| 1 | import assert from "node:assert/strict"; |
| 2 | import { readFileSync, readdirSync } from "node:fs"; |
| 3 | import { DatabaseSync } from "node:sqlite"; |
| 4 | import { test } from "node:test"; |
| 5 | |
| 6 | import { parseMarketplaceManifest } from "../../../packages/contracts/src/claude-plugin.ts"; |
| 7 | import { type Fetch, fetchMarketplace, fetchPlugin } from "./customize-fetch.ts"; |
| 8 | import * as marketplaces from "./marketplaces.ts"; |
| 9 | import * as plugins from "./plugins.ts"; |
| 10 | import { skillByName } from "./skill-library.ts"; |
| 11 | import { attachedRows, shelfFrom } from "./skills.ts"; |
| 12 | |
| 13 | /** D1, as far as Customize uses it, over node's SQLite with the service's migrations. */ |
| 14 | function fakeD1(): D1Database { |
| 15 | const db = new DatabaseSync(":memory:"); |
| 16 | const dir = new URL("../migrations/", import.meta.url); |
| 17 | for (const file of readdirSync(dir).sort()) db.exec(readFileSync(new URL(file, dir), "utf8")); |
| 18 | const statement = (sql: string, params: unknown[] = []) => ({ |
| 19 | bind: (...values: unknown[]) => statement(sql, values), |
| 20 | first: async () => (db.prepare(sql).get(...(params as never[])) as unknown) ?? null, |
| 21 | run: async () => { |
| 22 | const r = db.prepare(sql).run(...(params as never[])); |
| 23 | return { meta: { changes: Number(r.changes) } }; |
| 24 | }, |
| 25 | all: async () => ({ results: db.prepare(sql).all(...(params as never[])) }), |
| 26 | }); |
| 27 | const batch = async (statements: { run: () => Promise<unknown> }[]) => Promise.all(statements.map((s) => s.run())); |
| 28 | return { prepare: (sql: string) => statement(sql), batch } as unknown as D1Database; |
| 29 | } |
| 30 | |
| 31 | const SHA = "0123456789abcdef0123456789abcdef01234567"; |
| 32 | |
| 33 | /** GitHub, in miniature: a marketplace repository with two plugins, and raw files. */ |
| 34 | const REPO: Record<string, string> = { |
| 35 | ".claude-plugin/marketplace.json": JSON.stringify({ |
| 36 | name: "acme-tools", |
| 37 | owner: { name: "Acme" }, |
| 38 | metadata: { description: "Acme's tools" }, |
| 39 | plugins: [ |
| 40 | { name: "release", source: "./plugins/release", description: "Cut releases", category: "development", version: "1.2.0" }, |
| 41 | { name: "docs-skills", source: "./", description: "Writing skills", strict: false, skills: ["./skills/brief"] }, |
| 42 | { name: "from-npm", source: { source: "npm", package: "@acme/x" }, description: "Not here" }, |
| 43 | ], |
| 44 | }), |
| 45 | "plugins/release/.claude-plugin/plugin.json": JSON.stringify({ name: "release", version: "1.2.0", description: "Cuts releases", author: { name: "Acme" } }), |
| 46 | "plugins/release/README.md": "# Release\n\nCuts releases.", |
| 47 | "plugins/release/skills/release-notes/SKILL.md": "---\nname: release-notes\ndescription: Use when asked for release notes.\nallowed-tools: Read, Bash\n---\n\nRead the merged pull requests, group them, write the notes.\n", |
| 48 | "plugins/release/skills/release-notes/references/template.md": "# Notes\n", |
| 49 | "plugins/release/skills/code/SKILL.md": "---\nname: code\ndescription: A plugin skill with a foundational name.\n---\n\nIt is called release:code here.\n", |
| 50 | "plugins/release/commands/cut.md": "---\ndescription: Cut a release now.\n---\n\nRun the release script.\n", |
| 51 | "plugins/release/agents/releaser.md": "---\nname: releaser\ndescription: Cuts a release end to end.\ntools: Read, Bash\nmodel: sonnet\n---\n\nYou cut releases carefully.\n", |
| 52 | "plugins/release/.mcp.json": JSON.stringify({ mcpServers: { tracker: { type: "http", url: "https://mcp.example.com/mcp" }, local: { command: "npx", args: ["server"] }, keyed: { type: "http", url: "https://keyed.example.com/mcp", headers: { "X-Key": "${ACME_KEY}" } } } }), |
