@humanbased/crosscheck 1.2.0 → 1.3.0-beta.100

package/dist/__tests__/skill-broker.test.js

@@ -0,0 +1,186 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { callSkillBrokerTool, claudeSkillBrokerArgs, codexSkillBrokerArgs, codexSkillsReachable, createSkillActivationSession, handleSkillBrokerRequest, renderSkillBrokerInstructions, skillBrokerCommand, } from '../skills/broker.js';
+import { loadBundledSkills } from '../skills/catalog.js';
+import { execa } from 'execa';
+let session;
+afterEach(() => {
+    session?.close();
+    session = undefined;
+});
+describe('skill activation broker', () => {
+    it('exposes enabled metadata without loading skill instructions', () => {
+        session = createSkillActivationSession('fix', ['code-review-skill'], loadBundledSkills());
+        expect(session.enabledSkills).toEqual([
+            expect.objectContaining({
+                name: 'code-review-skill',
+                author: 'awesome-skills',
+                license: 'MIT',
+            }),
+        ]);
+        expect(session.enabledSkills[0]).not.toHaveProperty('path');
+        expect(session.activations()).toEqual([]);
+    });
+    it('asks for the listing as an obligatory first step, naming the step type', () => {
+        session = createSkillActivationSession('review', ['code-review-skill'], loadBundledSkills());
+        const instructions = renderSkillBrokerInstructions(session);
+        expect(instructions).toContain('do this first');
+        expect(instructions).toContain('Call `list_enabled_skills`');
+        expect(instructions).toContain('this review step');
+        // The catalog's descriptions are phrased for interactive use; without this
+        // the agent measures them against a user request that never arrives.
+        expect(instructions).toContain('when the user wants X');
+        // SKILL.md links to sibling files that no granted tool can open.
+        expect(instructions).toContain('`read_skill_file`');
+        expect(instructions).toContain('- code-review-skill:');
+    });
+    it('renders nothing when no skill is enabled for the step', () => {
+        session = createSkillActivationSession('review', [], loadBundledSkills());
+        expect(renderSkillBrokerInstructions(session)).toBe('');
+    });
+    it('loads and records a skill only when the agent activates it', () => {
+        session = createSkillActivationSession('review', ['code-review-skill'], loadBundledSkills());
+        const result = callSkillBrokerTool(session.path, 'activate_skill', { name: 'code-review-skill' });
+        expect(result.isError).toBeUndefined();
+        expect(result.content[0].text).toContain('# Code Review Skill');
+        expect(session.activations()).toEqual([
+            expect.objectContaining({ name: 'code-review-skill', author: 'awesome-skills', license: 'MIT' }),
+        ]);
+    });
+    it('keeps activation idempotent and rejects disabled skills', () => {
+        session = createSkillActivationSession('recheck', ['code-review-skill'], loadBundledSkills());
+        callSkillBrokerTool(session.path, 'activate_skill', { name: 'code-review-skill' });
+        callSkillBrokerTool(session.path, 'activate_skill', { name: 'code-review-skill' });
+        expect(session.activations()).toHaveLength(1);
+        expect(callSkillBrokerTool(session.path, 'activate_skill', { name: 'missing' }).isError).toBe(true);
+    });
+    it('ignores attacker-created state files', () => {
+        session = createSkillActivationSession('review', ['code-review-skill'], loadBundledSkills());
+        const attackerDir = mkdtempSync(join(tmpdir(), 'crosscheck-forged-session-'));
+        const attackerPath = join(attackerDir, 'session.json');
+        writeFileSync(attackerPath, JSON.stringify({ enabled: loadBundledSkills(), activated: ['code-review-skill'] }));
+        expect(() => callSkillBrokerTool(attackerPath, 'list_enabled_skills', {})).toThrow('not found');
+        expect(session.activations()).toEqual([]);
+        rmSync(attackerDir, { recursive: true, force: true });
+    });
+    it('rejects activation of a competing review baseline', () => {
+        session = createSkillActivationSession('review', ['code-review', 'code-review-skill'], loadBundledSkills());
+        callSkillBrokerTool(session.path, 'activate_skill', { name: 'code-review-skill' });
+        const result = callSkillBrokerTool(session.path, 'activate_skill', { name: 'code-review' });
+        expect(result.isError).toBe(true);
+        expect(result.content[0].text).toContain('competes with activated code-review-skill');
+        expect(session.activations().map(skill => skill.name)).toEqual(['code-review-skill']);
+    });
+    it('allows activated references but blocks path traversal', () => {
+        session = createSkillActivationSession('review', ['code-review-skill'], loadBundledSkills());
