test: add local unittest suite for plugin invariants

[davidmosiah]

Adds a small, honest local test suite for the two Agent Plugins in this marketplace (delx-recovery, delx-commerce). There was no tests/ directory and no root package manager; HOL plugin-scanner lint is not treated as a functional test.

How to run (this VM / any machine)

python3 -m unittest discover -s tests -t . -v
# or
bash tests/run.sh

Stdlib only (python3 -m unittest). No GitHub Actions — this PR does not add, enable, or depend on .github/workflows. Existing plugin-scanner.yml is untouched.

Proven on the cloud-agent VM

python3 -m unittest discover -s tests -t . -v
Ran 30 tests in 0.018s
OK

What is actually asserted

• Manifests: plugin.json / mcp.json parse, carry Agent Plugins 1.0.0 $schema + required fields, MCP URLs are HTTPS api.delx.ai with the recovery vs commerce src= tags, marketplace sources exist, Claude/Codex vendor manifests share identity, recovery hooks point at real executable scripts.
• Tool / schema names: first-hour skill still teaches the core Protocol tools; backticked calls are known recovery tools; commerce skills document the x402 pack routes and stay off leave_hive_note; recovery skill stays off /api/v1/x402/.
• No secrets: plugin text has no PEM / PAT / live-key shapes; MCP URLs have no embedded credentials; guardian hooks do not dump env or files.
• Continuity Capsule: skill links continuity-capsule-v1.json, the fenced example validates against the v1 allowlist, hook leave_hive_note payloads only use schema-legal fields.
• Hooks (functional): bash -n; guardian off is a noop; guardian on without DELX_HIVE_AGENT_ID exits 0; SessionEnd without session id is silent; no shared fallback agent id.

Not covered (out of scope): publishing, directory spam, live MCP round-trips, GitHub Actions minutes.

Note on Agent Plugins JSON Schema

delx-recovery/plugin.json includes a hooks object that the published Agent Plugins 1.0.0 schema marks as additionalProperties: false. Tests check the required 1.0.0 fields plus that hook commands exist, rather than rejecting the shipping extension.

  

Summary by CodeRabbit

• Tests
  • Added comprehensive automated checks for plugin manifests, layouts, hooks, tool names, recovery behavior, and commerce routes.
  • Added validation for Continuity Capsule v1 structure, required fields, examples, and lifecycle integration.
  • Added safeguards against exposed credentials, insecure URLs, and secret-leaking hook behavior.
• Documentation
  • Documented local test commands, alternative test execution, and suite coverage.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Warning

Review limit reached

@davidmosiah, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 119 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6cc46a73-f7a1-4e60-bf34-4132d62d06e3

📥 Commits

Reviewing files that changed from the base of the PR and between 32459c5 and d53ba52.

📒 Files selected for processing (10)

• README.md
• tests/__init__.py
• tests/fixtures/continuity-capsule-v1.json
• tests/helpers.py
• tests/run.sh
• tests/test_continuity_capsule.py
• tests/test_hooks.py
• tests/test_manifests.py
• tests/test_no_secrets.py
• tests/test_tool_names.py

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f1866767-3e3c-413e-a626-2cff97cd26f5

📥 Commits

Reviewing files that changed from the base of the PR and between 32459c5 and d53ba52.

📒 Files selected for processing (10)

• README.md
• tests/__init__.py
• tests/fixtures/continuity-capsule-v1.json
• tests/helpers.py
• tests/run.sh
• tests/test_continuity_capsule.py
• tests/test_hooks.py
• tests/test_manifests.py
• tests/test_no_secrets.py
• tests/test_tool_names.py

---

📝 Walkthrough

Walkthrough

Added a repository-local unittest suite with shared helpers and a Continuity Capsule schema fixture. The suite validates plugin manifests, layouts, hooks, tool names, commerce routes, MCP URLs, secret patterns, and product boundaries. README documentation describes local test execution.

Changes

Plugin invariant validation

Layer / File(s)	Summary
Test foundation and Continuity Capsule contract tests/helpers.py, tests/fixtures/continuity-capsule-v1.json, tests/test_continuity_capsule.py, tests/run.sh, tests/__init__.py, README.md	Added shared test constants and loaders, a Continuity Capsule v1 JSON Schema fixture, capsule validation tests, repository-root unittest discovery, and local test documentation.
Manifest and plugin layout checks tests/test_manifests.py	Added validation for marketplace metadata, plugin and MCP manifests, HTTPS endpoints, product separation, recovery hooks, ChatGPT annotations, JSON files, and skill frontmatter.
Hook behavior and secret checks tests/test_hooks.py, tests/test_no_secrets.py	Added Bash syntax checks, hook opt-in and missing-identity tests, source-level safety checks, credential-pattern scanning, MCP URL checks, and recovery-hook disclosure checks.
Tool and commerce route boundaries tests/test_tool_names.py	Added checks for recovery tool references, continuity hook tool calls, commerce x402 routes and metadata, and separation between recovery and commerce content.

Estimated code review effort: 3 (Moderate) | ~20 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/add-plugin-unit-tests-4edc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}