fix(marketplace): guard fetch-source against missing sourceUrl/sha

[gai095481]

Summary

The marketplace-fetch-source script crashes with TypeError: undefined is not an object (evaluating 'sourceUrl.match') when sourceUrl is undefined in entry.json. This happens on PRs that don't add a marketplace entry (no sourceUrl field), causing the marketplace-auto-review CI check to fail on every such PR.

Problem

• fetch-source destructures { sourceUrl, sha } from entry.json without null checks
• When a PR doesn't modify marketplace.ts, the sourceUrl field is undefined
• Calling .match() on undefined throws TypeError, killing the entire workflow
• This caused CI failures on PRs fix(core): respect worktree.enabled: false in dispatchBackgroundWorkflow #1685 and fix(marketplace-auto-review): feed actual workflow source to AI reviewer #1689 (and any PR not touching marketplace entries)

What Changed

• Made sourceUrl and sha optional in the MarketplaceEntry interface
• Added an early-return guard: when either field is missing, log a clear warning and output an empty { files, errors } result, then exit 0
• Downstream nodes (AI review) can now proceed without source files instead of the entire workflow crashing

Validation

Note: wiring .archon/scripts tests into bun run test/CI lands separately via #2147 — not duplicated here.

• The fix is a null guard with exit(0) — no behavioral change when sourceUrl and sha are present (the happy path for marketplace entries)
• When fields are missing, the workflow continues with an empty source list instead of crashing

Security Impact

None. This is a defensive null check that prevents a crash; no new data flows or permissions are introduced.

Compatibility

Fully backward compatible. Existing marketplace entries with valid sourceUrl/sha are unaffected.

Rollback Plan

Revert this commit to restore the previous behavior (crash on missing fields).

Blast Radius

Single script: .archon/scripts/marketplace-fetch-source.ts. Only affects the fetch-source node in marketplace-pr-review-and-merge.yaml. No other workflows or scripts are impacted.

Risks & Mitigations

• Risk: Downstream AI review runs without source files when fields are missing.
• Mitigation: The bundle-source node (from PR fix(marketplace-auto-review): feed actual workflow source to AI reviewer #1689) already handles surfacing available source content to the AI reviewer. When source files are empty, the reviewer works with what it has — this is preferable to the entire CI check crashing.

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of marketplace entries with missing required source details by reporting exactly which fields are absent, recording the error, returning no files, and exiting cleanly so downstream steps can continue.
• Tests
  • Added a Bun test suite covering exit codes and error messaging when source fields are missing or when the entry metadata is not present.

[coderabbitai]

📝 Walkthrough

Walkthrough

The marketplace source-fetch script makes sourceUrl and sha optional. An early guard reports missing fields, returns empty files with errors, and exits successfully. Tests cover missing fields, valid-field continuation, and missing entry.json.

Changes

Optional source-fetch fields and validation

Layer / File(s)	Summary
Optional source fields and missing-data guard .archon/scripts/marketplace-fetch-source.ts	MarketplaceEntry makes sourceUrl and sha optional. An early guard reports missing fields, records the error, outputs empty files, and exits with status 0.
Bun test suite for guard and missing entry.json .archon/scripts/__tests__/marketplace-fetch-source.test.ts	Adds process execution helpers and tests for missing fields, valid fields, and absent entry.json.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: coleam00

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	⚠️ Warning	It covers the core change, but omits multiple required sections like UX Journey, diagrams, labels, and linked issue.	Add the missing template sections: UX Journey, Architecture Diagram, Label Snapshot, Change Metadata, Linked Issue, and Human Verification.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly states the main fix: guarding fetch-source against missing sourceUrl/sha.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Wirasm]

Review Summary

Verdict: minor-fixes-needed

This PR adds a guard to marketplace-fetch-source.ts that exits gracefully with an empty result when entry.json is missing sourceUrl or sha — fixing a crash that occurs when PRs bypass the parse-entry step. The error handling is clean and consistent with existing patterns. The main gap: the new guard path has no test coverage.

