Defame1297
0dffff3c21
apm-marketplace-check checked network reachability of remote marketplace refs, but finding 35 already removed the only remote package entry, so every marketplace.packages[] source is local and the hook is pure overlap with apm-pack-check-clean. apm-audit-ci was re-examined and kept as-is -- its pre-commit-config.yaml comment already carries a dated, verified justification the audit had missed. check-marketplace-mirror-sync guarded .github/plugin/marketplace.json against drift from .claude-plugin/marketplace.json. Verified against current GitHub Copilot CLI docs: Copilot's marketplace discovery already falls back through .github/plugin/marketplace.json to .claude-plugin/marketplace.json, which this repo generates anyway -- the dedicated mirror bought a discovery-order preference, not a capability. Deleted the mirror file, its sync script, its test, and the hook. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YR2CjVumUbEGWcMikcoXBD
1290 lines
59 KiB
Bash
Executable File
1290 lines
59 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
SCRIPT="$REPO_ROOT/scripts/sync-plugin-content.sh"
|
|
PASS=0
|
|
FAIL=0
|
|
|
|
pass() { echo " PASS: $1"; PASS=$((PASS + 1)); }
|
|
fail() { echo " FAIL: $1"; FAIL=$((FAIL + 1)); }
|
|
|
|
if ! command -v apm &>/dev/null; then
|
|
echo "apm not installed -- skipping (see kyberforge:apm-install)" >&2
|
|
exit 77
|
|
fi
|
|
|
|
# Minimal fixture exercising every mirrored category -- all five of
|
|
# scripts/sync-plugin-content.sh's MIRROR_DIRS (agents, skills, commands,
|
|
# instructions, extensions) plus the merged hooks file -- without needing network
|
|
# access (no apm.yml dependencies). It also carries a .apm/prompts/ entry, which has
|
|
# no MIRROR_DIRS destination of its own: apm folds prompts into commands/. Two
|
|
# deliberately-shaped skill subdirectories:
|
|
#
|
|
# skills/hello/tests/ -- a dev-time fixture that must NOT be mirrored
|
|
# skills/hello/assets/templates/tests/ -- a template asset that MUST be mirrored
|
|
#
|
|
# Those two are the same basename at different depths. The exclusion is depth-scoped
|
|
# for exactly this reason: the real skill-author skill ships a template tree it
|
|
# scaffolds from, and a depth-agnostic strip amputated it.
|
|
#
|
|
# skills/hello/scripts/run.sh is executable so the mode/symlink drift checks have a
|
|
# real executable to tamper with.
|
|
make_fixture() {
|
|
local dir
|
|
dir="$(mktemp -d)"
|
|
mkdir -p "$dir/.apm/skills/hello/tests" "$dir/.apm/skills/hello/scripts" \
|
|
"$dir/.apm/skills/hello/assets/templates/tests" "$dir/.apm/agents" \
|
|
"$dir/.apm/hooks" "$dir/.apm/commands" "$dir/.apm/instructions" \
|
|
"$dir/.apm/extensions" "$dir/.apm/prompts"
|
|
cat > "$dir/apm.yml" <<'YAML'
|
|
name: fixture
|
|
version: 0.0.1
|
|
description: fixture
|
|
license: MIT
|
|
type: hybrid
|
|
targets:
|
|
- claude
|
|
dependencies:
|
|
apm: []
|
|
mcp: []
|
|
includes: auto
|
|
devDependencies:
|
|
apm: []
|
|
scripts: {}
|
|
YAML
|
|
cat > "$dir/.apm/skills/hello/SKILL.md" <<'EOF'
|
|
---
|
|
name: hello
|
|
description: hello
|
|
---
|
|
Hello.
|
|
EOF
|
|
cat > "$dir/.apm/skills/hello/tests/sample.bats" <<'EOF'
|
|
@test "dummy" { true; }
|
|
EOF
|
|
cat > "$dir/.apm/skills/hello/assets/templates/tests/README.md" <<'EOF'
|
|
Template asset: scaffolded into a new skill, not a dev fixture of this one.
|
|
EOF
|
|
cat > "$dir/.apm/skills/hello/scripts/run.sh" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
echo hi
|
|
EOF
|
|
chmod +x "$dir/.apm/skills/hello/scripts/run.sh"
|
|
cat > "$dir/.apm/agents/foo.agent.md" <<'EOF'
|
|
---
|
|
name: foo
|
|
description: foo
|
|
---
|
|
Foo.
|
|
EOF
|
|
cat > "$dir/.apm/commands/mycmd.md" <<'EOF'
|
|
---
|
|
description: mycmd
|
|
---
|
|
Do a thing.
|
|
EOF
|
|
cat > "$dir/.apm/prompts/greet.prompt.md" <<'EOF'
|
|
---
|
|
description: greet
|
|
---
|
|
Greet the user.
|
|
EOF
|
|
cat > "$dir/.apm/instructions/style.instructions.md" <<'EOF'
|
|
---
|
|
applyTo: "**"
|
|
---
|
|
Be consistent.
|
|
EOF
|
|
cat > "$dir/.apm/extensions/thing.md" <<'EOF'
|
|
Extension content.
|
|
EOF
|
|
cat > "$dir/.apm/hooks/hooks.json" <<'EOF'
|
|
{"hooks": {"PreToolUse": []}}
|
|
EOF
|
|
echo "$dir"
|
|
}
|
|
|
|
# Same base fixture, but with a copilot target (so apm pack produces
|
|
# .github/plugin/plugin.json) and a caller-supplied .mcp.json -- for exercising
|
|
# reinject_mcp_servers().
|
|
make_fixture_with_mcp() {
|
|
local mcp_json="$1" dir
|
|
dir="$(mktemp -d)"
|
|
mkdir -p "$dir/.apm/skills/hello" "$dir/.apm/agents"
|
|
cat > "$dir/apm.yml" <<'YAML'
|
|
name: fixture
|
|
version: 0.0.1
|
|
description: fixture
|
|
license: MIT
|
|
type: hybrid
|
|
targets:
|
|
- claude
|
|
- copilot
|
|
dependencies:
|
|
apm: []
|
|
mcp: []
|
|
includes: auto
|
|
devDependencies:
|
|
apm: []
|
|
scripts: {}
|
|
YAML
|
|
cat > "$dir/.apm/skills/hello/SKILL.md" <<'EOF'
|
|
---
|
|
name: hello
|
|
description: hello
|
|
---
|
|
Hello.
|
|
EOF
|
|
cat > "$dir/.apm/agents/foo.agent.md" <<'EOF'
|
|
---
|
|
name: foo
|
|
description: foo
|
|
---
|
|
Foo.
|
|
EOF
|
|
printf '%s' "$mcp_json" > "$dir/.mcp.json"
|
|
echo "$dir"
|
|
}
|
|
|
|
CLEANUP_DIRS=()
|
|
trap 'rm -rf ${CLEANUP_DIRS[@]+"${CLEANUP_DIRS[@]}"}' EXIT
|
|
track() { CLEANUP_DIRS+=("$1"); }
|
|
|
|
# --- 1. --check reports drift before any sync has run ---
|
|
echo ""
|
|
echo "--- --check reports drift on an unsynced fixture ---"
|
|
FIXTURE="$(make_fixture)"; track "$FIXTURE"
|
|
if bash "$SCRIPT" --check "$FIXTURE" > /dev/null 2>&1; then
|
|
fail "exited 0 on an unsynced fixture — expected drift (exit 1)"
|
|
else
|
|
pass "exits non-zero (drift) before syncing"
|
|
fi
|
|
|
|
# --- 2. A real sync creates the flat mirror and exits 0 ---
|
|
echo ""
|
|
echo "--- real sync creates every MIRROR_DIRS category plus hooks/hooks.json ---"
|
|
if bash "$SCRIPT" "$FIXTURE" > /dev/null 2>&1 \
|
|
&& [[ -f "$FIXTURE/skills/hello/SKILL.md" ]] \
|
|
&& [[ -f "$FIXTURE/agents/foo.agent.md" ]] \
|
|
&& [[ -f "$FIXTURE/commands/mycmd.md" ]] \
|
|
&& [[ -f "$FIXTURE/instructions/style.instructions.md" ]] \
|
|
&& [[ -f "$FIXTURE/extensions/thing.md" ]] \
|
|
&& [[ -f "$FIXTURE/hooks/hooks.json" ]]; then
|
|
pass "sync creates the expected flat mirror for all five MIRROR_DIRS plus hooks/hooks.json"
|
|
else
|
|
fail "sync did not create the expected flat mirror"
|
|
fi
|
|
|
|
# --- 2b. The merged hooks file goes to hooks/hooks.json, never the plugin root ---
|
|
# Claude Code convention-scans `hooks/hooks.json` at the plugin root (see
|
|
# plugins/kyberforge/docs/research/docs/claude-code-plugins/configuration.md's
|
|
# "Plugin Directory Layout" table, quoted in ADR-0017), and the compiled plugin.json
|
|
# carries no `hooks` pointer that could redirect it. A root-level hooks.json is read
|
|
# by nothing.
|
|
echo ""
|
|
echo "--- the merged hooks file is not left at the plugin root ---"
|
|
if [[ ! -e "$FIXTURE/hooks.json" ]]; then
|
|
pass "no root-level hooks.json after a sync"
|
|
else
|
|
fail "sync wrote hooks.json to the plugin root — Claude Code scans hooks/hooks.json"
