supercode-cli 0.4.18

//! ORCH-22 CLI acceptance: `supercode skills install|remove` through each
//! harness's OWN door.
//!
//! Three doors, one uniform command:
//!
//! * **Claude Code** — the door IS the directory, so a temp
//!   `CLAUDE_CONFIG_DIR` and a temp working tree exercise the user and
//!   project scopes for real; the package lands where Claude Code's own
//!   loader reads it and `supercode skills list` finds it there.
//! * **Hermes** — a FAKE `hermes` behind the documented test override
//!   `SUPERCODE_HERMES_BIN`, driven exactly as a user drives it
//!   (`HERMES_HOME` for the home). The fake writes hermes's own skills root,
//!   so the row printed back is the one the ORCH-11 loader reads.
//! * **OpenClaw** — install through a fake `openclaw`; `remove` must FAIL
//!   with the pin's own reason (no such verb), never quietly delete files.
//!
//! Offline, no gateway, no model spend, no real harness home touched.

use std::path::{Path, PathBuf};
use std::process::{Command, Output};

fn bin() -> PathBuf {
    PathBuf::from(env!("CARGO_BIN_EXE_supercode"))
}

fn scratch(tag: &str) -> PathBuf {
    let root = std::env::temp_dir().join(format!(
        "supercode-orch22-cli-{tag}-{}-{}",
        std::process::id(),
        std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .unwrap()
            .as_nanos()
    ));
    std::fs::create_dir_all(&root).unwrap();
    root
}

/// A skill package: a directory holding `SKILL.md`, exactly what every
/// harness's loader recognizes.
fn package(root: &Path, dir_name: &str, front_name: &str) -> PathBuf {
    let dir = root.join(dir_name);
    std::fs::create_dir_all(dir.join("references")).unwrap();
    std::fs::write(
        dir.join("SKILL.md"),
        format!("---\nname: {front_name}\ndescription: an ORCH-22 probe skill\nversion: 0.2.0\n---\n\nbody\n"),
    )
    .unwrap();
    std::fs::write(dir.join("references/notes.md"), "support file\n").unwrap();
    dir
}

#[cfg(unix)]
fn executable(path: &Path, script: &str) {
    use std::os::unix::fs::PermissionsExt;
    std::fs::write(path, script).unwrap();
    std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o755)).unwrap();
}

/// A fake `hermes` whose `skills install|uninstall` write hermes's own root
/// (`$HERMES_HOME/skills/<name>`), the way the real CLI does.
#[cfg(unix)]
fn fake_hermes(root: &Path) -> PathBuf {
    let path = root.join("fake-hermes");
    executable(
        &path,
        "#!/bin/sh\n\
         # argv: skills install --yes [--name N] <identifier> | skills uninstall <name> --yes\n\
         verb=$2\n\
         shift 2\n\
         name=\"\"\n\
         while [ $# -gt 0 ]; do\n\
         case \"$1\" in\n\
         --yes) ;;\n\
         --name) shift; name=\"$1\" ;;\n\
         *) [ -z \"$name\" ] && name=$(basename \"$1\") ;;\n\
         esac\n\
         shift\n\
         done\n\
         dir=\"$HERMES_HOME/skills/$name\"\n\
         if [ \"$verb\" = install ]; then\n\
         mkdir -p \"$dir\"\n\
         printf -- '---\\nname: %s\\nversion: 9.9.9\\n---\\nfetched\\n' \"$name\" > \"$dir/SKILL.md\"\n\
         printf 'Installed: %s\\n' \"$name\"\n\
         else\n\
         rm -rf \"$dir\"\n\
         printf 'Removed: %s\\n' \"$name\"\n\
         fi\n",
    );
    path
}

/// A fake `openclaw` whose `skills install --global` writes the shared
/// managed directory the ORCH-11 loader reads (`$OPENCLAW_STATE_DIR/skills`).
#[cfg(unix)]
fn fake_openclaw(root: &Path) -> PathBuf {
    let path = root.join("fake-openclaw");
    executable(
        &path,
        "#!/bin/sh\n\
         # argv: skills install <skill-ref> [--global] [--as slug]\n\
         ref=$3\n\
         name=$(basename \"$ref\")\n\
         shift 3\n\
         while [ $# -gt 0 ]; do\n\
         case \"$1\" in\n\
         --as) shift; name=\"$1\" ;;\n\
         esac\n\
         shift\n\
         done\n\
         mkdir -p \"$OPENCLAW_STATE_DIR/skills/$name\"\n\
         cp \"$ref/SKILL.md\" \"$OPENCLAW_STATE_DIR/skills/$name/SKILL.md\"\n\
         printf 'Installed %s\\n' \"$name\"\n",
    );
    path
}

