@skillsmith/cli 0.6.1 → 0.6.3

package/dist/tests/open-database.test.js

@@ -9,6 +9,9 @@
  * not throw on a brand-new database.
  */
 import { describe, it, expect, afterEach } from 'vitest';
+import { mkdtempSync, writeFileSync, existsSync, readdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { SearchService, SkillRepository, closeDatabase } from '@skillsmith/core';
 import { openCliDatabase } from '../src/utils/open-database.js';
 describe('SMI-4917 Bug 1: openCliDatabase', () => {
@@ -49,4 +52,26 @@ describe('SMI-4917 Bug 1: openCliDatabase', () => {
         expect(new SkillRepository(db).count()).toBe(0);
     });
 });
+describe('SMI-4484: openCliDatabase corrupt-DB self-heal', () => {
+    let tempDir;
+    afterEach(() => {
+        if (tempDir && existsSync(tempDir))
+            rmSync(tempDir, { recursive: true, force: true });
+    });
+    it('recovers from a corrupt on-disk database by backing it up and rebuilding', async () => {
+        tempDir = mkdtempSync(join(tmpdir(), `smi4484-cli-${Date.now()}-${Math.random().toString(36).slice(2)}-`));
+        const dbPath = join(tempDir, 'skills.db');
+        // A corrupt file the WASM driver cannot read.
+        writeFileSync(dbPath, Buffer.from('not a sqlite database — corrupt on-disk file'));
+        const db = await openCliDatabase(dbPath);
+        closeDatabase(db);
+        // The corrupt file was backed up out of the way.
+        const backups = readdirSync(tempDir).filter((f) => f.includes('.corrupt-'));
+        expect(backups.length).toBe(1);
+        // A fresh, schema-initialized DB was opened in its place.
+        const reopened = await openCliDatabase(dbPath);
+        expect(new SkillRepository(reopened).count()).toBe(0);
+        closeDatabase(reopened);
+    });
+});
 //# sourceMappingURL=open-database.test.js.map

package/dist/tests/open-database.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-database.test.js","sourceRoot":"","sources":["../../tests/open-database.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAqB,MAAM,kBAAkB,CAAA;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAA;IAEjC,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,EAAE,IAAI,MAAM;YAAE,aAAa,CAAC,EAAE,CAAC,CAAA;QAC1C,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,KAAK,UAAU,IAAI;QACjB,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,EAAE,CAAA;IACX,CAAC;IAED,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;QACvB,gEAAgE;QAChE,MAAM,UAAU,GAAG,EAAE;aAClB,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,EAAE,CAAA;QACR,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;QACvB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAA;QACpC,oEAAoE;QACpE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;QACvB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QAC/D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;QACvB,MAAM,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"open-database.test.js","sourceRoot":"","sources":["../../tests/open-database.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACrF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAqB,MAAM,kBAAkB,CAAA;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAA;IAEjC,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,EAAE,IAAI,MAAM;YAAE,aAAa,CAAC,EAAE,CAAC,CAAA;QAC1C,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,KAAK,UAAU,IAAI;QACjB,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,EAAE,CAAA;IACX,CAAC;IAED,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;QACvB,gEAAgE;QAChE,MAAM,UAAU,GAAG,EAAE;aAClB,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,EAAE,CAAA;QACR,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;QACvB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAA;QACpC,oEAAoE;QACpE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;QACvB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QAC/D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;QACvB,MAAM,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,IAAI,OAAe,CAAA;IAEnB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,OAAO,GAAG,WAAW,CACnB,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CACpF,CAAA;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QACzC,8CAA8C;QAC9C,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,CAAA;QAElF,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;QACxC,aAAa,CAAC,EAAE,CAAC,CAAA;QAEjB,iDAAiD;QACjD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;QAC3E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAE9B,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;QAC9C,MAAM,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrD,aAAa,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/sync.auth-ux.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * SMI-4482: CLI `sync` command — actionable auth UX.
+ *
+ * Covers the fresh-install scenario where `skillsmith sync` runs before
+ * `skillsmith login`: the API client reaches the anonymous IP-trial path, the
+ * per-IP trial limit is exhausted server-side, and the `skills-search` edge
+ * function returns HTTP 401 `{"error":"Authentication required"}`. Previously
+ * the CLI printed a bare `Authentication required` with `Σ Total: 0`; it must
+ * now print actionable next steps and exit non-zero.
