@rhize/skill-forge 0.6.0 → 0.6.1

package/dist/cli.js

@@ -153,15 +153,24 @@ async function quarantine(source, quarantineDir, deps = {}) {
       break;
     }
     case "npm": {
-      const packResult = await exec("npm", ["pack", source.value, "--pack-destination", quarantinePath], {
-        cwd: quarantinePath
-      });
+      const packResult = await exec(
+        "npm",
+        ["pack", source.value, "--ignore-scripts", "--pack-destination", quarantinePath],
+        { cwd: quarantinePath }
+      );
       if (packResult.code !== 0) {
         throw new UserError(
           `npm pack failed for "${source.value}" (exit ${packResult.code}): ${packResult.stderr || packResult.stdout}`
         );
       }
       const tarballPath = join3(quarantinePath, findTarball(quarantinePath, source.value));
+      const listResult = await exec("tar", ["-tzf", tarballPath], { cwd: quarantinePath });
+      if (listResult.code !== 0) {
+        throw new UserError(
+          `could not list tarball contents for "${source.value}" (exit ${listResult.code}): ${listResult.stderr || listResult.stdout}`
+        );
+      }
+      assertSafeTarMembers(listResult.stdout, source.value);
       const extractResult = await exec("tar", ["-xzf", tarballPath, "-C", quarantinePath], {
         cwd: quarantinePath
       });
@@ -190,7 +199,7 @@ function listQuarantineIds(quarantineDir) {
 }
 function findSkillDirs(root) {
   const found = [];
-  function walk3(dir) {
+  function walk2(dir) {
     let entries;
     try {
       entries = readdirSync(dir, { withFileTypes: true });
@@ -202,13 +211,24 @@ function findSkillDirs(root) {
     }
     for (const entry of entries) {
       if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {
-        walk3(join3(dir, entry.name));
+        walk2(join3(dir, entry.name));
       }
     }
   }
-  walk3(root);
+  walk2(root);
   return found;
 }
+function assertSafeTarMembers(tarListOutput, sourceValue) {
+  for (const raw of tarListOutput.split("\n")) {
+    const member = raw.trim();
+    if (!member) continue;
+    if (member.startsWith("/") || member.split("/").includes("..")) {
+      throw new UserError(
+        `refusing to extract tarball for "${sourceValue}": unsafe member path "${member}" (absolute path or ".." segment \u2014 possible path traversal)`
+      );
+    }
+  }
+}
 function findTarball(dir, sourceValue) {
   const tarball = readdirSync(dir).find((name) => name.endsWith(".tgz"));
   if (!tarball) {
@@ -281,6 +301,7 @@ import { dirname } from "path";
 function promoteMcp(_entry, profile, targetConfigPath, options = {}) {
   const force = options.force ?? false;
   const serverName = profile.name;
+  const { command, args, envVarsToFill } = deriveServerEntry(profile);
   let config = {};
   let rawExisting;
   if (existsSync5(targetConfigPath)) {
@@ -302,7 +323,6 @@ function promoteMcp(_entry, profile, targetConfigPath, options = {}) {
     backupPath = `${targetConfigPath}.bak-${Date.now()}`;
     writeFileSync2(backupPath, rawExisting);
   }
-  const { command, args, envVarsToFill } = deriveServerEntry(profile);
   const env = {};
   for (const name of envVarsToFill) env[name] = "";
   servers[serverName] = { command, args, env };
@@ -324,6 +344,11 @@ function deriveServerEntry(profile) {
       envVarsToFill: Array.from(envNames)
     };
   }
+  if (!profile.version) {
+    throw new UserError(
+      `cannot promote MCP server "${profile.name}": no version was found in its package.json, and there is no documented launch command to fall back to \u2014 refusing to write an unpinnable "npx ${profile.name}@unknown" command`
+    );
+  }
   return {
     command: "npx",
     args: ["-y", `${profile.name}@${profile.version}`],
@@ -406,7 +431,7 @@ function appendProvenance(entry, skillsRoot) {
 }
 
 // src/commands/gatePipeline.ts
