkdirSync(locked);
+  const result = withStatFailingUnder(locked, 'EACCES', () => detectInstalledTools(['pi'], opts({ homes: [home, locked] })));
+  assert.deepEqual(result, { detected: ['pi'], missing: [] });
+});
+
+test('an nvm dir that cannot be listed throws instead of reporting pi missing', () => {
+  const { home, opts } = fixture();
+  const nvm = path.join(home, '.nvm', 'versions', 'node');
+  fs.mkdirSync(nvm, { recursive: true });
+  const real = fs.readdirSync;
+  fs.readdirSync = (p, ...rest) => {
+    if (String(p) === nvm) throw Object.assign(new Error('EACCES'), { code: 'EACCES' });
+    return real(p, ...rest);
+  };
+  try {
+    assert.throws(() => detectInstalledTools(['pi'], opts()), { code: 'EACCES' });
+  } finally {
+    fs.readdirSync = real;
+  }
+});
+
+// ---- which homes the all-users scope looks in ----
+test('a home that is not a direct child of the users root is found', () => {
+  // /home/DOMAIN/alice: the MDM setup script installs for that account, so
+  // detection has to look there too. A listing of /home sees only DOMAIN.
+  const { root, opts } = fixture(['users/DOMAIN/alice/.pi/agent/auth.json']);
+  const usersRoot = path.join(root, 'users');
+  const alice = path.join(usersRoot, 'DOMAIN', 'alice');
+
+  const listed = allUserHomes('linux', { root: usersRoot, accounts: [] });
+  assert.equal(listed.includes(alice), false);
+  assert.deepEqual(detectInstalledTools(['pi'], opts({ homes: listed.slice(1) })).detected, []);
+
+  const homes = allUserHomes('linux', { root: usersRoot, accounts: [alice] });
+  assert.equal(homes.includes(alice), true);
+  assert.deepEqual(detectInstalledTools(['pi'], opts({ homes: homes.slice(1) })).detected, ['pi']);
+});
+
+test('linux users named Shared or Guest are real accounts; on macOS they are not', () => {
+  const { root } = fixture(['users/Shared/x', 'users/Guest/x', 'users/alice/x', 'users/.hidden/x']);
+  const usersRoot = path.join(root, 'users');
+  const at = name => path.join(usersRoot, name);
+
+  const linux = allUserHomes('linux', { root: usersRoot, accounts: [] });
+  for (const name of ['Shared', 'Guest', 'alice']) assert.equal(linux.includes(at(name)), true, name);
+  assert.equal(linux.includes(at('.hidden')), false);
+
+  const mac = allUserHomes('darwin', { root: usersRoot, accounts: [at('Guest')] });
+  assert.equal(mac.includes(at('alice')), true);
+  for (const name of ['Shared', 'Guest']) assert.equal(mac.includes(at(name)), false, name);
+});
+
+test('an account home that does not exist is dropped', () => {
+  const { root } = fixture();
+  const homes = allUserHomes('linux', { root: path.join(root, 'users'), accounts: [path.join(root, 'users', 'ghost')] });
+  assert.deepEqual(homes, [os.homedir()]);
+});
+
+// ---- the account database ----
+function withAccountLookup(fake, run) {
+  const real = childProcess.execFileSync;
+  childProcess.execFileSync = fake;
+  try {
+    return run();
+  } finally {
+    childProcess.execFileSync = real;
+  }
+}
+
+test('account homes are the database\'s homes under the platform prefix', () => {
+  const answer = JSON.stringify(['/home/alice', '/home/DOMAIN/bob', '/var/lib/postgres', '/root', '', null]);
+  const errors = [];
+  const homes = withAccountLookup(() => answer, () => accountHomes('linux', errors));
+  assert.deepEqual(homes, ['/home/alice', '/home/DOMAIN/bob']);
+  assert.deepEqual(errors, []);
+  assert.deepEqual(withAccountLookup(() => answer, () => accountHomes('win32', errors)), []);
+});
+
+// A setup script fails the same way, so it could not install into those homes
+// either: forcing Pi here would only fail onboarding on a device without pi.
+test('a missing python or a failing account database is not a detection error', () => {
+  for (const failure of [
+    Object.assign(new Error('spawn python3 ENOENT'), { code: 'ENOENT' }),
+    Object.assign(new Error('Command failed'), { status: 1 }),
+  ]) {
+    const errors = [];
+    const homes = withAccountLookup(() => { throw failure; }, () => accountHomes('linux', errors));
+    assert.deepEqual(homes, []);
+    assert.deepEqual(errors, [], failure.message);
+  }
+});
+
+// The database may be slow rather than down, and a setup script waits longer.