| 53 | "plugins/release/hooks/hooks.json": JSON.stringify({ hooks: {} }), |
| 54 | "skills/brief/SKILL.md": "---\nname: brief\ndescription: Use when asked for a brief.\n---\n\nWrite a one-page brief.\n", |
| 55 | }; |
| 56 | |
| 57 | function githubFetch(repo = "acme/tools", files = REPO): Fetch { |
| 58 | return async (url) => { |
| 59 | const u = new URL(url); |
| 60 | if (u.hostname === "raw.githubusercontent.com") { |
| 61 | const [, owner, name, ref, ...rest] = u.pathname.split("/"); |
| 62 | const path = rest.map(decodeURIComponent).join("/"); |
| 63 | if (`${owner}/${name}` !== repo || (ref !== SHA && ref !== "HEAD" && ref !== "main")) return new Response("no", { status: 404 }); |
| 64 | const file = files[path]; |
| 65 | return file === undefined ? new Response("no", { status: 404 }) : new Response(file, { status: 200 }); |
| 66 | } |
| 67 | if (u.hostname === "api.github.com") { |
| 68 | if (u.pathname === `/repos/${repo}/commits/HEAD` || u.pathname === `/repos/${repo}/commits/main`) return Response.json({ sha: SHA }); |
| 69 | if (u.pathname === `/repos/${repo}/git/trees/${SHA}`) return Response.json({ tree: Object.entries(files).map(([path, content]) => ({ path, type: "blob", size: content.length })), truncated: false }); |
| 70 | return new Response("no", { status: 404 }); |
| 71 | } |
| 72 | return new Response("no", { status: 404 }); |
| 73 | }; |
| 74 | } |
| 75 | |
| 76 | const ws = "wsp_acme"; |
| 77 | const at = new Date("2026-10-11T12:00:00.000Z"); |
| 78 | const deps = { fetchFn: githubFetch() }; |
| 79 | |
| 80 | test("a marketplace is read from GitHub by its address, its plugins listed with where each would be fetched from", async () => { |
| 81 | const read = await fetchMarketplace({ source: "github", repo: "acme/tools" }, deps); |
| 82 | assert.ok(read.ok); |
| 83 | assert.equal(read.sha, SHA); |
| 84 | const manifest = parseMarketplaceManifest(read.json); |
| 85 | assert.ok(manifest.ok); |
| 86 | const db = fakeD1(); |
| 87 | const added = await marketplaces.addMarketplace(db, ws, null, { source: "github", repo: "acme/tools" }, "chase", deps, "g1t.sh", at); |
| 88 | assert.ok(added.ok); |
| 89 | assert.deepEqual({ name: added.value.name, owner: added.value.owner, plugins: added.value.plugins, builtin: added.value.builtin, can_remove: added.value.can_remove }, { name: "acme-tools", owner: "Acme", plugins: 3, builtin: false, can_remove: true }); |
| 90 | const again = await marketplaces.addMarketplace(db, ws, null, { source: "github", repo: "acme/tools" }, "chase", deps, "g1t.sh", at); |
| 91 | assert.equal(!again.ok && again.error.code, "conflict"); |
| 92 | const reserved = await marketplaces.addMarketplace(db, ws, "claude-plugins-official", { source: "github", repo: "acme/tools" }, "chase", deps, "g1t.sh", at); |
| 93 | assert.equal(!reserved.ok && reserved.error.code, "invalid"); |
| 94 | // The built-ins can't be read in this test (no GitHub), so they are listed with a problem and no plugins; the workspace's own lists three. |
| 95 | const all = await marketplaces.loadAll(db, ws, deps, "g1t.sh", at); |
| 96 | const listings = marketplaces.discoverPlugins(all, new Map(), "g1t.sh"); |
| 97 | assert.deepEqual( |
| 98 | listings.map((l) => [l.ref, l.availability.kind, l.fetch.kind]), |
| 99 | [ |
| 100 | ["release@acme-tools", "available", "github"], |
| 101 | ["docs-skills@acme-tools", "available", "github"], |
| 102 | ["from-npm@acme-tools", "unavailable", "unsupported"], |
| 103 | ], |
| 104 | ); |
| 105 | assert.deepEqual(listings[0]!.fetch, { kind: "github", repo: "acme/tools", ref: null, sha: null, path: "plugins/release" }); |