+ *
+ * Network is fully mocked — no production API calls.
+ */
+export {};
+//# sourceMappingURL=sync.auth-ux.test.d.ts.map

package/dist/tests/sync.auth-ux.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.auth-ux.test.d.ts","sourceRoot":"","sources":["../../tests/sync.auth-ux.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/tests/sync.auth-ux.test.js

@@ -0,0 +1,148 @@
+/**
+ * SMI-4482: CLI `sync` command — actionable auth UX.
+ *
+ * Covers the fresh-install scenario where `skillsmith sync` runs before
+ * `skillsmith login`: the API client reaches the anonymous IP-trial path, the
+ * per-IP trial limit is exhausted server-side, and the `skills-search` edge
+ * function returns HTTP 401 `{"error":"Authentication required"}`. Previously
+ * the CLI printed a bare `Authentication required` with `Σ Total: 0`; it must
+ * now print actionable next steps and exit non-zero.
+ *
+ * Network is fully mocked — no production API calls.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { isAuthFailure, formatAuthGuidance } from '../src/commands/sync.helpers.js';
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+function makeResult(overrides = {}) {
+    return {
+        success: false,
+        skillsAdded: 0,
+        skillsUpdated: 0,
+        skillsUnchanged: 0,
+        totalProcessed: 0,
+        errors: [],
+        durationMs: 5,
+        dryRun: false,
+        ...overrides,
+    };
+}
+// ---------------------------------------------------------------------------
+// Pure-helper tests
+// ---------------------------------------------------------------------------
+describe('SMI-4482: isAuthFailure', () => {
+    it('detects the server "Authentication required" 401 signal', () => {
+        expect(isAuthFailure(makeResult({ errors: ['Authentication required'] }))).toBe(true);
+    });
+    it('detects an "Unauthorized" variant', () => {
+        expect(isAuthFailure(makeResult({ errors: ['Fetch error at offset 0: Unauthorized'] }))).toBe(true);
+    });
+    it('is case-insensitive', () => {
+        expect(isAuthFailure(makeResult({ errors: ['authentication required'] }))).toBe(true);
+    });
+    it('returns false for a transient network error (no auth signal)', () => {
+        expect(isAuthFailure(makeResult({ errors: ['fetch failed'] }))).toBe(false);
+    });
+    it('returns false for a successful sync', () => {
+        expect(isAuthFailure(makeResult({ success: true, totalProcessed: 12, skillsAdded: 12 }))).toBe(false);
+    });
+    it('returns false when partial results were returned even if an auth error is present', () => {
+        // A creds-present run that hit a 401 on one page but still synced skills
+        // is NOT a "needs login" situation — the user already has access.
+        expect(isAuthFailure(makeResult({ totalProcessed: 5, errors: ['Authentication required'] }))).toBe(false);
+    });
+    it('returns false when there are no errors', () => {
+        expect(isAuthFailure(makeResult({ errors: [] }))).toBe(false);
+    });
+});
+describe('SMI-4482: formatAuthGuidance', () => {
+    it('includes the login command and the headless/CI hint', () => {
+        const text = formatAuthGuidance().join('\n');
+        expect(text).toContain('skillsmith login');
+        expect(text).toContain('Sync requires authentication');
+        expect(text).toContain('SKILLSMITH_API_KEY');
+    });
+});
+// ---------------------------------------------------------------------------
+// Command-level tests
+// ---------------------------------------------------------------------------
+const mocks = vi.hoisted(() => ({
+    runRegistrySync: vi.fn(),
+    dbClose: vi.fn(),
+    spinner: {
+        start: vi.fn().mockReturnThis(),
+        stop: vi.fn().mockReturnThis(),
+        succeed: vi.fn().mockReturnThis(),
+        fail: vi.fn().mockReturnThis(),
+        warn: vi.fn().mockReturnThis(),
+        text: '',
+    },
+}));
+vi.mock('../src/commands/run-registry-sync.js', () => ({
+    runRegistrySync: (...args) => mocks.runRegistrySync(...args),
+}));
+vi.mock('../src/utils/open-database.js', () => ({
+    openCliDatabase: () => Promise.resolve({ close: mocks.dbClose }),
+}));
+vi.mock('ora', () => ({ default: () => mocks.spinner }));
+const originalConsoleLog = console.log;
+const originalConsoleError = console.error;
+const mockConsoleLog = vi.fn();
+const mockConsoleError = vi.fn();
+describe('SMI-4482: sync command — no-credentials UX', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        console.log = mockConsoleLog;
+        console.error = mockConsoleError;
+        process.exitCode = undefined;
+    });
+    afterEach(() => {