-import { readdirSync as readdirSync7 } from "fs";
+import { readdirSync as readdirSync5 } from "fs";
 import { join as join11 } from "path";
 
 // src/gate/profile.ts
@@ -416,23 +441,46 @@ import {
   existsSync as existsSync8,
   mkdtempSync,
   openSync,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   readdirSync as readdirSync3,
   readSync,
   rmSync as rmSync2,
   statSync as statSync4
 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename3, dirname as dirname2, extname as extname2, join as join7, resolve as resolve2 } from "path";
+import { basename as basename3, dirname as dirname2, extname as extname3, join as join8, resolve as resolve2 } from "path";
 
 // src/gate/mcpCapabilities.ts
-import { existsSync as existsSync7, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { extname as extname2, join as join7 } from "path";
+
+// src/gate/scanShared.ts
+import { readFileSync as readFileSync4, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
 import { extname, join as join6 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "__pycache__", ".venv", "venv"]);
-var SOURCE_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
+var BINARY_EXT = /* @__PURE__ */ new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".ico",
+  ".pdf",
+  ".zip",
+  ".tar",
+  ".gz",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".eot",
+  ".mp4",
+  ".mp3",
+  ".wasm",
+  ".bin",
+  ".exe"
+]);
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
-var MAX_ITEMS_PER_CATEGORY = 200;
-function* walkSourceFiles(dir) {
+function* walk(dir) {
   let entries;
   try {
     entries = readdirSync2(dir, { withFileTypes: true });
@@ -443,23 +491,41 @@ function* walkSourceFiles(dir) {
     const full = join6(dir, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRS2.has(entry.name)) continue;
-      yield* walkSourceFiles(full);
-    } else if (entry.isFile() && SOURCE_EXT.has(extname(entry.name))) {
+      yield* walk(full);
+    } else if (entry.isFile()) {
       yield full;
     }
   }
 }
-function readTextFileSafe(file) {
+function readTextFile(file) {
+  if (BINARY_EXT.has(extname(file).toLowerCase())) return void 0;
   try {
     if (statSync3(file).size > MAX_FILE_BYTES) return void 0;
-    return readFileSync4(file, "utf-8");
+    const content = readFileSync4(file, "utf-8");
+    if (content.slice(0, 512).includes("\0")) return void 0;
+    return content;
   } catch {
     return void 0;
   }
 }
+var BLOCK_SEVERITIES_BY_STRICTNESS = {
+  "block-high": /* @__PURE__ */ new Set(["HIGH", "CRITICAL"]),
+  "block-medium": /* @__PURE__ */ new Set(["MEDIUM", "HIGH", "CRITICAL"]),
+  "warn-only": /* @__PURE__ */ new Set()
+};
+function verdictFor(findings, strictness) {
+  const blockSeverities = BLOCK_SEVERITIES_BY_STRICTNESS[strictness];
+  if (findings.some((f) => blockSeverities.has(f.severity))) return "block";
+  if (findings.length > 0) return "warn";
+  return "pass";
+}
+
+// src/gate/mcpCapabilities.ts
+var SOURCE_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
+var MAX_ITEMS_PER_CATEGORY = 200;
 function readJsonSafe(file) {
   try {
-    return JSON.parse(readFileSync4(file, "utf-8"));
+    return JSON.parse(readFileSync5(file, "utf-8"));
   } catch {
     return void 0;
   }
@@ -560,7 +626,7 @@ var MCP_SDK_IMPORT_RE = /@modelcontextprotocol\/sdk/;
 function extractMcpCapabilities(packageDir) {
   const buckets = { tools: /* @__PURE__ */ new Set(), resources: /* @__PURE__ */ new Set(), prompts: /* @__PURE__ */ new Set() };
   let hasPackageJsonMarker = false;
-  const pkgPath = join6(packageDir, "package.json");
+  const pkgPath = join7(packageDir, "package.json");
   if (existsSync7(pkgPath)) {
     const pkg2 = readJsonSafe(pkgPath);
     if (pkg2 && typeof pkg2 === "object" && !Array.isArray(pkg2)) {
@@ -568,7 +634,7 @@ function extractMcpCapabilities(packageDir) {
     }
   }
