@skillsmith/core 0.11.1 → 0.11.3

package/dist/src/services/skill-installation.helpers.test.js

@@ -0,0 +1,80 @@
+/**
+ * @fileoverview Tests for the SMI-5676 `.mcp.json` cross-check additions to
+ *   skill-installation.helpers.ts (`getRegisteredMcpServers`, and the
+ *   resolution-aware warning filtering in `extractDepIntel`).
+ * @module @skillsmith/core/services/skill-installation.helpers.test
+ * @see SMI-5676: Wave 1 Step 3b — harden extractMcpReferences
+ */
+import { describe, expect, it, beforeEach, afterEach } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { extractDepIntel, getRegisteredMcpServers } from './skill-installation.helpers.js';
+describe('getRegisteredMcpServers (SMI-5676)', () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'skillsmith-mcp-json-'));
+    });
+    afterEach(() => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('returns undefined when .mcp.json does not exist (fail open)', () => {
+        expect(getRegisteredMcpServers(tmpDir)).toBeUndefined();
+    });
+    it('returns the registered server names when .mcp.json is valid', () => {
+        fs.writeFileSync(path.join(tmpDir, '.mcp.json'), JSON.stringify({ mcpServers: { ruflo: {}, skillsmith: {} } }));
+        expect(getRegisteredMcpServers(tmpDir)).toEqual(['ruflo', 'skillsmith']);
+    });
+    it('returns an empty array when mcpServers is present but empty (checked, found nothing)', () => {
+        fs.writeFileSync(path.join(tmpDir, '.mcp.json'), JSON.stringify({ mcpServers: {} }));
+        expect(getRegisteredMcpServers(tmpDir)).toEqual([]);
+    });
+    it('fails open (returns undefined) on unparseable JSON', () => {
+        fs.writeFileSync(path.join(tmpDir, '.mcp.json'), '{ not valid json');
+        expect(getRegisteredMcpServers(tmpDir)).toBeUndefined();
+    });
+    it('fails open (returns undefined) when the mcpServers key is missing', () => {
+        fs.writeFileSync(path.join(tmpDir, '.mcp.json'), JSON.stringify({ foo: 'bar' }));
+        expect(getRegisteredMcpServers(tmpDir)).toBeUndefined();
+    });
+    it('fails open (returns undefined) when mcpServers is not an object', () => {
+        fs.writeFileSync(path.join(tmpDir, '.mcp.json'), JSON.stringify({ mcpServers: 'nope' }));
+        expect(getRegisteredMcpServers(tmpDir)).toBeUndefined();
+    });
+    it('fails open (returns undefined) when mcpServers is an array', () => {
+        fs.writeFileSync(path.join(tmpDir, '.mcp.json'), JSON.stringify({ mcpServers: ['ruflo'] }));
+        expect(getRegisteredMcpServers(tmpDir)).toBeUndefined();
+    });
+});
+describe('extractDepIntel resolution-aware warnings (SMI-5676)', () => {
+    let tmpDir;
+    let originalCwd;
+    beforeEach(() => {
+        originalCwd = process.cwd();
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'skillsmith-dep-intel-'));
+    });
+    afterEach(() => {
+        process.chdir(originalCwd);
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('does not warn about a server confirmed registered in .mcp.json', () => {
+        fs.writeFileSync(path.join(tmpDir, '.mcp.json'), JSON.stringify({ mcpServers: { linear: {} } }));
+        process.chdir(tmpDir);
+        const result = extractDepIntel('Use mcp__linear__save_issue to create issues.');
+        expect(result.dep_inferred_servers).toContain('linear');
+        expect(result.dep_warnings.some((w) => w.includes('linear'))).toBe(false);
+    });
+    it('warns about a server absent from .mcp.json (e.g. the claude-flow -> ruflo rename)', () => {
+        fs.writeFileSync(path.join(tmpDir, '.mcp.json'), JSON.stringify({ mcpServers: { ruflo: {} } }));
+        process.chdir(tmpDir);
+        const result = extractDepIntel('Use mcp__claude-flow__agent_spawn to spawn agents.');
+        expect(result.dep_inferred_servers).toContain('claude-flow');
+        expect(result.dep_warnings.some((w) => w.includes('claude-flow'))).toBe(true);
+    });
+    it('still warns when .mcp.json is missing (fail open -> unknown, not silently trusted)', () => {
+        process.chdir(tmpDir); // no .mcp.json written
+        const result = extractDepIntel('Use mcp__linear__save_issue to create issues.');
+        expect(result.dep_warnings.some((w) => w.includes('linear'))).toBe(true);
+    });
+});
+//# sourceMappingURL=skill-installation.helpers.test.js.map