|
|
fi
|
|
|
|
# --- 2c. hooks/hooks.json is newline-terminated ---
|
|
# normalize_trailing_newline() exists so pre-commit's end-of-file-fixer does not
|
|
# re-dirty the tree on every sync: apm's bundle exporter emits hooks.json with no
|
|
# trailing newline, the committed file has one.
|
|
echo ""
|
|
echo "--- the synced hooks file ends in a newline ---"
|
|
if [[ -n "$(tail -c 1 "$FIXTURE/hooks/hooks.json")" ]]; then
|
|
fail "hooks/hooks.json has no trailing newline — end-of-file-fixer will re-dirty it every sync"
|
|
else
|
|
pass "hooks/hooks.json is newline-terminated"
|
|
fi
|
|
|
|
# --- 3. tests/ fixtures are excluded from the mirror ---
|
|
echo ""
|
|
echo "--- tests/ subdirectories are not mirrored ---"
|
|
if [[ ! -e "$FIXTURE/skills/hello/tests" ]]; then
|
|
pass "skills/hello/tests/ was not copied into the mirror"
|
|
else
|
|
fail "skills/hello/tests/ was copied into the mirror — should be excluded"
|
|
fi
|
|
|
|
# --- 3b. ...but a deeper tests/ that is a template ASSET must survive ---
|
|
# The exclusion above is depth-scoped to <category>/<name>/tests. Stripping every
|
|
# directory named tests at any depth also deletes template trees a skill ships for
|
|
# its own scaffolder to copy from — which is what broke the mirrored
|
|
# skills/skill-author/scripts/new-skill.sh (`sed: can't read .../tests/README.md`,
|
|
# half-written scaffold left behind) while the .apm/ original still worked.
|
|
echo ""
|
|
echo "--- a tests/ directory nested under assets/templates/ is preserved ---"
|
|
if [[ -f "$FIXTURE/skills/hello/assets/templates/tests/README.md" ]]; then
|
|
pass "skills/hello/assets/templates/tests/ survived the sync"
|
|
else
|
|
fail "skills/hello/assets/templates/tests/ was stripped — template assets are not dev fixtures"
|
|
fi
|
|
|
|
# --- 4. --check is clean immediately after a real sync ---
|
|
echo ""
|
|
echo "--- --check is clean right after syncing ---"
|
|
if bash "$SCRIPT" --check "$FIXTURE" > /dev/null 2>&1; then
|
|
pass "no drift reported immediately after syncing"
|
|
else
|
|
fail "drift reported right after syncing — sync and check disagree"
|
|
fi
|
|
|
|
# --- 5. New .apm/ content is detected as drift, and a re-sync clears it ---
|
|
echo ""
|
|
echo "--- new .apm/ content is detected as drift and cleared by re-sync ---"
|
|
mkdir -p "$FIXTURE/.apm/skills/second"
|
|
cat > "$FIXTURE/.apm/skills/second/SKILL.md" <<'EOF'
|
|
---
|
|
name: second
|
|
description: second
|
|
---
|
|
Second.
|
|
EOF
|
|
if bash "$SCRIPT" --check "$FIXTURE" > /dev/null 2>&1; then
|
|
fail "no drift reported after adding a new skill under .apm/ — expected drift"
|
|
else
|
|
pass "new .apm/ content is detected as drift"
|
|
bash "$SCRIPT" "$FIXTURE" > /dev/null 2>&1
|
|
if bash "$SCRIPT" --check "$FIXTURE" > /dev/null 2>&1; then
|
|
pass "re-sync clears the drift"
|
|
else
|
|
fail "re-sync did not clear the drift"
|
|
fi
|
|
fi
|
|
|
|
# --- 6. A plugin dir with no .apm/ is skipped cleanly, not treated as an error ---
|
|
echo ""
|
|
echo "--- a plugin dir with no .apm/ is skipped, not failed ---"
|
|
NO_APM="$(mktemp -d)"; track "$NO_APM"
|
|
if bash "$SCRIPT" "$NO_APM" > /dev/null 2>&1 && bash "$SCRIPT" --check "$NO_APM" > /dev/null 2>&1; then
|
|
pass "a plugin dir with no .apm/ exits 0 in both real and --check mode"
|
|
else
|
|
fail "a plugin dir with no .apm/ should exit 0 (skip), not fail"
|
|
fi
|
|
|
|
# --- 7. A plugin dir that doesn't exist at all is a hard failure, not a skip ---
|
|
echo ""
|
|
echo "--- a plugin dir that does not exist fails, distinct from an existing-but-empty one ---"
|
|
MISSING_ROOT="$(mktemp -d)"; track "$MISSING_ROOT"
|
|
MISSING="$MISSING_ROOT/does-not-exist"
|
|
if bash "$SCRIPT" "$MISSING" > /dev/null 2>&1; then
|
|
fail "exited 0 for a plugin dir that does not exist — expected a hard failure"
|
|
else
|
|
pass "a nonexistent plugin dir fails instead of silently skipping"
|
|
fi
|
|
|
|
# --- 8. --check never mutates the real plugin root, even on first-time manifest creation ---
|
|
echo ""
|
|
echo "--- --check does not create .claude-plugin/plugin.json or .github/plugin/plugin.json ---"
|
|
FIXTURE8="$(make_fixture)"; track "$FIXTURE8"
|
|
bash "$SCRIPT" --check "$FIXTURE8" > /dev/null 2>&1 || true
|
|
if [[ ! -e "$FIXTURE8/.claude-plugin/plugin.json" ]] && [[ ! -e "$FIXTURE8/.github/plugin/plugin.json" ]]; then
|
|
pass "--check leaves the real plugin root without a first-write plugin.json"
|
|
else
|
|
fail "--check created plugin.json in the real plugin root — it must never mutate it"
|
|
fi
|
|
|
|
# --- 9. A duplicate plugin-dir basename among arguments fails fast, not silently ---
|
|
echo ""
|
|
echo "--- duplicate plugin dir basenames among arguments are rejected ---"
|
|
DUP_PARENT_A="$(mktemp -d)"; track "$DUP_PARENT_A"
|
|
DUP_PARENT_B="$(mktemp -d)"; track "$DUP_PARENT_B"
|
|
mkdir -p "$DUP_PARENT_A/dup" "$DUP_PARENT_B/dup"
|
|
if bash "$SCRIPT" "$DUP_PARENT_A/dup" "$DUP_PARENT_B/dup" > /dev/null 2>&1; then
|
|
fail "exited 0 with two plugin-dir arguments sharing a basename — expected a collision error"
|
|
else
|
|
pass "rejects two plugin-dir arguments that share a basename"
|
|
fi
|
|
|
|
# --- 10. Real sync re-injects mcpServers as a PATH that apm's Copilot builder strips ---
|
|
# The payload is the string ".mcp.json", not the resolved server objects: Copilot's
|
|
# schema types the field "string or object", and only the string form is incapable
|
|
# of carrying a credential into a committed, published manifest (see case 23).
|
|
echo ""
|
|
echo "--- real sync re-injects mcpServers into .github/plugin/plugin.json as a path ---"
|
|
FIXTURE10="$(make_fixture_with_mcp '{"mcpServers":{"demo":{"command":"demo-server","type":"stdio"}}}')"; track "$FIXTURE10"
|
|
bash "$SCRIPT" "$FIXTURE10" > /dev/null 2>&1
|
|
if jq -e '.mcpServers == ".mcp.json"' "$FIXTURE10/.github/plugin/plugin.json" > /dev/null 2>&1; then
|
|
pass "mcpServers is the string \".mcp.json\" in .github/plugin/plugin.json after a real sync"
|
|
else
|
|
fail "mcpServers was not re-injected as the path \".mcp.json\" (got: $(jq -c '.mcpServers // "<absent>"' "$FIXTURE10/.github/plugin/plugin.json" 2>/dev/null))"
|
|
fi
|
|
# The inlined-object form is what leaked; assert it is gone, not merely that a
|
|
# key exists. `jq -e '.mcpServers == ".mcp.json"'` above already implies this, but
|
|
# a future refactor that emits an object again should fail on the reason, not just
|
|
# on the shape.
|
|
if jq -e '.mcpServers | type == "object"' "$FIXTURE10/.github/plugin/plugin.json" > /dev/null 2>&1; then
|
|
fail "mcpServers was inlined as an object — that is the form that copies .mcp.json verbatim into a published manifest"
|
|
else
|
|
pass "mcpServers is not an inlined object"
|
|
fi
|
|
|
|
# --- 10b. The re-injection preserves the manifest's own mode, rather than importing one ---
|
|
# reinject_mcp_servers used to build its replacement in a `mktemp` file (mode 0600)
|
|
# and `mv` it over the manifest, carrying 0600 onto a tracked, published file. Git
|
|
# records only the exec bit, so the demotion survived every commit unnoticed — this
|
|
# repo's own plugins/bin/.github/plugin/plugin.json really was 0600 on disk while
|
|
# its five siblings were 0644.
|
|
#
|
|
# The fix is `cat "$tmp" >"$dst"`, which keeps the destination inode: the manifest
|
|
# ends up at whatever mode apm pack gave it a moment earlier, i.e. 0666 & ~umask like
|
|
# any other freshly created file. So this is asserted across two umasks rather than
|
|
# against a hardcoded 644 — that is what distinguishes "preserved" from "assigned".
|
|
# A `mv` of the mktemp yields 600 under both; a `chmod 644` yields 644 under both,
|
|
# which is the umask dependence that made --check fail on a umask-002 checkout.
|
|
mode_of() {
|
|
stat -c '%a' "$1" 2>/dev/null || stat -f '%Lp' "$1" 2>/dev/null
|
|
}
|
|
echo ""
|
|
echo "--- the mcpServers re-injection leaves the manifest at the umask's own file mode ---"
|
|
for UMASK10B in 022 002; do
|
|
case "$UMASK10B" in
|
|
022) EXPECT10B=644 ;;
|
|
002) EXPECT10B=664 ;;
|
|
esac
|
|
FIXTURE10B="$(umask "$UMASK10B"; make_fixture_with_mcp '{"mcpServers":{"demo":{"command":"demo-server","type":"stdio"}}}')"
|
|
track "$FIXTURE10B"
|
|
(umask "$UMASK10B"; bash "$SCRIPT" "$FIXTURE10B" > /dev/null 2>&1)
|
|
MODE10B="$(mode_of "$FIXTURE10B/.github/plugin/plugin.json")"
|
|
if [[ "$MODE10B" == "$EXPECT10B" ]]; then
|
|
pass "under umask $UMASK10B the re-injected manifest is $EXPECT10B (its own mode, not mktemp's 600 and not a hardcoded one)"
|
|
else
|
|
fail "under umask $UMASK10B the re-injected manifest is $MODE10B, expected $EXPECT10B"
|
|
fi
|
|
done
|
|
|
|
# --- 11. An empty .mcp.json does not add a redundant mcpServers: {} ---
|
|
echo ""
|
|
echo "--- an empty .mcp.json does not add mcpServers: {} ---"
|
|
FIXTURE11="$(make_fixture_with_mcp '{"mcpServers":{}}')"; track "$FIXTURE11"
|
|
bash "$SCRIPT" "$FIXTURE11" > /dev/null 2>&1
|
|
if jq -e 'has("mcpServers") | not' "$FIXTURE11/.github/plugin/plugin.json" > /dev/null 2>&1; then
|
|
pass "an empty .mcp.json does not add mcpServers to .github/plugin/plugin.json"
|
|
else
|
|
fail "an empty .mcp.json still added mcpServers -- should match apm's own omit-when-empty convention"
|
|
fi
|
|
|
|
# --- 12. --check detects drift in the compiled plugin.json (apm.yml content changed) ---
|
|
echo ""
|
|
echo "--- --check detects plugin.json content drift from apm.yml after a version bump ---"
|
|
FIXTURE12="$(make_fixture)"; track "$FIXTURE12"
|
|
bash "$SCRIPT" "$FIXTURE12" > /dev/null 2>&1
|
|
if bash "$SCRIPT" --check "$FIXTURE12" > /dev/null 2>&1; then
|
|
pass "check is clean right after the initial sync (baseline for this test)"
|
|
else
|
|
fail "check reported drift right after the initial sync -- can't test the version-bump case"