   for (const manifestName of [".mcp.json", "mcp.json"]) {
-    const manifestPath = join6(packageDir, manifestName);
+    const manifestPath = join7(packageDir, manifestName);
     if (!existsSync7(manifestPath)) continue;
     const parsed = readJsonSafe(manifestPath);
     if (parsed !== void 0) {
@@ -578,8 +644,9 @@ function extractMcpCapabilities(packageDir) {
   let sawStdioTransport = false;
   let sawHttpTransport = false;
   let sawMcpSdkImport = false;
-  for (const file of walkSourceFiles(packageDir)) {
-    const text = readTextFileSafe(file);
+  for (const file of walk(packageDir)) {
+    if (!SOURCE_EXT.has(extname2(file))) continue;
+    const text = readTextFile(file);
     if (text === void 0) continue;
     captureRegistrations(text, buckets);
     extractFromListHandlers(text, buckets);
@@ -659,7 +726,7 @@ function profileSkill(inputPath) {
   return profileSkillDir(p);
 }
 function classifyInput(p) {
-  if (existsSync8(join7(p, ".claude-plugin", "plugin.json"))) return "plugin";
+  if (existsSync8(join8(p, ".claude-plugin", "plugin.json"))) return "plugin";
   if (detectArtifactType(p) === "mcp") return "mcp";
   return "skill";
 }
@@ -667,10 +734,10 @@ var MCP_SDK_DEP2 = "@modelcontextprotocol/sdk";
 var MCP_KEYWORD2 = "mcp-server";
 var MCP_BIN_PREFIX2 = /^mcp-/i;
 function readPackageJsonSafe(root) {
-  const pkgPath = join7(root, "package.json");
+  const pkgPath = join8(root, "package.json");
   if (!existsSync8(pkgPath)) return void 0;
   try {
-    return JSON.parse(readFileSync5(pkgPath, "utf-8"));
+    return JSON.parse(readFileSync6(pkgPath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -691,7 +758,7 @@ function hasMcpPackageMarkers(pkg2) {
   return false;
 }
 function detectArtifactType(root) {
-  if (existsSync8(join7(root, ".mcp.json")) || existsSync8(join7(root, "mcp.json"))) return "mcp";
+  if (existsSync8(join8(root, ".mcp.json")) || existsSync8(join8(root, "mcp.json"))) return "mcp";
   const pkg2 = readPackageJsonSafe(root);
   if (pkg2 && hasMcpPackageMarkers(pkg2)) return "mcp";
   return "skill";
@@ -700,8 +767,8 @@ function resolveSkillMd(inputPath) {
   let currentPath = inputPath;
   let tmpDir;
   const initialStat = statSync4(currentPath);
-  if (extname2(currentPath) === ".skill" || initialStat.isFile() && isZipFile(currentPath)) {
-    tmpDir = mkdtempSync(join7(tmpdir(), "forge_"));
+  if (extname3(currentPath) === ".skill" || initialStat.isFile() && isZipFile(currentPath)) {
+    tmpDir = mkdtempSync(join8(tmpdir(), "forge_"));
     extractZip(currentPath, tmpDir);
     currentPath = tmpDir;
   }
@@ -710,7 +777,7 @@ function resolveSkillMd(inputPath) {
     return { skillMd: currentPath, root: dirname2(currentPath), tmpDir };
   }
   if (stat.isDirectory()) {
-    const direct = join7(currentPath, "SKILL.md");
+    const direct = join8(currentPath, "SKILL.md");
     if (existsSync8(direct)) {
       return { skillMd: direct, root: currentPath, tmpDir };
     }
@@ -736,15 +803,15 @@ function findSkillMdOneLevelDown(dir) {
   const matches = /* @__PURE__ */ new Set();
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
-      const candidate = join7(dir, entry.name, "SKILL.md");
+      const candidate = join8(dir, entry.name, "SKILL.md");
       if (existsSync8(candidate)) matches.add(candidate);
     }
   }
-  const skillsDir = join7(dir, "skills");
+  const skillsDir = join8(dir, "skills");
   if (isDir(skillsDir)) {
     for (const entry of readdirSync3(skillsDir, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        const candidate = join7(skillsDir, entry.name, "SKILL.md");
+        const candidate = join8(skillsDir, entry.name, "SKILL.md");
         if (existsSync8(candidate)) matches.add(candidate);
       }
     }
@@ -828,9 +895,9 @@ function detectLicense(root, fm) {
   if (fm.license) return fm.license;
