fix(stations/notify): skip unpublished source component

Co-Authored-By: Cursor <cursoragent@cursor.com>

Author: solomonneas

scripts/windows-native-acceptance.ps1

@@ -400,18 +400,26 @@ function Get-UnpublishedComponentIds {
     # pins real native assets. Those entries are the only components source
     # acceptance may skip: a component with declared assets must still install
     # and smoke, even if the report labels it "unsupported".
+    #
+    # Windows PowerShell 5.1 treats an empty JSON object as a truthy
+    # PSCustomObject whose .PSObject.Properties.Count is unreliable unless the
+    # Properties collection is forced through @(). Without that wrapper,
+    # agent-notify's empty assets map is never classified as unpublished and the
+    # post-setup health assertion fails with unsupported-component-platform.
     if (-not (Test-Path -LiteralPath $ManifestPath)) {
         throw "bundled compatibility manifest not found at $ManifestPath"
     }
     $manifest = Get-Content -LiteralPath $ManifestPath -Raw | ConvertFrom-Json
-    $unpublished = @()
+    $unpublished = [System.Collections.Generic.List[string]]::new()
     foreach ($property in $manifest.components.PSObject.Properties) {
         $assets = $property.Value.assets
-        if (-not $assets -or $assets.PSObject.Properties.Count -eq 0) {
-            $unpublished += $property.Name
+        if ($null -eq $assets -or @($assets.PSObject.Properties).Count -eq 0) {
+            $unpublished.Add([string]$property.Name)
         }
     }
-    return $unpublished
+    # Write-Output -NoEnumerate keeps a single empty-asset id as a one-element
+    # string[] instead of unrolling to a scalar that foreach would iterate by char.
+    Write-Output -NoEnumerate $unpublished.ToArray()
 }
 
 function Assert-AllComponentsHealthy {
@@ -575,8 +583,20 @@ try {
     & brigade --version
     if ($LASTEXITCODE -ne 0) { throw "brigade --version failed" }
 
+    # Source-mode acceptance runs against the bundled compatibility manifest,
+    # which carries not-yet-released components with empty assets. Compute that
+    # empty-asset set before both setup invocations so online and offline setup
+    # are only expected to install published components; post-setup health and
+    # smoke assertions reuse the same set. Published/release acceptance never
+    # skips anything and keeps bare setup (every published component).
+    [string[]]$unpublishedIds = @()
     if ($InstallMode -eq "source") {
+        $bundledManifestPath = Join-Path $RepoRoot "src\brigade\templates\components\manifest-v1.json"
+        [string[]]$unpublishedIds = @(Get-UnpublishedComponentIds -ManifestPath $bundledManifestPath)
+
         Write-Step "brigade setup (online)"
+        # Standalone manifest + published_component_ids omits empty-asset entries
+        # such as agent-notify; do not add flags that would request them.
         & brigade setup --manifest-source standalone
         if ($LASTEXITCODE -ne 0) { throw "brigade setup failed" }
 
@@ -594,16 +614,6 @@ try {
         if ($LASTEXITCODE -ne 0) { throw "brigade setup --offline failed" }
     }
 
-    # Source-mode acceptance runs against the bundled compatibility manifest,
-    # which carries not-yet-released components with empty assets. Only those
-    # entries may be skipped; published components (declared assets) must still
-    # install and smoke. Published/release acceptance never skips anything.
-    $unpublishedIds = @()
-    if ($InstallMode -eq "source") {
-        $bundledManifestPath = Join-Path $RepoRoot "src\brigade\templates\components\manifest-v1.json"
-        $unpublishedIds = Get-UnpublishedComponentIds -ManifestPath $bundledManifestPath
-    }
-
     $report = Get-ComponentReport -StderrRoot $acceptRoot
     Assert-AllComponentsHealthy -Report $report -Skippable $unpublishedIds
     $managedBin = Join-Path $env:LOCALAPPDATA "brigade\bin"

tests/test_ci_workflow.py

@@ -317,8 +317,15 @@ def test_windows_native_acceptance_source_setup_uses_standalone_manifest_online_
 