+        callSkillBrokerTool(session.path, 'activate_skill', { name: 'code-review-skill' });
+        const reference = callSkillBrokerTool(session.path, 'read_skill_file', {
+            name: 'code-review-skill',
+            path: 'reference/typescript.md',
+        });
+        expect(reference.content[0].text).toContain('TypeScript');
+        expect(callSkillBrokerTool(session.path, 'read_skill_file', {
+            name: 'code-review-skill',
+            path: '../LICENSE',
+        }).isError).toBe(true);
+    });
+    it('speaks the MCP initialize and tools/list protocol', () => {
+        session = createSkillActivationSession('review', ['code-review-skill'], loadBundledSkills());
+        expect(handleSkillBrokerRequest(session.path, {
+            jsonrpc: '2.0', id: 1, method: 'initialize', params: {},
+        })).toMatchObject({ jsonrpc: '2.0', id: 1, result: { capabilities: { tools: {} } } });
+        expect(handleSkillBrokerRequest(session.path, {
+            jsonrpc: '2.0', id: 2, method: 'tools/list', params: {},
+        })).toMatchObject({
+            jsonrpc: '2.0',
+            id: 2,
+            result: {
+                tools: expect.arrayContaining([
+                    expect.objectContaining({
+                        name: 'activate_skill',
+                        annotations: {
+                            readOnlyHint: true,
+                            destructiveHint: false,
+                            idempotentHint: true,
+                            openWorldHint: false,
+                        },
+                    }),
+                ]),
+            },
+        });
+    });
+    it('serves newline-delimited MCP over stdio', async () => {
+        session = createSkillActivationSession('review', ['code-review-skill'], loadBundledSkills());
+        const broker = skillBrokerCommand(session);
+        const requests = [
+            { jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2024-11-05' } },
+            { jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} },
+        ].map(request => JSON.stringify(request)).join('\n') + '\n';
+        const { stdout } = await execa(broker.command, broker.args, { input: requests });
+        const responses = stdout.split('\n').map(line => JSON.parse(line));
+        expect(responses).toHaveLength(2);
+        expect(responses[1]).toMatchObject({ id: 2, result: { tools: expect.any(Array) } });
+    });
+    it('builds session-scoped Claude and Codex MCP arguments', () => {
+        session = createSkillActivationSession('fix', ['code-review-skill'], loadBundledSkills());
+        expect(claudeSkillBrokerArgs(session)).toEqual([
+            '--mcp-config', expect.stringContaining('crosscheck'),
+        ]);
+        expect(codexSkillBrokerArgs(session, true)).toEqual([
+            '-c', expect.stringContaining('mcp_servers.crosscheck.command='),
+            '-c', expect.stringContaining('mcp_servers.crosscheck.args='),
+            '-c', 'sandbox_mode="danger-full-access"',
+        ]);
+    });
+    // Codex registers the MCP server and lists its tools under any sandbox, then
+    // cancels every tools/call ("user cancelled MCP tool call") unless the sandbox
+    // is danger-full-access. Measured against codex-cli 0.147: -a never,
+    // --full-auto, -s read-only, -s workspace-write, approval_policy="never" and
+    // per-tool approval_mode all leave the call cancelled. Without this arg the
+    // broker is reachable but unusable — which is why codex logged 0 skill
+    // activations across 244 production runs while claude logged 131.
+    it('widens the codex sandbox so broker tool calls are not cancelled', () => {
+        session = createSkillActivationSession('review', ['code-review-skill'], loadBundledSkills());
+        expect(codexSkillBrokerArgs(session, true)).toContain('sandbox_mode="danger-full-access"');
+    });
+    // The override is the price of reaching the broker, so it is scoped to exactly
+    // that: no skills, no widened sandbox.
+    it('does not widen the sandbox when there is no session', () => {
+        expect(codexSkillBrokerArgs(undefined, true)).toEqual([]);
+    });
+    // Reviews read untrusted PR content, and reaching the broker costs the codex
+    // sandbox, so the operator has to say yes to that trade — onboarding does not
+    // say it for them. Six BLOCK reviews on #298 landed on this point.
+    it('registers nothing when the operator has not opted into full access', () => {
+        session = createSkillActivationSession('review', ['code-review-skill'], loadBundledSkills());
+        expect(codexSkillBrokerArgs(session, false)).toEqual([]);
+    });
+    // The broker registration and the sandbox override travel together: half of
+    // this pair is the 0-activations bug (broker present, every call cancelled) and
+    // the other half is an unsandboxed run with nothing to show for it.