+        console.log = originalConsoleLog;
+        console.error = originalConsoleError;
+        process.exitCode = undefined;
+    });
+    it('prints actionable login guidance (not a bare error) and exits non-zero', async () => {
+        mocks.runRegistrySync.mockResolvedValue(makeResult({ errors: ['Authentication required'] }));
+        const { createSyncCommand } = await import('../src/commands/sync.js');
+        await createSyncCommand().parseAsync(['node', 'test']);
+        const stderr = mockConsoleError.mock.calls.map((c) => String(c[0])).join('\n');
+        expect(stderr).toContain('Sync requires authentication');
+        expect(stderr).toContain('skillsmith login');
+        expect(stderr).toContain('SKILLSMITH_API_KEY');
+        expect(process.exitCode).toBe(1);
+        // The bad UX must NOT appear: no bare "Σ Total: 0" results block.
+        const stdout = mockConsoleLog.mock.calls.map((c) => String(c[0])).join('\n');
+        expect(stdout).not.toContain('Total:');
+        expect(mocks.dbClose).toHaveBeenCalled();
+    });
+    it('emits machine-readable JSON and exit code 1 with --json on auth failure', async () => {
+        mocks.runRegistrySync.mockResolvedValue(makeResult({ errors: ['Authentication required'] }));
+        const { createSyncCommand } = await import('../src/commands/sync.js');
+        await createSyncCommand().parseAsync(['node', 'test', '--json']);
+        const stdout = mockConsoleLog.mock.calls.map((c) => String(c[0])).join('\n');
+        const parsed = JSON.parse(stdout);
+        expect(parsed.errors).toContain('Authentication required');
+        expect(process.exitCode).toBe(1);
+    });
+    it('does NOT trigger the guard for a successful (creds-present) sync', async () => {
+        mocks.runRegistrySync.mockResolvedValue(makeResult({ success: true, totalProcessed: 8, skillsAdded: 8 }));
+        const { createSyncCommand } = await import('../src/commands/sync.js');
+        await createSyncCommand().parseAsync(['node', 'test']);
+        expect(mocks.spinner.succeed).toHaveBeenCalled();
+        const stdout = mockConsoleLog.mock.calls.map((c) => String(c[0])).join('\n');
+        expect(stdout).toContain('Total:');
+        const stderr = mockConsoleError.mock.calls.map((c) => String(c[0])).join('\n');
+        expect(stderr).not.toContain('Sync requires authentication');
+        expect(process.exitCode).toBeUndefined();
+    });
+    it('does NOT trigger the guard for a non-auth transient failure', async () => {
+        mocks.runRegistrySync.mockResolvedValue(makeResult({ errors: ['fetch failed'] }));
+        const { createSyncCommand } = await import('../src/commands/sync.js');
+        await createSyncCommand().parseAsync(['node', 'test']);
+        expect(mocks.spinner.warn).toHaveBeenCalled();
+        const stderr = mockConsoleError.mock.calls.map((c) => String(c[0])).join('\n');
+        expect(stderr).not.toContain('Sync requires authentication');
+    });
+});
+//# sourceMappingURL=sync.auth-ux.test.js.map

package/dist/tests/sync.auth-ux.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.auth-ux.test.js","sourceRoot":"","sources":["../../tests/sync.auth-ux.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAExE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AAEnF,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,SAAS,UAAU,CAAC,YAAiC,EAAE;IACrD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,CAAC;QACd,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,cAAc,EAAE,CAAC;QACjB,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,KAAK;QACb,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAC3F,IAAI,CACL,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5F,KAAK,CACN,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,CACJ,aAAa,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CACtF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACf,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9B,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;IAChB,OAAO,EAAE;QACP,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;QAC/B,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;QAC9B,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;QACjC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;QAC9B,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;QAC9B,IAAI,EAAE,EAAE;KACT;CACF,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,eAAe,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;CACxE,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;CACjE,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AAExD,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAA;AACtC,