package/dist/src/services/skill-installation.helpers.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.helpers.test.js","sourceRoot":"","sources":["../../../src/services/skill-installation.helpers.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACpE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAE1F,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,IAAI,MAAc,CAAA;IAElB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAC9B,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAC9D,CAAA;QACD,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QACpF,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,kBAAkB,CAAC,CAAA;QACpE,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAChF,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;QACxF,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3F,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACzD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sDAAsD,EAAE,GAAG,EAAE;IACpE,IAAI,MAAc,CAAA;IAClB,IAAI,WAAmB,CAAA;IAEvB,UAAU,CAAC,GAAG,EAAE;QACd,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;QAC3B,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAC1B,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QAChG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAErB,MAAM,MAAM,GAAG,eAAe,CAAC,+CAA+C,CAAC,CAAA;QAE/E,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/F,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAErB,MAAM,MAAM,GAAG,eAAe,CAAC,oDAAoD,CAAC,CAAA;QAEpF,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAC5D,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA,CAAC,uBAAuB;QAE7C,MAAM,MAAM,GAAG,eAAe,CAAC,+CAA+C,CAAC,CAAA;QAE/E,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/sync/inventory-collector.d.ts

@@ -9,9 +9,18 @@
  * Design parity with the CLI scanner at
  * `packages/cli/src/utils/skills-directory.ts`:
  * - Uses the SAME {@link SkillParser} to resolve `skill_id` / `version`.
- * - Realpath-deduplicates ACROSS harnesses (collapses symlink aliases), but does
- *   NOT name-deduplicate — the same skill independently installed under two
- *   harnesses is two distinct rows (the `device_skills` PK is `(harness, skill_id)`).
+ * - Realpath-memoizes the expensive SKILL.md read/parse/hash ACROSS harnesses
+ *   (a symlinked alias is parsed only once), but does NOT drop the emitted
+ *   entry for it — one row is still emitted per harness, since the same skill
+ *   independently installed (or symlink-aliased) under two harnesses must
+ *   remain two distinct rows (the `device_skills` PK is `(harness, skill_id)`).
+ *   A shared `Set<realpath>` here used to also skip the push whenever the
+ *   SAME realpath recurred under a DIFFERENT harness, collapsing legitimate
+ *   cross-harness membership (GH #1912 / SMI-5717). The fix keys the
+ *   memoization cache by realpath alone (safe — it's for parse-cost reuse
+ *   only) but keys emitted-row tracking by `(harness, realpath)` (so a
+ *   within-harness alias still collapses to one row, while a cross-harness
+ *   one does not).
  *
  * @module @skillsmith/core/sync/inventory-collector
  */
@@ -28,7 +37,9 @@ import type { InventorySkillEntry } from './inventory-types.js';
  * a `too_many_skills` 400) — silently dropping skills here would corrupt the
  * server-side reconcile by making present skills look absent.
  *
- * @returns One entry per (harness, skill), realpath-deduplicated across harnesses.
+ * @returns One entry per (harness, skill). `readSkillFields()` is memoized by
+ *   realpath across harnesses to avoid redundant parsing, but every harness
+ *   that observes the skill still gets its own row (GH #1912 / SMI-5717).
  * @see SMI-5392
  */
 export declare function collectDeviceSkills(): Promise<InventorySkillEntry[]>;

package/dist/src/sync/inventory-collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inventory-collector.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAyJ/D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAO1E"}
+{"version":3,"file":"inventory-collector.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAQH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AA0L/D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAQ1E"}