   const names = ["LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING", "license"];
   for (const name of names) {
-    const p = join7(root, name);
+    const p = join8(root, name);
     if (existsSync8(p) && statSync4(p).isFile()) {
-      const head = readFileSync5(p, "utf-8").slice(0, 2e3).toLowerCase();
+      const head = readFileSync6(p, "utf-8").slice(0, 2e3).toLowerCase();
       for (const [hint, label] of Object.entries(SPDX_HINTS)) {
         if (head.includes(hint)) return label;
       }
@@ -842,7 +909,7 @@ function detectLicense(root, fm) {
 function walkFiles(dir) {
   const out = [];
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
-    const full = join7(dir, entry.name);
+    const full = join8(dir, entry.name);
     if (entry.isDirectory()) {
       out.push(...walkFiles(full));
     } else if (entry.isFile()) {
@@ -854,7 +921,7 @@ function walkFiles(dir) {
 function countResources(root) {
   const resources = {};
   for (const d of RESOURCE_DIRS) {
-    const dp = join7(root, d);
+    const dp = join8(root, d);
     if (isDir(dp)) {
       resources[d] = walkFiles(dp).length;
     }
@@ -865,11 +932,11 @@ function scanMcpAndImports(text, root) {
   const mcpRefRe = /mcp__[a-zA-Z0-9_]+/g;
   const mcpRefs = new Set(text.match(mcpRefRe) ?? []);
   const imports = /* @__PURE__ */ new Set();
-  const scriptsDir = join7(root, "scripts");
+  const scriptsDir = join8(root, "scripts");
   if (isDir(scriptsDir)) {
     for (const f of walkFiles(scriptsDir)) {
       if (!f.endsWith(".py")) continue;
-      const ft = readFileSync5(f, "utf-8");
+      const ft = readFileSync6(f, "utf-8");
       for (const m2 of ft.match(mcpRefRe) ?? []) mcpRefs.add(m2);
       const importRe = /^\s*(?:import|from)\s+([a-zA-Z0-9_]+)/gm;
       let m;
@@ -886,7 +953,7 @@ function scanMcpAndImports(text, root) {
 function profileSkillDir(inputPath) {
   const { skillMd, root, tmpDir } = resolveSkillMd(inputPath);
   try {
-    const text = readFileSync5(skillMd, "utf-8");
+    const text = readFileSync6(skillMd, "utf-8");
     const fm = parseFrontmatter(text);
     const bodyLines = (text.match(/\n/g)?.length ?? 0) + 1;
     const headers = Array.from(text.matchAll(/^#{1,3}\s+(.+)$/gm)).map((m) => m[1]);
@@ -914,19 +981,19 @@ function profileSkillDir(inputPath) {
   }
 }
 function profilePlugin(p) {
-  const manifestPath = join7(p, ".claude-plugin", "plugin.json");
+  const manifestPath = join8(p, ".claude-plugin", "plugin.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync5(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync6(manifestPath, "utf-8"));
   } catch (err) {
     throw new Error(`could not parse plugin.json under ${p}: ${err.message}`);
   }
-  const skillsDir = join7(p, "skills");
+  const skillsDir = join8(p, "skills");
   let skills = [];
   if (isDir(skillsDir)) {
-    skills = readdirSync3(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync8(join7(skillsDir, d.name, "SKILL.md"))).map((d) => d.name).sort();
+    skills = readdirSync3(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync8(join8(skillsDir, d.name, "SKILL.md"))).map((d) => d.name).sort();
   }
-  const commandsDir = join7(p, "commands");
+  const commandsDir = join8(p, "commands");
   const commands = isDir(commandsDir) ? readdirSync3(commandsDir).filter((f) => f.endsWith(".md")).length : 0;
   const mc = manifest.mcpServers ?? manifest.mcp_servers ?? {};
   const mcpServers = typeof mc === "object" && mc !== null ? Object.keys(mc).sort() : [];
@@ -944,11 +1011,11 @@ function profilePlugin(p) {
   };
 }
 function profileMcp(p) {
-  const explicitConfig = existsSync8(join7(p, ".mcp.json")) ? join7(p, ".mcp.json") : existsSync8(join7(p, "mcp.json")) ? join7(p, "mcp.json") : void 0;
+  const explicitConfig = existsSync8(join8(p, ".mcp.json")) ? join8(p, ".mcp.json") : existsSync8(join8(p, "mcp.json")) ? join8(p, "mcp.json") : void 0;