+    it('never registers the broker without the sandbox override, or vice versa', () => {
+        session = createSkillActivationSession('review', ['code-review-skill'], loadBundledSkills());
+        for (const allowed of [true, false]) {
+            const args = codexSkillBrokerArgs(session, allowed);
+            const hasBroker = args.some(a => a.includes('mcp_servers.crosscheck.command='));
+            const hasSandbox = args.includes('sandbox_mode="danger-full-access"');
+            expect(hasBroker).toBe(hasSandbox);
+        }
+    });
+    it('codexSkillsReachable gates on both a session and the opt-in', () => {
+        session = createSkillActivationSession('review', ['code-review-skill'], loadBundledSkills());
+        expect(codexSkillsReachable(session, true)).toBe(true);
+        expect(codexSkillsReachable(session, false)).toBe(false);
+        expect(codexSkillsReachable(undefined, true)).toBe(false);
+    });
+    it('removes the session endpoint on close', () => {
+        session = createSkillActivationSession('review', [], loadBundledSkills());
+        const path = session.path;
+        session.close();
+        session = undefined;
+        expect(existsSync(path)).toBe(false);
+    });
+});
+//# sourceMappingURL=skill-broker.test.js.map

package/dist/__tests__/skill-broker.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-broker.test.js","sourceRoot":"","sources":["../../src/__tests__/skill-broker.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,EAC7B,kBAAkB,GAEnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAE7B,IAAI,OAA2C,CAAA;AAE/C,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,GAAG,SAAS,CAAA;AACrB,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,OAAO,GAAG,4BAA4B,CAAC,KAAK,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAEzF,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC;YACpC,MAAM,CAAC,gBAAgB,CAAC;gBACtB,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,gBAAgB;gBACxB,OAAO,EAAE,KAAK;aACf,CAAC;SACH,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC3D,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAE5F,MAAM,YAAY,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAA;QAE3D,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;QAC/C,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAA;QAC5D,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;QAClD,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;QACvD,iEAAiE;QACjE,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;QACnD,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAEzE,MAAM,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAE5F,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAA;QAEjG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAA;QAC/D,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;YACpC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;SACjG,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,OAAO,GAAG,4BAA4B,CAAC,SAAS,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC7F,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAA;QAClF,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAA;QAElF,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7C,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC5F,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAC7E,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;QACtD,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAA;QAE/G,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC/F,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACzC,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,OAAO,GAAG,4BAA4B,CACpC,QAAQ,EACR,CAAC,aAAa,EAAE,mBAAmB,CAAC,EACpC,iBAAiB,EAAE,CACpB,CAAA;QACD,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAA;QAElF,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;QAE3F,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAA;QACrF,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC5F,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAA;QAElF,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE;YACrE,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,yBAAyB;SAChC,CAAC,CAAA;QACF,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACzD,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE;YAC1D,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAE5F,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,EAAE;YAC5C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE;SACxD,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACrF,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,EAAE;YAC5C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE;SACxD,CAAC,CAAC,CAAC,aAAa,CAAC;YAChB,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,CAAC;YACL,MAAM,EAAE;gBACN,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC;oBAC5B,MAAM,CAAC,gBAAgB,CAAC;wBACtB,IAAI,EAAE,gBAAgB;wBACtB,WAAW,EAAE;4BACX,YAAY,EAAE,IAAI;4BAClB,eAAe,EAAE,KAAK;4BACtB,cAAc,EAAE,IAAI;4BACpB,aAAa,EAAE,KAAK;yBACrB;qBACF,CAAC;iBACH,CAAC;aACH;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC5F,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAG;YACf,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,EAAE;YAC1F,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE;SAC5D,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;QAE3D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QAChF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC,CAAA;QAE7F,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,OAAO,GAAG,4BAA4B,CAAC,KAAK,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAEzF,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC;SACtD,CAAC,CAAA;QACF,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAClD,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,iCAAiC,CAAC;YAChE,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;YAC7D,IAAI,EAAE,mCAAmC;SAC1C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,+EAA+E;IAC/E,qEAAqE;IACrE,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,kEAAkE;IAClE,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,uCAAuC;IACvC,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,mEAAmE;IACnE,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,gFAAgF;IAChF,oEAAoE;IACpE,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC5F,KAAK,MAAM,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACnD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC,CAAA;YAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAA;YACrE,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtD,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxD,MAAM,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,OAAO,GAAG,4BAA4B,CAAC,QAAQ,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACzE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACzB,OAAO,CAAC,KAAK,EAAE,CAAA;QACf,OAAO,GAAG,SAAS,CAAA;QAEnB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/skill-catalog.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skill-catalog.test.d.ts.map

package/dist/__tests__/skill-catalog.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-catalog.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/skill-catalog.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/skill-catalog.test.js

@@ -0,0 +1,40 @@
+import { describe, expect, it } from 'vitest';
+import { BUNDLED_SKILL_RECOMMENDATIONS, findCompetingSkill, formatSkillIdentity, loadBundledSkills, RECOMMENDED_SKILL_NAMES, } from '../skills/catalog.js';
+describe('bundled skill catalog', () => {
+    it('loads the pinned recommended code-review skill with attribution', () => {
+        const skill = loadBundledSkills().find(candidate => candidate.name === 'code-review-skill');
+        expect(skill).toMatchObject({
+            name: 'code-review-skill',
+            author: 'awesome-skills',
+            license: 'MIT',
+            source: 'https://github.com/awesome-skills/code-review-skill',
+        });
+        expect(skill?.description).not.toBe('');
+        expect(skill?.revision).toMatch(/^[0-9a-f]{40}$/);
+        expect(skill?.integrity).toMatch(/^sha256:[0-9a-f]{64}$/);
+        expect(formatSkillIdentity(skill)).toBe('code-review-skill (by @awesome-skills, MIT)');
+    });
+    it('ships Matt Pocock engineering skills with attribution', () => {
+        const skills = loadBundledSkills();
+        expect(skills.filter(skill => skill.author === 'mattpocock').map(skill => skill.name)).toEqual([
+            'code-review',
+            'codebase-design',
+            'diagnosing-bugs',
+        ]);
+        expect(skills.filter(skill => skill.author === 'mattpocock').every(skill => (skill.license === 'MIT'
+            && skill.source === 'https://github.com/mattpocock/skills'
+            && /^[0-9a-f]{40}$/.test(skill.revision)
+            && /^sha256:[0-9a-f]{64}$/.test(skill.integrity)))).toBe(true);
+    });
+    it('preselects the general review, design, and debugging bundle during onboarding', () => {
+        expect(RECOMMENDED_SKILL_NAMES).toEqual(['code-review-skill', 'codebase-design', 'diagnosing-bugs']);
+        expect(RECOMMENDED_SKILL_NAMES).not.toContain('code-review');
+    });
+    it('recommends every bundled skill and identifies competing review baselines', () => {
+        expect(Object.keys(BUNDLED_SKILL_RECOMMENDATIONS).sort()).toEqual(loadBundledSkills().map(skill => skill.name));
+        expect(findCompetingSkill('code-review', ['code-review-skill'])).toBe('code-review-skill');
+        expect(findCompetingSkill('code-review-skill', ['code-review'])).toBe('code-review');
+        expect(findCompetingSkill('diagnosing-bugs', ['code-review'])).toBeUndefined();
+    });
+});
+//# sourceMappingURL=skill-catalog.test.js.map

package/dist/__tests__/skill-catalog.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-catalog.test.js","sourceRoot":"","sources":["../../src/__tests__/skill-catalog.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAE7B,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAA;QAE3F,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;YAC1B,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qDAAqD;SAC9D,CAAC,CAAA;QACF,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;QACzD,MAAM,CAAC,mBAAmB,CAAC,KAAM,CAAC,CAAC,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;QAElC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7F,aAAa;YACb,iBAAiB;YACjB,iBAAiB;SAClB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAC1E,KAAK,CAAC,OAAO,KAAK,KAAK;eACpB,KAAK,CAAC,MAAM,KAAK,sCAAsC;eACvD,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;eACrC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CACjD,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAA;QACpG,MAAM,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAC/D,iBAAiB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC7C,CAAA;QACD,MAAM,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC1F,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACpF,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IAChF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/skill-installer.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skill-installer.test.d.ts.map