package/dist/src/sync/inventory-collector.js

@@ -9,9 +9,18 @@
  * Design parity with the CLI scanner at
  * `packages/cli/src/utils/skills-directory.ts`:
  * - Uses the SAME {@link SkillParser} to resolve `skill_id` / `version`.
- * - Realpath-deduplicates ACROSS harnesses (collapses symlink aliases), but does
- *   NOT name-deduplicate — the same skill independently installed under two
- *   harnesses is two distinct rows (the `device_skills` PK is `(harness, skill_id)`).
+ * - Realpath-memoizes the expensive SKILL.md read/parse/hash ACROSS harnesses
+ *   (a symlinked alias is parsed only once), but does NOT drop the emitted
+ *   entry for it — one row is still emitted per harness, since the same skill
+ *   independently installed (or symlink-aliased) under two harnesses must
+ *   remain two distinct rows (the `device_skills` PK is `(harness, skill_id)`).
+ *   A shared `Set<realpath>` here used to also skip the push whenever the
+ *   SAME realpath recurred under a DIFFERENT harness, collapsing legitimate
+ *   cross-harness membership (GH #1912 / SMI-5717). The fix keys the
+ *   memoization cache by realpath alone (safe — it's for parse-cost reuse
+ *   only) but keys emitted-row tracking by `(harness, realpath)` (so a
+ *   within-harness alias still collapses to one row, while a cross-harness
+ *   one does not).
  *
  * @module @skillsmith/core/sync/inventory-collector
  */
@@ -52,18 +61,25 @@ async function resolvesToDirectory(entryPath, isDirectory, isSymbolicLink) {
     }
 }
 /**
- * Read `<skillDir>/SKILL.md` and derive the inventory fields.
+ * Read `<skillDir>/SKILL.md` and derive the realpath-INVARIANT inventory
+ * fields — i.e. only what's derivable from file content, safe to memoize by
+ * realpath across harnesses (see {@link collectHarness}).
  *
  * - `content_hash` is the sha256 hex digest of the raw SKILL.md content. Wave 5
  *   validates that this hashing stays drift-aligned with the indexer's hashing.
- * - `skill_id` is the parsed `id` front-matter field, falling back to the parsed
- *   `name`, then the directory name (same precedence as the CLI scanner).
- * - A directory with no readable SKILL.md still counts as a skill: `skill_id` is
- *   the directory name, with `version`, `content_hash`, and provenance fields `null`.
+ * - `skillId` is the parsed `id` front-matter field, falling back to the parsed
+ *   `name`, or `null` when neither is present (same precedence as the CLI
+ *   scanner). It is intentionally NOT defaulted to a directory name here: two
+ *   harnesses can observe the SAME realpath under DIFFERENT directory names
+ *   (e.g. a symlink renamed on the far end), so the directory-name fallback
+ *   must be applied per-harness by the caller using ITS OWN dirent name, never
+ *   cached — caching it here would let whichever harness populated the cache
+ *   first silently overwrite the other harness's directory-derived id
+ *   (GH #1912 / SMI-5717).
  * - `author`, `license`, `repository` are self-asserted values from the SKILL.md
  *   front-matter (SMI-5442 Wave 3). They are `null` when absent or unparseable.
  */
-async function readSkillFields(skillDir, dirName) {
+async function readSkillFields(skillDir) {
     try {
         const content = await readFile(join(skillDir, 'SKILL.md'), 'utf-8');
         const contentHash = createHash('sha256').update(content, 'utf8').digest('hex');
@@ -71,7 +87,7 @@ async function readSkillFields(skillDir, dirName) {
         if (!parsed) {
             // SKILL.md is readable but has no valid frontmatter — hash still applies.
             return {
-                skillId: dirName,
+                skillId: null,
                 version: null,
                 contentHash,
                 author: null,
@@ -82,7 +98,7 @@ async function readSkillFields(skillDir, dirName) {
         // Match the CLI scanner: read `id` off the parsed metadata, then `name`.
         const parsedId = parsed['id'];
         return {
-            skillId: parsedId ?? parsed.name ?? dirName,
+            skillId: parsedId ?? parsed.name ?? null,
             version: parsed.version ?? null,
             contentHash,
             author: parsed.author ?? null,
@@ -93,7 +109,7 @@ async function readSkillFields(skillDir, dirName) {
     catch {
         // No readable SKILL.md — still a skill, but version/hash/provenance are unknown.
         return {
-            skillId: dirName,
+            skillId: null,
             version: null,
             contentHash: null,
             author: null,