/// Every harness home pinned at an absent path unless the caller names it, so
/// no test can reach this machine's real installs.
fn run(cwd: &Path, envs: &[(&str, PathBuf)], args: &[&str]) -> Output {
    let home = scratch("home");
    let mut command = Command::new(bin());
    command
        .current_dir(cwd)
        .env("SUPERCODE_HOME", home.join("sessions"))
        .env("HOME", &home)
        .env("CLAUDE_CONFIG_DIR", home.join("absent-claude"))
        .env("CODEX_HOME", home.join("absent-codex"))
        .env("OPENCODE_CONFIG_DIR", home.join("absent-opencode"))
        .env("PI_CODING_AGENT_DIR", home.join("absent-pi"))
        .env("HERMES_HOME", home.join("absent-hermes"))
        .env("OPENCLAW_STATE_DIR", home.join("absent-openclaw"))
        .env("NO_COLOR", "1")
        .env_remove("OPENROUTER_API_KEY");
    for (key, value) in envs {
        command.env(key, value);
    }
    let output = command
        .args(args)
        .stdin(std::process::Stdio::null())
        .output()
        .expect("supercode binary runs");
    let _ = std::fs::remove_dir_all(&home);
    output
}

fn stdout_of(output: &Output, args: &[&str]) -> String {
    assert!(
        output.status.success(),
        "`supercode {}` failed: {}",
        args.join(" "),
        String::from_utf8_lossy(&output.stderr)
    );
    String::from_utf8_lossy(&output.stdout).into_owned()
}

fn ok(cwd: &Path, envs: &[(&str, PathBuf)], args: &[&str]) -> String {
    stdout_of(&run(cwd, envs, args), args)
}

/// Claude Code, user scope: install → `skills list` sees it → remove.
#[test]
fn the_directory_door_installs_lists_and_removes_for_claude_code() {
    let root = scratch("cc-user");
    let cwd = root.join("tree");
    std::fs::create_dir_all(&cwd).unwrap();
    let source = package(&root, "probe-src", "orch22-cli");
    let claude_home = root.join("claude_home");
    let envs = [("CLAUDE_CONFIG_DIR", claude_home.clone())];

    let installed = ok(
        &cwd,
        &envs,
        &[
            "skills",
            "install",
            "--harness",
            "claude-code",
            source.to_str().unwrap(),
        ],
    );
    assert!(installed.contains("ran: cp -R "), "{installed}");
    assert!(
        installed.contains("installed: claude-code skill orch22-cli (user)"),
        "{installed}"
    );
    let landed = claude_home.join("skills/orch22-cli");
    assert!(landed.join("SKILL.md").is_file(), "{installed}");
    // The whole package travels, not just its manifest.
    assert!(landed.join("references/notes.md").is_file(), "{installed}");

    // The harness's own loader is the witness.
    let listed = ok(
        &cwd,
        &envs,
        &["skills", "list", "--harness", "claude-code", "--json"],
    );
    let rows: Vec<serde_json::Value> = serde_json::from_str(&listed).unwrap();
    let row = rows
        .iter()
        .find(|row| row["name"] == "orch22-cli")
        .unwrap_or_else(|| panic!("skills list must report the installed skill: {listed}"));
    assert_eq!(row["scope"], "user");
    assert_eq!(row["version"], "0.2.0");

    let removed = ok(
        &cwd,
        &envs,
        &[
            "skills",
            "remove",
            "--harness",
            "claude-code",
            "orch22-cli",
            "--yes",
            "--json",
        ],
    );
    let result: serde_json::Value = serde_json::from_str(&removed).unwrap();
    assert_eq!(result["removed"], true, "{result}");
    assert!(result["ran"]
        .as_str()
        .is_some_and(|ran| ran.starts_with("rm -r ")));
    assert!(!landed.exists());
    std::fs::remove_dir_all(&root).ok();
}