|
|
fi
|
|
# Bump the version in apm.yml without re-syncing -- the compiled
|
|
# .claude-plugin/plugin.json is now stale relative to what apm pack would
|
|
# currently produce.
|
|
cat > "$FIXTURE12/apm.yml" <<'YAML'
|
|
name: fixture
|
|
version: 0.0.2
|
|
description: fixture
|
|
license: MIT
|
|
type: hybrid
|
|
targets:
|
|
- claude
|
|
dependencies:
|
|
apm: []
|
|
mcp: []
|
|
includes: auto
|
|
devDependencies:
|
|
apm: []
|
|
scripts: {}
|
|
YAML
|
|
if bash "$SCRIPT" --check "$FIXTURE12" > /dev/null 2>&1; then
|
|
fail "no drift reported after bumping apm.yml's version -- plugin.json should be stale"
|
|
else
|
|
pass "plugin.json content drift (version bump) is detected"
|
|
bash "$SCRIPT" "$FIXTURE12" > /dev/null 2>&1
|
|
if bash "$SCRIPT" --check "$FIXTURE12" > /dev/null 2>&1; then
|
|
pass "re-sync clears the plugin.json drift"
|
|
else
|
|
fail "re-sync did not clear the plugin.json drift"
|
|
fi
|
|
fi
|
|
|
|
# --- 13. --check detects an orphaned hooks file after .apm/hooks/ is removed ---
|
|
echo ""
|
|
echo "--- --check detects an orphaned hooks/hooks.json when .apm/hooks/ is removed ---"
|
|
FIXTURE13="$(make_fixture)"; track "$FIXTURE13"
|
|
bash "$SCRIPT" "$FIXTURE13" > /dev/null 2>&1
|
|
if [[ ! -f "$FIXTURE13/hooks/hooks.json" ]]; then
|
|
fail "initial sync did not create hooks/hooks.json -- can't test the orphan case"
|
|
fi
|
|
rm -rf "$FIXTURE13/.apm/hooks"
|
|
if bash "$SCRIPT" --check "$FIXTURE13" > /dev/null 2>&1; then
|
|
fail "no drift reported for an orphaned hooks/hooks.json after .apm/hooks/ removal"
|
|
else
|
|
pass "orphaned hooks/hooks.json is detected as drift"
|
|
bash "$SCRIPT" "$FIXTURE13" > /dev/null 2>&1
|
|
if [[ ! -e "$FIXTURE13/hooks/hooks.json" ]]; then
|
|
pass "re-sync removes the orphaned hooks/hooks.json"
|
|
else
|
|
fail "re-sync left the orphaned hooks/hooks.json in place"
|
|
fi
|
|
if bash "$SCRIPT" --check "$FIXTURE13" > /dev/null 2>&1; then
|
|
pass "re-sync clears the orphaned-hooks drift"
|
|
else
|
|
fail "re-sync did not clear the orphaned-hooks drift"
|
|
fi
|
|
fi
|
|
|
|
# --- 14. A legacy root-level hooks.json is stale output, not content ---
|
|
# Every plugin synced by an earlier revision of this script carries one. Nothing
|
|
# reads it (no `hooks` pointer in the compiled plugin.json, and Claude Code's
|
|
# convention scan looks at hooks/hooks.json), so --check must flag it and a real
|
|
# sync must delete it.
|
|
echo ""
|
|
echo "--- a legacy root-level hooks.json is reported as drift and removed by a sync ---"
|
|
FIXTURE14="$(make_fixture)"; track "$FIXTURE14"
|
|
bash "$SCRIPT" "$FIXTURE14" > /dev/null 2>&1
|
|
printf '{"hooks": {"PreToolUse": []}}\n' > "$FIXTURE14/hooks.json"
|
|
if bash "$SCRIPT" --check "$FIXTURE14" > /dev/null 2>&1; then
|
|
fail "no drift reported for a leftover root-level hooks.json"
|
|
else
|
|
pass "a leftover root-level hooks.json is reported as drift"
|
|
bash "$SCRIPT" "$FIXTURE14" > /dev/null 2>&1
|
|
if [[ ! -e "$FIXTURE14/hooks.json" ]] && [[ -f "$FIXTURE14/hooks/hooks.json" ]]; then
|
|
pass "re-sync deletes the root-level hooks.json and keeps hooks/hooks.json"
|
|
else
|
|
fail "re-sync did not clean up the root-level hooks.json"
|
|
fi
|
|
fi
|
|
|
|
# --- 15. Deleting a skill from .apm/ leaves a stale mirror a re-sync must clear ---
|
|
# Without sync_dir()'s rm -rf of the destination before recopying, --check would
|
|
# report a drift that no amount of re-syncing could ever clear -- a permanently
|
|
# unfixable pre-push failure. This is the assertion that pins that wipe.
|
|
echo ""
|
|
echo "--- a skill deleted from .apm/ is removed from the mirror by a re-sync ---"
|
|
FIXTURE15="$(make_fixture)"; track "$FIXTURE15"
|
|
mkdir -p "$FIXTURE15/.apm/skills/doomed"
|
|
cat > "$FIXTURE15/.apm/skills/doomed/SKILL.md" <<'EOF'
|
|
---
|
|
name: doomed
|
|
description: doomed
|
|
---
|
|
Doomed.
|
|
EOF
|
|
bash "$SCRIPT" "$FIXTURE15" > /dev/null 2>&1
|
|
if [[ ! -f "$FIXTURE15/skills/doomed/SKILL.md" ]]; then
|
|
fail "initial sync did not mirror skills/doomed -- can't test the stale-skill case"
|
|
else
|
|
rm -rf "$FIXTURE15/.apm/skills/doomed"
|
|
if bash "$SCRIPT" --check "$FIXTURE15" > /dev/null 2>&1; then
|
|
fail "no drift reported for a mirrored skill deleted from .apm/"
|
|
else
|
|
pass "a mirrored skill deleted from .apm/ is reported as drift"
|
|
bash "$SCRIPT" "$FIXTURE15" > /dev/null 2>&1
|
|
if [[ ! -e "$FIXTURE15/skills/doomed" ]]; then
|
|
pass "re-sync removes the stale skills/doomed/ from the mirror"
|
|
else
|
|
fail "re-sync left the stale skills/doomed/ behind — this drift would be unfixable"
|
|
fi
|
|
if bash "$SCRIPT" --check "$FIXTURE15" > /dev/null 2>&1; then
|
|
pass "re-sync clears the stale-skill drift"
|
|
else
|
|
fail "re-sync did not clear the stale-skill drift"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# --- 16. Drift in each of the less-obvious MIRROR_DIRS is detected ---
|
|
# agents/ and skills/ are exercised everywhere above; commands/, instructions/, and
|
|
# extensions/ were previously unreachable by the fixture, so dropping them from
|
|
# MIRROR_DIRS entirely still passed the suite.
|
|
echo ""
|
|
echo "--- drift in commands/, instructions/, and extensions/ is detected ---"
|
|
for CATEGORY_PATH in commands/mycmd.md instructions/style.instructions.md extensions/thing.md; do
|
|
FIXTURE16="$(make_fixture)"; track "$FIXTURE16"
|
|
bash "$SCRIPT" "$FIXTURE16" > /dev/null 2>&1
|
|
if [[ ! -f "$FIXTURE16/$CATEGORY_PATH" ]]; then
|
|
fail "sync did not mirror $CATEGORY_PATH at all — is its category still in MIRROR_DIRS?"
|
|
continue
|
|
fi
|
|
printf 'tampered\n' >> "$FIXTURE16/$CATEGORY_PATH"
|
|
if bash "$SCRIPT" --check "$FIXTURE16" > /dev/null 2>&1; then
|
|
fail "no drift reported after tampering with $CATEGORY_PATH"
|
|
else
|
|
pass "drift in $CATEGORY_PATH is detected"
|
|
fi
|
|
done
|
|
|
|
# --- 17. --check reports every drift in one run, not just the first ---
|
|
# The DRIFT-detail `diff | sed` pipelines return non-zero under `set -o pipefail`;
|
|
# without an explicit `|| true` guard, `set -e` aborts the per-plugin subshell after
|
|
# the first reported drift, turning one push into N fix/re-push cycles.
|
|
echo ""
|
|
echo "--- --check reports all independent drifts in a single run ---"
|
|
FIXTURE17="$(make_fixture)"; track "$FIXTURE17"