| 106 | const skills = marketplaces.discoverSkills(listings, new Set()); |
| 107 | assert.deepEqual( |
| 108 | skills.map((s) => [s.ref, s.plugin, s.added]), |
| 109 | [["docs-skills:brief", "docs-skills", false]], |
| 110 | ); |
| 111 | const out = marketplaces.marketplacesOut(all, true); |
| 112 | assert.deepEqual( |
| 113 | out.map((m) => [m.name, m.builtin, m.can_remove]), |
| 114 | [ |
| 115 | ["claude-plugins-official", true, false], |
| 116 | ["anthropic-agent-skills", true, false], |
| 117 | ["acme-tools", false, true], |
| 118 | ["g1t", true, false], |
| 119 | ], |
| 120 | ); |
| 121 | const removed = await marketplaces.removeMarketplace(db, ws, "acme-tools"); |
| 122 | assert.ok(removed.ok); |
| 123 | assert.equal(!(await marketplaces.removeMarketplace(db, ws, "claude-plugins-official")).ok, true); |
| 124 | }); |
| 125 | |
| 126 | test("a plugin is fetched from GitHub at a commit, read, and installed: skills into the library under its name, agents kept, servers found", async () => { |
| 127 | const plan = { kind: "github" as const, repo: "acme/tools", ref: null, sha: null, path: "plugins/release" }; |
| 128 | const fetched = await fetchPlugin(plan, deps); |
| 129 | assert.ok(fetched.ok); |
| 130 | assert.equal(fetched.sha, SHA); |
| 131 | assert.deepEqual(fetched.files.map((f) => f.path).sort(), [".claude-plugin/plugin.json", ".mcp.json", "README.md", "agents/releaser.md", "commands/cut.md", "hooks/hooks.json", "skills/code/SKILL.md", "skills/release-notes/SKILL.md", "skills/release-notes/references/template.md"]); |
| 132 | const read = plugins.readPlugin(fetched.files, fetched.sha, null); |
| 133 | assert.equal(read.manifest?.version, "1.2.0"); |
| 134 | assert.deepEqual( |
| 135 | read.components.skills.map((s) => [s.name, s.description]), |
| 136 | [ |
| 137 | ["code", "A plugin skill with a foundational name."], |
| 138 | ["release-notes", "Use when asked for release notes."], |
| 139 | ], |
| 140 | ); |
| 141 | assert.deepEqual(read.components.commands.map((c) => c.name), ["cut"]); |
| 142 | assert.deepEqual(read.agents.map((a) => [a.name, a.model, a.tools]), [["releaser", "sonnet", ["Read", "Bash"]]]); |
| 143 | assert.deepEqual( |
| 144 | read.components.mcp_servers.map((s) => [s.name, s.type, s.remote]), |
| 145 | [ |
| 146 | ["tracker", "http", true], |
| 147 | ["local", "stdio", false], |
| 148 | ["keyed", "http", true], |
| 149 | ], |
| 150 | ); |
| 151 | assert.equal(read.components.hooks, true); |
| 152 | assert.equal(read.readme, "# Release\n\nCuts releases."); |
| 153 | |
| 154 | const db = fakeD1(); |
| 155 | await marketplaces.addMarketplace(db, ws, null, { source: "github", repo: "acme/tools" }, "chase", deps, "g1t.sh", at); |
| 156 | const all = await marketplaces.loadAll(db, ws, deps, "g1t.sh", at); |
| 157 | const listings = marketplaces.discoverPlugins(all, new Map(), "g1t.sh"); |
| 158 | const listing = marketplaces.findListing(listings, "release@acme-tools")!; |
| 159 | const entry = marketplaces.entryOf(all, { name: "release", marketplace: "acme-tools" })!; |
| 160 | const done = await plugins.install(db, { workspaceId: ws, listing, entry: entry.entry, marketplace: { name: "acme-tools", source: entry.source, pluginRoot: entry.pluginRoot }, host: "g1t.sh", by: "chase", deps, now: at }); |
| 161 | assert.ok(done.ok); |
| 162 | assert.deepEqual(done.value.skills.map((s) => [s.name, s.problem]), [ |
| 163 | ["code", null], |
| 164 | ["release-notes", null], |
| 165 | ["cut", null], |
| 166 | ]); |
| 167 | assert.equal(done.value.install.sha, SHA); |
| 168 | assert.deepEqual(done.value.install.fetch, { ...plan, sha: SHA }); |