package/dist/__tests__/skill-installer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installer.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/skill-installer.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/skill-installer.test.js

@@ -0,0 +1,96 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { execFileSync } from 'child_process';
+import { pathToFileURL } from 'url';
+import { installSkill, redactSkillSource, SkillInstallError } from '../skills/installer.js';
+import { loadInstalledSkills } from '../skills/catalog.js';
+let tempDir;
+let sourceDir;
+let installDir;
+beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), 'crosscheck-skill-install-'));
+    sourceDir = join(tempDir, 'source');
+    installDir = join(tempDir, 'installed');
+    mkdirSync(sourceDir);
+    writeFileSync(join(sourceDir, 'SKILL.md'), `---
+name: test-skill
+description: Test guidance
+author: acme
+---
+
+# Test skill
+`);
+    writeFileSync(join(sourceDir, 'LICENSE'), 'MIT License\n\nCopyright (c) 2026 Acme\n');
+});
+afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+});
+describe('installSkill', () => {
+    it('installs a local skill with a provenance and integrity receipt', async () => {
+        const skill = await installSkill(sourceDir, { installDir });
+        const receipt = JSON.parse(readFileSync(join(installDir, 'test-skill', '.crosscheck-skill.json'), 'utf8'));
+        expect(skill).toMatchObject({ name: 'test-skill', author: 'acme', license: 'MIT' });
+        expect(receipt).toMatchObject({
+            schemaVersion: 1,
+            name: 'test-skill',
+            author: 'acme',
+            license: 'MIT',
+            source: sourceDir,
+            revision: 'local',
+        });
+        expect(receipt.integrity).toMatch(/^sha256:[0-9a-f]{64}$/);
+        expect(loadInstalledSkills(installDir)).toHaveLength(1);
+    });
+    it('does not overwrite an installed skill', async () => {
+        await installSkill(sourceDir, { installDir });
+        await expect(installSkill(sourceDir, { installDir })).rejects.toThrow('already installed');
+    });
+    it('records the commit when installing from a Git source', async () => {
+        execFileSync('git', ['init'], { cwd: sourceDir });
+        execFileSync('git', ['config', 'user.email', 'test@example.com'], { cwd: sourceDir });
+        execFileSync('git', ['config', 'user.name', 'Test'], { cwd: sourceDir });
+        execFileSync('git', ['add', '.'], { cwd: sourceDir });
+        execFileSync('git', ['commit', '-m', 'test skill'], { cwd: sourceDir });
+        const skill = await installSkill(pathToFileURL(sourceDir).href, { installDir });
+        expect(skill.revision).toMatch(/^[0-9a-f]{40}$/);
+    });
+    it('rejects unsafe skill names', async () => {
+        writeFileSync(join(sourceDir, 'SKILL.md'), '---\nname: ../escape\ndescription: nope\n---\n');
+        await expect(installSkill(sourceDir, { installDir })).rejects.toThrow('Invalid skill name');
+        expect(existsSync(join(tempDir, 'escape'))).toBe(false);
+    });
+    it('rejects names that collide with bundled skills', async () => {
+        writeFileSync(join(sourceDir, 'SKILL.md'), '---\nname: code-review-skill\ndescription: Imposter guidance\n---\n');
+        await expect(installSkill(sourceDir, { installDir })).rejects.toThrow('already bundled with Crosscheck');
+    });
+    it('classifies malformed YAML frontmatter as an install error', async () => {
+        writeFileSync(join(sourceDir, 'SKILL.md'), '---\nname: [unterminated\n---\n');
+        const error = await installSkill(sourceDir, { installDir }).catch((err) => err);
+        expect(error).toBeInstanceOf(SkillInstallError);
+        expect(error).toHaveProperty('message', expect.stringContaining('Invalid SKILL.md frontmatter'));
+    });
+    it('removes Git credentials from persisted provenance', () => {
+        expect(redactSkillSource('https://user:secret-token@github.com/acme/private-skill.git?token=query-secret#fragment-secret'))
+            .toBe('https://github.com/acme/private-skill.git');
+    });
+    it('rejects symbolic links in a package', async () => {
+        symlinkSync(join(sourceDir, 'LICENSE'), join(sourceDir, 'linked-license'));
+        await expect(installSkill(sourceDir, { installDir })).rejects.toThrow('symbolic links');
+    });
+    it('does not load an installed skill after its contents are modified', async () => {
+        await installSkill(sourceDir, { installDir });
+        writeFileSync(join(installDir, 'test-skill', 'SKILL.md'), '\nTampered\n', { flag: 'a' });
+        expect(loadInstalledSkills(installDir)).toEqual([]);
+    });
+    it('rejects oversized skill packages', async () => {
+        writeFileSync(join(sourceDir, 'large.bin'), Buffer.alloc(10 * 1024 * 1024 + 1));
+        await expect(installSkill(sourceDir, { installDir })).rejects.toThrow('cannot exceed 10 MiB');
+    });
+    it('rejects attribution fields that could inject terminal or Markdown output', async () => {