@@ -103,10 +119,27 @@ async function readSkillFields(skillDir, dirName) {
     }
 }
 /**
- * Scan a single harness directory and append its skills to `entries`,
- * deduplicating by realpath via the shared `seenRealpaths` set.
+ * Scan a single harness directory and append its skills to `entries`.
+ *
+ * Two independent, differently-scoped tracking structures are threaded
+ * through every harness scan (GH #1912 / SMI-5717):
+ *
+ * - `fieldsCache` (keyed by realpath ALONE) memoizes the expensive
+ *   `readSkillFields()` parse/hash so a symlinked alias observed under a
+ *   later harness reuses the cached fields instead of re-reading/
+ *   re-parsing/re-hashing SKILL.md.
+ * - `emitted` (keyed by `` `${harness}:${realpath}` ``) tracks which
+ *   (harness, realpath) pairs have already produced a row, so an entry is
+ *   pushed exactly once per harness per underlying file. This preserves TWO
+ *   distinct behaviors at once: (a) the same realpath observed under
+ *   DIFFERENT harnesses still gets a row EACH time (cross-harness membership
+ *   — this is the bug this fix restores), and (b) multiple aliases to the
+ *   SAME realpath WITHIN one harness's own directory still collapse to a
+ *   single row for that harness (this dedup was already correct and must
+ *   not regress). A single shared Set here used to conflate both cases,
+ *   collapsing (a) as if it were (b).
  */
-async function collectHarness(harness, entries, seenRealpaths) {
+async function collectHarness(harness, entries, fieldsCache, emitted) {
     const harnessDir = CLIENT_NATIVE_PATHS[harness];
     let dirents;
     try {
@@ -129,16 +162,29 @@ async function collectHarness(harness, entries, seenRealpaths) {
         if (!(await resolvesToDirectory(entryPath, dirent.isDirectory(), dirent.isSymbolicLink()))) {
             continue;
         }
-        // Realpath dedup ACROSS harnesses: the first harness in CLIENT_IDS order
-        // wins, so a symlinked alias under a later harness is collapsed away.
         const realDir = await safeRealpath(entryPath);
-        if (seenRealpaths.has(realDir))
+        // Emit at most once per (harness, realpath): collapses multiple aliases
+        // to the same target WITHIN this harness, but — unlike the pre-fix
+        // behavior — never collapses the same realpath observed under a
+        // DIFFERENT harness, since the key includes `harness`.
+        const emittedKey = `${harness}:${realDir}`;
+        if (emitted.has(emittedKey))
             continue;
-        seenRealpaths.add(realDir);
-        const { skillId, version, contentHash, author, license, repository } = await readSkillFields(entryPath, dirent.name);
+        emitted.add(emittedKey);
+        // Realpath memoization ACROSS harnesses: the expensive SKILL.md
+        // read/parse/hash is performed only once per underlying file.
+        let fields = fieldsCache.get(realDir);
+        if (!fields) {
+            fields = await readSkillFields(entryPath);
+            fieldsCache.set(realDir, fields);
+        }
+        const { skillId, version, contentHash, author, license, repository } = fields;
         entries.push({
             harness,
-            skill_id: skillId,
+            // skillId falls back to THIS dirent's own name — never cached (see
+            // readSkillFields()'s docstring) — so a shared realpath with a
+            // different directory name under another harness doesn't leak in.
+            skill_id: skillId ?? dirent.name,
             version,
             content_hash: contentHash,
             source: null,
@@ -162,14 +208,17 @@ async function collectHarness(harness, entries, seenRealpaths) {
  * a `too_many_skills` 400) — silently dropping skills here would corrupt the
  * server-side reconcile by making present skills look absent.
  *
- * @returns One entry per (harness, skill), realpath-deduplicated across harnesses.
+ * @returns One entry per (harness, skill). `readSkillFields()` is memoized by
+ *   realpath across harnesses to avoid redundant parsing, but every harness
+ *   that observes the skill still gets its own row (GH #1912 / SMI-5717).
  * @see SMI-5392
  */
 export async function collectDeviceSkills() {
     const entries = [];
-    const seenRealpaths = new Set();
+    const fieldsCache = new Map();
+    const emitted = new Set();
     for (const harness of CLIENT_IDS) {
-        await collectHarness(harness, entries, seenRealpaths);
+        await collectHarness(harness, entries, fieldsCache, emitted);
     }
     return entries;
 }