| 169 | // The library has them, named by the plugin, read-only, with Claude Code's tools kept aside. |
| 170 | const notes = await skillByName(db, ws, "release-notes", "release@acme-tools"); |
| 171 | assert.ok(notes); |
| 172 | assert.equal(notes.plugin, "release@acme-tools"); |
| 173 | assert.equal(await skillByName(db, ws, "release-notes"), null); |
| 174 | const code = await skillByName(db, ws, "code", "release@acme-tools"); |
| 175 | assert.ok(code, "a plugin skill may carry a foundational name"); |
| 176 | const version = await db.prepare("SELECT skill_md FROM skill_versions WHERE skill_id = ? AND version = 1").bind(notes.id).first<{ skill_md: string }>(); |
| 177 | assert.match(version!.skill_md, /allowed-tools: Read, Bash/); |
| 178 | // Attached to every agent, it reaches an agent as `release:release-notes`. |
| 179 | await db.prepare("INSERT INTO skill_attachments (id, workspace_id, skill_id, scope, target, version, attached_by, attached_at) VALUES ('ska_1', ?, ?, 'workspace', '', 1, 'chase', ?)").bind(ws, notes.id, at.toISOString()).run(); |
| 180 | const rows = await attachedRows(db, ws, "agt_1", []); |
| 181 | const shelf = shelfFrom([], rows).skills.filter((s) => s.kind === "library"); |
| 182 | assert.deepEqual(shelf.map((s) => s.name), ["release:release-notes"]); |
| 183 | // Installed twice is a conflict; its agents are templates; Discover marks it installed. |
| 184 | const twice = await plugins.install(db, { workspaceId: ws, listing: { ...listing, availability: { kind: "installed", enabled: true } }, entry: entry.entry, marketplace: { name: "acme-tools", source: entry.source, pluginRoot: entry.pluginRoot }, host: "g1t.sh", by: "chase", deps, now: at }); |
| 185 | assert.equal(!twice.ok && twice.error.code, "conflict"); |
| 186 | assert.deepEqual((await plugins.pluginAgents(db, ws)).map((a) => [a.ref, a.model]), [["release:releaser", "sonnet"]]); |
| 187 | const marked = marketplaces.discoverPlugins(all, new Map([["release@acme-tools", { enabled: true }]]), "g1t.sh"); |
| 188 | assert.deepEqual(marked[0]!.availability, { kind: "installed", enabled: true }); |
| 189 | // Switched off, its skills leave prompts; uninstalled, they are archived and detached. |
| 190 | const off = await plugins.setEnabled(db, ws, "release@acme-tools", false, at); |
| 191 | assert.ok(off.ok && !off.value.enabled); |
| 192 | assert.deepEqual(await attachedRows(db, ws, "agt_1", []), []); |
| 193 | assert.deepEqual((await plugins.pluginAgents(db, ws)).length, 0); |
| 194 | await plugins.setEnabled(db, ws, "release@acme-tools", true, at); |
| 195 | assert.equal((await attachedRows(db, ws, "agt_1", [])).length, 1); |
| 196 | const gone = await plugins.uninstall(db, ws, "release@acme-tools", "chase", at); |
| 197 | assert.ok(gone.ok); |
| 198 | assert.deepEqual(gone.value.skills.sort(), ["code", "cut", "release-notes"]); |
| 199 | assert.equal(await skillByName(db, ws, "release-notes", "release@acme-tools"), null); |
| 200 | assert.deepEqual(await attachedRows(db, ws, "agt_1", []), []); |
| 201 | assert.deepEqual(await plugins.listInstalls(db, ws), []); |
| 202 | }); |
| 203 | |
| 204 | test("a skills-only plugin at a marketplace's root installs the skills its entry names", async () => { |
| 205 | const db = fakeD1(); |
| 206 | await marketplaces.addMarketplace(db, ws, null, { source: "github", repo: "acme/tools" }, "chase", deps, "g1t.sh", at); |
| 207 | const all = await marketplaces.loadAll(db, ws, deps, "g1t.sh", at); |
| 208 | const listings = marketplaces.discoverPlugins(all, new Map(), "g1t.sh"); |
| 209 | const listing = marketplaces.findListing(listings, "docs-skills@acme-tools")!; |
| 210 | const entry = marketplaces.entryOf(all, { name: "docs-skills", marketplace: "acme-tools" })!; |