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAA;AAC1C,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;AAEhC,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;QAClB,OAAO,CAAC,GAAG,GAAG,cAAc,CAAA;QAC5B,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAA;QAChC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,GAAG,kBAAkB,CAAA;QAChC,OAAO,CAAC,KAAK,GAAG,oBAAoB,CAAA;QACpC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,KAAK,CAAC,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAA;QAE5F,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACrE,MAAM,iBAAiB,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QAEtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9E,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;QACxD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;QAC9C,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAEhC,kEAAkE;QAClE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5E,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,KAAK,CAAC,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAA;QAE5F,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACrE,MAAM,iBAAiB,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEhE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;QAC1D,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,KAAK,CAAC,eAAe,CAAC,iBAAiB,CACrC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CACjE,CAAA;QAED,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACrE,MAAM,iBAAiB,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QAEtD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAA;QAChD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5E,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9E,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;QAC5D,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,KAAK,CAAC,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;QAEjF,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACrE,MAAM,iBAAiB,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QAEtD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAA;QAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9E,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillsmith/cli",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "CLI tools for Skillsmith skill discovery and authentication",
   "type": "module",
   "bin": {
@@ -17,8 +17,8 @@
   },
   "dependencies": {
     "@inquirer/prompts": "7.10.1",
-    "@skillsmith/core": "^0.6.1",
-    "@skillsmith/mcp-server": "^0.5.1",
+    "@skillsmith/core": "^0.8.0",
+    "@skillsmith/mcp-server": "^0.5.3",
     "chalk": "5.6.2",
     "chokidar": "4.0.3",
     "cli-table3": "0.6.5",
@@ -32,7 +32,7 @@
     "@isaacs/keytar": "7.9.0"
   },
   "devDependencies": {
-    "@types/node": "^22.15.0",
+    "@types/node": "^25.9.0",
     "vitest": "4.1.6"
   },
   "peerDependencies": {
@@ -46,6 +46,7 @@
   "files": [
     "dist",
     "assets",
+    "templates",
     "CHANGELOG.md"
   ],
   "license": "Elastic-2.0",

package/templates/skill-telemetry.cmd

@@ -0,0 +1,16 @@
+@echo off
+REM Skillsmith skill-invocation telemetry hook — Windows Git-Bash shim.
+REM
+REM SMI-5012 / SMI-5020 W3.S1. Claude Code on Windows requires Git Bash,
+REM so we delegate to the POSIX-sh script via `bash`. The shim itself
+REM does no parsing — all logic (including the privacy-critical
+REM never-read-args invariant) lives in skill-telemetry.sh.
+REM
+REM Stdin is piped through unchanged. Exit code is forwarded; the .sh
+REM always exits 0 so this shim always exits 0 too.
+REM
+REM Installed at:  %USERPROFILE%\.skillsmith\hooks\skill-telemetry.cmd
+REM Delegates to:  %USERPROFILE%\.skillsmith\hooks\skill-telemetry.sh
+
+bash "%USERPROFILE%\.skillsmith\hooks\skill-telemetry.sh" %*
+exit /b 0

package/templates/skill-telemetry.sh

@@ -0,0 +1,199 @@
+#!/usr/bin/env sh
+# Skillsmith skill-invocation telemetry hook (SMI-5012 / SMI-5020 W3.S1).
+#
+# Invoked from ~/.claude/settings.json PreToolUse + PostToolUse matchers on
+# the `Skill` tool. Captures skill-invocation latency telemetry for the
+# Skillsmith /functions/v1/events endpoint.
+#
+# PRIVACY INVARIANTS (DO NOT WEAKEN):
+#   - NEVER reads `.tool_input.args` from the hook stdin payload. EVER.
+#     Only `.session_id` and `.tool_input.skill` are extracted.
+#   - NEVER captures absolute paths, cwd, env vars, or file contents.
+#   - NEVER blocks the user. Exits 0 in every code path. No `set -e`.
+#   - Curl is fire-and-forget (backgrounded + output redirected).
+#
+# CROSS-PLATFORM:
+#   - POSIX `sh` only (NOT bash). Runs on macOS /bin/sh (dash-equiv),
+#     Linux /bin/sh (dash/bash), and Git Bash on Windows (via .cmd shim).