     source = re.search(r'if \(\$InstallMode -eq "source"\) \{(?P<body>.*?)\n    \}', setup, re.DOTALL)
     assert source is not None
-    assert "& brigade setup --manifest-source standalone" in source.group("body")
-    assert "& brigade setup --offline --manifest-source standalone" in source.group("body")
+    body = source.group("body")
+    # Empty-asset ids are derived before either setup invocation so online and
+    # offline share the published-only expectation set.
+    unpublished_at = body.index("$unpublishedIds = @(Get-UnpublishedComponentIds -ManifestPath $bundledManifestPath)")
+    online_at = body.index('Write-Step "brigade setup (online)"')
+    offline_at = body.index('Write-Step "brigade setup --offline"')
+    assert unpublished_at < online_at < offline_at
+    assert "& brigade setup --manifest-source standalone" in body
+    assert "& brigade setup --offline --manifest-source standalone" in body
 
 
 def test_windows_native_acceptance_pypi_setup_keeps_exact_manifest_default_and_digest_check():
@@ -541,7 +548,10 @@ def test_windows_native_acceptance_source_mode_skips_only_bundled_unpublished_co
     unpublished_fn = _extract_powershell_function(script, "Get-UnpublishedComponentIds")
     assert "function Get-UnpublishedComponentIds" in unpublished_fn
     assert "ConvertFrom-Json" in unpublished_fn
-    assert "PSObject.Properties.Count -eq 0" in unpublished_fn
+    # Force Properties through @(...) so Windows PowerShell 5.1 reports Count 0
+    # for empty "assets": {} maps (bare .Count is unreliable and dropped agent-notify).
+    assert "@($assets.PSObject.Properties).Count -eq 0" in unpublished_fn
+    assert "Write-Output -NoEnumerate" in unpublished_fn
     # The skip set is read from the bundled manifest on disk, not from the
     # component report, so an unsupported component with declared assets is
     # never treated as skippable.
@@ -550,8 +560,20 @@ def test_windows_native_acceptance_source_mode_skips_only_bundled_unpublished_co
     main = script[script.index("$acceptRoot = $null") :]
     source_block = main[main.index('if ($InstallMode -eq "source") {') : main.index("$report = Get-ComponentReport")]
     assert 'Join-Path $RepoRoot "src\\brigade\\templates\\components\\manifest-v1.json"' in source_block
-    assert "$unpublishedIds = Get-UnpublishedComponentIds -ManifestPath $bundledManifestPath" in source_block
-    assert "$unpublishedIds = @" in main
+    assert (
+        "[string[]]$unpublishedIds = @(Get-UnpublishedComponentIds -ManifestPath $bundledManifestPath)" in source_block
+    )
+    # Empty-asset omission applies to both setup requests: ids are computed
+    # before online and offline standalone setup, then reused for health/smoke.
+    assert source_block.index(
+        "[string[]]$unpublishedIds = @(Get-UnpublishedComponentIds -ManifestPath $bundledManifestPath)"
+    ) < source_block.index('Write-Step "brigade setup (online)"')
+    assert source_block.index('Write-Step "brigade setup (online)"') < source_block.index(
+        'Write-Step "brigade setup --offline"'
+    )
+    assert "& brigade setup --manifest-source standalone" in source_block
+    assert "& brigade setup --offline --manifest-source standalone" in source_block
+    assert "[string[]]$unpublishedIds = @()" in main
     assert "Assert-AllComponentsHealthy -Report $report -Skippable $unpublishedIds" in main
 
     healthy_fn = _extract_powershell_function(script, "Assert-AllComponentsHealthy")
@@ -573,6 +595,52 @@ def test_windows_native_acceptance_source_mode_skips_only_bundled_unpublished_co
     assert "& $agentNotifyExe version --json" in agent_block
 
