fix(e2e): honor the live_download exclusion; fix runtime plugin search path (#68)

Follow-up to #67. The e2e workflow has been red on `main` for weeks —
first at compile (`--warnings-as-errors`), which #67 fixed; with compile
green, the `runtime-api` job then failed on `{:error, {:no_plugin,
"zig"}}` from tests that were never meant to run there. Two pre-existing
defects, both fixed at source:

## 1. Tag taxonomy — download tests ran in PR CI despite the exclusion

The live-download tests carried **both** `@tag :external_api` and `@tag
:live_download`. ExUnit's `--include` re-includes tests dropped by
`--exclude`, so

```
mix test --include external_api --exclude live_download
```

ran the ~10–50MB download tests that `e2e.yml`'s own header reserves for
manual dispatch. They now carry only `:live_download` (run manually via
`--include live_download`), matching the taxonomy defined at the top of
the test file.

## 2. Plugin search path — `Manager.install` couldn't resolve plugins
from a checkout

`@plugin_search_dirs` was a **module attribute**, so
`:code.priv_dir(:opsm)` was frozen at *compile* time, pointing inside
whatever `_build` compiled the module — its own comment said "resolved
at runtime", an intent that never held. Result: `runtime/core/*.ncl`
plugins were unreachable from any repo checkout (this also breaks the
`opsm runtime install` dogfooding path that reads `opsm.toml
[runtime]`).

Search dirs are now computed per call, with repo-checkout fallbacks
(`cwd/../runtime/core` under mix, `cwd/runtime/core` as escript) and a
fail-safe guard on `:code.priv_dir/1`. `find_plugin_ncl/1` is `@doc
false` public with unit tests covering checkout resolution.

Also hardened: `System.cmd("nickel", …)` raises `ErlangError :enoent`
when nickel isn't installed — now returns `{:error,
{:nickel_not_installed, tool}}`.

## Verified (OTP 28.3.1 / Elixir 1.19.5)

- `mix compile --warnings-as-errors` — green
- `mix test test/opsm/runtime/manager_test.exs` — 17/17 (2 new
`find_plugin_ncl` tests)
- The exact `runtime-api` CI command — **9 tests, 0 failures, 6
excluded**, live against ziglang.org / go.dev / nodejs.org; both
previously-failing tests correctly excluded

Note: the branch was restarted from `main` after #67's squash-merge (the
old remote branch was auto-deleted on merge), so this PR contains only
the follow-up commit.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

opsm_ex/lib/opsm/runtime/manager.ex

@@ -292,31 +292,55 @@ defmodule Opsm.Runtime.Manager do
         nil ->
           {:error, {:no_plugin, tool}}
         path ->
-          case System.cmd("nickel", ["export", "--format", "json", path], stderr_to_stdout: true) do
-            {json_str, 0} ->
-              case Jason.decode(json_str) do
-                {:ok, plugin} ->
-                  # Cache for next time
-                  File.mkdir_p!(@plugins_dir)
-                  File.write!(cached, json_str)
-                  {:ok, plugin}
-                err -> {:error, {:json_decode, err}}
+          # System.cmd/3 raises ErlangError (:enoent) when the nickel binary
+          # is not installed — surface that as a structured error instead.
+          try do
+            case System.cmd("nickel", ["export", "--format", "json", path], stderr_to_stdout: true) do
+              {json_str, 0} ->
+                case Jason.decode(json_str) do
+                  {:ok, plugin} ->
+                    # Cache for next time
+                    File.mkdir_p!(@plugins_dir)
+                    File.write!(cached, json_str)
+                    {:ok, plugin}
+                  err -> {:error, {:json_decode, err}}
+                end
+              {err_str, _} ->
+                {:error, {:nickel_eval, err_str}}
+            end
+          rescue
+            e in ErlangError ->
+              case e do
+                %ErlangError{original: :enoent} -> {:error, {:nickel_not_installed, tool}}
+                _ -> reraise e, __STACKTRACE__
               end
-            {err_str, _} ->
-              {:error, {:nickel_eval, err_str}}
           end
       end
     end
   end
 