+test('an account lookup that times out counts as a place that could not be inspected', () => {
+  const timeout = Object.assign(new Error('spawnSync python3 ETIMEDOUT'), { code: 'ETIMEDOUT' });
+  const errors = [];
+  assert.deepEqual(withAccountLookup(() => { throw timeout; }, () => accountHomes('linux', errors)), []);
+  assert.deepEqual(errors, [timeout]);
+
+  const { root } = fixture();
+  const seen = [];
+  withAccountLookup(() => { throw timeout; }, () => allUserHomes('linux', { errors: seen, root: path.join(root, 'users') }));
+  assert.deepEqual(seen, [timeout]);
+});
+
+test('an unreadable answer from the account lookup is kept as an error', () => {
+  const errors = [];
+  assert.deepEqual(withAccountLookup(() => 'Traceback (most recent call last)', () => accountHomes('linux', errors)), []);
+  assert.equal(errors.length, 1);
+});
+
+test('a tool with no signals is never ruled out', () => {
+  const { opts } = fixture();
+  assert.deepEqual(detectInstalledTools(['cursor', 'pi'], opts()), { detected: ['cursor'], missing: ['pi'] });
+});
+
+test('pi is the only tool with detection signals', () => {
+  assert.deepEqual(Object.keys(TOOL_SIGNALS), ['pi']);
+});
+
+// ---- onboard uses the detection result ----
+const USER_BUNDLE = ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot', 'augment'];
+const MDM_BUNDLE = ['cursor', 'claude-code-subscription', 'gemini-cli', 'codex-subscription', 'copilot', 'augment'];
+const piDetected = (names) => ({ detected: names, missing: [] });
+const piMissing = (names) => ({ detected: [], missing: names });
+
+async function runOnboard({ isRoot, detect, fail, discoveryThrows }) {
+  for (const m of [
+    '../src/commands/onboard', '../src/commands/setup', '../src/commands/discover',
+    '../src/auth', '../src/config', '../src/output', '../src/toolDetect',
+  ]) {
+    delete require.cache[require.resolve(m)];
+  }
+  const calls = { bundle: [], candidates: null, allUsers: null, discovery: 0, lines: [], errors: [] };
+  const setup = require('../src/commands/setup');
+  const discover = require('../src/commands/discover');
+  const auth = require('../src/auth');
+  const config = require('../src/config');
+  const output = require('../src/output');
+  const toolDetect = require('../src/toolDetect');
+
+  setup.hasRootPrivileges = () => isRoot;
+  // The core bundle is called with no `tools`; Pi is its own call with ['pi'].
+  const bundle = async (_key, opts) => {
+    const step = opts.tools ? opts.tools.join(',') : 'core';
+    calls.bundle.push(step);
+    return { ok: step !== fail, skipped: [] };
+  };
+  setup.runSetupAllBundle = bundle;
+  setup.runMdmSetupAllBundle = bundle;
+  toolDetect.detectInstalledTools = (names, opts) => {
+    calls.candidates = names;
+    calls.allUsers = opts.allUsers;
+    return detect(names);
+  };
+  discover.runDiscoveryScan = async () => {
+    calls.discovery++;
+    if (discoveryThrows) throw new Error('scan failed');
+  };
+  auth.ensureLoggedIn = async () => {};
+  auth.fetchDeviceOwnerKey = async () => 'owner-key';
+  config.setUrls = () => ({});
+  config.getApiKey = () => 'resolved-key';
+  config.getBaseUrl = () => 'https://b.acme';
+  config.getFrontendUrl = () => 'https://f.acme';
+  config.getGatewayUrl = () => 'https://g.acme';
+  config.isLoggedIn = () => true;
+  output.success = (msg) => calls.lines.push(String(msg));
+  output.error = (msg) => calls.errors.push(String(msg));
+  for (const k of ['info', 'warn']) output[k] = (msg) => calls.lines.push(String(msg));
+
+  const { register } = require('../src/commands/onboard');
+  const program = new Command();
+  program.exitOverride();
+  register(program);
+  const savedLog = console.log;
+  const savedError = console.error;
+  const savedExit = process.exitCode;
+  console.log = (...args) => calls.lines.push(args.join(' '));
+  console.error = (...args) => calls.errors.push(args.join(' '));
+  process.exitCode = 0;
+  try {
+    await program.parseAsync(['node', 'unbound', 'onboard', '--api-key', 'k']);
+    calls.exitCode = process.exitCode;
+  } finally {
+    console.log = savedLog;
+    console.error = savedError;
+    process.exitCode = savedExit;
+  }
+  calls.piLines = calls.lines.filter(l => /\bPi\b/.test(l));