|
|
bash "$SCRIPT" "$FIXTURE17" > /dev/null 2>&1
|
|
# Guarded like case 16's `[[ ! -f ... ]] || continue`, and for the same reason:
|
|
# an unwritable path here makes `printf >>` fail, and under `set -e` that aborts
|
|
# the whole script — no "Results:" line, and cases 18-22 never run at all. The
|
|
# exit status is non-zero so the dispatcher does report FAILED, but the six lost
|
|
# assertions are invisible and the only diagnostic is a bare shell error.
|
|
MISSING17=""
|
|
for CATEGORY_PATH in agents/foo.agent.md skills/hello/SKILL.md commands/mycmd.md \
|
|
instructions/style.instructions.md; do
|
|
[[ -f "$FIXTURE17/$CATEGORY_PATH" ]] || MISSING17="$MISSING17 $CATEGORY_PATH"
|
|
done
|
|
if [[ -n "$MISSING17" ]]; then
|
|
fail "sync did not mirror:$MISSING17 — cannot test multi-drift reporting"
|
|
else
|
|
printf 'tampered\n' >> "$FIXTURE17/agents/foo.agent.md"
|
|
printf 'tampered\n' >> "$FIXTURE17/skills/hello/SKILL.md"
|
|
printf 'tampered\n' >> "$FIXTURE17/commands/mycmd.md"
|
|
printf 'tampered\n' >> "$FIXTURE17/instructions/style.instructions.md"
|
|
mkdir -p "$FIXTURE17/hooks"
|
|
printf '{"hooks": {"PreToolUse": [], "tampered": true}}\n' > "$FIXTURE17/hooks/hooks.json"
|
|
CHECK17="$(bash "$SCRIPT" --check "$FIXTURE17" 2>&1 || true)"
|
|
MISSED=""
|
|
for CATEGORY_PATH in agents skills commands instructions hooks/hooks.json; do
|
|
case "$CHECK17" in
|
|
*"DRIFT $FIXTURE17/$CATEGORY_PATH"*) ;;
|
|
*) MISSED="$MISSED $CATEGORY_PATH" ;;
|
|
esac
|
|
done
|
|
if [[ -z "$MISSED" ]]; then
|
|
pass "all five independent drifts are reported in one --check run"
|
|
else
|
|
fail "--check stopped early — never reported drift for:$MISSED"
|
|
fi
|
|
fi
|
|
|
|
# --- 18. --check sees a mode change on a mirrored executable ---
|
|
# `diff -r` compares content only, so a chmod -x left --check at exit 0 while a real
|
|
# sync silently restored the bit — check and sync disagreeing.
|
|
echo ""
|
|
echo "--- --check detects a mode change on a mirrored executable ---"
|
|
FIXTURE18="$(make_fixture)"; track "$FIXTURE18"
|
|
bash "$SCRIPT" "$FIXTURE18" > /dev/null 2>&1
|
|
if [[ ! -x "$FIXTURE18/skills/hello/scripts/run.sh" ]]; then
|
|
fail "sync did not preserve the executable bit on skills/hello/scripts/run.sh"
|
|
else
|
|
pass "sync preserves the executable bit on a mirrored script"
|
|
chmod -x "$FIXTURE18/skills/hello/scripts/run.sh"
|
|
if bash "$SCRIPT" --check "$FIXTURE18" > /dev/null 2>&1; then
|
|
fail "no drift reported after chmod -x on a mirrored executable"
|
|
else
|
|
pass "a mode change on a mirrored executable is detected as drift"
|
|
bash "$SCRIPT" "$FIXTURE18" > /dev/null 2>&1
|
|
if [[ -x "$FIXTURE18/skills/hello/scripts/run.sh" ]]; then
|
|
pass "re-sync restores the executable bit"
|
|
else
|
|
fail "re-sync did not restore the executable bit"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# --- 19. --check sees a mirrored file replaced by a symlink ---
|
|
# `diff -r` dereferences symlinks, so a symlink to byte-identical content reads as
|
|
# no drift while a real sync replaces it with a regular file.
|
|
echo ""
|
|
echo "--- --check detects a mirrored file swapped for a symlink ---"
|
|
FIXTURE19="$(make_fixture)"; track "$FIXTURE19"
|
|
bash "$SCRIPT" "$FIXTURE19" > /dev/null 2>&1
|
|
SYMLINK_TARGET="$FIXTURE19/decoy-agent.md"
|
|
# Guarded for the same reason as cases 16 and 17: with the mirror absent the `cp`
|
|
# below fails and `set -e` takes the rest of the suite down with it.
|
|
if [[ ! -f "$FIXTURE19/agents/foo.agent.md" ]]; then
|
|
fail "sync did not mirror agents/foo.agent.md — cannot test the symlink-swap case"
|
|
else
|
|
cp "$FIXTURE19/agents/foo.agent.md" "$SYMLINK_TARGET"
|
|
rm -f "$FIXTURE19/agents/foo.agent.md"
|
|
ln -s "$SYMLINK_TARGET" "$FIXTURE19/agents/foo.agent.md"
|
|
if bash "$SCRIPT" --check "$FIXTURE19" > /dev/null 2>&1; then
|
|
fail "no drift reported after replacing a mirrored file with a symlink to identical content"
|
|
else
|
|
pass "a mirrored file replaced by a symlink is detected as drift"
|
|
bash "$SCRIPT" "$FIXTURE19" > /dev/null 2>&1
|
|
if [[ -f "$FIXTURE19/agents/foo.agent.md" ]] && [[ ! -L "$FIXTURE19/agents/foo.agent.md" ]]; then
|
|
pass "re-sync restores it to a regular file"
|
|
else
|
|
fail "re-sync did not restore the symlinked mirror entry to a regular file"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# --- 20. .apm/prompts/ is mirrored, via commands/ rather than a prompts/ of its own ---
|
|
# The script header lists prompts among the .apm/ directories it mirrors while
|
|
# MIRROR_DIRS has no `prompts` entry, which reads as a hole and has already been filed
|
|
# as one. It is not: MIRROR_DIRS names DESTINATION directories, and apm's exporter
|
|
# folds .apm/prompts/ into commands/ (renaming *.prompt.md to *.md) alongside
|
|
# .apm/commands/. This pins that mapping, so an apm upgrade that gave prompts a
|
|
# destination of its own — the one change that would genuinely need a MIRROR_DIRS
|
|
# entry — fails here instead of silently dropping the content.
|
|
echo ""
|
|
echo "--- .apm/prompts/ content arrives in commands/, not in a prompts/ directory ---"
|
|
FIXTURE20="$(make_fixture)"; track "$FIXTURE20"
|
|
bash "$SCRIPT" "$FIXTURE20" > /dev/null 2>&1
|
|
if [[ -f "$FIXTURE20/commands/greet.md" ]]; then
|
|
pass ".apm/prompts/greet.prompt.md is mirrored to commands/greet.md"
|
|
else
|
|
fail ".apm/prompts/ content never reached commands/ — apm's prompts mapping changed"
|
|
fi
|
|
if [[ ! -e "$FIXTURE20/prompts" ]]; then
|
|
pass "no prompts/ directory is produced at the plugin root"
|
|
else
|
|
fail "a prompts/ directory appeared at the plugin root — it now needs a MIRROR_DIRS entry"
|
|
fi
|
|
if bash "$SCRIPT" --check "$FIXTURE20" > /dev/null 2>&1; then
|
|
pass "--check is clean with .apm/prompts/ content present"
|
|
else
|
|
fail "--check reports drift on a freshly synced fixture carrying .apm/prompts/"
|
|
fi
|
|
|
|
# --- 21. A stray file inside the generated hooks/ directory is drift ---
|
|
# hooks/ is mirror-owned output, so it is scoped like a MIRROR_DIRS destination and
|
|
# not like the plugin root (where README.md, docs/, bin/ and .mcp.json are all
|
|
# hand-authored and deliberately none of this script's business). Before hooks/ came
|
|
# under that ownership, --check exited 0 on a stray inside it and a real sync left the
|
|
# stray untouched — agreeing with each other, but agreeing on the wrong answer.
|
|
echo ""
|
|
echo "--- a stray file inside the generated hooks/ directory is reported and removed ---"
|
|
FIXTURE21="$(make_fixture)"; track "$FIXTURE21"
|
|
bash "$SCRIPT" "$FIXTURE21" > /dev/null 2>&1
|
|
if [[ ! -f "$FIXTURE21/hooks/hooks.json" ]]; then
|
|
fail "initial sync did not create hooks/hooks.json -- can't test the stray case"
|
|
else
|
|
printf '{"stray": true}\n' > "$FIXTURE21/hooks/extra.json"
|
|
if bash "$SCRIPT" --check "$FIXTURE21" > /dev/null 2>&1; then
|
|
fail "no drift reported for a stray file inside the generated hooks/ directory"
|
|
else
|
|
pass "a stray file inside hooks/ is reported as drift"
|
|
bash "$SCRIPT" "$FIXTURE21" > /dev/null 2>&1
|
|
if [[ ! -e "$FIXTURE21/hooks/extra.json" ]] && [[ -f "$FIXTURE21/hooks/hooks.json" ]]; then
|
|
pass "re-sync removes the stray and keeps hooks/hooks.json"
|
|
else
|
|
fail "re-sync did not clean the stray out of hooks/"
|
|
fi
|
|
if bash "$SCRIPT" --check "$FIXTURE21" > /dev/null 2>&1; then
|
|
pass "re-sync clears the stray-hooks-file drift"
|
|
else
|
|
fail "re-sync did not clear the stray-hooks-file drift"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# --- 22. An empty leftover hooks/ directory is drift, not an acceptable resting state ---
