test(marketplace): add test coverage for fetch-source guard block

- Add marketplace-fetch-source.test.ts covering all guard paths:
  - missing sourceUrl only (stderr mentions sourceUrl, exit 0)
  - missing sha only (stderr mentions sha, exit 0)
  - missing both (stderr mentions both, exit 0)
  - both present (guard does not trigger, gh api errors expected)
  - missing entry.json (exit 1)
- Trim inline comment to 2 lines per review feedback

Author: Hermes

.archon/scripts/__tests__/marketplace-fetch-source.test.ts

@@ -0,0 +1,103 @@
+import { describe, it, expect } from 'bun:test';
+import { mkdirSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+const SCRIPT = resolve(import.meta.dir, '../marketplace-fetch-source.ts');
+
+interface FetchOutput {
+  files: string[];
+  errors: string[];
+}
+
+function runFetch(entryJson: Record<string, unknown>): { output: FetchOutput; stderr: string; exitCode: number } {
+  const artifactsDir = mkdtempSync(join(tmpdir(), 'fetch-test-'));
+  try {
+    mkdirSync(join(artifactsDir, 'source'), { recursive: true });
+    writeFileSync(join(artifactsDir, 'entry.json'), JSON.stringify(entryJson));
+
+    const result = spawnSync('bun', [SCRIPT], {
+      env: { ...process.env, ARTIFACTS_DIR: artifactsDir },
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+
+    const exitCode = result.status ?? 1;
+    const stdout = result.stdout?.toString() ?? '';
+    const stderr = result.stderr?.toString() ?? '';
+
+    let output: FetchOutput = { files: [], errors: [] };
+    if (stdout) {
+      try {
+        output = JSON.parse(stdout);
+      } catch {
+        // stdout wasn't JSON — return empty default
+      }
+    }
+
+    return { output, stderr, exitCode };
+  } finally {
+    rmSync(artifactsDir, { recursive: true, force: true });
+  }
+}
+
+describe('marketplace-fetch-source: guard for missing sourceUrl/sha', () => {
+  it('exits 0 with empty files when sourceUrl is missing', () => {
+    const { output, stderr, exitCode } = runFetch({ sha: 'abc123' });
+    expect(exitCode).toBe(0);
+    expect(output.files).toHaveLength(0);
+    expect(stderr).toContain('sourceUrl');
+    expect(output.errors.length).toBeGreaterThan(0);
+    expect(output.errors[0]).toContain('sourceUrl');
+  });
+
+  it('exits 0 with empty files when sha is missing', () => {
+    const { output, stderr, exitCode } = runFetch({ sourceUrl: 'https://github.com/owner/repo/blob/main/path' });
+    expect(exitCode).toBe(0);
+    expect(output.files).toHaveLength(0);
+    expect(stderr).toContain('sha');
+    expect(output.errors.length).toBeGreaterThan(0);
+    expect(output.errors[0]).toContain('sha');
+  });
+
+  it('exits 0 with empty files when both sourceUrl and sha are missing', () => {
+    const { output, stderr, exitCode } = runFetch({});
+    expect(exitCode).toBe(0);
+    expect(output.files).toHaveLength(0);
+    expect(stderr).toContain('sourceUrl');
+    expect(stderr).toContain('sha');
+    expect(output.errors.length).toBeGreaterThan(0);
+  });
+
+  it('does not trigger guard when entry.json has both sourceUrl and sha', () => {
+    // When both fields are present, the guard should NOT fire.
+    // The script proceeds past the guard to URL parsing and gh api calls.
+    // Since gh api will fail in the test env, we verify the guard didn't
+    // trigger by checking stderr does NOT contain the guard's signature message.
+    const { stderr, output } = runFetch({
+      sourceUrl: 'https://github.com/coleam00/Archon/blob/main/README.md',
+      sha: 'abc123def456',
+    });
+    expect(stderr).not.toContain('missing required field');
+    expect(output.files).toHaveLength(0); // no fetch possible in test env
+    // The script proceeds past the guard; gh api errors are expected.
+    expect(output.errors.length).toBeGreaterThan(0);
+    expect(output.errors.some((e) => e.includes('gh api'))).toBe(true);
+  });
+});
+
+describe('marketplace-fetch-source: missing entry.json', () => {
+  it('exits 1 when entry.json is absent', () => {
+    const artifactsDir = mkdtempSync(join(tmpdir(), 'fetch-test-'));
+    try {
+      // No entry.json created
+      const result = spawnSync('bun', [SCRIPT], {
+        env: { ...process.env, ARTIFACTS_DIR: artifactsDir },
+        stdio: ['ignore', 'pipe', 'pipe'],
+      });
+      expect(result.status ?? 1).toBe(1);
+    } finally {
+      rmSync(artifactsDir, { recursive: true, force: true });
+    }
+  });
+});

.archon/scripts/marketplace-fetch-source.ts

@@ -34,9 +34,8 @@ mkdirSync(sourceDir, { recursive: true });
 const errors: string[] = [];
 const files: string[] = [];
 
-// Guard: sourceUrl and sha are required for fetching source files.
-// If either is missing (e.g., PR doesn't add a marketplace entry),
-// output an empty result so downstream nodes can proceed gracefully.
+// Guard: sourceUrl/sha are required. If missing, output empty result so
+// downstream nodes proceed gracefully (e.g., PR without a marketplace entry).
 if (!sourceUrl || !sha) {
   const missing: string[] = [];
   if (!sourceUrl) missing.push('sourceUrl');