+  calls.setup = setup;
+  return calls;
+}
+
+test('onboard sets pi up after the user bundle when pi is detected', async () => {
+  const calls = await runOnboard({ isRoot: false, detect: piDetected });
+  assert.deepEqual(calls.candidates, ['pi']);
+  assert.equal(calls.allUsers, false);
+  assert.deepEqual(calls.bundle, ['core', 'pi']);
+  assert.equal(calls.discovery, 1);
+  assert.equal(calls.exitCode, 0);
+  assert.equal(calls.piLines.length, 1);
+});
+
+test('onboard installs exactly the user bundle when pi is not detected', async () => {
+  const calls = await runOnboard({ isRoot: false, detect: piMissing });
+  assert.deepEqual(calls.bundle, ['core']);
+  assert.equal(calls.discovery, 1);
+  assert.equal(calls.piLines.length, 1);
+});
+
+test('sudo onboard detects pi across all users and sets it up after the MDM bundle', async () => {
+  const calls = await runOnboard({ isRoot: true, detect: piDetected });
+  assert.deepEqual(calls.candidates, ['pi']);
+  assert.equal(calls.allUsers, true);
+  assert.deepEqual(calls.bundle, ['core', 'pi']);
+  assert.equal(calls.piLines.length, 1);
+});
+
+test('sudo onboard installs exactly the MDM bundle when pi is not detected', async () => {
+  const calls = await runOnboard({ isRoot: true, detect: piMissing });
+  assert.deepEqual(calls.bundle, ['core']);
+  assert.equal(calls.piLines.length, 1);
+});
+
+test('a detection crash still sets pi up, and onboarding exits 0', async () => {
+  for (const isRoot of [false, true]) {
+    const calls = await runOnboard({ isRoot, detect: () => { throw new Error('EPERM'); } });
+    assert.deepEqual(calls.bundle, ['core', 'pi']);
+    assert.equal(calls.discovery, 1);
+    assert.equal(calls.exitCode, 0);
+    assert.equal(calls.piLines.length, 1);
+  }
+});
+
+// Pi is opportunistic: before it joined onboarding, a device with pi still got
+// its bundle and its discovery scan. A broken pi setup must not take those away.
+test('a failed pi setup still runs discovery, and onboarding exits 1', async () => {
+  for (const isRoot of [false, true]) {
+    const calls = await runOnboard({ isRoot, detect: piDetected, fail: 'pi' });
+    assert.deepEqual(calls.bundle, ['core', 'pi']);
+    assert.equal(calls.discovery, 1);
+    assert.equal(calls.exitCode, 1);
+    assert.equal(calls.errors.length, 1);
+    assert.match(calls.errors[0], /Pi Coding Agent setup failed/);
+    assert.match(calls.errors[0], /unbound setup .*pi/);
+    assert.equal(calls.lines.some(l => /Onboarding complete/.test(l)), false);
+  }
+});
+
+// The hints printed for a failed scan retry the scan only. Without its own line
+// the earlier Pi failure would be reported as "tool setup completed".
+test('a failed pi setup is still reported when discovery fails after it', async () => {
+  for (const isRoot of [false, true]) {
+    const calls = await runOnboard({ isRoot, detect: piDetected, fail: 'pi', discoveryThrows: true });
+    assert.equal(calls.exitCode, 1);
+    const text = calls.errors.join('\n');
+    assert.match(text, /Pi Coding Agent setup also failed/);
+    assert.match(text, /unbound setup .*pi/);
+    assert.doesNotMatch(text, /Tool setup completed successfully/);
+  }
+});
+
+test('a failed scan after a clean pi setup keeps the usual message', async () => {
+  const calls = await runOnboard({ isRoot: false, detect: piDetected, discoveryThrows: true });
+  const text = calls.errors.join('\n');
+  assert.match(text, /Tool setup completed successfully — only discovery failed/);
+  assert.doesNotMatch(text, /Pi Coding Agent/);
+});
+
+test('a failed core bundle stops before pi and before discovery', async () => {
+  for (const isRoot of [false, true]) {
+    const calls = await runOnboard({ isRoot, detect: piDetected, fail: 'core' });
+    assert.deepEqual(calls.bundle, ['core']);
+    assert.equal(calls.discovery, 0);
+    assert.equal(calls.exitCode, 1);
+  }
+});
+
+test('the default bundles themselves never gain pi', async () => {
+  for (const isRoot of [false, true]) {
+    const { setup } = await runOnboard({ isRoot, detect: piDetected });
+    assert.deepEqual(setup.ALL_TOOLS, USER_BUNDLE);
+    assert.deepEqual(setup.MDM_ALL_TOOLS, MDM_BUNDLE);
+  }
+});