Blocking issues

(none — no CRITICAL findings)

Suggested fixes

• .archon/scripts/__tests__/marketplace-fetch-source.test.ts (missing): Add test coverage for the new guard block (lines 37-51). Test:
  1. entry.json missing sourceUrl only → expects stderr mention of "sourceUrl", files: [], exitCode(0)
  2. entry.json missing sha only → expects stderr mention of "sha", exitCode(0)
  3. entry.json missing both → expects both field names in stderr
  4. entry.json complete → continues to fetch logic unchanged

Minor / nice-to-have

• The inline comment at lines 37-48 is accurate and well-written. A small future polish: trim to two lines to reduce rot risk from the "e.g., PR doesn't add a marketplace entry" phrasing.
• The optional sourceUrl/sha fields in MarketplaceEntry are handled correctly by the guard. Be aware: if parse-entry ever starts writing partial entries intentionally, this interface change will silently accept them without breaking — which may or may not be desired behavior.

Compliments

• The guard mirrors the established pattern in ghApi() (stderr + errors array + return empty / exit 0), so no new error-handling style is introduced.
• The inline comment does a good job of capturing WHY the guard exists, not just WHAT it checks.

---

Reviewed via maintainer-review-pr workflow (Pi/Minimax). Aspects run: code-review, error-handling, test-coverage, comment-quality.

[Wirasm]

@$gai095481 related to #1326 — overlapping area or partial fix.

[Wirasm]

@$gai095481 related to #1720 — overlapping area or partial fix.

[Wirasm]

@$gai095481 related to #1489 — overlapping area or partial fix.

[Wirasm]

@$gai095481 related to #1578 — overlapping area or partial fix.

[Wirasm]

@$gai095481 related to #1326 — overlapping area or partial fix.

[Wirasm]

@$gai095481 related to #1720 — overlapping area or partial fix.

[Wirasm]

@$gai095481 related to #1489 — overlapping area or partial fix.

[Wirasm]

@$gai095481 related to #1578 — overlapping area or partial fix.

[Wirasm]

Hi @gai095481 — thanks for opening this PR.

This repository uses a PR template at .github/pull_request_template.md with several required sections. A few of them appear to be empty or placeholder here:

• Validation Evidence
• Human Verification
• Side Effects / Blast Radius

Could you fill those out (even briefly)? The template helps reviewers understand scope, risk, and rollback — it speeds up review significantly.

If a section genuinely doesn't apply, just write "N/A" in it rather than leaving it blank.

[Wirasm]

Review Summary

Verdict: minor-fixes-needed

Nice, focused bugfix — the missing-field guard in marketplace-fetch-source.ts mirrors the script's existing ghApi failure contract (exit 0 + errors[] populated), and the inline comment captures the non-obvious "let downstream nodes proceed gracefully" invariant. Two items before this is fully CI-safe.

Blocking issues

• (none — but the test wiring below should land before merge to keep the regression protection real)

Suggested fixes

• Wire the new tests into the repo's standard test/CI path. .archon/scripts/__tests__/marketplace-fetch-source.test.ts isn't invoked by bun run test or any GitHub workflow (the root command only fans out to workspace packages, and .archon/ is outside every workspace). The 5 cases pass locally but give no CI protection — the missing-field guard can regress while the standard suite stays green. Add something like "test:archon-scripts": "bun test ./.archon/scripts/__tests__" to a root script and invoke it from test/validate (or add a required CI step). Bonus: this also pulls the existing marketplace-security-scan tests into CI.
• Make the "does not trigger guard" / "both fields present" cases hermetic. They depend on a real (or unauthenticated) gh api call and have no execFileSync timeout, so a developer with gh auth status active hits a real network call (slower, noisier, can stall), and the test result depends on a ref that may eventually become valid. For the guard-regression assertion specifically, supply truthy fields with an intentionally unrecognized URL and assert the script reaches the deterministic URL-validation error rather than the missing-field guard — or PATH-shadow a stub gh via bun:test's mock helper.