/// Claude Code, project scope: the working tree's own `.claude/skills`.
#[test]
fn the_directory_door_writes_the_project_root() {
    let root = scratch("cc-project");
    let cwd = root.join("tree");
    std::fs::create_dir_all(&cwd).unwrap();
    let source = package(&root, "probe-src", "tree-scoped");
    let envs = [("CLAUDE_CONFIG_DIR", root.join("claude_home"))];

    let installed = ok(
        &cwd,
        &envs,
        &[
            "skills",
            "install",
            "--harness",
            "claude-code",
            source.to_str().unwrap(),
            "--scope",
            "project",
        ],
    );
    assert!(
        installed.contains("installed: claude-code skill tree-scoped (project)"),
        "{installed}"
    );
    assert!(cwd.join(".claude/skills/tree-scoped/SKILL.md").is_file());

    ok(
        &cwd,
        &envs,
        &[
            "skills",
            "remove",
            "--harness",
            "claude-code",
            "tree-scoped",
            "--scope",
            "project",
            "--yes",
        ],
    );
    assert!(!cwd.join(".claude/skills/tree-scoped").exists());
    std::fs::remove_dir_all(&root).ok();
}

/// A package whose SKILL.md has no name at all still installs under its
/// directory name; a source that is not a skill package at all is refused.
#[test]
fn a_source_without_a_manifest_is_refused_by_name() {
    let root = scratch("no-manifest");
    let cwd = root.join("tree");
    std::fs::create_dir_all(&cwd).unwrap();
    let source = root.join("not-a-skill");
    std::fs::create_dir_all(&source).unwrap();
    std::fs::write(source.join("README.md"), "no manifest here\n").unwrap();

    let output = run(
        &cwd,
        &[("CLAUDE_CONFIG_DIR", root.join("claude_home"))],
        &[
            "skills",
            "install",
            "--harness",
            "claude-code",
            source.to_str().unwrap(),
        ],
    );
    assert!(!output.status.success(), "a non-package must not install");
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(stderr.contains("SKILL.md"), "{stderr}");
    assert!(!root.join("claude_home").exists(), "nothing was written");
    std::fs::remove_dir_all(&root).ok();
}

/// The containment gate: a package whose own frontmatter names a path may not
/// write outside the harness's root.
#[test]
fn a_name_that_escapes_the_root_is_refused() {
    let root = scratch("escape");
    let cwd = root.join("tree");
    std::fs::create_dir_all(&cwd).unwrap();
    let source = package(&root, "probe-src", "../../escaped");

    let output = run(
        &cwd,
        &[("CLAUDE_CONFIG_DIR", root.join("claude_home"))],
        &[
            "skills",
            "install",
            "--harness",
            "claude-code",
            source.to_str().unwrap(),
        ],
    );
    assert!(
        !output.status.success(),
        "an escaping name must not install"
    );
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(stderr.contains("path separator"), "{stderr}");
    assert!(!root.join("escaped").exists());
    std::fs::remove_dir_all(&root).ok();
}

/// A root the HARNESS owns is never written by supercode.
#[test]
fn a_scope_the_harness_owns_is_refused() {
    let root = scratch("managed-scope");
    let cwd = root.join("tree");
    std::fs::create_dir_all(&cwd).unwrap();
    let source = package(&root, "probe-src", "managed-probe");

    let output = run(
        &cwd,
        &[("CLAUDE_CONFIG_DIR", root.join("claude_home"))],
        &[
            "skills",
            "install",
            "--harness",
            "claude-code",
            source.to_str().unwrap(),
            "--scope",
            "managed",
        ],
    );
    assert!(!output.status.success());
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(stderr.contains("user or project"), "{stderr}");
    std::fs::remove_dir_all(&root).ok();
}

/// Hermes: the narration is hermes's OWN verb, and the row comes back from
/// hermes's own skills root.
#[cfg(unix)]
#[test]
fn hermes_install_and_remove_narrate_the_harness_verb() {
    let root = scratch("hermes");
    let cwd = root.join("tree");
    std::fs::create_dir_all(&cwd).unwrap();
    let hermes_home = root.join("hermes_home");
    let envs = [
        ("HERMES_HOME", hermes_home.clone()),
        ("SUPERCODE_HERMES_BIN", fake_hermes(&root)),
    ];

    let installed = ok(
        &cwd,
        &envs,
        &[
            "skills",
            "install",
            "--harness",
            "hermes",
            "openai/skills/arxiv-search",
            "--json",
        ],
    );
    let result: serde_json::Value = serde_json::from_str(&installed).unwrap();
    // The narration is hermes's own argv (the program is the test override,
    // so only the verb tail is fixed).
    assert!(
        result["ran"]
            .as_str()
            .is_some_and(|ran| ran.ends_with(" skills install --yes openai/skills/arxiv-search")),
        "{result}"
    );
    assert_eq!(result["name"], "arxiv-search");
    // The row is the harness's own, not an echo of the request.
    assert_eq!(result["skill"]["version"], "9.9.9", "{result}");
    assert_eq!(
        result["skill"]["location"],
        hermes_home
            .join("skills/arxiv-search")
            .to_string_lossy()
            .into_owned()
    );

