plugins/lisa-harper-fabric-cursor/skills/harper-testing/SKILL.md
This skill should be used when adding, repairing, or designing tests for a Harper (HarperDB/Fabric) component app — Vitest unit tests for pure functions and Resource methods, local Harper integration tests that boot/symlink/seed/assert real endpoints, Playwright e2e tests against REST/GraphQL routes, and schema/verify-script coupling. Use it when a Harper app needs its first test suite, endpoint coverage, seed isolation, or a local smoke/verify path. Pairs with harper-build-and-deploy, harper-schema-graphql, and e2e-coverage-gaps.
npx skillsauth add codyswanngt/lisa harper-testingInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Test Harper apps at the layer that proves the risk:
Resource methods with mocked Harper runtime globals.Harper application source lives in TypeScript under src/; deployable
harper-app/resources.js, harper-app/resource-*.js, and harper-app/web/** are
generated. Build before integration or e2e tests so the runtime loads the code you
just changed. See [[harper-build-and-deploy]].
| Layer | Tool | Use when | Avoid |
| --- | --- | --- | --- |
| Pure unit | Vitest | Validating transforms, validators, serializers, query builders, and other code with no Harper runtime dependency. | Mocking HTTP or tables for logic that can stay pure. |
| Resource unit | Vitest | Exercising get, post, search, patch, or permission/error logic in a resource class without booting Harper. | Treating mocked tables as proof that config.yaml, schema.graphql, or REST exposure works. |
| Integration | Vitest or shell smoke | Proving Harper boots, schema loads, jsResource registers code, data seeds, and endpoints respond. | Replacing this with resource mocks after config, schema, or generated artifact changes. |
| E2E | Playwright | Verifying client-observable REST/GraphQL behavior, auth states, error paths, and browser workflows. | Re-testing every pure branch through the browser. |
Use [[e2e-coverage-gaps]] after a suite exists to find missing routes and non-happy paths. Use this skill when creating or repairing the test patterns themselves.
Keep business transforms importable without Harper globals:
import { describe, expect, it } from 'vitest';
import { normalizePetName } from '../src/pets/normalize';
describe('normalizePetName', () => {
it('trims and title-cases names', () => {
expect(normalizePetName(' ada LOVELACE ')).toBe('Ada Lovelace');
});
});
If a resource method contains complex transformation logic, extract the pure part and test it directly. Leave a thinner resource test for runtime wiring, authorization, and persistence behavior.
Harper injects runtime globals such as Resource and tables when it loads
resources.js. Unit tests do not get those globals automatically. Test resource
methods by importing code through a seam that accepts mocks, or by setting the
minimal globals before importing the resource module.
Prefer dependency injection for new code:
import { describe, expect, it, vi } from 'vitest';
import { createPetsResource } from '../src/resources/pets';
describe('PetsResource.get', () => {
it('adds adoption status from the table record', async () => {
const table = {
get: vi.fn(async () => ({ id: 'pet-1', name: 'Mina', adoptedAt: null })),
};
const Pets = createPetsResource({ Resource: class {}, table });
await expect(Pets.get({ id: 'pet-1' })).resolves.toMatchObject({
id: 'pet-1',
name: 'Mina',
adoptionStatus: 'available',
});
expect(table.get).toHaveBeenCalledWith({ id: 'pet-1' });
});
});
When existing code must extend tables.X directly, isolate the runtime globals in
a test helper and import the module after setup:
import { beforeEach, describe, expect, it, vi } from 'vitest';
describe('Pets resource', () => {
beforeEach(() => {
vi.resetModules();
vi.stubGlobal('Resource', class {});
vi.stubGlobal('tables', {
Pets: class {
static async get(target: { id: string }) {
return { id: target.id, name: 'Mina' };
}
},
});
});
it('wraps the runtime table', async () => {
const { Pets } = await import('../src/resources/pets');
await expect(Pets.get({ id: 'pet-1' })).resolves.toMatchObject({
id: 'pet-1',
name: 'Mina',
});
});
});
Keep mocks narrow. Mock only the table methods, Resource base behavior,
server.resources, or external fetch calls the method actually uses. If the test
starts recreating Harper's schema, REST routing, or auth behavior, move it to an
integration test.
Use integration tests to prove the component runs as Harper will load it:
bun install --frozen-lockfile
when needed, then bun run build.harper dev harper-app for watch mode or harper run harper-app for a
one-shot test process. Use the project's wrapper command when present.dataLoader fixtures when the project owns static fixtures,
or through REST/Operations API calls when each test needs dynamic setup.Shell smoke tests are acceptable when the project already has that convention. Keep them strict: exit non-zero on boot failure, seed failure, missing endpoint, wrong status, or wrong response shape.