   if (explicitConfig) {
     let cfg;
     try {
-      cfg = JSON.parse(readFileSync5(explicitConfig, "utf-8"));
+      cfg = JSON.parse(readFileSync6(explicitConfig, "utf-8"));
     } catch (err) {
       throw new Error(`could not parse MCP config ${explicitConfig}: ${err.message}`);
     }
@@ -964,10 +1031,10 @@ function profileMcp(p) {
       capabilities: extractMcpCapabilities(p)
     };
   }
-  const pkgPath = join7(p, "package.json");
+  const pkgPath = join8(p, "package.json");
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync5(pkgPath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync6(pkgPath, "utf-8"));
   } catch (err) {
     throw new Error(`could not parse package.json ${pkgPath}: ${err.message}`);
   }
@@ -984,16 +1051,11 @@ function profileMcp(p) {
 }
 
 // src/gate/safety.ts
-import { readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
+import { statSync as statSync5 } from "fs";
 import { execFile } from "child_process";
-import { delimiter, extname as extname3, join as join8 } from "path";
+import { delimiter, join as join9 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
-var BLOCK_SEVERITIES_BY_STRICTNESS = {
-  "block-high": /* @__PURE__ */ new Set(["HIGH", "CRITICAL"]),
-  "block-medium": /* @__PURE__ */ new Set(["MEDIUM", "HIGH", "CRITICAL"]),
-  "warn-only": /* @__PURE__ */ new Set()
-};
 var DENY_RULES = [
   {
     rule: "curl-pipe-shell",
@@ -1056,57 +1118,6 @@ var DENY_RULES = [
     message: "invokes sudo \u2014 review for unnecessary privilege escalation"
   }
 ];
-var SKIP_DIRS3 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "__pycache__", ".venv", "venv"]);
-var BINARY_EXT = /* @__PURE__ */ new Set([
-  ".png",
-  ".jpg",
-  ".jpeg",
-  ".gif",
-  ".webp",
-  ".ico",
-  ".pdf",
-  ".zip",
-  ".tar",
-  ".gz",
-  ".woff",
-  ".woff2",
-  ".ttf",
-  ".eot",
-  ".mp4",
-  ".mp3",
-  ".wasm",
-  ".bin",
-  ".exe"
-]);
-var MAX_FILE_BYTES2 = 2 * 1024 * 1024;
-function* walk(dir) {
-  let entries;
-  try {
-    entries = readdirSync4(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    const full = join8(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (SKIP_DIRS3.has(entry.name)) continue;
-      yield* walk(full);
-    } else if (entry.isFile()) {
-      yield full;
-    }
-  }
-}
-function readTextFile(file) {
-  if (BINARY_EXT.has(extname3(file).toLowerCase())) return void 0;
-  try {
-    if (statSync5(file).size > MAX_FILE_BYTES2) return void 0;
-    const content = readFileSync6(file, "utf-8");
-    if (content.slice(0, 512).includes("\0")) return void 0;
-    return content;
-  } catch {
-    return void 0;
-  }
-}
 function scanStaticRules(targetPath) {
   const findings = [];
   let root;
@@ -1141,7 +1152,7 @@ function which(cmd) {
   const exts = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";") : [""];
   for (const dir of dirs) {
     for (const ext of exts) {
-      const candidate = join8(dir, cmd + ext);
+      const candidate = join9(dir, cmd + ext);
       try {
         if (statSync5(candidate).isFile()) return candidate;
       } catch {
@@ -1175,20 +1186,14 @@ async function scanWithSkillSpector(targetPath) {
     return [];
   }
 }
-function verdictFor(findings, strictness) {
-  const blockSeverities = BLOCK_SEVERITIES_BY_STRICTNESS[strictness];
-  if (findings.some((f) => blockSeverities.has(f.severity))) return "block";
-  if (findings.length > 0) return "warn";
-  return "pass";
-}
 async function scanSafety(targetPath, strictness = DEFAULT_STRICTNESS) {
   const findings = [...scanStaticRules(targetPath), ...await scanWithSkillSpector(targetPath)];
   return { findings, verdict: verdictFor(findings, strictness) };
 }
 
 // src/gate/overlap.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync5 } from "fs";