+        writeFileSync(join(sourceDir, 'SKILL.md'), '---\nname: test-skill\ndescription: Test guidance\nauthor: "acme\\nspoof"\n---\n');
+        await expect(installSkill(sourceDir, { installDir })).rejects.toThrow('Invalid skill author');
+    });
+});
+//# sourceMappingURL=skill-installer.test.js.map

package/dist/__tests__/skill-installer.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installer.test.js","sourceRoot":"","sources":["../../src/__tests__/skill-installer.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AACzG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,IAAI,OAAe,CAAA;AACnB,IAAI,SAAiB,CAAA;AACrB,IAAI,UAAkB,CAAA;AAEtB,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAA;IAClE,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACnC,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACvC,SAAS,CAAC,SAAS,CAAC,CAAA;IACpB,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;;;;;;;CAO5C,CAAC,CAAA;IACA,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,0CAA0C,CAAC,CAAA;AACvF,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACnD,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,wBAAwB,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAA;QAErI,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QACnF,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;YAC5B,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;QAC1D,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;QAC7C,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;QACjD,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;QACrF,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;QACxE,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;QACrD,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;QAEvE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;QAE/E,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,gDAAgD,CAAC,CAAA;QAC5F,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QAC3F,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,qEAAqE,CAAC,CAAA;QAEjH,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC1G,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,iCAAiC,CAAC,CAAA;QAE7E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;QACxF,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAA;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,CAAC,CAAA;IAClG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,iBAAiB,CAAC,gGAAgG,CAAC,CAAC;aACxH,IAAI,CAAC,2CAA2C,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAA;QAC1E,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;QAC7C,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;QAExF,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;QAE/E,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,kFAAkF,CAAC,CAAA;QAE9H,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/skills-config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skills-config.test.d.ts.map

package/dist/__tests__/skills-config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-config.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/skills-config.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/skills-config.test.js

@@ -0,0 +1,12 @@
+import { describe, expect, it } from 'vitest';
+import { ConfigSchema } from '../config/schema.js';
+describe('skills config', () => {
+    it('keeps existing configs unchanged by default', () => {
+        expect(ConfigSchema.parse({}).skills.enabled).toEqual([]);
+    });
+    it('accepts enabled skill names', () => {
+        expect(ConfigSchema.parse({ skills: { enabled: ['code-review-skill'] } }).skills.enabled)
+            .toEqual(['code-review-skill']);
+    });
+});
+//# sourceMappingURL=skills-config.test.js.map

package/dist/__tests__/skills-config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-config.test.js","sourceRoot":"","sources":["../../src/__tests__/skills-config.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAElD,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;aACtF,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/superseded-fix-pr.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=superseded-fix-pr.test.d.ts.map

package/dist/__tests__/superseded-fix-pr.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"superseded-fix-pr.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/superseded-fix-pr.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/superseded-fix-pr.test.js

@@ -0,0 +1,225 @@
+import { describe, it, expect, vi } from 'vitest';
+import { autoFixBranchName, autoFixPRIntro, isCrosscheckAutoFixPR, buildSupersededComment, closeSupersededAutoFixPRs, sourcePRHasMerged, } from '../github/superseded-fix-pr.js';
+const OWNER = 'humanbased-ai';
+const REPO = 'monorepo';
+// The pair from the reported regression: #2527 merged as 8ae3dc694, and the auto-fix
+// PR #2532 cut from its pre-fix state stayed open and mergeable.
+const SOURCE_PR = 2527;
+const FIX_PR = 2532;
+const MERGE_SHA = '8ae3dc694b1f2a3c5d7e9f0a1b2c3d4e5f60718a';
+function makeOctokit(options = {}) {
+    const list = vi.fn(async () => {
+        if (options.listError)
+            throw options.listError;
+        return { data: options.open ?? [] };
+    });
+    const createComment = vi.fn(async () => {
+        if (options.commentError)
+            throw options.commentError;
+        return { data: { id: 1 } };