 
+def test_windows_native_acceptance_source_setup_command_contract_omits_empty_asset_components():
+    """Source-mode setup must request only published components: both online and
+    offline use standalone manifest selection (which omits empty-asset entries
+    via published_component_ids) after deriving that same empty-asset set for
+    post-setup assertions. Nonempty published assets stay required."""
+    script = (ROOT / "scripts/windows-native-acceptance.ps1").read_text()
+    manifest = json.loads((ROOT / "src/brigade/templates/components/manifest-v1.json").read_text())
+    unpublished = [component_id for component_id, record in manifest["components"].items() if not record.get("assets")]
+    published = [component_id for component_id, record in manifest["components"].items() if record.get("assets")]
+    assert unpublished == ["agent-notify"]
+    assert "graphtrail" in published
+
+    main = script[script.index("$acceptRoot = $null") :]
+    source_block = main[main.index('if ($InstallMode -eq "source") {') : main.index("$report = Get-ComponentReport")]
+    online_cmd = "& brigade setup --manifest-source standalone"
+    offline_cmd = "& brigade setup --offline --manifest-source standalone"
+    assert source_block.count(online_cmd) == 1
+    assert source_block.count(offline_cmd) == 1
+    # No alternate manifest path or component-selection flag that could request
+    # unpublished agent-notify or hide a published component failure.
+    assert "--manifest " not in source_block
+    assert "Get-UnpublishedComponentIds" in source_block
+    assert "@($assets.PSObject.Properties).Count -eq 0" in _extract_powershell_function(
+        script, "Get-UnpublishedComponentIds"
+    )
+
+
+def test_windows_native_acceptance_pypi_setup_command_contract_is_strict():
+    """PyPI/released mode must issue bare setup online and offline (every
+    published component) and never populate the empty-asset skip set."""
+    script = (ROOT / "scripts/windows-native-acceptance.ps1").read_text()
+    main = script[script.index("$acceptRoot = $null") :]
+    setup = main[main.index("[string[]]$unpublishedIds = @()") : main.index("$report = Get-ComponentReport")]
+    published = re.search(r"else \{(?P<body>.*?)\n    \}", setup, re.DOTALL)
+    assert published is not None
+    body = published.group("body")
+    assert re.search(r"(?m)^        & brigade setup$", body)
+    assert re.search(r"(?m)^        & brigade setup --offline$", body)
+    assert "--manifest-source" not in body
+    assert "Get-UnpublishedComponentIds" not in body
+    # Default empty skip set is only replaced inside the source branch.
+    assert setup.index("[string[]]$unpublishedIds = @()") < setup.index('if ($InstallMode -eq "source") {')
+    source_block = setup[setup.index('if ($InstallMode -eq "source") {') : setup.index("else {")]
+    assert "Get-UnpublishedComponentIds" in source_block
+
+
 def test_windows_native_acceptance_pypi_mode_never_skips_agent_notify():
     """Published/release acceptance keeps the strict five-component contract:
     no skip set, agent-notify must install, digest-check, and smoke by absolute
@@ -581,9 +649,12 @@ def test_windows_native_acceptance_pypi_mode_never_skips_agent_notify():
     main = script[script.index("$acceptRoot = $null") :]
 
     # The skip set is only populated in source mode; pypi mode leaves it empty.
-    source_block = main[main.index('if ($InstallMode -eq "source") {') : main.index("$report = Get-ComponentReport")]
-    assert "$unpublishedIds = @()" in source_block
+    setup = main[main.index("[string[]]$unpublishedIds = @()") : main.index("$report = Get-ComponentReport")]
+    source_block = setup[setup.index('if ($InstallMode -eq "source") {') : setup.index("else {")]
+    pypi_block = setup[setup.index("else {") :]
+    assert "[string[]]$unpublishedIds = @()" in setup
     assert "Get-UnpublishedComponentIds" in source_block
+    assert "Get-UnpublishedComponentIds" not in pypi_block
 
     assert "Assert-ManagedComponentDigests -Manifest $releaseManifest -Report $report -ManagedBin $managedBin" in main
     digest_fn = _extract_powershell_function(script, "Assert-ManagedComponentDigests")
@@ -626,5 +697,7 @@ def test_windows_native_acceptance_pypi_mode_rejects_bare_agent_notify_metadata(
     # Source-mode skip behavior is preserved: the unpublished-ids derivation and
     # the required-ids gating are unchanged.
     source_block = main[main.index('if ($InstallMode -eq "source") {') : main.index("$report = Get-ComponentReport")]
-    assert "$unpublishedIds = Get-UnpublishedComponentIds -ManifestPath $bundledManifestPath" in source_block
+    assert (
+        "[string[]]$unpublishedIds = @(Get-UnpublishedComponentIds -ManifestPath $bundledManifestPath)" in source_block
+    )
     assert "Where-Object { $unpublishedIds -notcontains $_ }" in main