-import { basename as basename4, dirname as dirname3, join as join9, resolve as resolve3 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync4 } from "fs";
+import { basename as basename4, dirname as dirname3, join as join10, resolve as resolve3 } from "path";
 var STOPWORDS = new Set(
   `
 a an the and or of to for in on with use used using when whether this that these those is are be
@@ -1307,25 +1312,25 @@ function listSubdirs(dir) {
   if (!existsSync9(dir)) return [];
   let entries;
   try {
-    entries = readdirSync5(dir, { withFileTypes: true });
+    entries = readdirSync4(dir, { withFileTypes: true });
   } catch {
     return [];
   }
-  return entries.filter((e) => e.isDirectory()).map((e) => join9(dir, e.name));
+  return entries.filter((e) => e.isDirectory()).map((e) => join10(dir, e.name));
 }
 function findSkillMdFiles(root) {
   const found = /* @__PURE__ */ new Set();
   for (const dir of listSubdirs(root)) {
-    const candidate = join9(dir, "SKILL.md");
+    const candidate = join10(dir, "SKILL.md");
     if (existsSync9(candidate)) found.add(resolve3(candidate));
   }
-  for (const dir of listSubdirs(join9(root, "skills"))) {
-    const candidate = join9(dir, "SKILL.md");
+  for (const dir of listSubdirs(join10(root, "skills"))) {
+    const candidate = join10(dir, "SKILL.md");
     if (existsSync9(candidate)) found.add(resolve3(candidate));
   }
   for (const topDir of listSubdirs(root)) {
-    for (const dir of listSubdirs(join9(topDir, "skills"))) {
-      const candidate = join9(dir, "SKILL.md");
+    for (const dir of listSubdirs(join10(topDir, "skills"))) {
+      const candidate = join10(dir, "SKILL.md");
       if (existsSync9(candidate)) found.add(resolve3(candidate));
     }
   }
@@ -1338,7 +1343,7 @@ function scanOverlap(candidatePath, skillsRoot) {
   }
   let cpath = resolve3(expandHome(candidatePath));
   if (isDir(cpath)) {
-    cpath = join9(cpath, "SKILL.md");
+    cpath = join10(cpath, "SKILL.md");
   }
   if (!existsSync9(cpath)) {
     throw new Error(`candidate SKILL.md not found: ${cpath}`);
@@ -1364,59 +1369,8 @@ function scanOverlap(candidatePath, skillsRoot) {
 }
 
 // src/gate/mcpSafety.ts
-import { readFileSync as readFileSync8, readdirSync as readdirSync6, statSync as statSync6 } from "fs";
-import { basename as basename5, extname as extname4, join as join10 } from "path";
-var SKIP_DIRS4 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "__pycache__", ".venv", "venv"]);
-var BINARY_EXT2 = /* @__PURE__ */ new Set([
-  ".png",
-  ".jpg",
-  ".jpeg",
-  ".gif",
-  ".webp",
-  ".ico",
-  ".pdf",
-  ".zip",
-  ".tar",
-  ".gz",
-  ".woff",
-  ".woff2",
-  ".ttf",
-  ".eot",
-  ".mp4",
-  ".mp3",
-  ".wasm",
-  ".bin",
-  ".exe"
-]);
-var MAX_FILE_BYTES3 = 2 * 1024 * 1024;
-function* walk2(dir) {
-  let entries;
-  try {
-    entries = readdirSync6(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    const full = join10(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (SKIP_DIRS4.has(entry.name)) continue;
-      yield* walk2(full);
-    } else if (entry.isFile()) {
-      yield full;
-    }
-  }
-}
-function readTextFile2(file) {
-  if (BINARY_EXT2.has(extname4(file).toLowerCase())) return void 0;
-  try {
-    if (statSync6(file).size > MAX_FILE_BYTES3) return void 0;
-    const content = readFileSync8(file, "utf-8");
-    if (content.slice(0, 512).includes("\0")) return void 0;
-    return content;
-  } catch {
-    return void 0;
-  }
-}
+import { statSync as statSync6 } from "fs";
+import { basename as basename5, extname as extname4 } from "path";
 function isConfigOrExampleFile(file) {
   const base = basename5(file).toLowerCase();
   if (base.startsWith(".env")) return true;
@@ -1446,7 +1400,18 @@ function looksHighEntropy(value) {
 }
 function isPinnedPackageSpec(spec) {
   const withoutScope = spec.startsWith("@") ? spec.slice(spec.indexOf("/") + 1) : spec;