+    });
+    const update = vi.fn(async () => {
+        if (options.updateError)
+            throw options.updateError;
+        return { data: {} };
+    });
+    return {
+        octokit: {
+            rest: { pulls: { list, update }, issues: { createComment } },
+        },
+        list,
+        createComment,
+        update,
+    };
+}
+function autoFixPR(number = FIX_PR, sourcePrNumber = SOURCE_PR) {
+    return {
+        number,
+        body: [
+            autoFixPRIntro(sourcePrNumber),
+            '',
+            `Review: https://github.com/${OWNER}/${REPO}/pull/${sourcePrNumber}`,
+        ].join('\n'),
+    };
+}
+describe('autoFixBranchName', () => {
+    it('matches the branch the fix step pushes', () => {
+        expect(autoFixBranchName(SOURCE_PR)).toBe('fix/cr-2527-review-issues');
+    });
+});
+describe('isCrosscheckAutoFixPR', () => {
+    it('recognises the body the fix step writes', () => {
+        expect(isCrosscheckAutoFixPR(autoFixPR().body, SOURCE_PR)).toBe(true);
+    });
+    it('rejects a body naming a different source PR', () => {
+        expect(isCrosscheckAutoFixPR(autoFixPR(FIX_PR, 2444).body, SOURCE_PR)).toBe(false);
+    });
+    it('rejects a hand-written PR that only shares the branch name', () => {
+        expect(isCrosscheckAutoFixPR('Picking up the review findings from #2527 by hand.', SOURCE_PR)).toBe(false);
+    });
+    it('rejects an empty body', () => {
+        expect(isCrosscheckAutoFixPR(null, SOURCE_PR)).toBe(false);
+    });
+});
+describe('buildSupersededComment', () => {
+    it('names the merged source PR and links the merge commit', () => {
+        const body = buildSupersededComment({ owner: OWNER, repo: REPO, sourcePrNumber: SOURCE_PR, mergeCommitSha: MERGE_SHA });
+        expect(body).toContain('Superseded');
+        expect(body).toContain(`#${SOURCE_PR} merged`);
+        expect(body).toContain(`https://github.com/${OWNER}/${REPO}/commit/${MERGE_SHA}`);
+    });
+    it('omits the merge link when the merge commit is unknown', () => {
+        const body = buildSupersededComment({ owner: OWNER, repo: REPO, sourcePrNumber: SOURCE_PR, mergeCommitSha: null });
+        expect(body).toContain(`#${SOURCE_PR} merged,`);
+        expect(body).not.toContain('/commit/');
+    });
+});
+describe('closeSupersededAutoFixPRs', () => {
+    it('comments then closes the auto-fix PR cut from the merged PR', async () => {
+        const { octokit, list, createComment, update } = makeOctokit({ open: [autoFixPR()] });
+        const outcomes = await closeSupersededAutoFixPRs(octokit, OWNER, REPO, SOURCE_PR, MERGE_SHA);
+        expect(outcomes).toEqual([{ prNumber: FIX_PR, status: 'closed' }]);
+        expect(list).toHaveBeenCalledWith({
+            owner: OWNER, repo: REPO, state: 'open', head: `${OWNER}:fix/cr-2527-review-issues`,
+        });
+        expect(createComment).toHaveBeenCalledWith(expect.objectContaining({
+            issue_number: FIX_PR,
+            body: expect.stringContaining('Superseded'),
+        }));
+        expect(update).toHaveBeenCalledWith({ owner: OWNER, repo: REPO, pull_number: FIX_PR, state: 'closed' });
+        // The reason must land before the PR closes, or a reader sees a bare closed PR.
+        expect(createComment.mock.invocationCallOrder[0]).toBeLessThan(update.mock.invocationCallOrder[0]);
+    });
+    it('returns no outcomes when the merged PR had no auto-fix PR', async () => {
+        const { octokit, update } = makeOctokit({ open: [] });
+        const outcomes = await closeSupersededAutoFixPRs(octokit, OWNER, REPO, SOURCE_PR, MERGE_SHA);
+        expect(outcomes).toEqual([]);
+        expect(update).not.toHaveBeenCalled();
+    });
+    it('leaves a PR crosscheck did not author open', async () => {
+        const { octokit, createComment, update } = makeOctokit({
+            open: [{ number: 2540, body: 'Manual follow-up on the same branch name.' }],
+        });
+        const outcomes = await closeSupersededAutoFixPRs(octokit, OWNER, REPO, SOURCE_PR, MERGE_SHA);
+        expect(outcomes).toEqual([{ prNumber: 2540, status: 'not_crosscheck' }]);
+        expect(createComment).not.toHaveBeenCalled();
+        expect(update).not.toHaveBeenCalled();
+    });
+    it('reports a close failure instead of throwing', async () => {
+        const { octokit } = makeOctokit({ open: [autoFixPR()], updateError: new Error('Resource not accessible by integration') });
+        const outcomes = await closeSupersededAutoFixPRs(octokit, OWNER, REPO, SOURCE_PR, MERGE_SHA);
+        expect(outcomes).toEqual([
+            { prNumber: FIX_PR, status: 'failed', reason: 'Resource not accessible by integration' },
+        ]);
+    });
+    it('does not close the PR when the superseded comment could not be posted', async () => {
+        const { octokit, update } = makeOctokit({ open: [autoFixPR()], commentError: new Error('403 Forbidden') });
+        const outcomes = await closeSupersededAutoFixPRs(octokit, OWNER, REPO, SOURCE_PR, MERGE_SHA);
+        expect(outcomes[0].status).toBe('failed');
+        expect(update).not.toHaveBeenCalled();
+    });
+});
+describe('closeSupersededAutoFixPRs — concurrency', () => {
+    // AGENTS.md: never await inside a loop. Serialising the candidates makes every
+    // later one wait on the comment+close round-trips of the earlier ones.