Example integration skeleton:
#!/usr/bin/env bash
set -euo pipefail
bun run build
HARPER_APP_DIR="${PWD}/harper-app"
HARPER_HOME="${HARPER_HOME:-${PWD}/.harper-test}"
BASE_URL="${BASE_URL:-http://127.0.0.1:9926}"
mkdir -p "$HARPER_HOME/components"
ln -sfn "$HARPER_APP_DIR" "$HARPER_HOME/components/pets"
HARPER_HOME="$HARPER_HOME" harper run "$HARPER_APP_DIR" > /tmp/harper-test.log 2>&1 &
HARPER_PID=$!
trap 'kill "$HARPER_PID" 2>/dev/null || true; rm -f "$HARPER_HOME/components/pets"' EXIT
for _ in {1..30}; do
curl -fsS "$BASE_URL/health" >/dev/null && break
sleep 1
done
curl -fsS -X POST "$BASE_URL/Pets" \
-H 'content-type: application/json' \
--data '{"id":"pet-it-1","name":"Mina"}' >/dev/null
curl -fsS "$BASE_URL/Pets/pet-it-1" | jq -e '.name == "Mina"'
Adjust the health path, component name, port, and endpoint names to the project.
Do not commit local HARPER_HOME, logs, generated component copies, or secrets.
Use deterministic test data that cannot collide with developer or CI data:
pet-${process.env.GITHUB_RUN_ID ?? Date.now()}.dataLoader fixtures for stable baseline data that every local boot
should have.dataLoader is good for fast, declarative baseline rows. REST seeding is better
when the test must exercise validation, defaults, auth, or generated IDs exactly as
clients see them.
Use Playwright for HTTP behavior that needs browser tooling, request contexts, storage state, tracing, or cross-browser/project coverage. A first endpoint spec should cover one happy path and one non-happy path:
import { expect, test } from '@playwright/test';
test.describe('Pets REST endpoint', () => {
test('creates and reads a pet', async ({ request }) => {
const id = `pet-pw-${Date.now()}`;
const create = await request.post('/Pets', {
data: { id, name: 'Mina' },
});
expect(create.ok()).toBe(true);
const read = await request.get(`/Pets/${id}`);
expect(read.status()).toBe(200);
await expect(read).toHaveJSON(expect.objectContaining({ id, name: 'Mina' }));
});
test('rejects invalid payloads', async ({ request }) => {
const response = await request.post('/Pets', {
data: { name: '' },
});
expect(response.status()).toBeGreaterThanOrEqual(400);
await expect(response).toHaveJSON(
expect.objectContaining({
error: expect.any(String),
}),
);
});
});
If the project uses custom auth, set storageState, headers, or a request fixture
in Playwright config instead of embedding credentials in specs. Never commit
tokens or local .env values.
A schema rename or resource route change is a breaking change for every verify path that names that table, field, endpoint, fixture, or response shape.
In the same PR as a schema/resource change:
schema.graphql, TypeScript resources, fixtures, and data loaders.scripts/verify* paths that assert row counts, joins, or
response keys.bun run build, bun run typecheck, and the smallest relevant test command.Do not report a Harper test change done only because mocks pass. At least one verify path must prove the generated app still boots and exposes the expected surface whenever config, schema, resources, generated artifacts, or endpoints are part of the change.
development
Prepare a machine — a fresh laptop or a throwaway container — to run coding agents, before any repository exists. Detects which of Lisa's supported agents (Claude Code, Codex, Cursor, OpenCode, Antigravity, Copilot) are already installed, asks which credential manager the machine uses (Bitwarden, 1Password, Doppler, Vault, AWS, or none), and installs only what is missing, each by its vendor's own preferred method. Idempotent, headless by default, and emits a Dockerfile for a spin-up/spin-down environment. Run it on a new machine, in a container, or before cloning anything.
tools
Provision and verify a remote execution environment for a host project — Codex Cloud today, other remote surfaces as they are added. Generates a repository-owned setup script that installs the declared toolchain, materializes secrets through lisa-secrets-access, and runs the project's own hook. Provisions by API where one exists, by driving the vendor console where one does not, and by emitting exact config otherwise — then proves the result with the same read-back regardless of which tier did the work. Use before dispatching any work with executionEnv.
tools
Bring a developer's machine in line with the toolchain the project declares. Reports every tool in remoteEnv.tools that is missing, outdated, or unpinned for this platform, and installs the missing ones into ~/.local/bin from the same pinned, checksummed entries the remote surfaces use — but only when asked. Same manifest, same pins, same installers as lisa-setup-remote-env; what differs is consent and that the pin is a floor rather than an equality. Run it on a fresh checkout, after a manifest change, or when a tool fails at the moment of use.
tools
Route one unit of work to a remote execution surface. Reads the executionEnv parameter (local by default, codex-cloud or claude-web today), verifies the environment is provisioned and bound to this repository, submits a thin skill invocation, records the task identifier to .lisa/remote-dispatch.json, and exits without polling. Routing only — the remote runs the identical skill from the identical repository. Composable and inline: other skills invoke it via the Skill tool rather than users calling it directly.