@volcengine/mediakit-cli - npm Package Compare versions

Comparing version 0.1.8-beta.1 to 0.1.8-beta.2

scripts/install-wizard.test.js

+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const test = require('node:test')
+
+const { runInstallWizard } = require('./install-wizard')
+
+function writeExecutable(file, content) {
+  fs.writeFileSync(file, content, { mode: 0o755 })
+}
+
+async function captureLogs(t, fn) {
+  const oldLog = console.log
+  const logs = []
+  console.log = (...args) => logs.push(args.join(' '))
+  t.after(() => {
+    console.log = oldLog
+  })
+  await fn()
+  console.log = oldLog
+  return logs.join('\n')
+}
+
+test('installs skills from the npm package skills directory', async (t) => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'mediakit-install-wizard-'))
+  const bin = path.join(temp, 'bin')
+  fs.mkdirSync(bin)
+  const log = path.join(temp, 'calls.jsonl')
+
+  writeExecutable(
+    path.join(bin, 'npm'),
+    `#!/usr/bin/env node
+const fs = require('node:fs')
+fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({ cmd: 'npm', args: process.argv.slice(2) }) + '\\n')
+process.exit(0)
+`,
+  )
+  writeExecutable(
+    path.join(bin, 'npx'),
+    `#!/usr/bin/env node
+const fs = require('node:fs')
+fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({ cmd: 'npx', args: process.argv.slice(2) }) + '\\n')
+process.exit(0)
+`,
+  )
+
+  t.after(() => fs.rmSync(temp, { recursive: true, force: true }))
+  const oldPath = process.env.PATH
+  process.env.PATH = `${bin}${path.delimiter}${oldPath || ''}`
+  t.after(() => {
+    process.env.PATH = oldPath
+  })
+
+  await runInstallWizard(['--skills-only', '--skill', 'byted-mediakit-video', '-y'])
+
+  const calls = fs
+    .readFileSync(log, 'utf8')
+    .trim()
+    .split('\n')
+    .map((line) => JSON.parse(line))
+  assert.equal(calls.length, 1)
+  assert.equal(calls[0].cmd, 'npx')
+  assert.deepEqual(calls[0].args, [
+    '-y',
+    'skills',
+    'add',
+    path.join(__dirname, '..', 'skills'),
+    '-s',
+    'byted-mediakit-video',
+    '-g',
+    '-y',
+  ])
+  assert(!calls[0].args.some((arg) => /^https?:\/\//.test(String(arg))))
+})
+
+test('regular install delegates skills installation to npm postinstall', async (t) => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'mediakit-install-wizard-'))
+  const bin = path.join(temp, 'bin')
+  fs.mkdirSync(bin)
+  const log = path.join(temp, 'calls.jsonl')
+
+  writeExecutable(
+    path.join(bin, 'npm'),
+    `#!/usr/bin/env node
+const fs = require('node:fs')
+fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({ cmd: 'npm', args: process.argv.slice(2) }) + '\\n')
+process.exit(0)
+`,
+  )
+  writeExecutable(
+    path.join(bin, 'npx'),
+    `#!/usr/bin/env node
+const fs = require('node:fs')
+fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({ cmd: 'npx', args: process.argv.slice(2) }) + '\\n')
+process.exit(0)
+`,
+  )
+
+  t.after(() => fs.rmSync(temp, { recursive: true, force: true }))
+  const oldPath = process.env.PATH
+  process.env.PATH = `${bin}${path.delimiter}${oldPath || ''}`
+  t.after(() => {
+    process.env.PATH = oldPath
+  })
+
+  const output = await captureLogs(t, () => runInstallWizard(['-y']))
+
+  const calls = fs
+    .readFileSync(log, 'utf8')
+    .trim()
+    .split('\n')
+    .map((line) => JSON.parse(line))
+  assert.deepEqual(calls, [
+    {
+      cmd: 'npm',
+      args: [
+        'install',
+        '-g',
+        '@volcengine/mediakit-cli@0.1.7',
+        '--foreground-scripts',
+        '--ignore-scripts=false',
+      ],
+    },
+  ])
+  assert.match(output, /installing @volcengine\/mediakit-cli@0\.1\.7 via npm install -g/)
+  assert.match(output, /Installing skills \.\.\./)
+  assert.match(output, /✓ Successfully installed mediakit-cli 0\.1\.7/)
+  assert.match(output, /✓ Skills installed/)
+})
+
+test('install wizard rejects unsupported version override', async (t) => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'mediakit-install-wizard-'))
+  const bin = path.join(temp, 'bin')
+  fs.mkdirSync(bin)
+  const log = path.join(temp, 'calls.jsonl')
+
+  writeExecutable(
+    path.join(bin, 'npm'),
+    `#!/usr/bin/env node
+const fs = require('node:fs')
+fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({ cmd: 'npm', args: process.argv.slice(2) }) + '\\n')
+process.exit(0)
+`,
+  )
+  writeExecutable(
+    path.join(bin, 'npx'),
+    `#!/usr/bin/env node
+process.exit(0)
+`,
+  )
+
+  t.after(() => fs.rmSync(temp, { recursive: true, force: true }))
+  const oldPath = process.env.PATH
+  process.env.PATH = `${bin}${path.delimiter}${oldPath || ''}`
+  t.after(() => {
+    process.env.PATH = oldPath
+  })
+
+  await assert.rejects(
+    () => runInstallWizard(['--version', '0.1.7', '-y']),
+    /--version is not supported/,
+  )
+  assert.equal(fs.existsSync(log), false)
+})

