ktg-plugin-marketplace/plugins/config-audit/tests/scanners/posture.test.mjs
Kjell Tore Guttormsen cd25c1e934 feat(config-audit): cross-plugin collision scanner COL (v5 N6) [skip-docs]
New COL scanner detects skill-name collisions across plugins and
between user-level skills (~/.claude/skills/) and plugin-bundled
skills. Skill identity is the directory basename — matches how
enumerateSkills resolves names.

Detection rules (per docs/v5-namespace-research.md, confidence: medium):
- Plugin-vs-plugin same skill name → severity low (CA-COL-001)
- User-vs-plugin same skill name → severity medium (CA-COL-001)
- Plugin-vs-built-in collisions: out of scope for v5.0.0 (insufficient
  verification — recorded for v5.0.1 follow-up).

Findings carry details.namespaces array with {source, name, path} for
every conflicting source — supports per-collision reporting downstream.

output.mjs: finding() helper now passes through optional `details`
field (scanner-specific structured payload).

scoring.mjs: COL → "Plugin Hygiene" (new area, 10 total). Posture test
updated from 9 → 10 area scores.

.gitignore: docs/v5-namespace-research.md is local-only (Step 22a
research output, gitignored per plan).

Fixture collision-plugins/fake-home/ has user skill `review` colliding
with plugin-a + plugin-b's `review` (medium severity), plus plugin-c's
unique `summarize` (no collision).

[skip-docs] reason: v5 plan fences off README/CLAUDE.md badge updates
to Session 5; Forgejo pre-commit-docs-gate hook requires this tag.

Tests: 617 → 625 (+8).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-01 07:46:15 +02:00

129 lines
4.7 KiB
JavaScript

import { describe, it, beforeEach } from 'node:test';
import assert from 'node:assert/strict';
import { resolve } from 'node:path';
import { fileURLToPath } from 'node:url';
import { execFile } from 'node:child_process';
import { promisify } from 'node:util';
const exec = promisify(execFile);
const __dirname = fileURLToPath(new URL('.', import.meta.url));
const FIXTURES = resolve(__dirname, '../fixtures');
const POSTURE_BIN = resolve(__dirname, '../../scanners/posture.mjs');
async function runPosture(args) {
const { stdout, stderr } = await exec('node', [POSTURE_BIN, ...args], {
timeout: 30000,
cwd: resolve(__dirname, '../..'),
});
return { stdout, stderr };
}
async function runPostureJson(fixturePath) {
const { stdout } = await runPosture([fixturePath, '--json']);
return JSON.parse(stdout);
}
describe('posture.mjs CLI — healthy project', () => {
let result;
beforeEach(async () => {
result = await runPostureJson(resolve(FIXTURES, 'healthy-project'));
});
it('returns utilization with score and overhang', () => {
assert.ok(typeof result.utilization.score === 'number');
assert.ok(typeof result.utilization.overhang === 'number');
assert.equal(result.utilization.score + result.utilization.overhang, 100);
});
it('returns maturity level >= 2', () => {
assert.ok(result.maturity.level >= 2);
assert.ok(typeof result.maturity.name === 'string');
});
it('returns segment string', () => {
assert.ok(typeof result.segment.segment === 'string');
assert.ok(result.segment.segment.length > 0);
});
it('returns 10 area scores (v5 adds Plugin Hygiene from COL)', () => {
assert.equal(result.areas.length, 10);
for (const area of result.areas) {
assert.ok('id' in area);
assert.ok('name' in area);
assert.ok('grade' in area);
assert.ok('score' in area);
assert.ok('findingCount' in area);
}
});
it('exposes a token_efficiency area id', () => {
const te = result.areas.find(a => a.id === 'token_efficiency');
assert.ok(te, 'token_efficiency id present');
});
it('returns overallGrade', () => {
assert.ok(['A', 'B', 'C', 'D', 'F'].includes(result.overallGrade));
});
it('includes topActions array', () => {
assert.ok(Array.isArray(result.topActions));
});
it('includes scannerEnvelope', () => {
assert.ok(result.scannerEnvelope.meta);
assert.ok(result.scannerEnvelope.scanners);
assert.ok(result.scannerEnvelope.aggregate);
});
});
describe('posture.mjs CLI — minimal project', () => {
it('scores lower utilization than healthy', async () => {
const healthy = await runPostureJson(resolve(FIXTURES, 'healthy-project'));
const minimal = await runPostureJson(resolve(FIXTURES, 'minimal-project'));
assert.ok(minimal.utilization.score < healthy.utilization.score,
`minimal (${minimal.utilization.score}) should be < healthy (${healthy.utilization.score})`);
});
it('has lower maturity than healthy', async () => {
const healthy = await runPostureJson(resolve(FIXTURES, 'healthy-project'));
const minimal = await runPostureJson(resolve(FIXTURES, 'minimal-project'));
assert.ok(minimal.maturity.level <= healthy.maturity.level);
});
});
describe('posture.mjs CLI — terminal output (v3 health format)', () => {
it('scorecard contains health sections', async () => {
const { stderr } = await runPosture([resolve(FIXTURES, 'healthy-project')]);
assert.ok(stderr.includes('Config-Audit Health Score'));
assert.ok(stderr.includes('Health:'));
assert.ok(stderr.includes('Area Scores'));
assert.ok(stderr.includes('areas scanned'));
});
it('scorecard does NOT contain legacy metrics', async () => {
const { stderr } = await runPosture([resolve(FIXTURES, 'healthy-project')]);
assert.ok(!stderr.includes('Maturity:'));
assert.ok(!stderr.includes('Utilization:'));
assert.ok(!stderr.includes('Segment:'));
});
it('scorecard excludes Feature Coverage from area display', async () => {
const { stderr } = await runPosture([resolve(FIXTURES, 'healthy-project')]);
assert.ok(!stderr.includes('Feature Coverage'));
});
});
describe('posture.mjs CLI — JSON includes opportunityCount', () => {
it('returns opportunityCount field', async () => {
const result = await runPostureJson(resolve(FIXTURES, 'healthy-project'));
assert.ok(typeof result.opportunityCount === 'number');
assert.ok(result.opportunityCount >= 0);
});
it('JSON still includes legacy fields for backward compat', async () => {
const result = await runPostureJson(resolve(FIXTURES, 'healthy-project'));
assert.ok(typeof result.utilization.score === 'number');
assert.ok(typeof result.maturity.level === 'number');
assert.ok(typeof result.segment.segment === 'string');
});
});