+#   - `date +%s%3N` (GNU) falls back to `date +%s` (BSD/macOS) for second-
+#     precision when millisecond precision is unavailable.
+#
+# STATE:
+#   - Start files: $HOME/.skillsmith/run/skill-$SESSION-$SKILL.start
+#     Per M8: lives under ~/.skillsmith/run (NOT /tmp) so files survive
+#     reboot; orphans GC'd by next pre-call's 1h sweep.
+#
+# OPT-IN GATES (both must pass; checked before parsing stdin):
+#   1. SKILLSMITH_TELEMETRY_DISABLE != "1"   (panic switch env var)
+#   2. ~/.skillsmith/config.json `.telemetry.enabled == true`
+#
+# VERIFICATION (1000-iteration micro-bench):
+#   PAYLOAD='{"session_id":"abc","tool_input":{"skill":"search"}}'
+#   for i in $(seq 1 1000); do
+#     printf '%s' "$PAYLOAD" | time \
+#       sh packages/cli/templates/skill-telemetry.sh pre
+#   done
+#   # Target: <25ms p95 EXCLUDING the backgrounded curl in `post`.
+#
+# Claude Code hook stdin contract:
+#   https://code.claude.com/docs/en/hooks.md
+
+set -u
+
+MODE="${1:-}"
+
+# ---- Gate 1: panic switch ----
+if [ "${SKILLSMITH_TELEMETRY_DISABLE:-}" = "1" ]; then
+  exit 0
+fi
+
+# ---- Gate 2: jq availability (defensive; required by other Skillsmith hooks) ----
+command -v jq >/dev/null 2>&1 || exit 0
+
+# ---- Gate 3: opt-in config (single jq invocation for all three reads) ----
+CONFIG="${HOME}/.skillsmith/config.json"
+if [ ! -f "$CONFIG" ]; then
+  exit 0
+fi
+# Output is newline-separated: enabled-bool, endpoint, anonymousId.
+# `jq -e` here would require a separate call; we instead check the first
+# line for "true" via `case`. One jq fork instead of three.
+CFG_OUT="$(jq -r '
+  (.telemetry.enabled // false),
+  (.telemetry.endpoint // "https://vrcnzpmndtroqxxoqkzy.supabase.co/functions/v1/events"),
+  (.telemetry.anonymousId // "")
+' "$CONFIG" 2>/dev/null)"
+# POSIX line-extraction without spawning awk/sed.
+CFG_ENABLED="${CFG_OUT%%
+*}"
+CFG_REST="${CFG_OUT#*
+}"
+ENDPOINT="${CFG_REST%%
+*}"
+ANON_ID="${CFG_REST#*
+}"
+case "$CFG_ENABLED" in
+  true) ;;
+  *) exit 0 ;;
+esac
+
+# ---- Parse Claude Code hook stdin payload (single jq for both reads) ----
+# IMPORTANT: only `.session_id` and `.tool_input.skill` are extracted.
+# `.tool_input.args` is NEVER read. See privacy invariants above.
+PAYLOAD="$(cat 2>/dev/null || printf '%s' '{}')"
+STDIN_OUT="$(printf '%s' "$PAYLOAD" | jq -r '(.session_id // ""), (.tool_input.skill // "")' 2>/dev/null)"
+SESSION_ID="${STDIN_OUT%%
+*}"
+SKILL_NAME="${STDIN_OUT#*
+}"
+
+RUN_DIR="${HOME}/.skillsmith/run"
+mkdir -p "$RUN_DIR" 2>/dev/null || true
+
+# ---- Quarantine path: unparseable payload ----
+# Per risk #13 (line 803): tool_input.skill shape changes ship a
+# `skill_invoke_unparsed` event. Emit ONLY from `pre` so we don't
+# double-count (post has no matching start file to read anyway).
