perf(test): avoid npm pack in plugin install e2e fixtures

src/plugins/install.e2e.test.ts

@@ -1,9 +1,9 @@
 import JSZip from "jszip";
-import { spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import * as tar from "tar";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import * as skillScanner from "../security/skill-scanner.js";
 
@@ -20,40 +20,7 @@ function makeTempDir() {
   return dir;
 }
 
-function resolveNpmCliJs() {
-  const fromEnv = process.env.npm_execpath;
-  if (fromEnv?.includes(`${path.sep}npm${path.sep}`) && fromEnv?.endsWith("npm-cli.js")) {
-    return fromEnv ?? null;
-  }
-
-  const fromNodeDir = path.join(
-    path.dirname(process.execPath),
-    "node_modules",
-    "npm",
-    "bin",
-    "npm-cli.js",
-  );
-  if (fs.existsSync(fromNodeDir)) {
-    return fromNodeDir;
-  }
-
-  const fromLibNodeModules = path.resolve(
-    path.dirname(process.execPath),
-    "..",
-    "lib",
-    "node_modules",
-    "npm",
-    "bin",
-    "npm-cli.js",
-  );
-  if (fs.existsSync(fromLibNodeModules)) {
-    return fromLibNodeModules;
-  }
-
-  return null;
-}
-
-function packToArchive({
+async function packToArchive({
   pkgDir,
   outDir,
   outName,
@@ -62,27 +29,16 @@ function packToArchive({
   outDir: string;
   outName: string;
 }) {
-  const npmCli = resolveNpmCliJs();
-  const cmd = npmCli ? process.execPath : "npm";
-  const args = npmCli
-    ? [npmCli, "pack", "--silent", "--pack-destination", outDir, pkgDir]
-    : ["pack", "--silent", "--pack-destination", outDir, pkgDir];
-
-  const res = spawnSync(cmd, args, { encoding: "utf-8" });
-  expect(res.status).toBe(0);
-  if (res.status !== 0) {
-    throw new Error(`npm pack failed: ${res.stderr || res.stdout || "<no output>"}`);
-  }
-
-  const packed = (res.stdout || "").trim().split(/\r?\n/).filter(Boolean).at(-1);
-  if (!packed) {
-    throw new Error(`npm pack did not output a filename: ${res.stdout || "<no stdout>"}`);
-  }
-
-  const src = path.join(outDir, packed);
   const dest = path.join(outDir, outName);
   fs.rmSync(dest, { force: true });
-  fs.renameSync(src, dest);
+  await tar.c(
+    {
+      gzip: true,
+      file: dest,
+      cwd: path.dirname(pkgDir),
+    },
+    [path.basename(pkgDir)],
+  );
   return dest;
 }
 
@@ -113,7 +69,7 @@ describe("installPluginFromArchive", () => {
     );
     fs.writeFileSync(path.join(pkgDir, "dist", "index.js"), "export {};", "utf-8");
 
-    const archivePath = packToArchive({
+    const archivePath = await packToArchive({
       pkgDir,
       outDir: workDir,
       outName: "plugin.tgz",
@@ -151,7 +107,7 @@ describe("installPluginFromArchive", () => {
     );
     fs.writeFileSync(path.join(pkgDir, "dist", "index.js"), "export {};", "utf-8");
 
-    const archivePath = packToArchive({
+    const archivePath = await packToArchive({
       pkgDir,
       outDir: workDir,
       outName: "plugin.tgz",
@@ -227,13 +183,13 @@ describe("installPluginFromArchive", () => {
     );
     fs.writeFileSync(path.join(pkgDir, "dist", "index.js"), "export {};", "utf-8");
 
-    const archiveV1 = packToArchive({
+    const archiveV1 = await packToArchive({
       pkgDir,
       outDir: workDir,
       outName: "plugin-v1.tgz",
     });
 
-    const archiveV2 = (() => {
+    const archiveV2 = await (async () => {
       fs.writeFileSync(
         path.join(pkgDir, "package.json"),
         JSON.stringify({
@@ -243,7 +199,7 @@ describe("installPluginFromArchive", () => {
         }),
         "utf-8",
       );
-      return packToArchive({
+      return await packToArchive({
         pkgDir,
         outDir: workDir,
         outName: "plugin-v2.tgz",
@@ -289,7 +245,7 @@ describe("installPluginFromArchive", () => {
     );
     fs.writeFileSync(path.join(pkgDir, "dist", "index.js"), "export {};", "utf-8");
 
-    const archivePath = packToArchive({
+    const archivePath = await packToArchive({
       pkgDir,
       outDir: workDir,
       outName: "traversal.tgz",
@@ -325,7 +281,7 @@ describe("installPluginFromArchive", () => {
     );
     fs.writeFileSync(path.join(pkgDir, "dist", "index.js"), "export {};", "utf-8");
 
-    const archivePath = packToArchive({
+    const archivePath = await packToArchive({
       pkgDir,
       outDir: workDir,
       outName: "reserved.tgz",
@@ -356,7 +312,7 @@ describe("installPluginFromArchive", () => {
       "utf-8",
     );
 
-    const archivePath = packToArchive({
+    const archivePath = await packToArchive({
       pkgDir,
       outDir: workDir,
       outName: "bad.tgz",