scripts/install.test.js

+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const test = require('node:test')
+
+const { install } = require('./install')
+
+function writeExecutable(file, content) {
+  fs.writeFileSync(file, content, { mode: 0o755 })
+}
+
+async function captureLogs(t, fn) {
+  const oldLog = console.log
+  const logs = []
+  console.log = (...args) => logs.push(args.join(' '))
+  t.after(() => {
+    console.log = oldLog
+  })
+  await fn()
+  console.log = oldLog
+  return logs.join('\n')
+}
+
+test('postinstall installs skills from the npm package skills directory when binary already exists', async (t) => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'mediakit-postinstall-'))
+  const bin = path.join(temp, 'bin')
+  fs.mkdirSync(bin)
+  const log = path.join(temp, 'calls.jsonl')
+
+  writeExecutable(
+    path.join(bin, 'npx'),
+    `#!/usr/bin/env node
+const fs = require('node:fs')
+fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({ cmd: 'npx', args: process.argv.slice(2) }) + '\\n')
+process.exit(0)
+`,
+  )
+
+  t.after(() => fs.rmSync(temp, { recursive: true, force: true }))
+  const oldPath = process.env.PATH
+  const oldSkip = process.env.MEDIAKIT_CLI_SKIP_DOWNLOAD
+  process.env.PATH = `${bin}${path.delimiter}${oldPath || ''}`
+  delete process.env.MEDIAKIT_CLI_SKIP_DOWNLOAD
+  t.after(() => {
+    process.env.PATH = oldPath
+    if (oldSkip === undefined) {
+      delete process.env.MEDIAKIT_CLI_SKIP_DOWNLOAD
+    } else {
+      process.env.MEDIAKIT_CLI_SKIP_DOWNLOAD = oldSkip
+    }
+  })
+
+  const output = await captureLogs(t, () => install())
+
+  const calls = fs
+    .readFileSync(log, 'utf8')
+    .trim()
+    .split('\n')
+    .map((line) => JSON.parse(line))
+  assert.equal(calls.length, 1)
+  assert.deepEqual(calls[0].args, [
+    '-y',
+    'skills',
+    'add',
+    path.join(__dirname, '..', 'skills'),
+    '-g',
+    '-y',
+  ])
+  assert.match(output, /Installing skills \.\.\./)
+  assert.match(output, /✓ Skills installed/)
+})