+    it('processes candidates concurrently', async () => {
+        const started = [];
+        let releaseAll = () => { };
+        const gate = new Promise(resolve => { releaseAll = resolve; });
+        const createComment = vi.fn(async ({ issue_number }) => {
+            started.push(issue_number);
+            await gate;
+            return { data: { id: 1 } };
+        });
+        const octokit = {
+            rest: {
+                pulls: {
+                    list: vi.fn(async () => ({ data: [autoFixPR(2532), autoFixPR(2533), autoFixPR(2534)] })),
+                    update: vi.fn(async () => ({ data: {} })),
+                },
+                issues: { createComment },
+            },
+        };
+        const pending = closeSupersededAutoFixPRs(octokit, OWNER, REPO, SOURCE_PR, MERGE_SHA);
+        // Every candidate must be in flight before any of them is allowed to finish.
+        await Promise.resolve();
+        expect(started).toEqual([2532, 2533, 2534]);
+        releaseAll();
+        const outcomes = await pending;
+        expect(outcomes.map(o => o.prNumber)).toEqual([2532, 2533, 2534]);
+        expect(outcomes.every(o => o.status === 'closed')).toBe(true);
+    });
+    it('still comments before closing within each candidate', async () => {
+        const order = [];
+        const octokit = {
+            rest: {
+                pulls: {
+                    list: vi.fn(async () => ({ data: [autoFixPR(2532), autoFixPR(2533)] })),
+                    update: vi.fn(async ({ pull_number }) => {
+                        order.push(`close:${pull_number}`);
+                        return { data: {} };
+                    }),
+                },
+                issues: {
+                    createComment: vi.fn(async ({ issue_number }) => {
+                        order.push(`comment:${issue_number}`);
+                        return { data: { id: 1 } };
+                    }),
+                },
+            },
+        };
+        await closeSupersededAutoFixPRs(octokit, OWNER, REPO, SOURCE_PR, MERGE_SHA);
+        expect(order.indexOf('comment:2532')).toBeLessThan(order.indexOf('close:2532'));
+        expect(order.indexOf('comment:2533')).toBeLessThan(order.indexOf('close:2533'));
+    });
+    it('keeps one candidate failing from taking down the others', async () => {
+        const octokit = {
+            rest: {
+                pulls: {
+                    list: vi.fn(async () => ({ data: [autoFixPR(2532), autoFixPR(2533)] })),
+                    update: vi.fn(async ({ pull_number }) => {
+                        if (pull_number === 2532)
+                            throw new Error('403 Forbidden');
+                        return { data: {} };
+                    }),
+                },
+                issues: { createComment: vi.fn(async () => ({ data: { id: 1 } })) },
+            },
+        };
+        const outcomes = await closeSupersededAutoFixPRs(octokit, OWNER, REPO, SOURCE_PR, MERGE_SHA);
+        expect(outcomes).toEqual([
+            { prNumber: 2532, status: 'failed', reason: '403 Forbidden' },
+            { prNumber: 2533, status: 'closed' },
+        ]);
+    });
+});
+describe('sourcePRHasMerged', () => {
+    // The merge handler sweeps once. A fallback auto-fix PR created after that
+    // sweep is never seen by it, so it stays open and mergeable — the exact
+    // stale-snapshot regression this feature exists to prevent. The fix step
+    // asks this immediately before it pushes and opens the PR.
+    const octokitWith = (result) => ({
+        rest: { pulls: { get: vi.fn(async () => {
+                    if (result instanceof Error)
+                        throw result;
+                    return { data: result };
+                }) } },
+    });
+    it('is true once the source PR has merged', async () => {
+        expect(await sourcePRHasMerged(octokitWith({ merged: true, state: 'closed' }), OWNER, REPO, SOURCE_PR)).toBe(true);
+    });
+    it('is false while the source PR is still open', async () => {
+        expect(await sourcePRHasMerged(octokitWith({ merged: false, state: 'open' }), OWNER, REPO, SOURCE_PR)).toBe(false);
+    });
+    it('is false for a PR closed without merging', async () => {
+        // The source branch is still where that finding gets addressed.
+        expect(await sourcePRHasMerged(octokitWith({ merged: false, state: 'closed' }), OWNER, REPO, SOURCE_PR)).toBe(false);
+    });
+    it('fails open when the state cannot be read', async () => {
+        // A dropped fix is invisible; an unreadable lookup must not silently discard
+        // work. Today's behaviour is to always create, so failing open is no
+        // regression — the merge webhook remains the primary mechanism.
+        expect(await sourcePRHasMerged(octokitWith(new Error('502 Bad Gateway')), OWNER, REPO, SOURCE_PR)).toBe(false);
+    });
+});
+//# sourceMappingURL=superseded-fix-pr.test.js.map