+if [ -z "$SESSION_ID" ] || [ -z "$SKILL_NAME" ]; then
+  if [ "$MODE" = "pre" ] && [ -n "$ANON_ID" ]; then
+    QUARANTINE_PAYLOAD="$(jq -n \
+      --arg event 'skill_invoke_unparsed' \
+      --arg anon "$ANON_ID" \
+      --arg source 'claude-code-hook' \
+      --arg framework 'claude-code' \
+      --arg platform "$(uname -s 2>/dev/null | tr '[:upper:]' '[:lower:]')" \
+      '{event:$event, anonymous_id:$anon, metadata:{source:$source, framework:$framework, platform:$platform, success:false}}' \
+      2>/dev/null)"
+    if [ -n "$QUARANTINE_PAYLOAD" ]; then
+      nohup curl -s -m 5 -X POST \
+        -H 'Content-Type: application/json' \
+        -d "$QUARANTINE_PAYLOAD" \
+        "$ENDPOINT" >/dev/null 2>&1 &
+    fi
+  fi
+  exit 0
+fi
+
+START_FILE="$RUN_DIR/skill-${SESSION_ID}-${SKILL_NAME}.start"
+
+case "$MODE" in
+  pre)
+    # GC orphans older than 1h (mtime), then record start time (ms epoch).
+    # `find -mmin` is portable across BSD (macOS) and GNU (Linux/Git Bash).
+    find "$RUN_DIR" -maxdepth 1 -name 'skill-*.start' -type f -mmin +60 -delete 2>/dev/null || true
+    NOW_MS="$(date +%s%3N 2>/dev/null)"
+    # BSD date doesn't support %3N — falls back to seconds with 000 suffix.
+    case "$NOW_MS" in
+      *N|'')
+        NOW_MS="$(date +%s 2>/dev/null)000"
+        ;;
+    esac
+    printf '%s' "$NOW_MS" > "$START_FILE" 2>/dev/null || true
+    ;;
+
+  post)
+    if [ ! -f "$START_FILE" ]; then
+      exit 0
+    fi
+    START_MS="$(cat "$START_FILE" 2>/dev/null)"
+    rm -f "$START_FILE" 2>/dev/null || true
+    if [ -z "$START_MS" ]; then
+      exit 0
+    fi
+
+    NOW_MS="$(date +%s%3N 2>/dev/null)"
+    case "$NOW_MS" in
+      *N|'')
+        NOW_MS="$(date +%s 2>/dev/null)000"
+        ;;
+    esac
+
+    # Pure-sh integer arithmetic; both operands are integers above.
+    DURATION_MS=$((NOW_MS - START_MS))
+    if [ "$DURATION_MS" -lt 0 ]; then
+      DURATION_MS=0
+    fi
+
+    # If no anonymous id has been provisioned yet, we have nothing to send.
+    if [ -z "$ANON_ID" ]; then
+      exit 0
+    fi
+
+    PLATFORM="$(uname -s 2>/dev/null | tr '[:upper:]' '[:lower:]')"
+
+    # Build payload (see wire format at skill-invoke-telemetry.md:614-643).
+    # NOTE: only $SKILL_NAME and $SESSION_ID flow from stdin → payload.
+    # No args, no paths, no env vars.
+    PAYLOAD_JSON="$(jq -n \
+      --arg event 'skill_invoke' \
+      --arg anon "$ANON_ID" \
+      --arg skill "$SKILL_NAME" \
+      --arg session "$SESSION_ID" \
+      --argjson dur "$DURATION_MS" \
+      --arg source 'claude-code-hook' \
+      --arg framework 'claude-code' \
+      --arg platform "$PLATFORM" \
+      '{event:$event, anonymous_id:$anon, metadata:{skill_name:$skill, session_id:$session, duration_ms:$dur, source:$source, framework:$framework, platform:$platform, success:true, is_subagent:false}}' \
+      2>/dev/null)"
+
+    if [ -z "$PAYLOAD_JSON" ]; then
+      exit 0
+    fi
+
+    # Fire-and-forget. `nohup` + `&` + redirected fd's mean the parent
+    # shell does not wait on the curl process. `-m 5` caps the curl at
+    # 5s in case the endpoint is unreachable (no impact on hook latency
+    # because the curl is already detached).
+    nohup curl -s -m 5 -X POST \
+      -H 'Content-Type: application/json' \
+      -d "$PAYLOAD_JSON" \
+      "$ENDPOINT" >/dev/null 2>&1 &
+    ;;
+
+  *)
+    # Unknown mode — silently exit. Belt-and-suspenders.
+    :
+    ;;
+esac
+
+exit 0