|
| 1 | +import { mkdir, mkdtemp, symlink, writeFile } from 'node:fs/promises' |
| 2 | +import { tmpdir } from 'node:os' |
| 3 | +import { join } from 'pathe' |
| 4 | +import { describe, expect, it } from 'vitest' |
| 5 | +import { resolveSkillFilePath, scanSkills } from '../utils' |
| 6 | + |
| 7 | +async function skillsRoot(): Promise<string> { |
| 8 | + return mkdtemp(join(tmpdir(), 'comark-skills-')) |
| 9 | +} |
| 10 | + |
| 11 | +async function writeSkill(root: string, name: string, skillMd: string, extra: Record<string, string> = {}) { |
| 12 | + const dir = join(root, name) |
| 13 | + await mkdir(dir, { recursive: true }) |
| 14 | + await writeFile(join(dir, 'SKILL.md'), skillMd) |
| 15 | + for (const [rel, body] of Object.entries(extra)) { |
| 16 | + const path = join(dir, rel) |
| 17 | + await mkdir(join(path, '..'), { recursive: true }) |
| 18 | + await writeFile(path, body) |
| 19 | + } |
| 20 | +} |
| 21 | + |
| 22 | +describe('scanSkills', () => { |
| 23 | + it('catalogues a valid skill with supporting files, SKILL.md first', async () => { |
| 24 | + const root = await skillsRoot() |
| 25 | + await writeSkill( |
| 26 | + root, |
| 27 | + 'my-product', |
| 28 | + '---\nname: my-product\ndescription: >\n Build apps with My Product.\n---\n', |
| 29 | + { |
| 30 | + 'references/api.md': '# API\n', |
| 31 | + 'scripts/setup.sh': '#!/bin/sh\n', |
| 32 | + } |
| 33 | + ) |
| 34 | + |
| 35 | + const { catalog, warnings } = await scanSkills(root) |
| 36 | + expect(warnings).toEqual([]) |
| 37 | + expect(catalog).toEqual([ |
| 38 | + { |
| 39 | + name: 'my-product', |
| 40 | + description: 'Build apps with My Product.\n', |
| 41 | + files: ['SKILL.md', 'references/api.md', 'scripts/setup.sh'], |
| 42 | + }, |
| 43 | + ]) |
| 44 | + }) |
| 45 | + |
| 46 | + it('defaults name to the directory when frontmatter omits it', async () => { |
| 47 | + const root = await skillsRoot() |
| 48 | + await writeSkill(root, 'create-project', '---\ndescription: Scaffold a project.\n---\n') |
| 49 | + expect((await scanSkills(root)).catalog[0]?.name).toBe('create-project') |
| 50 | + }) |
| 51 | + |
| 52 | + it('skips skills without a description, with an invalid name, or with a name/dir mismatch', async () => { |
| 53 | + const root = await skillsRoot() |
| 54 | + await writeSkill(root, 'no-desc', '---\nname: no-desc\n---\n') |
| 55 | + await writeSkill(root, 'BadName', '---\nname: BadName\ndescription: Nope.\n---\n') |
| 56 | + await writeSkill(root, 'mismatch', '---\nname: other\ndescription: Nope.\n---\n') |
| 57 | + await writeSkill(root, 'ok-skill', '---\ndescription: Fine.\n---\n') |
| 58 | + |
| 59 | + const { catalog, warnings } = await scanSkills(root) |
| 60 | + expect(catalog.map((s) => s.name)).toEqual(['ok-skill']) |
| 61 | + expect(warnings).toHaveLength(3) |
| 62 | + }) |
| 63 | + |
| 64 | + it('omits hidden files from the catalog', async () => { |
| 65 | + const root = await skillsRoot() |
| 66 | + await writeSkill(root, 'my-skill', '---\ndescription: Hidden files stay private.\n---\n', { |
| 67 | + '.secret': 'nope', |
| 68 | + 'refs/.cache': 'nope', |
| 69 | + }) |
| 70 | + expect((await scanSkills(root)).catalog[0]?.files).toEqual(['SKILL.md']) |
| 71 | + }) |
| 72 | + |
| 73 | + it('returns an empty catalog when the directory is missing', async () => { |
| 74 | + expect(await scanSkills(join(tmpdir(), 'comark-skills-missing'))).toEqual({ |
| 75 | + catalog: [], |
| 76 | + warnings: [], |
| 77 | + }) |
| 78 | + }) |
| 79 | + |
| 80 | + it('skips a skill whose SKILL.md is a directory, without aborting the scan', async () => { |
| 81 | + const root = await skillsRoot() |
| 82 | + await mkdir(join(root, 'broken', 'SKILL.md'), { recursive: true }) |
| 83 | + await writeSkill(root, 'ok-skill', '---\ndescription: Fine.\n---\n') |
| 84 | + |
| 85 | + const { catalog, warnings } = await scanSkills(root) |
| 86 | + expect(catalog.map((s) => s.name)).toEqual(['ok-skill']) |
| 87 | + expect(warnings.some((w) => w.includes('broken') && w.includes('not a file'))).toBe(true) |
| 88 | + }) |
| 89 | + |
| 90 | + it('does not list a symlink that points outside the skill directory', async () => { |
| 91 | + const root = await skillsRoot() |
| 92 | + const outside = await mkdtemp(join(tmpdir(), 'comark-skills-outside-')) |
| 93 | + await writeFile(join(outside, 'secret.md'), 'leaked') |
| 94 | + await writeSkill(root, 'my-skill', '---\ndescription: Fine.\n---\n', { |
| 95 | + 'references/api.md': '# API\n', |
| 96 | + }) |
| 97 | + await symlink(join(outside, 'secret.md'), join(root, 'my-skill', 'leaked.md')) |
| 98 | + await symlink(outside, join(root, 'my-skill', 'escape')) |
| 99 | + |
| 100 | + expect((await scanSkills(root)).catalog[0]?.files).toEqual(['SKILL.md', 'references/api.md']) |
| 101 | + }) |
| 102 | +}) |
| 103 | + |
| 104 | +describe('resolveSkillFilePath', () => { |
| 105 | + it('normalises in-skill `.` / `..` segments', () => { |
| 106 | + expect(resolveSkillFilePath('my-skill/refs/../SKILL.md')).toEqual({ |
| 107 | + skillName: 'my-skill', |
| 108 | + relativeFile: 'SKILL.md', |
| 109 | + }) |
| 110 | + expect(resolveSkillFilePath('my-skill/./references/api.md')).toEqual({ |
| 111 | + skillName: 'my-skill', |
| 112 | + relativeFile: 'references/api.md', |
| 113 | + }) |
| 114 | + }) |
| 115 | + |
| 116 | + it('rejects paths that escape or have no file', () => { |
| 117 | + expect(resolveSkillFilePath('../etc/passwd')).toBeNull() |
| 118 | + expect(resolveSkillFilePath('my-skill/../../etc/passwd')).toBeNull() |
| 119 | + expect(resolveSkillFilePath('/etc/passwd')).toBeNull() |
| 120 | + expect(resolveSkillFilePath('my-skill/SKILL.md\0.png')).toBeNull() |
| 121 | + expect(resolveSkillFilePath('my-skill')).toBeNull() |
| 122 | + expect(resolveSkillFilePath('')).toBeNull() |
| 123 | + }) |
| 124 | +}) |
0 commit comments