From 055bbb91193bb584ce576ac175f7b65f6b0f15d6 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Sun, 13 Sep 2026 13:19:55 -0400 Subject: [PATCH] fix(plugin): warn instead of silently dropping an installed plugin with a bad manifest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `nself plugin install notifications` prints "installed successfully", writes the directory and manifest, and the plugin is then invisible to `nself plugin list --installed` — no warning, no error, nothing on stderr. From the user's side that is indistinguishable from never having installed it. Cause: listInstalled() skipped any directory whose plugin.json failed to parse with a bare `continue // skip directories without valid manifests`. That comment is right for a stray directory, but a directory under the plugin root IS an installed plugin — the manifest failing to parse is a defect to report, not a reason to pretend the plugin is absent. What made it parse-fail, found live 2026-09-13 while running the Task Bundle clean-install proof: plugins/free/notifications declares `"status": "deprecated"` but carries the flat deprecated/deprecatedSince/deprecated_in/ replacedBy fields instead of the `deprecation` block validateManifest requires (announcedDate, eolDate, migrationGuide). It is the only free plugin in that state. Its manifest is therefore invalid, and it is one of the eight plugins in the free Task Bundle — so the flagship free bundle installs eight plugins and lists seven, with nothing explaining the difference. The skip stays a `continue` on purpose: one bad manifest must not hide the other seven. It is now a visible diagnostic naming the directory and the parse error. Output style follows this package's existing convention — `fmt.Fprintf(os.Stderr, "warning: ...")`, identical in shape to download.go:283. internal/plugin deliberately does not import internal/ui anywhere, and this is a low-level diagnostic rather than command output. Two tests added. The first reproduces the exact shape that broke (status deprecated, flat fields, no deprecation block) and asserts both that the valid neighbour is still listed and that stderr names the offending directory. The second proves the real remedy: with a proper deprecation block the plugin parses and lists normally. Verified: both new tests pass; the whole internal/plugin package passes (go test ./internal/plugin/ -count=1 => ok); go vet clean; gofmt clean; go build ./... exits 0. Negative case proved by deleting the warning and re-running — the first test fails with exactly the "would disappear silently" message, then passes again when restored. The manifest itself is a separate fix in nself-org/plugins; this change is what makes that class of defect visible instead of silent. --- internal/plugin/loader.go | 25 +++- .../plugin/loader_invalid_manifest_test.go | 130 ++++++++++++++++++ 2 files changed, 153 insertions(+), 2 deletions(-) create mode 100644 internal/plugin/loader_invalid_manifest_test.go diff --git a/internal/plugin/loader.go b/internal/plugin/loader.go index dbeca5453..6cffedf76 100644 --- a/internal/plugin/loader.go +++ b/internal/plugin/loader.go @@ -5,7 +5,8 @@ package plugin // Inputs: pluginDir string (absolute path to plugin installation directory). // Outputs: []PluginInfo or []InstalledPluginInfo; error on directory read failure. // Constraints: Registry fetch uses a 30s timeout; pluginDir non-existence returns nil, nil. -// Directories without a valid plugin.json are silently skipped. +// Directories without a valid plugin.json are skipped, with a warning on +// stderr naming the directory and the parse error — never silently. // SPORT: list/inventory operations; callers: cmd/plugin/list.go, cmd/plugin/inventory.go import ( @@ -136,7 +137,27 @@ func listInstalled(pluginDir string) ([]PluginInfo, error) { manifestPath := filepath.Join(pluginDir, entry.Name(), "plugin.json") m, err := parseManifest(manifestPath) if err != nil { - continue // skip directories without valid manifests + // A directory here is an INSTALLED plugin, so an unreadable + // manifest is not the same as "not a plugin" — the plugin is on + // disk and the user was told it installed. Swallowing the error + // made it vanish from `nself plugin list --installed` with no + // output at all, which is indistinguishable from never having + // installed it. + // + // Found 2026-09-13: the free Task Bundle's `notifications` plugin + // declares status "deprecated" but carries the flat + // deprecated/deprecatedSince/replacedBy fields instead of the + // `deprecation` block validateManifest requires, so its manifest + // is invalid. `nself plugin install notifications` printed + // "installed successfully", the directory and manifest were + // written, and the plugin was then invisible to every listing. + // + // Still a `continue`, deliberately: one bad manifest must not