-  return withoutScope.includes("@");
+  const atIdx = withoutScope.lastIndexOf("@");
+  if (atIdx <= 0) return false;
+  return /^\d/.test(withoutScope.slice(atIdx + 1));
+}
+function isNpxCommand(command) {
+  const base = command.split(/[\\/]/).pop() ?? command;
+  return base.replace(/\.(cmd|exe)$/i, "").toLowerCase() === "npx";
+}
+function packageSpecBase(spec) {
+  const scopeEnd = spec.startsWith("@") ? spec.indexOf("/") + 1 : 0;
+  const atIdx = spec.lastIndexOf("@");
+  return atIdx > scopeEnd ? spec.slice(0, atIdx) : spec;
 }
 function collectServerNodes(node, out) {
   if (Array.isArray(node)) {
@@ -1475,7 +1440,7 @@ function scanJsonConfig(file, parsed) {
   for (const node of nodes) {
     const command = typeof node.command === "string" ? node.command : void 0;
     const args = Array.isArray(node.args) ? node.args.filter((a) => typeof a === "string") : [];
-    if (command === "npx") {
+    if (command && isNpxCommand(command)) {
       const flagIdx = args.findIndex((a) => a === "-y" || a === "--yes");
       if (flagIdx !== -1) {
         const pkgSpec = args.slice(flagIdx + 1).find((a) => !a.startsWith("-"));
@@ -1484,7 +1449,7 @@ function scanJsonConfig(file, parsed) {
             severity: "MEDIUM",
             rule: "mcp-unpinned-npx",
             file,
-            detail: `npx -y ${pkgSpec} is unpinned \u2014 pin an exact version (${pkgSpec}@<version>) so the resolved server code can't change silently`
+            detail: `npx -y ${pkgSpec} is unpinned \u2014 pin an exact version (${packageSpecBase(pkgSpec)}@<version>) so the resolved server code can't change silently`
           });
         }
       }
@@ -1523,9 +1488,22 @@ function scanJsonConfig(file, parsed) {
   }
   return findings;
 }
-var NPX_SHELL_RE = /\bnpx\s+(?:-y|--yes)\s+((?:@[\w.-]+\/)?[\w.-]+)(@[\w.-]+)?/g;
+var NPX_SHELL_RE = /\bnpx(?:\.cmd|\.exe)?\s+(?:-y|--yes)\s+((?:@[\w.-]+\/)?[\w.-]+)(@[\w.-]+)?/gi;
 var DANGEROUS_FLAG_RE = /--dangerously-[\w-]+|--no-sandbox\b/g;
 var CREDENTIAL_ASSIGNMENT_RE = /["']?([A-Za-z][A-Za-z0-9_]*)["']?\s*[:=]\s*["']([^"']{6,})["']/g;
+var CREDENTIAL_ASSIGNMENT_UNQUOTED_RE = /^\s*(?:export\s+|-\s+)?([A-Za-z][A-Za-z0-9_]*)\s*[:=]\s*(\S+)/;
+var LEADING_QUOTE_RE = /^["']/;
+function pushCredentialFinding(findings, file, lineNo, varName, value) {
+  if (isPlaceholderValue(value)) return;
+  if (looksCredentialKey(varName) || looksHighEntropy(value)) {
+    findings.push({
+      severity: "HIGH",
+      rule: "mcp-inline-credential-value",
+      file,
+      detail: `line ${lineNo}: inline credential value assigned to ${varName}`
+    });
+  }
+}
 function scanTextFile(file, content, allowCredentialCheck) {
   const findings = [];
   const lines = content.split("\n");
@@ -1536,8 +1514,8 @@ function scanTextFile(file, content, allowCredentialCheck) {
     let m;
     while ((m = NPX_SHELL_RE.exec(line)) !== null) {
       const pkgSpec = m[1];
-      const pinned = m[2] !== void 0;
-      if (!pinned) {
+      const versionSuffix = m[2] ?? "";
+      if (!isPinnedPackageSpec(pkgSpec + versionSuffix)) {
         findings.push({
           severity: "MEDIUM",
           rule: "mcp-unpinned-npx",
@@ -1558,24 +1536,18 @@ function scanTextFile(file, content, allowCredentialCheck) {
     if (allowCredentialCheck) {
       CREDENTIAL_ASSIGNMENT_RE.lastIndex = 0;
       while ((m = CREDENTIAL_ASSIGNMENT_RE.exec(line)) !== null) {
-        const varName = m[1];
-        const value = m[2];
-        if (isPlaceholderValue(value)) continue;
-        if (looksCredentialKey(varName) || looksHighEntropy(value)) {
-          findings.push({
-            severity: "HIGH",
-            rule: "mcp-inline-credential-value",
-            file,
-            detail: `line ${lineNo}: inline credential value assigned to ${varName}`
-          });
-        }
+        pushCredentialFinding(findings, file, lineNo, m[1], m[2]);