|
|
# When .apm/hooks/ produces no hooks.json, the correct mirror state is no hooks/
|
|
# directory at all — not an empty one. Empty leftovers are exactly what earlier
|
|
# revisions of this script left behind in this repo's own plugin roots.
|
|
echo ""
|
|
echo "--- an empty leftover hooks/ directory is reported and removed ---"
|
|
FIXTURE22="$(make_fixture)"; track "$FIXTURE22"
|
|
rm -rf "$FIXTURE22/.apm/hooks"
|
|
bash "$SCRIPT" "$FIXTURE22" > /dev/null 2>&1
|
|
if [[ -e "$FIXTURE22/hooks" ]]; then
|
|
fail "sync created hooks/ for a plugin whose .apm/hooks/ produces no hooks.json"
|
|
else
|
|
pass "no hooks/ directory when .apm/hooks/ produces nothing"
|
|
fi
|
|
mkdir -p "$FIXTURE22/hooks"
|
|
if bash "$SCRIPT" --check "$FIXTURE22" > /dev/null 2>&1; then
|
|
fail "no drift reported for an empty leftover hooks/ directory"
|
|
else
|
|
pass "an empty leftover hooks/ directory is reported as drift"
|
|
bash "$SCRIPT" "$FIXTURE22" > /dev/null 2>&1
|
|
if [[ ! -e "$FIXTURE22/hooks" ]]; then
|
|
pass "re-sync removes the empty leftover hooks/ directory"
|
|
else
|
|
fail "re-sync left the empty hooks/ directory in place"
|
|
fi
|
|
if bash "$SCRIPT" --check "$FIXTURE22" > /dev/null 2>&1; then
|
|
pass "re-sync clears the empty-hooks-directory drift"
|
|
else
|
|
fail "re-sync did not clear the empty-hooks-directory drift"
|
|
fi
|
|
fi
|
|
|
|
# --- 23. A credential in .mcp.json can never reach the published manifest ---
|
|
# apm's own builder runs _sanitize_mcp_servers() (apm_cli/core/plugin_manifest.py)
|
|
# before writing .claude-plugin/plugin.json — it drops env/environment/headers/
|
|
# authorization and any key matching token/secret/password/credential/apikey/key at
|
|
# any depth, because "copying them verbatim into a committed plugin.json would
|
|
# exfiltrate them into the distributed artefact". The old jq --slurpfile
|
|
# re-injection reached .github/plugin/plugin.json by a route that never touched the
|
|
# sanitizer, so the same fixture produced a stripped Claude manifest and a Copilot
|
|
# manifest carrying the live token. A path reference cannot carry a secret at all.
|
|
echo ""
|
|
echo "--- a token in .mcp.json never reaches .github/plugin/plugin.json ---"
|
|
# Assembled at runtime, never written as a literal: a credential-shaped constant
|
|
# in a tracked file is exactly what the gitleaks pre-commit hook exists to reject,
|
|
# and allowlisting this file to keep one would blunt the scanner across every
|
|
# future edit to it. The concatenation is what the leak test needs anyway — the
|
|
# assertion is that this value does not survive into the manifest, and its shape
|
|
# only has to be distinctive enough to grep for.
|
|
SECRET="ghp""_TESTONLYnotarealcredential000000000000"
|
|
FIXTURE23="$(make_fixture_with_mcp "{\"mcpServers\":{\"demo\":{\"command\":\"demo-server\",\"type\":\"stdio\",\"env\":{\"OBSIDIAN_API_TOKEN\":\"$SECRET\"}}}}")"; track "$FIXTURE23"
|
|
bash "$SCRIPT" "$FIXTURE23" > /dev/null 2>&1
|
|
if [[ ! -f "$FIXTURE23/.github/plugin/plugin.json" ]]; then
|
|
fail "sync produced no .github/plugin/plugin.json — cannot test the credential-leak case"
|
|
else
|
|
if grep -q "$SECRET" "$FIXTURE23/.github/plugin/plugin.json"; then
|
|
fail "the .mcp.json token was written into .github/plugin/plugin.json — a tracked, marketplace-distributed file"
|
|
else
|
|
pass "no .mcp.json credential appears in the generated Copilot manifest"
|
|
fi
|
|
# The Claude-side manifest is apm's own output and is sanitized upstream; assert
|
|
# it too, so this case fails loudly if a future change starts routing the Claude
|
|
# manifest through the same re-injection.
|
|
if [[ -f "$FIXTURE23/.claude-plugin/plugin.json" ]] \
|
|
&& grep -q "$SECRET" "$FIXTURE23/.claude-plugin/plugin.json"; then
|
|
fail "the .mcp.json token was written into .claude-plugin/plugin.json"
|
|
else
|
|
pass "no .mcp.json credential appears in the generated Claude manifest"
|
|
fi
|
|
if bash "$SCRIPT" --check "$FIXTURE23" > /dev/null 2>&1; then
|
|
pass "--check is clean on a freshly synced fixture whose .mcp.json carries an env block"
|
|
else
|
|
fail "--check reports drift on a freshly synced fixture carrying an .mcp.json env block"
|
|
fi
|
|
fi
|
|
|
|
# --- 24. .mcp.json drift is detected in both directions ---
|
|
# The re-injection is the only writer of the manifest's mcpServers field, and
|
|
# nothing covered it: --check could have silently stopped noticing either an
|
|
# .mcp.json that gained servers or one that lost them.
|
|
echo ""
|
|
echo "--- adding servers to .mcp.json after a sync is drift ---"
|
|
FIXTURE24="$(make_fixture_with_mcp '{"mcpServers":{}}')"; track "$FIXTURE24"
|
|
bash "$SCRIPT" "$FIXTURE24" > /dev/null 2>&1
|
|
if jq -e 'has("mcpServers")' "$FIXTURE24/.github/plugin/plugin.json" > /dev/null 2>&1; then
|
|
fail "an empty .mcp.json produced an mcpServers key — cannot test the gained-servers case"
|
|
else
|
|
printf '%s' '{"mcpServers":{"demo":{"command":"demo-server","type":"stdio"}}}' > "$FIXTURE24/.mcp.json"
|
|
CHECK24="$(bash "$SCRIPT" --check "$FIXTURE24" 2>&1 || true)"
|
|
case "$CHECK24" in
|
|
*"DRIFT $FIXTURE24/.github/plugin/plugin.json"*)
|
|
pass "an .mcp.json that gained its first server is reported as drift" ;;
|
|
*)
|
|
fail "no drift reported for .github/plugin/plugin.json after .mcp.json gained a server" ;;
|
|
esac
|
|
bash "$SCRIPT" "$FIXTURE24" > /dev/null 2>&1
|
|
if bash "$SCRIPT" --check "$FIXTURE24" > /dev/null 2>&1; then
|
|
pass "re-sync clears the gained-server drift"
|
|
else
|
|
fail "re-sync did not clear the gained-server drift"
|
|
fi
|
|
fi
|
|
|
|
echo ""
|
|
echo "--- emptying .mcp.json after a sync is drift ---"
|
|
FIXTURE24B="$(make_fixture_with_mcp '{"mcpServers":{"demo":{"command":"demo-server","type":"stdio"}}}')"; track "$FIXTURE24B"
|
|
bash "$SCRIPT" "$FIXTURE24B" > /dev/null 2>&1
|
|
if ! jq -e '.mcpServers == ".mcp.json"' "$FIXTURE24B/.github/plugin/plugin.json" > /dev/null 2>&1; then
|
|
fail "initial sync did not re-inject mcpServers — cannot test the lost-servers case"
|
|
else
|
|
printf '%s' '{"mcpServers":{}}' > "$FIXTURE24B/.mcp.json"
|
|
CHECK24B="$(bash "$SCRIPT" --check "$FIXTURE24B" 2>&1 || true)"
|
|
case "$CHECK24B" in
|
|
*"DRIFT $FIXTURE24B/.github/plugin/plugin.json"*)
|
|
pass "an .mcp.json emptied of its servers is reported as drift" ;;
|
|
*)
|
|
fail "no drift reported for .github/plugin/plugin.json after .mcp.json lost its servers" ;;
|
|
esac
|
|
bash "$SCRIPT" "$FIXTURE24B" > /dev/null 2>&1
|
|
if jq -e 'has("mcpServers") | not' "$FIXTURE24B/.github/plugin/plugin.json" > /dev/null 2>&1 \
|
|
&& bash "$SCRIPT" --check "$FIXTURE24B" > /dev/null 2>&1; then
|
|
pass "re-sync drops the mcpServers key and clears the drift"
|
|
else
|
|
fail "re-sync did not drop mcpServers / did not clear the lost-server drift"
|
|
fi
|
|
fi
|
|
|
|
# --- 25. The generated manifests: --check and a real sync agree about their mode ---
|
|
# The gate's contract is agreement between --check and a real sync, not "every
|
|
# property is repaired". Neither touches a generated manifest's permission bits, and
|
|
# neither can: in check mode the expected side is a `cp -a` of the real plugin root,
|
|
# so apm pack rewrites a file whose mode is already the actual side's. A revision that
|
|
# listed these paths in the mode manifest was measuring that inheritance, not the
|
|
# mirror — `chmod 600` left --check at exit 0 for as long as it was listed. This case
|
|
# pins the agreement instead, so a future "fix" that makes --check report a mode it
|
|
# cannot repair fails here.
|
|
echo ""
|
|
echo "--- --check and a real sync agree that a manifest's mode is not theirs to change ---"
|
|
FIXTURE25="$(make_fixture_with_mcp '{"mcpServers":{"demo":{"command":"demo-server","type":"stdio"}}}')"; track "$FIXTURE25"
|
|
bash "$SCRIPT" "$FIXTURE25" > /dev/null 2>&1
|
|
if ! bash "$SCRIPT" --check "$FIXTURE25" > /dev/null 2>&1; then
|
|
fail "check reported drift right after the initial sync — cannot test the manifest-mode case"
|
|
else
|
|
chmod 600 "$FIXTURE25/.github/plugin/plugin.json"
|
|
if bash "$SCRIPT" --check "$FIXTURE25" > /dev/null 2>&1; then
|
|
bash "$SCRIPT" "$FIXTURE25" > /dev/null 2>&1
|
|
MODE25="$(mode_of "$FIXTURE25/.github/plugin/plugin.json")"
|
|
if [[ "$MODE25" == "600" ]]; then
|
|
pass "--check reports no mode drift on a manifest, and a real sync indeed leaves the mode alone"
|
|
else
|
|
fail "--check reported no mode drift but a real sync changed the mode to $MODE25 — check and sync disagree"
|
|
fi
|
|
else
|
|
fail "--check reported drift after chmod 600 on .github/plugin/plugin.json, but a real sync cannot repair it — an unfixable pre-push failure"
