config-audit/tests/scanners/skill-listing-scanner.test.mjs

import { describe, it } from 'node:test';
import assert from 'node:assert/strict';
import { join } from 'node:path';
import { mkdir, writeFile, rm } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { resetCounter } from '../../scanners/lib/output.mjs';
import { scan } from '../../scanners/skill-listing-scanner.mjs';

const CAP = 1536; // verified per-description listing cap (CC 2.1.105, changelog L1502)

function uniqueDir(suffix) {
  return join(tmpdir(), `config-audit-skl-${suffix}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
}

/**
 * The SKL scanner enumerates active skills via process.env.HOME
 * (enumeratePlugins/enumerateSkills). Tests must override HOME, run, restore —
 * never rely on the developer's real ~/.claude.
 */
async function runScannerWithHome(home) {
  resetCounter();
  const original = process.env.HOME;
  process.env.HOME = home;
  try {
    return await scan('/unused', { files: [] });
  } finally {
    process.env.HOME = original;
  }
}

/** Build a fake HOME with one user skill whose description has `len` chars. */
async function homeWithUserSkill(name, descLen) {
  const home = uniqueDir(name);
  const dir = join(home, '.claude', 'skills', name);
  await mkdir(dir, { recursive: true });
  const desc = 'a'.repeat(descLen);
  await writeFile(
    join(dir, 'SKILL.md'),
    `---\nname: ${name}\ndescription: ${desc}\n---\nBody of the skill.\n`,
  );
  return home;
}

describe('SKL scanner — basic structure', () => {
  it('reports scanner prefix SKL', async () => {
    const home = uniqueDir('empty');
    try {
      await mkdir(join(home, '.claude'), { recursive: true });
      const result = await runScannerWithHome(home);
      assert.equal(result.scanner, 'SKL');
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });

  it('finding IDs match CA-SKL-NNN pattern', async () => {
    const home = await homeWithUserSkill('longdesc', CAP + 64);
    try {
      const result = await runScannerWithHome(home);
      for (const f of result.findings) {
        assert.match(f.id, /^CA-SKL-\d{3}$/);
      }
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });
});

describe('SKL scanner — per-description 1536-char cap (CA-SKL-001)', () => {
  it('flags a skill whose description exceeds the cap', async () => {
    const home = await homeWithUserSkill('toolong', CAP + 100);
    try {
      const result = await runScannerWithHome(home);
      const f = result.findings.find(x => /toolong/.test(x.evidence || x.description || ''));
      assert.ok(f, `expected a cap finding; got: ${result.findings.map(x => x.title).join(' | ')}`);
      assert.equal(f.severity, 'medium', `expected medium, got ${f.severity}`);
      assert.match(f.id, /^CA-SKL-001$/);
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });

  it('evidence carries the measured char count and the 1536 cap', async () => {
    const home = await homeWithUserSkill('measured', CAP + 200);
    try {
      const result = await runScannerWithHome(home);
      const f = result.findings.find(x => /measured/.test(x.evidence || ''));
      assert.ok(f, 'expected a finding for the oversized skill');
      assert.match(String(f.evidence), new RegExp(String(CAP + 200)));
      assert.match(String(f.evidence), new RegExp(String(CAP)));
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });

  it('points file at the offending SKILL.md', async () => {
    const home = await homeWithUserSkill('filepath', CAP + 1);
    try {
      const result = await runScannerWithHome(home);
      const f = result.findings.find(x => /filepath/.test(x.evidence || ''));
      assert.ok(f);
      assert.match(String(f.file), /filepath[\\/]SKILL\.md$/);
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });
});

describe('SKL scanner — boundary and negative cases', () => {
  it('a description exactly at the cap (1536) yields no finding', async () => {
    const home = await homeWithUserSkill('exact', CAP);
    try {
      const result = await runScannerWithHome(home);
      assert.equal(result.findings.length, 0,
        `expected 0 findings at the cap; got: ${result.findings.map(f => f.title).join(' | ')}`);
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });

  it('one char over the cap (1537) yields a finding', async () => {
    const home = await homeWithUserSkill('over', CAP + 1);
    try {
      const result = await runScannerWithHome(home);
      assert.equal(result.findings.length, 1,
        `expected 1 finding at cap+1; got: ${result.findings.map(f => f.title).join(' | ')}`);
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });

  it('a short description yields no finding', async () => {
    const home = await homeWithUserSkill('short', 80);
    try {
      const result = await runScannerWithHome(home);
      assert.equal(result.findings.length, 0,
        `expected 0 findings; got: ${result.findings.map(f => f.title).join(' | ')}`);
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });

  it('an empty HOME (no skills) yields zero findings', async () => {
    const home = uniqueDir('noskills');
    try {
      await mkdir(join(home, '.claude'), { recursive: true });
      const result = await runScannerWithHome(home);
      assert.equal(result.findings.length, 0);
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });
});

describe('SKL scanner — remediation levers (Item 2b folded in)', () => {
  it('recommendation lists disableBundledSkills, skillOverrides, and trimming', async () => {
    const home = await homeWithUserSkill('levers', CAP + 300);
    try {
      const result = await runScannerWithHome(home);
      const f = result.findings.find(x => /levers/.test(x.evidence || ''));
      assert.ok(f, 'expected a finding to carry remediation');
      const rec = String(f.recommendation);
      assert.match(rec, /disableBundledSkills/);
      assert.match(rec, /skillOverrides/);
      assert.match(rec, /trim/i);
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });
});

describe('SKL scanner — suppression compatibility', () => {
  it('CA-SKL-001 is NOT matched by a CA-TOK-* glob suppression', async () => {
    const { applySuppressions } = await import('../../scanners/lib/suppression.mjs');
    const home = await homeWithUserSkill('suppress', CAP + 50);
    try {
      const result = await runScannerWithHome(home);
      assert.ok(result.findings.length > 0, 'precondition: at least one SKL finding');
      const { active, suppressed } = applySuppressions(result.findings, [
        { pattern: 'CA-TOK-*', source: 'test', sourceLine: 1 },
      ]);
      assert.equal(active.length, result.findings.length,
        'CA-TOK-* glob should not match CA-SKL-* findings');
      assert.equal(suppressed.length, 0);
    } finally {
      await rm(home, { recursive: true, force: true });
    }
  });
});