Minor / nice-to-have

• The 4-line comment above the "both fields present" test is heavier than the project's "short, WHY-only" guidance; the middle line restates WHAT. Compress to one line carrying only the WHY.
• Drop // No entry.json created and // stdout wasn't JSON — return empty default — both restate WHAT and the surrounding it(...)/init code already conveys it.
• The guard comment says "sourceUrl/sha are required", which sits in mild tension with the now-optional TS fields on MarketplaceEntry. Optional rewording: "needed for fetching" instead of "required".
• File ends without a trailing newline (sibling tests end with one).
• Out-of-scope follow-ups if you want them: the unrecognized sourceUrl branch (process.exit(1)) has no test coverage, and mkdirSync(sourceDir, { recursive: true }) runs before the new guard, so source/ is created and left empty on every "no marketplace entry" PR.

Compliments

The guard is consistent with the script's existing error contract, and the inline comment grounding the WHY in a concrete scenario ("PR without a marketplace entry") is the kind of comment the project's style guide is asking for — keep doing that.

---

Reviewed via maintainer-review-pr workflow (Pi/Minimax). Aspects run: code-review, error-handling, test-coverage, comment-quality. docs-impact skipped (no docs/README changes in PR).

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.archon/scripts/__tests__/marketplace-fetch-source.test.ts (1)

17-17: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Avoid pre-creating the source/ directory in the test helper.

The PR reviewer noted that the script itself creates an empty source/ directory before returning. By pre-creating it here in the test helper, the tests will silently pass even if the script fails to create this directory.

Consider removing this line and instead adding assertions in the missing-field tests to verify that the source/ directory was successfully created by the script.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.archon/scripts/__tests__/marketplace-fetch-source.test.ts at line 17,
Remove the pre-creation of the source directory from the test helper setup.
Update the missing-field tests around the marketplace fetch script invocation to
assert that the script itself creates the source directory, while preserving the
existing test behavior and cleanup.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.archon/scripts/__tests__/marketplace-fetch-source.test.ts:
- Line 76: Update the negative assertion in the marketplace fetch test to check
for the updated guard wording, such as “needed for fetching,” instead of the
obsolete “missing required field” text. Keep the assertion tied to the exact
message emitted by the script’s validation guard so it still detects an
incorrectly triggered guard.

---

Nitpick comments:
In @.archon/scripts/__tests__/marketplace-fetch-source.test.ts:
- Line 17: Remove the pre-creation of the source directory from the test helper
setup. Update the missing-field tests around the marketplace fetch script
invocation to assert that the script itself creates the source directory, while
preserving the existing test behavior and cleanup.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7300dae9-883e-4c54-bbed-9ad665428377

📥 Commits

Reviewing files that changed from the base of the PR and between 6cf9075 and 62dcb7a.

📒 Files selected for processing (2)

• .archon/scripts/__tests__/marketplace-fetch-source.test.ts
• .archon/scripts/marketplace-fetch-source.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• .archon/scripts/marketplace-fetch-source.ts

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Update the negative assertion to match the updated guard message.

The PR reviewer suggested changing the error wording from "required" to "needed for fetching". If the script's error message was updated accordingly, this negative assertion (not.toContain('missing required field')) will pass vacuously even if the guard is mistakenly triggered, hiding potential bugs.

Ensure this assertion reflects the exact string emitted by the updated guard (e.g., 'needed for fetching').

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.archon/scripts/__tests__/marketplace-fetch-source.test.ts at line 76,
Update the negative assertion in the marketplace fetch test to check for the
updated guard wording, such as “needed for fetching,” instead of the obsolete
“missing required field” text. Keep the assertion tied to the exact message
emitted by the script’s validation guard so it still detects an incorrectly
triggered guard.