hide + // the other seven. But it is now a visible diagnostic. + fmt.Fprintf(os.Stderr, + "warning: installed plugin %q has an unreadable manifest and is being skipped: %v\n", + entry.Name(), err) + continue } running := false diff --git a/internal/plugin/loader_invalid_manifest_test.go b/internal/plugin/loader_invalid_manifest_test.go new file mode 100644 index 000000000..1da3cab3d --- /dev/null +++ b/internal/plugin/loader_invalid_manifest_test.go @@ -0,0 +1,130 @@ +package plugin + +// Purpose: Pin the behaviour of listInstalled when an installed plugin carries +// an invalid manifest — it must be skipped but WARNED about, never +// silently dropped. +// Inputs: A temp plugin dir with one valid and one invalid manifest. +// Outputs: Test results. +// Constraints: Must not depend on the real ~/.nself tree. +// SPORT: list/inventory operations — see loader.go. + +import ( + "encoding/json" + "os" + "path/filepath" + "testing" +) + +// writeManifest writes a plugin.json for a plugin dir under root. +func writeTestPluginManifest(t *testing.T, root, name string, manifest map[string]any) { + t.Helper() + dir := filepath.Join(root, name) + if err := os.MkdirAll(dir, 0o755); err != nil { + t.Fatalf("mkdir %s: %v", dir, err) + } + data, err := json.Marshal(manifest) + if err != nil { + t.Fatalf("marshal manifest for %s: %v", name, err) + } + if err := os.WriteFile(filepath.Join(dir, "plugin.json"), data, 0o644); err != nil { + t.Fatalf("write manifest for %s: %v", name, err) + } +} + +func validManifest(name string) map[string]any { + return map[string]any{ + "name": name, + "version": "1.2.1", + "description": "A valid test plugin.", + "category": "infrastructure", + "license": "MIT", + } +} + +// TestListInstalled_InvalidManifestIsSkippedButWarned reproduces the live +// 2026-09-13 defect: the free Task Bundle's `notifications` plugin declares +// status "deprecated" without the `deprecation` block validateManifest +// requires, so its manifest is invalid. `nself plugin install notifications` +// reported success and wrote the directory, and the plugin then vanished from +// `nself plugin list --installed` with no output whatsoever. +// +// The skip itself is correct (one bad manifest must not hide the others). What +// was wrong is that it was silent. +func TestListInstalled_InvalidManifestIsSkippedButWarned(t *testing.T) { + root := t.TempDir() + + writeTestPluginManifest(t, root, "good-plugin", validManifest("good-plugin")) + + // Exactly the shape that broke: status=deprecated, flat deprecation + // fields, no `deprecation` block. + bad := validManifest("notifications") + bad["status"] = "deprecated" + bad["deprecated"] = true + bad["deprecatedSince"] = "1.1.0" + bad["replacedBy"] = "notify" + writeTestPluginManifest(t, root, "notifications", bad) + + // Capture stderr for the duration of the call. + origStderr := os.Stderr + r, w, err := os.Pipe() + if err != nil { + t.Fatalf("pipe: %v", err) + } + os.Stderr = w + + plugins, listErr := listInstalled(root) + + w.Close() + os.Stderr = origStderr + var buf [4096]byte + n, _ := r.Read(buf[:]) + stderr := string(buf[:n]) + r.Close() + + if listErr != nil { + t.Fatalf("listInstalled returned an error: %v", listErr) + } + + // The valid plugin must still be listed — a bad neighbour must not hide it. + if len(plugins) != 1 { + t.Fatalf("expected exactly 1 listed plugin, got %d: %+v", len(plugins), plugins) + } + if plugins[0].Name != "good-plugin" { + t.Fatalf("expected good-plugin to be listed, got %q", plugins[0].Name) + } + + // The invalid one must have produced a warning naming it. Before this fix + // stderr was empty and the plugin simply disappeared. + if stderr == "" { + t.Fatal("expected a warning on stderr for the invalid manifest, got nothing — " + + "the plugin would disappear from `plugin list --installed` silently") + } + if !contains(stderr, "notifications") { + t.Fatalf("warning does not name the offending plugin directory; got: %q", stderr) + } +} + +// TestListInstalled_ValidDeprecatedManifestIsListed proves the fix to the +// manifest itself is the real remedy: with a proper `deprecation` block the +// plugin parses and is listed normally, warning-free. +func TestListInstalled_ValidDeprecatedManifestIsListed(t *testing.T) { + root := t.TempDir() + + m := validManifest("notifications") + m["status"] = "deprecated" + m["deprecation"] = map[string]any{ + "announcedDate": "2026-05-01", + "eolDate": "2027-01-01", + "replacedBy": "notify", + "migrationGuide": "https://nself.org/docs/plugins/notifications", + } + writeTestPluginManifest(t, root, "notifications", m) + + plugins, err := listInstalled(root) + if err != nil { + t.Fatalf("listInstalled returned an error: %v", err) + } + if len(plugins) != 1 || plugins[0].Name != "notifications" { + t.Fatalf("a validly-deprecated plugin must still be listed; got %+v", plugins) + } +}