| 211 | const done = await plugins.install(db, { workspaceId: ws, listing, entry: entry.entry, marketplace: { name: "acme-tools", source: entry.source, pluginRoot: entry.pluginRoot }, host: "g1t.sh", by: "chase", deps, now: at }); |
| 212 | assert.ok(done.ok); |
| 213 | assert.deepEqual(done.value.skills.map((s) => s.name), ["brief"]); |
| 214 | // Not the marketplace's other plugins' skills, though they are in the same repository. |
| 215 | assert.equal(await skillByName(db, ws, "release-notes", "docs-skills@acme-tools"), null); |
| 216 | const skills = marketplaces.discoverSkills(listings, new Set(["docs-skills@acme-tools/brief"])); |
| 217 | assert.equal(skills[0]!.added, true); |
| 218 | }); |
| 219 | |
| 220 | test("what can't be fetched says why, and a marketplace that moved on shows an update", async () => { |
| 221 | const npm = await fetchPlugin({ kind: "unsupported", why: "It is published on npm." }, deps); |
| 222 | assert.equal(!npm.ok && npm.message, "It is published on npm."); |
| 223 | const missing = await fetchPlugin({ kind: "github", repo: "acme/tools", ref: null, sha: null, path: "plugins/nothing" }, deps); |
| 224 | assert.equal(!missing.ok && missing.message, "There are no files in plugins/nothing of acme/tools."); |
| 225 | const gone = await fetchMarketplace({ source: "github", repo: "acme/gone" }, deps); |
| 226 | assert.match(!gone.ok ? gone.message : "", /no \.claude-plugin\/marketplace\.json/); |
| 227 | const row: plugins.PluginRow = { id: "plg_1", workspace_id: ws, ref: "release@acme-tools", name: "release", marketplace: "acme-tools", display_name: null, description: "", version: "1.0.0", sha: "a".repeat(40), fetch: JSON.stringify({ kind: "github", repo: "acme/tools", ref: null, sha: "a".repeat(40), path: "plugins/release" }), components: "{}", agents: "[]", problems: "[]", enabled: 1, installed_by: "chase", installed_at: at.toISOString(), updated_at: at.toISOString(), uninstalled_by: null, uninstalled_at: null }; |
| 228 | const listing = { ref: "release@acme-tools", name: "release", marketplace: "acme-tools", display_name: null, description: "", version: "1.2.0", author: null, homepage: null, category: null, tags: [], keywords: [], fetch: { kind: "github" as const, repo: "acme/tools", ref: null, sha: null, path: "plugins/release" }, availability: { kind: "available" as const }, skills: [] }; |
| 229 | assert.deepEqual(plugins.installsOut([row], [listing])[0]!.update, { version: "1.2.0", sha: null }); |
| 230 | assert.equal(plugins.installsOut([row], [{ ...listing, version: "1.0.0" }])[0]!.update, null); |
| 231 | }); |
| 232 | |
| 233 | test("a plugin skill larger than a version holds keeps its text and leaves its biggest binaries out", () => { |
| 234 | const big = "A".repeat(1_200_000); |
| 235 | const files = [ |
| 236 | { path: "SKILL.md", content: "---\nname: canvas\ndescription: Use when drawing.\n---\n\nDraw.\n", encoding: "utf8" as const }, |
| 237 | { path: "reference.md", content: "# Reference\n", encoding: "utf8" as const }, |
| 238 | { path: "fonts/a.ttf", content: big, encoding: "base64" as const }, |
| 239 | { path: "fonts/b.ttf", content: big, encoding: "base64" as const }, |
| 240 | { path: "scripts/draw.py", content: "print(1)\n", encoding: "utf8" as const }, |
| 241 | ]; |
| 242 | const fitted = plugins.fitSkillFolder(files); |
| 243 | assert.deepEqual(fitted.omitted, ["fonts/a.ttf"], "one font out brings it under the limit; text stays"); |
| 244 | assert.deepEqual(fitted.files.map((f) => f.path).sort(), ["SKILL.md", "fonts/b.ttf", "reference.md", "scripts/draw.py"]); |
| 245 | assert.deepEqual(plugins.fitSkillFolder(files.slice(0, 2)).omitted, []); |
| 246 | }); |