    let removed = ok(
        &cwd,
        &envs,
        &[
            "skills",
            "remove",
            "--harness",
            "hermes",
            "arxiv-search",
            "--yes",
            "--json",
        ],
    );
    let result: serde_json::Value = serde_json::from_str(&removed).unwrap();
    assert!(
        result["ran"]
            .as_str()
            .is_some_and(|ran| ran.ends_with(" skills uninstall arxiv-search --yes")),
        "{result}"
    );
    assert_eq!(result["removed"], true);
    assert!(!hermes_home.join("skills/arxiv-search").exists());
    std::fs::remove_dir_all(&root).ok();
}

/// Hermes has no local-directory install form at the pin, so a local path is
/// refused rather than handed to a verb that cannot take it.
#[cfg(unix)]
#[test]
fn hermes_refuses_a_local_directory_source() {
    let root = scratch("hermes-local");
    let cwd = root.join("tree");
    std::fs::create_dir_all(&cwd).unwrap();
    let source = package(&root, "probe-src", "local-only");
    let output = run(
        &cwd,
        &[
            ("HERMES_HOME", root.join("hermes_home")),
            ("SUPERCODE_HERMES_BIN", fake_hermes(&root)),
        ],
        &[
            "skills",
            "install",
            "--harness",
            "hermes",
            source.to_str().unwrap(),
        ],
    );
    assert!(!output.status.success());
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(stderr.contains("registry identifier"), "{stderr}");
    std::fs::remove_dir_all(&root).ok();
}

/// OpenClaw: install through its own verb; `remove` refuses at the pin.
#[cfg(unix)]
#[test]
fn openclaw_installs_through_its_verb_and_refuses_remove() {
    let root = scratch("openclaw");
    let cwd = root.join("tree");
    std::fs::create_dir_all(&cwd).unwrap();
    let source = package(&root, "probe-src", "claw-probe");
    let state = root.join("openclaw_home");
    let envs = [
        ("OPENCLAW_STATE_DIR", state.clone()),
        ("SUPERCODE_OPENCLAW_BIN", fake_openclaw(&root)),
    ];

    let installed = ok(
        &cwd,
        &envs,
        &[
            "skills",
            "install",
            "--harness",
            "openclaw",
            source.to_str().unwrap(),
            "--json",
        ],
    );
    let result: serde_json::Value = serde_json::from_str(&installed).unwrap();
    assert!(
        result["ran"].as_str().is_some_and(
            |ran| ran.ends_with(&format!(" skills install {} --global", source.display()))
        ),
        "{result}"
    );
    assert_eq!(result["name"], "claw-probe");
    // `--global` lands in openclaw's shared MANAGED directory, and the row
    // reports the scope the loader reads it at — not the one requested.
    assert_eq!(result["skill"]["scope"], "managed", "{result}");
    assert!(state.join("skills/probe-src/SKILL.md").is_file());

    let output = run(
        &cwd,
        &envs,
        &[
            "skills",
            "remove",
            "--harness",
            "openclaw",
            "claw-probe",
            "--yes",
        ],
    );
    assert!(
        !output.status.success(),
        "openclaw publishes no `skills remove` at the pin; a silent success would be a lie"
    );
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(stderr.contains("no `skills remove` verb"), "{stderr}");
    // Refused means untouched.
    assert!(state.join("skills/probe-src/SKILL.md").is_file());
    std::fs::remove_dir_all(&root).ok();
}

/// supercode has no skills root of its own, so it refuses to be a target.
#[test]
fn supercode_is_not_a_skills_target() {
    let root = scratch("supercode-target");
    let cwd = root.join("tree");
    std::fs::create_dir_all(&cwd).unwrap();
    let source = package(&root, "probe-src", "self-install");
    let output = run(
        &cwd,
        &[],
        &[
            "skills",
            "install",
            "--harness",
            "supercode",
            source.to_str().unwrap(),
        ],
    );
    assert!(!output.status.success());
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(stderr.contains("no skills root"), "{stderr}");
    std::fs::remove_dir_all(&root).ok();
}