+      }
+      const unquoted = CREDENTIAL_ASSIGNMENT_UNQUOTED_RE.exec(line);
+      if (unquoted && !LEADING_QUOTE_RE.test(unquoted[2])) {
+        pushCredentialFinding(findings, file, lineNo, unquoted[1], unquoted[2]);
       }
     }
   }
   return findings;
 }
 function scanFileForMcpFindings(file) {
-  const content = readTextFile2(file);
+  const content = readTextFile(file);
   if (content === void 0) return [];
   if (extname4(file).toLowerCase() === ".json") {
     const parsed = tryParseJson(content);
@@ -1590,40 +1562,29 @@ function scanMcpFindings(targetPath) {
   } catch {
     return [];
   }
-  const files = root.isDirectory() ? Array.from(walk2(targetPath)) : [targetPath];
+  const files = root.isDirectory() ? Array.from(walk(targetPath)) : [targetPath];
   const findings = [];
   for (const file of files) {
     findings.push(...scanFileForMcpFindings(file));
   }
   return findings;
 }
-var BLOCK_SEVERITIES_BY_STRICTNESS2 = {
-  "block-high": /* @__PURE__ */ new Set(["HIGH", "CRITICAL"]),
-  "block-medium": /* @__PURE__ */ new Set(["MEDIUM", "HIGH", "CRITICAL"]),
-  "warn-only": /* @__PURE__ */ new Set()
-};
-function verdictFor2(findings, strictness) {
-  const blockSeverities = BLOCK_SEVERITIES_BY_STRICTNESS2[strictness];
-  if (findings.some((f) => blockSeverities.has(f.severity))) return "block";
-  if (findings.length > 0) return "warn";
-  return "pass";
-}
 async function mcpScan(targetPath, strictness = DEFAULT_STRICTNESS) {
   const base = await scanSafety(targetPath, strictness);
   const mcpFindings = scanMcpFindings(targetPath);
   const findings = [...base.findings, ...mcpFindings];
-  return { findings, verdict: verdictFor2(findings, strictness) };
+  return { findings, verdict: verdictFor(findings, strictness) };
 }
 
 // src/gate/mcpOverlap.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
 import { resolve as resolve4 } from "path";
 function readTargetServers(targetPath) {
   const path = resolve4(expandHome(targetPath));
   if (!existsSync10(path)) return [];
   let cfg;
   try {
-    cfg = JSON.parse(readFileSync9(path, "utf-8"));
+    cfg = JSON.parse(readFileSync8(path, "utf-8"));
   } catch {
     return [];
   }
@@ -1908,7 +1869,7 @@ function resolveMcpCandidatePath(entry) {
   if (entry.packageDir) return entry.packageDir;
   let children = [];
   try {
-    children = readdirSync7(entry.quarantinePath, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    children = readdirSync5(entry.quarantinePath, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
   }
   return children.length === 1 ? join11(entry.quarantinePath, children[0]) : entry.quarantinePath;
@@ -1942,7 +1903,7 @@ async function runGate(candidatePath, skillsRoot, {
 
 // src/queue.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
 import { join as join12 } from "path";
 function getQueuePath() {
   return join12(getHomeDir(), "queue.json");
@@ -1952,7 +1913,7 @@ function readQueue() {
   if (!existsSync11(path)) {
     return { version: 1, entries: [] };
   }
-  const raw = readFileSync10(path, "utf-8");
+  const raw = readFileSync9(path, "utf-8");
   const parsed = JSON.parse(raw);
   return { version: 1, entries: parsed.entries ?? [] };
 }
@@ -2589,7 +2550,9 @@ async function addMcp(source, config, options) {
     const detail = resolveMcpCandidateDetail(profile);
     const serverProfile = {
       name: detail.name,
-      version: detail.version ?? "unknown",
+      // version may be absent — promoteMcp refuses the unpinnable npx fallback
+      // rather than writing "npx pkg@unknown"; see deriveServerEntry in promoteMcp.ts.
+      version: detail.version,
       envVars: detail.env ? Object.keys(detail.env) : void 0,
       candidateEntry: detail.command ? { command: detail.command, args: detail.args, env: detail.env } : void 0
     };