|
|
fi
|
|
fi
|
|
|
|
# --- 25b. A manifest replaced by a SYMLINK is real drift and is reported ---
|
|
# This is the one property of the generated manifests worth asserting, and the reason
|
|
# it cannot live in check_path_modes: that compares against a `cp -a` of the same
|
|
# plugin root, which reproduces the symlink on the expected side and calls the two
|
|
# equal (verified — it sat at exit 0). The hazard is concrete: apm pack opens the
|
|
# manifest for writing and reinject_mcp_servers redirects into it, and both follow the
|
|
# link, so a real sync rewrites the link's TARGET instead of the manifest.
|
|
echo ""
|
|
echo "--- a plugin.json replaced by a symlink is reported as drift ---"
|
|
FIXTURE25B="$(make_fixture_with_mcp '{"mcpServers":{"demo":{"command":"demo-server","type":"stdio"}}}')"; track "$FIXTURE25B"
|
|
bash "$SCRIPT" "$FIXTURE25B" > /dev/null 2>&1
|
|
if [[ ! -f "$FIXTURE25B/.claude-plugin/plugin.json" ]]; then
|
|
fail "sync produced no .claude-plugin/plugin.json — cannot test the symlinked-manifest case"
|
|
else
|
|
cp "$FIXTURE25B/.claude-plugin/plugin.json" "$FIXTURE25B/decoy.json"
|
|
rm -f "$FIXTURE25B/.claude-plugin/plugin.json"
|
|
ln -s ../decoy.json "$FIXTURE25B/.claude-plugin/plugin.json"
|
|
CHECK25B="$(bash "$SCRIPT" --check "$FIXTURE25B" 2>&1 || true)"
|
|
case "$CHECK25B" in
|
|
*"DRIFT $FIXTURE25B/.claude-plugin/plugin.json: is a symlink"*)
|
|
pass "a symlinked .claude-plugin/plugin.json is reported as drift" ;;
|
|
*)
|
|
fail "no drift reported for a symlinked .claude-plugin/plugin.json — a real sync would write through it. Output: $CHECK25B" ;;
|
|
esac
|
|
fi
|
|
|
|
# --- 26. --check compares full permission bits, not just the exec bit ---
|
|
# The manifest used to record a bare exec/file kind, so `chmod 444` on a mirrored
|
|
# SKILL.md left --check at exit 0 while a real sync restored 644 — the same
|
|
# check/sync disagreement case 18 pins for the exec bit, one bit over.
|
|
echo ""
|
|
echo "--- --check detects a non-exec permission change on a mirrored file ---"
|
|
FIXTURE26="$(make_fixture)"; track "$FIXTURE26"
|
|
bash "$SCRIPT" "$FIXTURE26" > /dev/null 2>&1
|
|
if [[ ! -f "$FIXTURE26/skills/hello/SKILL.md" ]]; then
|
|
fail "sync did not mirror skills/hello/SKILL.md — cannot test the permission-bits case"
|
|
else
|
|
chmod 444 "$FIXTURE26/skills/hello/SKILL.md"
|
|
CHECK26="$(bash "$SCRIPT" --check "$FIXTURE26" 2>&1 || true)"
|
|
case "$CHECK26" in
|
|
*"mirrored paths/types/modes differ"*)
|
|
pass "chmod 444 on a mirrored file is reported as drift" ;;
|
|
*)
|
|
fail "no drift reported after chmod 444 on a mirrored file — only the exec bit is being compared" ;;
|
|
esac
|
|
bash "$SCRIPT" "$FIXTURE26" > /dev/null 2>&1
|
|
if bash "$SCRIPT" --check "$FIXTURE26" > /dev/null 2>&1; then
|
|
pass "re-sync restores the permission bits and clears the drift"
|
|
else
|
|
fail "re-sync did not clear the permission-bits drift"
|
|
fi
|
|
fi
|
|
|
|
# --- 26b. The mode comparison must not depend on the runtime umask ---
|
|
# Case 26's widening from the exec bit to full permission bits is correct for the
|
|
# files this script COPIES — both sides of the comparison trace to the same checkout.
|
|
# It is wrong for the files it WRITES: sync_hooks_json creates hooks/hooks.json with
|
|
# `printf '%s\n' >`, at the RUNTIME umask, while the real side carries the umask of
|
|
# the checkout that produced the committed file. Those are independent, so on a
|
|
# umask-002 machine `--check --all` over this repo's own umask-022 checkout reported
|
|
# `< file 664 hooks/hooks.json` / `> file 644` for every plugin with hooks — a pre-push
|
|
# failure with nothing wrong, and unfixable by committing, since git records no
|
|
# non-exec mode and the next --check from a umask-022 machine fails the other way.
|
|
#
|
|
# Two directions, because a one-sided assertion passes on the wrong fix: (a) the same
|
|
# tree checked under several runtime umasks, and (b) a tree whose GENERATED files carry
|
|
# a foreign umask — which is exactly what a umask-002 clone of a umask-022 commit looks
|
|
# like, git having recorded nothing to distinguish them.
|
|
echo ""
|
|
echo "--- --check is umask-independent over the files this script generates ---"
|
|
FIXTURE26B="$(umask 022; make_fixture)"; track "$FIXTURE26B"
|
|
(umask 022; bash "$SCRIPT" "$FIXTURE26B" > /dev/null 2>&1)
|
|
if [[ ! -f "$FIXTURE26B/hooks/hooks.json" ]]; then
|
|
fail "sync did not create hooks/hooks.json — cannot test the umask-independence case"
|
|
else
|
|
for UMASK26B in 022 002 077; do
|
|
if (umask "$UMASK26B"; bash "$SCRIPT" --check "$FIXTURE26B" > /dev/null 2>&1); then
|
|
pass "--check at umask $UMASK26B is clean on a tree synced at umask 022"
|
|
else
|
|
fail "--check at umask $UMASK26B reported drift on a tree synced at umask 022 — the gate is reporting the runner's umask, not the mirror"
|
|
fi
|
|
done
|
|
# What a umask-002 clone of the same commit looks like on disk.
|
|
chmod 664 "$FIXTURE26B/hooks/hooks.json"
|
|
[[ -f "$FIXTURE26B/.claude-plugin/plugin.json" ]] && chmod 664 "$FIXTURE26B/.claude-plugin/plugin.json"
|
|
for UMASK26B in 022 002; do
|
|
if (umask "$UMASK26B"; bash "$SCRIPT" --check "$FIXTURE26B" > /dev/null 2>&1); then
|
|
pass "--check at umask $UMASK26B is clean when the generated files carry a umask-002 checkout's mode"
|
|
else
|
|
fail "--check at umask $UMASK26B reported drift on generated files carrying a umask-002 checkout's mode — no commit can fix that"
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# --- 27. A plugin-dir argument whose basename is . or .. is rejected ---
|
|
# Every scratch path is "$SCRATCH_ROOT/$(basename "$plugin_dir")", so `..` resolves
|
|
# to the scratch root's PARENT: `apm pack -o` then writes outside the tree the EXIT
|
|
# trap cleans, and sync_one's `find "$scratch" -mindepth 1 -maxdepth 1 -type d |
|
|
# head -1` adopts an arbitrary unrelated directory as the "bundle" — whose contents
|
|
# a real sync cp -a's into the plugin root after an rm -rf. The duplicate-basename
|
|
# guard cannot catch it: a single `..` collides with nothing.
|
|
echo ""
|
|
echo "--- a plugin dir whose basename is . or .. is rejected ---"
|
|
for TRAVERSAL in . ..; do
|
|
RC27=0
|
|
OUT27="$(bash "$SCRIPT" "$TRAVERSAL" 2>&1)" || RC27=$?
|
|
case "$RC27:$OUT27" in
|
|
0:*)
|
|
fail "'$TRAVERSAL' was accepted as a plugin dir — expected a rejection" ;;
|
|
*"scratch paths built from it would escape the scratch root"*)
|
|
pass "'$TRAVERSAL' is rejected with a scratch-path-escape error" ;;
|
|
*)
|
|
fail "'$TRAVERSAL' was not rejected with the expected message (rc=$RC27): $OUT27" ;;
|
|
esac
|
|
done
|
|
|
|
# --- 27b. sync_dir and sync_hooks_json refuse an empty target_dir ---
|
|
# `set -u` aborts on an UNSET variable but not an empty one, so an empty
|
|
# $target_dir turns both functions' `rm -rf` calls into `rm -rf /agents`,
|
|
# `/skills`, `/commands`, `/instructions`, `/extensions`, `/hooks`. Unreachable
|
|
# from today's two call sites (both pass a validated plugin_dir or a scratch
|
|
# path), which is exactly why it needs a direct test: no end-to-end invocation
|
|
# can reach it, and the next caller added is the one that finds out.
|
|
#
|
|
# The functions are extracted and run with rm/mkdir/cp/find shadowed by loggers,
|
|
# so the UNGUARDED form is observed rather than executed — running it for real,
|
|
# as root, is the outcome the guard exists to prevent.
|
|
echo ""
|
|
echo "--- sync_dir/sync_hooks_json abort on an empty target_dir instead of rm -rf'ing / ---"
|
|
for GUARDED_FN in sync_dir sync_hooks_json; do
|
|
FNSRC="$(awk -v fn="^${GUARDED_FN}\\\\(\\\\) \\\\{$" '$0 ~ fn, /^\}$/' "$SCRIPT")"
|
|
if [[ -z "$FNSRC" ]] || [[ "$FNSRC" != *"rm -rf"* ]]; then
|
|
fail "could not extract $GUARDED_FN() from $SCRIPT — this case is testing nothing"
|
|
continue
|
|
fi
|
|
GUARD_BUNDLE="$(mktemp -d)"; track "$GUARD_BUNDLE"
|
|
mkdir -p "$GUARD_BUNDLE/agents"
|
|
printf '{}\n' > "$GUARD_BUNDLE/hooks.json"
|
|
GUARD_LOG="$(mktemp)"; track "$GUARD_LOG"
|
|
# HOOKS_DIR_REL/HOOKS_REL/LEGACY_HOOKS_REL are script globals sync_hooks_json
|
|
# reads; supply them so the extracted copy behaves like the real one.
|
|
RC27B=0
|
|
bash -c '
|
|
set -euo pipefail
|
|
LOG="$2"
|
|
HOOKS_DIR_REL="hooks"; HOOKS_REL="hooks/hooks.json"; LEGACY_HOOKS_REL="hooks.json"
|
|
rm() { printf "rm %s\n" "$*" >> "$LOG"; }
|
|
mkdir() { printf "mkdir %s\n" "$*" >> "$LOG"; }
|
|
cp() { printf "cp %s\n" "$*" >> "$LOG"; }
|
|
find() { printf "find %s\n" "$*" >> "$LOG"; }
|
|
'"$FNSRC"'
|
|
'"$GUARDED_FN"' "" "$1" agents
|
|
' _ "$GUARD_BUNDLE" "$GUARD_LOG" > /dev/null 2>&1 || RC27B=$?