checksums.txt

@@ -1,6 +0,6 @@
-b1c946b0543cf5f650932b316243392f642d08fb4873a4abb1a96134dd153c73  mediakit-cli_0.1.8-beta.1_darwin_amd64.tar.gz
-046e3126d2fc6294a346a059dc29d7bdd28059a62fa4bdef19b45e920dc337f0  mediakit-cli_0.1.8-beta.1_darwin_arm64.tar.gz
-b77f572393034c82475a25c0e483f7ac8d82226ee8315bf763b7d56305f679f6  mediakit-cli_0.1.8-beta.1_linux_amd64.tar.gz
-a74821d98415092b77f78695811de539640b9a7634747378666a7d3824d9f094  mediakit-cli_0.1.8-beta.1_linux_arm64.tar.gz
-78a9190cf6a3f551747eef4c1fd8fd2a3da5c18d6633c66c618c183650acb487  mediakit-cli_0.1.8-beta.1_windows_amd64.zip
-938353471fa21fc401cf316d2af92ebfea436a063c1e69d554c84b64ceacf7da  mediakit-cli_0.1.8-beta.1_windows_arm64.zip
+dee87a39ea7677725ee9f677e024d1bdd742603b3005e7097c1afc240460bf5d  mediakit-cli_0.1.8-beta.2_darwin_amd64.tar.gz
[phone]c895f2637cdf8cd66d3195ff07635dd0b97b7377223ee07d6a1fe1ef  mediakit-cli_0.1.8-beta.2_darwin_arm64.tar.gz
+633b70aa50950a9b92f6fcc9ba1cf6e64f87457b42edf0107af58474f3be7413  mediakit-cli_0.1.8-beta.2_linux_amd64.tar.gz
+c016504d52de075fd48c50130a47ddd58d8b52d5b8a8bbd990b39cda72baf12d  mediakit-cli_0.1.8-beta.2_linux_arm64.tar.gz
+2ec4586fa21656da7831ea1e3ea96db98b9bde742f0a21254deffa5410504a53  mediakit-cli_0.1.8-beta.2_windows_amd64.zip
+9bc2bff6da607a21380bd306b23343474fd6f58de4b15e3199a02c56491366f4  mediakit-cli_0.1.8-beta.2_windows_arm64.zip

package.json

 {
   "name": "@volcengine/mediakit-cli",
-  "version": "0.1.8-beta.1",
+  "version": "0.1.8-beta.2",
   "description": "MediaKit CLI with multi-platform binary distribution via npm",
@@ -5,0 +5,0 @@ "license": "MIT",

scripts/install-wizard.js

@@ -10,2 +10,3 @@ #!/usr/bin/env node
 const PACKAGE_NAME = pkg.name || '@volcengine/mediakit-cli'
+const PACKAGE_SPEC = `${PACKAGE_NAME}@${pkg.version}`
 const SKILLS_DIR = path.join(__dirname, '..', 'skills')
@@ -86,5 +87,10 @@
   log(`installing ${target} via npm install -g`)
-  const result = spawnSync('npm', ['install', '-g', target], {
-    stdio: 'inherit',
-  })
+  log('Installing skills ...')
+  const result = spawnSync(
+    'npm',
+    ['install', '-g', target, '--foreground-scripts', '--ignore-scripts=false'],
+    {
+      stdio: 'inherit',
+    },
+  )
   if (result.error) {
@@ -98,2 +104,4 @@ throw result.error
   }
+  log(`✓ Successfully installed mediakit-cli ${pkg.version}`)
+  log('✓ Skills installed')
 }
@@ -120,2 +128,3 @@
   }
+  log('✓ Skills installed')
 }
@@ -131,3 +140,3 @@
   if (!opts.skillsOnly) {
-    runNpmInstall(PACKAGE_NAME)
+    runNpmInstall(PACKAGE_SPEC)
   }
@@ -134,0 +143,0 @@

scripts/install.js

@@ -203,2 +203,4 @@ #!/usr/bin/env node
 function installSkills() {
+  console.log("[mediakit-cli] Installing skills ...");
+  console.log(`[mediakit-cli] skills source: ${skillsDir}`);
   const result = spawnSync(
@@ -215,2 +217,3 @@ "npx",
   }
+  console.log("[mediakit-cli] ✓ Skills installed");
 }
@@ -217,0 +220,0 @@

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 4 instances

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 3 instances

Improved metrics

Total package byte prevSize

208624

3.55%

Number of package files

65

3.17%

Lines of code

647

52.96%

Worsened metrics

Number of low supply chain risk alerts

35

118.75%

No dependency changes