import { describe, it } from 'node:test'; import assert from 'node:assert/strict'; import { join } from 'node:path'; import { mkdir, writeFile, rm } from 'node:fs/promises'; import { tmpdir } from 'node:os'; import { resetCounter } from '../../scanners/lib/output.mjs'; import { scan } from '../../scanners/skill-listing-scanner.mjs'; const CAP = 1536; // verified per-description listing cap (CC 2.1.105, changelog L1502) function uniqueDir(suffix) { return join(tmpdir(), `config-audit-skl-${suffix}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`); } /** * The SKL scanner enumerates active skills via process.env.HOME * (enumeratePlugins/enumerateSkills). Tests must override HOME, run, restore — * never rely on the developer's real ~/.claude. */ async function runScannerWithHome(home) { resetCounter(); const original = process.env.HOME; process.env.HOME = home; try { return await scan('/unused', { files: [] }); } finally { process.env.HOME = original; } } /** Build a fake HOME with one user skill whose description has `len` chars. */ async function homeWithUserSkill(name, descLen) { const home = uniqueDir(name); const dir = join(home, '.claude', 'skills', name); await mkdir(dir, { recursive: true }); const desc = 'a'.repeat(descLen); await writeFile( join(dir, 'SKILL.md'), `---\nname: ${name}\ndescription: ${desc}\n---\nBody of the skill.\n`, ); return home; } describe('SKL scanner — basic structure', () => { it('reports scanner prefix SKL', async () => { const home = uniqueDir('empty'); try { await mkdir(join(home, '.claude'), { recursive: true }); const result = await runScannerWithHome(home); assert.equal(result.scanner, 'SKL'); } finally { await rm(home, { recursive: true, force: true }); } }); it('finding IDs match CA-SKL-NNN pattern', async () => { const home = await homeWithUserSkill('longdesc', CAP + 64); try { const result = await runScannerWithHome(home); for (const f of result.findings) { assert.match(f.id, /^CA-SKL-\d{3}$/); } } finally { await rm(home, { recursive: true, force: true }); } }); }); describe('SKL scanner — per-description 1536-char cap (CA-SKL-001)', () => { it('flags a skill whose description exceeds the cap', async () => { const home = await homeWithUserSkill('toolong', CAP + 100); try { const result = await runScannerWithHome(home); const f = result.findings.find(x => /toolong/.test(x.evidence || x.description || '')); assert.ok(f, `expected a cap finding; got: ${result.findings.map(x => x.title).join(' | ')}`); assert.equal(f.severity, 'medium', `expected medium, got ${f.severity}`); assert.match(f.id, /^CA-SKL-001$/); } finally { await rm(home, { recursive: true, force: true }); } }); it('evidence carries the measured char count and the 1536 cap', async () => { const home = await homeWithUserSkill('measured', CAP + 200); try { const result = await runScannerWithHome(home); const f = result.findings.find(x => /measured/.test(x.evidence || '')); assert.ok(f, 'expected a finding for the oversized skill'); assert.match(String(f.evidence), new RegExp(String(CAP + 200))); assert.match(String(f.evidence), new RegExp(String(CAP))); } finally { await rm(home, { recursive: true, force: true }); } }); it('points file at the offending SKILL.md', async () => { const home = await homeWithUserSkill('filepath', CAP + 1); try { const result = await runScannerWithHome(home); const f = result.findings.find(x => /filepath/.test(x.evidence || '')); assert.ok(f); assert.match(String(f.file), /filepath[\\/]SKILL\.md$/); } finally { await rm(home, { recursive: true, force: true }); } }); }); describe('SKL scanner — boundary and negative cases', () => { it('a description exactly at the cap (1536) yields no finding', async () => { const home = await homeWithUserSkill('exact', CAP); try { const result = await runScannerWithHome(home); assert.equal(result.findings.length, 0, `expected 0 findings at the cap; got: ${result.findings.map(f => f.title).join(' | ')}`); } finally { await rm(home, { recursive: true, force: true }); } }); it('one char over the cap (1537) yields a finding', async () => { const home = await homeWithUserSkill('over', CAP + 1); try { const result = await runScannerWithHome(home); assert.equal(result.findings.length, 1, `expected 1 finding at cap+1; got: ${result.findings.map(f => f.title).join(' | ')}`); } finally { await rm(home, { recursive: true, force: true }); } }); it('a short description yields no finding', async () => { const home = await homeWithUserSkill('short', 80); try { const result = await runScannerWithHome(home); assert.equal(result.findings.length, 0, `expected 0 findings; got: ${result.findings.map(f => f.title).join(' | ')}`); } finally { await rm(home, { recursive: true, force: true }); } }); it('an empty HOME (no skills) yields zero findings', async () => { const home = uniqueDir('noskills'); try { await mkdir(join(home, '.claude'), { recursive: true }); const result = await runScannerWithHome(home); assert.equal(result.findings.length, 0); } finally { await rm(home, { recursive: true, force: true }); } }); }); describe('SKL scanner — remediation levers (Item 2b folded in)', () => { it('recommendation lists disableBundledSkills, skillOverrides, and trimming', async () => { const home = await homeWithUserSkill('levers', CAP + 300); try { const result = await runScannerWithHome(home); const f = result.findings.find(x => /levers/.test(x.evidence || '')); assert.ok(f, 'expected a finding to carry remediation'); const rec = String(f.recommendation); assert.match(rec, /disableBundledSkills/); assert.match(rec, /skillOverrides/); assert.match(rec, /trim/i); } finally { await rm(home, { recursive: true, force: true }); } }); }); describe('SKL scanner — suppression compatibility', () => { it('CA-SKL-001 is NOT matched by a CA-TOK-* glob suppression', async () => { const { applySuppressions } = await import('../../scanners/lib/suppression.mjs'); const home = await homeWithUserSkill('suppress', CAP + 50); try { const result = await runScannerWithHome(home); assert.ok(result.findings.length > 0, 'precondition: at least one SKL finding'); const { active, suppressed } = applySuppressions(result.findings, [ { pattern: 'CA-TOK-*', source: 'test', sourceLine: 1 }, ]); assert.equal(active.length, result.findings.length, 'CA-TOK-* glob should not match CA-SKL-* findings'); assert.equal(suppressed.length, 0); } finally { await rm(home, { recursive: true, force: true }); } }); });