|
|
DANGEROUS="$(grep -E '(^| )/(agents|skills|commands|instructions|extensions|hooks)([[:space:]]|$)' "$GUARD_LOG" 2>/dev/null || true)"
|
|
if [[ "$RC27B" -ne 0 ]] && [[ -z "$DANGEROUS" ]]; then
|
|
pass "$GUARDED_FN aborts on an empty target_dir before touching any path"
|
|
else
|
|
fail "$GUARDED_FN with an empty target_dir exited $RC27B and would have run:${DANGEROUS:-<nothing logged>}"
|
|
fi
|
|
done
|
|
|
|
# --- 28. --all refuses to report success over an unusable or empty marketplace ---
|
|
# check-plugin-content-sync is the one pre-push gate whose work list comes from a
|
|
# GENERATED file, so "the marketplace yields nothing" must never mean "verified,
|
|
# no drift" — regenerating marketplace.json badly would otherwise silence the hook
|
|
# that guards it. Every case below reached exit 0 before: the process substitution
|
|
# feeding `while read` is its own subshell, so a jq abort in there yields zero lines
|
|
# and reads exactly like "declares no local plugins".
|
|
echo ""
|
|
echo "--- --check --all fails on a marketplace that yields no plugins ---"
|
|
make_repo_fixture() {
|
|
local marketplace_json="$1" dir
|
|
dir="$(mktemp -d)"
|
|
dir="$(cd "$dir" && pwd -P)"
|
|
if ! env -u GIT_DIR -u GIT_WORK_TREE git -C "$dir" init -q >/dev/null 2>&1; then
|
|
echo "make_repo_fixture: 'git init' failed in $dir" >&2
|
|
exit 1
|
|
fi
|
|
mkdir -p "$dir/.claude-plugin"
|
|
printf '%s' "$marketplace_json" > "$dir/.claude-plugin/marketplace.json"
|
|
echo "$dir"
|
|
}
|
|
# `env -u GIT_DIR -u GIT_WORK_TREE`: run-tests.sh runs as a pre-push hook, and git
|
|
# hooks export both variables, which would re-target the script's
|
|
# `git rev-parse --show-toplevel` at the LIVE repo from any cwd.
|
|
run_all() {
|
|
local dir="$1"
|
|
shift
|
|
(cd "$dir" && env -u GIT_DIR -u GIT_WORK_TREE bash "$SCRIPT" "$@")
|
|
}
|
|
# Message-asserted, not just exit-code-asserted: --all has several independent
|
|
# routes to exit 1 (missing marketplace, apm pack failure, genuine drift), and an
|
|
# exit-code-only assertion would pass on any of them.
|
|
check_all_fails_with() {
|
|
local desc="$1" marketplace_json="$2" expected="$3" dir out rc=0
|
|
dir="$(make_repo_fixture "$marketplace_json")"; track "$dir"
|
|
out="$(run_all "$dir" --check --all 2>&1)" || rc=$?
|
|
if [[ "$rc" -eq 0 ]]; then
|
|
fail "$desc: --check --all exited 0 having checked nothing"
|
|
else
|
|
case "$out" in
|
|
*"$expected"*) pass "$desc: rejected with the expected message" ;;
|
|
*) fail "$desc: exited non-zero but not for the expected reason: $out" ;;
|
|
esac
|
|
fi
|
|
}
|
|
check_all_fails_with "an empty plugins array" \
|
|
'{"plugins":[]}' \
|
|
"declares no local (string-source) plugin entries"
|
|
check_all_fails_with "a marketplace with no plugins key at all" \
|
|
'{"name":"x"}' \
|
|
"declares no local (string-source) plugin entries"
|
|
check_all_fails_with "unparseable JSON" \
|
|
'{ not json' \
|
|
"is not valid JSON"
|
|
check_all_fails_with "a plugins field that is not an array" \
|
|
'{"plugins":{"a":1}}' \
|
|
"expected an array of plugin entries"
|
|
check_all_fails_with "a JSON array at the marketplace root" \
|
|
'[]' \
|
|
"is a JSON array at its top level"
|
|
check_all_fails_with "an entry with no source field" \
|
|
'{"plugins":[{"name":"orphan"}]}' \
|
|
"\`source\` is neither a local path string nor a remote source object"
|
|
# The guard used to name `.source == null` specifically, so every other malformed
|
|
# value walked straight through it into the same silence.
|
|
check_all_fails_with "an entry whose source is a number" \
|
|
'{"plugins":[{"name":"orphan","source":42}]}' \
|
|
"\`source\` is neither a local path string nor a remote source object"
|
|
check_all_fails_with "an entry whose source is an array" \
|
|
'{"plugins":[{"name":"orphan","source":[]}]}' \
|
|
"\`source\` is neither a local path string nor a remote source object"
|
|
|
|
# --- 28b. --all outside a git worktree refuses instead of guessing $PWD ---
|
|
# --all's entire work list hangs off REPO_ROOT, so a `|| pwd` fallback lets it derive
|
|
# that list from a marketplace.json belonging to some other tree. Run from a directory
|
|
# with no marketplace.json the old form happened to hit the "--all requires ..." error,
|
|
# but only by accident — the dangerous case is a $PWD that HAS one.
|
|
echo ""
|
|
echo "--- --all outside a git worktree refuses to guess the repository root ---"
|
|
NOGIT="$(mktemp -d)"; track "$NOGIT"
|
|
mkdir -p "$NOGIT/.claude-plugin"
|
|
printf '%s' '{"plugins":[{"name":"decoy","source":"./plugins/decoy"}]}' > "$NOGIT/.claude-plugin/marketplace.json"
|
|
if (cd "$NOGIT" && env -u GIT_DIR -u GIT_WORK_TREE git rev-parse --show-toplevel) >/dev/null 2>&1; then
|
|
fail "fixture precondition: $NOGIT is inside a git worktree, so this case cannot test the no-worktree path"
|
|
else
|
|
RC28B=0
|
|
OUT28B="$(cd "$NOGIT" && env -u GIT_DIR -u GIT_WORK_TREE bash "$SCRIPT" --check --all 2>&1)" || RC28B=$?
|
|
case "$RC28B:$OUT28B" in
|
|
0:*)
|
|
fail "--check --all exited 0 outside a worktree, having derived its plugin list from \$PWD" ;;
|
|
*"not inside a git worktree"*)
|
|
pass "--all refuses to guess \$PWD when it cannot locate the repository root" ;;
|
|
*)
|
|
fail "--check --all exited $RC28B outside a worktree but not for the stated reason: $OUT28B" ;;
|
|
esac
|
|
fi
|
|
|
|
# --- 29. A symlink under .apm/ is reported, in both modes ---
|
|
# apm's bundle exporter filters every symlink out of the bundle it builds
|
|
# (`f.is_file() and not f.is_symlink()` in _collect_flat/_collect_recursive,
|
|
# apm_cli/bundle/plugin_exporter.py) with no warning. Every other check here diffs
|
|
# the live mirror against a freshly synced copy, and BOTH are built from that same
|
|
# bundle — so the symlink is absent on both sides, they agree, and --check exits 0
|
|
# while the author's content is simply gone. Not a mismatch: an absence with nothing
|
|
# left to mismatch against. Verified before the fix: `ln -s real.md link.md` under
|
|
# .apm/skills/hello/ produced a mirror with no link.md and a --check at exit 0.
|
|
#
|
|
# Message-asserted, not exit-code-asserted: an unsynced fixture exits 1 anyway, so a
|
|
# bare non-zero would pass with the detection deleted.
|
|
echo ""
|
|
echo "--- a symlink under .apm/ is reported as lost content in both modes ---"
|
|
FIXTURE29="$(make_fixture)"; track "$FIXTURE29"
|
|
printf 'real content\n' > "$FIXTURE29/.apm/skills/hello/real.md"
|
|
ln -s real.md "$FIXTURE29/.apm/skills/hello/link.md"
|
|
RCSYNC29=0
|
|
SYNC29="$(bash "$SCRIPT" "$FIXTURE29" 2>&1)" || RCSYNC29=$?
|
|
CHECK29="$(bash "$SCRIPT" --check "$FIXTURE29" 2>&1 || true)"
|
|
for MODE29 in sync check; do
|
|
case "$MODE29" in
|
|
sync) OUT29="$SYNC29" ;;
|
|
check) OUT29="$CHECK29" ;;
|
|
esac
|
|
case "$OUT29" in
|
|
*"$FIXTURE29/.apm/skills/hello/link.md: symlink under .apm/"*)
|
|
pass "$MODE29 mode reports the symlink under .apm/ by path" ;;
|
|
*)
|
|
fail "$MODE29 mode did not report the symlink under .apm/ — apm drops it silently and no diff can see it: $OUT29" ;;
|
|
esac
|
|
done
|
|
# The loss is real, not theoretical: assert the mirror genuinely lacks it, so this
|
|
# case still means something if apm ever starts exporting symlinks.
|
|
if [[ ! -e "$FIXTURE29/skills/hello/link.md" ]]; then
|
|
pass "the symlink is indeed absent from the mirror (nothing else could have caught it)"
|
|
else
|
|
fail "the symlink reached the mirror — apm's exporter no longer drops it, so this report is now wrong"
|
|
fi
|
|
# The real sync above exited non-zero too (its rc, not a fresh run). Sync and --check
|
|
# agreeing is this script's core contract, and a real sync that "succeeds" while
|
|
# dropping content breaks it.
|
|
if [[ "$RCSYNC29" -ne 0 ]]; then
|
|
pass "a real sync exits non-zero rather than reporting success over dropped content"
|
|
else
|
|
fail "a real sync exited 0 while silently dropping .apm/ content — sync and --check must agree"
|
|
fi
|
|
rm -f "$FIXTURE29/.apm/skills/hello/link.md"
|
|
if bash "$SCRIPT" "$FIXTURE29" > /dev/null 2>&1 && bash "$SCRIPT" --check "$FIXTURE29" > /dev/null 2>&1; then
|
|
pass "removing the symlink clears the report in both modes"
|
|
else
|
|
fail "the symlink report survived its removal"
|
|
fi
|
|
|
|
# --- 29b. The report is scoped to content the mirror would actually carry ---
|
|
# sync_dir strips <category>/<name>/tests from the mirror outright, so a symlink in
|
|
# there loses nothing and reporting it would be a false alarm demanding a pointless
|
|
# edit. A `tests` DEEPER than that is a template asset the mirror does carry (case
|
|
# 3b), so a symlink in it is real loss. Same depth boundary, both directions —
|
|
# a carve-out asserted in only one direction passes on "report nothing, ever".
|
|
echo ""
|
|
echo "--- the symlink report follows the mirror's own tests/ depth boundary ---"
|
|
FIXTURE29B="$(make_fixture)"; track "$FIXTURE29B"
|
|
printf 'x\n' > "$FIXTURE29B/.apm/skills/hello/tests/real.txt"
|
|
ln -s real.txt "$FIXTURE29B/.apm/skills/hello/tests/link.txt"
|
|
bash "$SCRIPT" "$FIXTURE29B" > /dev/null 2>&1
|
|
RC29B=0
|
|
OUT29B="$(bash "$SCRIPT" --check "$FIXTURE29B" 2>&1)" || RC29B=$?
