codex-chief-of-staff/test/package.test.ts

import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import test from "node:test";
import { readFile } from "node:fs/promises";

interface PackageContract {
  version?: string;
  private?: boolean;
  license?: string;
  bin?: Record<string, string>;
  files?: string[];
  scripts?: Record<string, string>;
}

test("npm package contract exposes only the compiled private CLI", async () => {
  const [packageText, sourceEntry, compiledEntry] = await Promise.all([
    readFile(new URL("../../package.json", import.meta.url), "utf8"),
    readFile(new URL("../../src/index.ts", import.meta.url), "utf8"),
    readFile(new URL("../src/index.js", import.meta.url), "utf8"),
  ]);
  const packageJson = JSON.parse(packageText) as PackageContract;

  assert.equal(packageJson.private, true);
  assert.equal(packageJson.version, "0.1.1");
  assert.equal(packageJson.license, "UNLICENSED");
  assert.deepEqual(packageJson.bin, { "codex-chief-of-staff": "dist/src/index.js" });
  assert.deepEqual(packageJson.files, ["dist/src", "README.md"]);
  assert.equal(packageJson.scripts?.compile, "tsc -p tsconfig.json");
  assert.equal(packageJson.scripts?.build, undefined);
  for (const lifecycle of ["prepack", "prepare", "preinstall", "install", "postinstall"]) {
    assert.equal(packageJson.scripts?.[lifecycle], undefined);
  }
  assert.match(packageJson.scripts?.test ?? "", /npm run compile/);
  assert.match(packageJson.scripts?.smoke ?? "", /npm run compile/);
  assert.equal(
    packageJson.scripts?.["verify:runtime"],
    "node scripts/verify-generated-runtime.mjs",
  );
  assert.match(packageJson.scripts?.["pack:verified"] ?? "", /npm run verify:runtime/);
  assert.match(packageJson.scripts?.["pack:verified"] ?? "", /npm pack --ignore-scripts/);
  assert.match(sourceEntry, /^#!\/usr\/bin\/env node\n/);
  assert.match(compiledEntry, /^#!\/usr\/bin\/env node\n/);
});

test("Git ignore rules admit only the compiled source runtime", () => {
  const repository = new URL("../..", import.meta.url);
  const checkIgnored = (path: string) => spawnSync(
    "git",
    ["check-ignore", "--no-index", "--quiet", path],
    { cwd: repository, encoding: "utf8" },
  ).status;

  assert.equal(checkIgnored("dist/src/index.js"), 1);
  assert.equal(checkIgnored("dist/test/package.test.js"), 0);
  assert.equal(checkIgnored("dist/other-output.js"), 0);
});

test("packed-artifact verifier rejects a missing tarball argument", () => {
  const verifier = new URL("../../scripts/verify-packed-package.mjs", import.meta.url);
  const result = spawnSync(process.execPath, [verifier.pathname], { encoding: "utf8" });
  assert.notEqual(result.status, 0);
  assert.match(result.stderr, /Packed-package verification failed: usage:/);
});