-  @plugin_search_dirs [
-    # Relative to the OPSM install — resolved at runtime
-    Path.expand("../runtime/core", :code.priv_dir(:opsm)),
-    Path.expand("~/.opsm/plugins/core"),
-  ]
+  # Computed at call time, NOT a module attribute: an attribute freezes
+  # :code.priv_dir/1 at compile time (pointing inside whatever _build the
+  # module was compiled in), and the repo-checkout fallbacks depend on cwd.
+  defp plugin_search_dirs do
+    priv_relative =
+      case :code.priv_dir(:opsm) do
+        {:error, _} -> []
+        priv -> [Path.expand("../runtime/core", priv)]
+      end
+
+    priv_relative ++
+      [
+        Path.expand("~/.opsm/plugins/core"),
+        # Repo checkout: cwd is opsm_ex/ under mix, the repo root as escript
+        Path.expand("../runtime/core", File.cwd!()),
+        Path.expand("runtime/core", File.cwd!())
+      ]
+  end
 
-  defp find_plugin_ncl(tool) do
-    Enum.find_value(@plugin_search_dirs, fn dir ->
+  @doc false
+  def find_plugin_ncl(tool) do
+    Enum.find_value(plugin_search_dirs(), fn dir ->
       path = Path.join(dir, "#{tool}.ncl")
       if File.exists?(path), do: path
     end)

opsm_ex/test/opsm/runtime/integration_test.exs

@@ -140,7 +140,6 @@ defmodule Opsm.Runtime.IntegrationTest do
   # ---------------------------------------------------------------------------
 
   describe "Manager.install/2 — live download (zig 0.13.0)" do
-    @tag :external_api
     @tag :live_download
     test "installs zig 0.13.0 and creates expected directory layout" do
       install_result = Manager.install("zig", @zig_stable)
@@ -158,7 +157,6 @@ defmodule Opsm.Runtime.IntegrationTest do
       assert File.dir?(install_dir), "expected install_dir #{install_dir} to exist"
     end
 
-    @tag :external_api
     @tag :live_download
     test "which/1 returns a path after successful install" do
       Manager.install("zig", @zig_stable)
@@ -175,7 +173,6 @@ defmodule Opsm.Runtime.IntegrationTest do
       end
     end
 
-    @tag :external_api
     @tag :live_download
     test "current_version/1 returns the installed version after install" do
       Manager.install("zig", @zig_stable)
@@ -185,7 +182,6 @@ defmodule Opsm.Runtime.IntegrationTest do
       assert version == @zig_stable or version == "none"
     end
 
-    @tag :external_api
     @tag :live_download
     test "remove/1 cleans up installed tool" do
       Manager.install("zig", @zig_stable)
@@ -202,7 +198,6 @@ defmodule Opsm.Runtime.IntegrationTest do
   # ---------------------------------------------------------------------------
 
   describe "Manager.install/2 — idempotency" do
-    @tag :external_api
     @tag :live_download
     test "installing the same version twice returns :ok both times" do
       on_exit(fn -> Manager.remove("zig") end)
@@ -229,7 +224,6 @@ defmodule Opsm.Runtime.IntegrationTest do
       {:ok, dir: dir}
     end
 
-    @tag :external_api
     @tag :live_download
     test "installs tools declared in [runtime] section", %{dir: dir} do
       manifest = Path.join(dir, "opsm.toml")

opsm_ex/test/opsm/runtime/manager_test.exs

@@ -105,6 +105,24 @@ defmodule Opsm.Runtime.ManagerTest do
     end
   end
 
+  # ---------------------------------------------------------------------------
+  # find_plugin_ncl/1 — plugin search path resolution
+  # ---------------------------------------------------------------------------
+
+  describe "find_plugin_ncl/1" do
+    test "resolves a core plugin from the repo checkout (runtime/core)" do
+      # Under mix, cwd is opsm_ex/ — the sibling runtime/core/ dir must be
+      # searched at call time (a compile-time priv_dir attribute cannot see it)
+      path = Manager.find_plugin_ncl("zig")
+      assert is_binary(path), "expected zig.ncl to resolve from the repo checkout"
+      assert String.ends_with?(path, "/zig.ncl")
+    end
+
+    test "returns nil for a tool with no plugin definition" do
+      assert Manager.find_plugin_ncl("definitely-not-a-real-tool-xyz") == nil
+    end
+  end
+
   # ---------------------------------------------------------------------------
   # list_installed/0 — filesystem scan
   # ---------------------------------------------------------------------------