|
|
case "$OUT29B" in
|
|
*"tests/link.txt: symlink under .apm/"*)
|
|
fail "a symlink under the un-mirrored <name>/tests/ was reported — nothing is lost there" ;;
|
|
*)
|
|
pass "a symlink under <name>/tests/ is not reported (that subtree is not mirrored)" ;;
|
|
esac
|
|
# Exit code as well as message, from that same run: a carve-out that suppresses the
|
|
# line but still fails the gate is not a carve-out.
|
|
if [[ "$RC29B" -eq 0 ]]; then
|
|
pass "--check is clean with a symlink confined to the un-mirrored tests/ fixture dir"
|
|
else
|
|
fail "--check reported drift for a symlink under the un-mirrored <name>/tests/: $OUT29B"
|
|
fi
|
|
printf 'y\n' > "$FIXTURE29B/.apm/skills/hello/assets/templates/tests/real.txt"
|
|
ln -s real.txt "$FIXTURE29B/.apm/skills/hello/assets/templates/tests/link.txt"
|
|
OUT29B2="$(bash "$SCRIPT" --check "$FIXTURE29B" 2>&1 || true)"
|
|
case "$OUT29B2" in
|
|
*"assets/templates/tests/link.txt: symlink under .apm/"*)
|
|
pass "a symlink under the mirrored assets/templates/tests/ IS reported" ;;
|
|
*)
|
|
fail "a symlink under the mirrored assets/templates/tests/ was not reported — the carve-out is depth-agnostic and swallows real loss: $OUT29B2" ;;
|
|
esac
|
|
|
|
# --- 30. --all fails when it verified fewer plugins than the marketplace declares ---
|
|
# The zero-plugin floor (case 28) rejects "the marketplace yielded nothing"; it cannot
|
|
# see "it yielded N and only M were checked". sync_one SKIPs a plugin directory with no
|
|
# .apm/ at status 0, so --all printed one SKIP line and exited 0 having verified one
|
|
# plugin fewer than it listed — a pre-push gate over a GENERATED work list silently
|
|
# covering less than it claims.
|
|
echo ""
|
|
echo "--- --check --all fails when a listed plugin cannot be verified ---"
|
|
# A repo fixture with real plugin directories, unlike case 28's marketplace-only one.
|
|
make_repo_with_plugins() {
|
|
local dir
|
|
dir="$(mktemp -d)"
|
|
dir="$(cd "$dir" && pwd -P)"
|
|
if ! env -u GIT_DIR -u GIT_WORK_TREE git -C "$dir" init -q >/dev/null 2>&1; then
|
|
echo "make_repo_with_plugins: 'git init' failed in $dir" >&2
|
|
exit 1
|
|
fi
|
|
mkdir -p "$dir/.claude-plugin" "$dir/plugins"
|
|
printf '%s' '{"plugins":[{"name":"good","source":"./plugins/good"},{"name":"bare","source":"./plugins/bare"}]}' \
|
|
> "$dir/.claude-plugin/marketplace.json"
|
|
local p
|
|
for p in good bare; do
|
|
local src
|
|
src="$(make_fixture)"; track "$src"
|
|
mv "$src" "$dir/plugins/$p"
|
|
done
|
|
echo "$dir"
|
|
}
|
|
REPO30="$(make_repo_with_plugins)"; track "$REPO30"
|
|
# Sync both first, so the ONLY thing --all can complain about below is the count.
|
|
bash "$SCRIPT" "$REPO30/plugins/good" "$REPO30/plugins/bare" > /dev/null 2>&1
|
|
if (cd "$REPO30" && env -u GIT_DIR -u GIT_WORK_TREE bash "$SCRIPT" --check --all > /dev/null 2>&1); then
|
|
pass "--check --all is clean when every declared plugin is verifiable (baseline)"
|
|
else
|
|
fail "--check --all reported drift on a freshly synced two-plugin repo — cannot test the count case"
|
|
fi
|
|
# Now take one listed plugin's .apm/ away: it is still declared, still on disk, and
|
|
# now unverifiable. Its mirror is left in place, so no other check has anything to say.
|
|
rm -rf "$REPO30/plugins/bare/.apm"
|
|
RC30=0
|
|
OUT30="$(cd "$REPO30" && env -u GIT_DIR -u GIT_WORK_TREE bash "$SCRIPT" --check --all 2>&1)" || RC30=$?
|
|
case "$RC30:$OUT30" in
|
|
0:*)
|
|
fail "--check --all exited 0 having verified 1 of the 2 plugins its marketplace declares" ;;
|
|
*"verified 1 of the 2 local plugin entries"*)
|
|
pass "--check --all fails and names how many of the declared plugins it actually verified" ;;
|
|
*)
|
|
fail "--check --all exited $RC30 but not for the under-count reason: $OUT30" ;;
|
|
esac
|
|
# The message must name the plugin, not just the arithmetic — a count alone leaves the
|
|
# reader diffing marketplace.json against a directory listing by hand.
|
|
case "$OUT30" in
|
|
*"unverified: $REPO30/plugins/bare"*)
|
|
pass "the failure names the unverified plugin directory" ;;
|
|
*)
|
|
fail "the failure did not name the unverified plugin directory: $OUT30" ;;
|
|
esac
|
|
# ...and an explicitly-named plugin dir with no .apm/ stays a skip (case 6): there the
|
|
# caller chose the work list, so a non-apm directory is their business, not drift in a
|
|
# generated file.
|
|
if bash "$SCRIPT" --check "$REPO30/plugins/bare" > /dev/null 2>&1; then
|
|
pass "the same directory named explicitly is still a clean skip, not a failure"
|
|
else
|
|
fail "an explicitly-named plugin dir with no .apm/ now fails — case 6's skip contract is broken"
|
|
fi
|
|
|
|
# --- 31. No `hooks` pointer is injected into the Copilot manifest ---
|
|
# Copilot types `hooks` "string or object" with NO default (github-copilot-plugins/
|
|
# configuration.md:47), exactly like mcpServers — so Copilot resolves no hooks from any
|
|
# plugin here, and re-injecting a pointer the way reinject_mcp_servers() does for
|
|
# mcpServers looks like the obvious twin fix. It is not, and this case pins the
|
|
# difference: apm merges .apm/hooks/*.json into exactly ONE hooks.json with no
|
|
# per-target shaping, while the two ecosystems' hook file formats are mutually
|
|
# incompatible (Claude: `{"hooks":{"PreToolUse":[{matcher,hooks}]}}`; Copilot:
|
|
# `{"version":1,"hooks":{"sessionStart":[{type,bash,powershell}]}}`). A pointer would
|
|
# assert that a Claude-shaped file is Copilot-shaped — a wrong manifest in place of an
|
|
# incomplete one. .mcp.json carries no such claim: it is one format both hosts read.
|
|
# See ADR-0017's "no `hooks` pointer" amendment and plugins/kyberforge/docs/hooks.md.
|
|
echo ""
|
|
echo "--- the generated Copilot manifest carries no hooks pointer ---"
|
|
FIXTURE31="$(make_fixture_with_mcp '{"mcpServers":{"demo":{"command":"demo-server","type":"stdio"}}}')"; track "$FIXTURE31"
|
|
mkdir -p "$FIXTURE31/.apm/hooks"
|
|
cat > "$FIXTURE31/.apm/hooks/hooks.json" <<'EOF'
|
|
{"hooks": {"PreToolUse": [{"matcher": "Bash", "hooks": [{"type": "command", "command": "true"}]}]}}
|
|
EOF
|
|
bash "$SCRIPT" "$FIXTURE31" > /dev/null 2>&1
|
|
if [[ ! -f "$FIXTURE31/hooks/hooks.json" ]]; then
|
|
fail "sync produced no hooks/hooks.json — cannot test the hooks-pointer decision"
|
|
elif [[ ! -f "$FIXTURE31/.github/plugin/plugin.json" ]]; then
|
|
fail "sync produced no .github/plugin/plugin.json — cannot test the hooks-pointer decision"
|
|
else
|
|
pass "a non-empty .apm/hooks/ produces hooks/hooks.json (Claude Code's convention path)"
|
|
if jq -e 'has("hooks") | not' "$FIXTURE31/.github/plugin/plugin.json" > /dev/null 2>&1; then
|
|
pass "no hooks pointer in .github/plugin/plugin.json, even with a real hook present"
|
|
else
|
|
fail "a hooks pointer was injected into the Copilot manifest (got: $(jq -c '.hooks' "$FIXTURE31/.github/plugin/plugin.json" 2>/dev/null)) — it would point Copilot at a Claude-shaped hooks file. Reconcile the two hook schemas first; see ADR-0017"
|
|
fi
|
|
# The Claude manifest needs none either: hooks/hooks.json IS its convention path.
|
|
if jq -e 'has("hooks") | not' "$FIXTURE31/.claude-plugin/plugin.json" > /dev/null 2>&1; then
|
|
pass "no hooks pointer in .claude-plugin/plugin.json either — the convention path needs none"
|
|
else
|
|
fail "a hooks pointer appeared in the Claude manifest, which convention-scans hooks/hooks.json already"
|
|
fi
|
|
fi
|
|
|
|
echo ""
|
|
echo "Results: $PASS passed, $FAIL failed"
|
|
[[ $FAIL -eq 0 ]]
|