package/dist/src/sync/inventory-collector.js.map

@@ -1 +1 @@
-{"version":3,"file":"inventory-collector.js","sourceRoot":"","sources":["../../../src/sync/inventory-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAiB,MAAM,qBAAqB,CAAA;AAGpF;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,WAAoB,EACpB,cAAuB;IAEvB,IAAI,WAAW;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAA;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,iBAAiB;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,OAAe;IASf,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;QACnE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,0EAA0E;YAC1E,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,IAAI;gBACb,WAAW;gBACX,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,IAAI;aACjB,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,MAAM,QAAQ,GAAI,MAA6C,CAAC,IAAI,CAAuB,CAAA;QAC3F,OAAO;YACL,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO;YAC3C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;SACtC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;QACjF,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;SACjB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAiB,EACjB,OAA8B,EAC9B,aAA0B;IAE1B,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAE/C,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;QAClD,2EAA2E;QAC3E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAM;QACnD,MAAM,KAAK,CAAA;IACb,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC;YAC3F,SAAQ;QACV,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;QAC7C,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAQ;QACxC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAE1B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAC1F,SAAS,EACT,MAAM,CAAC,IAAI,CACZ,CAAA;QACD,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,QAAQ,EAAE,OAAO;YACjB,OAAO;YACP,YAAY,EAAE,WAAW;YACzB,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,OAAO;YACP,UAAU;YACV,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,OAAO,GAA0B,EAAE,CAAA;IACzC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"inventory-collector.js","sourceRoot":"","sources":["../../../src/sync/inventory-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAiB,MAAM,qBAAqB,CAAA;AAGpF;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,WAAoB,EACpB,cAAuB;IAEvB,IAAI,WAAW;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAA;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,iBAAiB;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,eAAe,CAAC,QAAgB;IAQ7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;QACnE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,0EAA0E;YAC1E,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;gBACb,WAAW;gBACX,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,IAAI;aACjB,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,MAAM,QAAQ,GAAI,MAA6C,CAAC,IAAI,CAAuB,CAAA;QAC3F,OAAO;YACL,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI;YACxC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;SACtC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;QACjF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;SACjB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAiB,EACjB,OAA8B,EAC9B,WAAqE,EACrE,OAAoB;IAEpB,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAE/C,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;QAClD,2EAA2E;QAC3E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAM;QACnD,MAAM,KAAK,CAAA;IACb,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC;YAC3F,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;QAE7C,wEAAwE;QACxE,mEAAmE;QACnE,gEAAgE;QAChE,uDAAuD;QACvD,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,OAAO,EAAE,CAAA;QAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAQ;QACrC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAEvB,gEAAgE;QAChE,8DAA8D;QAC9D,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAA;YACzC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAClC,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;QAC7E,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,mEAAmE;YACnE,+DAA+D;YAC/D,kEAAkE;YAClE,QAAQ,EAAE,OAAO,IAAI,MAAM,CAAC,IAAI;YAChC,OAAO;YACP,YAAY,EAAE,WAAW;YACzB,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,OAAO;YACP,UAAU;YACV,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,OAAO,GAA0B,EAAE,CAAA;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuD,CAAA;IAClF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/src/sync/inventory-collector.test.d.ts

@@ -7,8 +7,22 @@
  * without re-importing the module.
  *
  * IC-1: same skill under two harnesses (distinct realpaths) -> two entries.
- * IC-2: a symlinked alias across harnesses -> one entry (first ClientId wins).
+ * IC-2: a symlinked alias across harnesses -> two entries, one per harness
+ *       (GH #1912 / SMI-5717 — cross-harness membership is preserved; only
+ *       the expensive SKILL.md parse is memoized by realpath).
  * IC-3: readable SKILL.md -> content_hash + version; missing SKILL.md -> nulls.
+ * IC-8: guards the memoization itself — SkillParser.parse is called exactly
+ *       once across two harnesses sharing a realpath (GH #1912 / SMI-5717).
+ * IC-9: two aliases to the same realpath WITHIN one harness still collapse
+ *       to a single row for that harness — the fix for IC-2 must not
+ *       regress this pre-existing, correct within-harness dedup (SMI-5717).
+ * IC-10: a symlinked pair with DIFFERENT dirent names on each end and NO
+ *        SKILL.md (so skill_id falls back to the directory name) — guards
+ *        that the fallback is computed per-harness, not cached inside
+ *        readSkillFields() (the actual Correction 1 bug: IC-1/IC-2/IC-8 all
+ *        happen to use a `name:` front-matter field and matching dirent
+ *        names on both ends, so they'd still pass even if the fallback were
+ *        wrongly cached) (SMI-5717).
  */
 export {};
 //# sourceMappingURL=inventory-collector.test.d.ts.map

package/dist/src/sync/inventory-collector.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inventory-collector.test.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-collector.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}
+{"version":3,"file":"inventory-collector.test.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-collector.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}

package/dist/src/sync/inventory-collector.test.js

@@ -7,13 +7,28 @@
  * without re-importing the module.
  *
  * IC-1: same skill under two harnesses (distinct realpaths) -> two entries.
- * IC-2: a symlinked alias across harnesses -> one entry (first ClientId wins).
+ * IC-2: a symlinked alias across harnesses -> two entries, one per harness
+ *       (GH #1912 / SMI-5717 — cross-harness membership is preserved; only
+ *       the expensive SKILL.md parse is memoized by realpath).
  * IC-3: readable SKILL.md -> content_hash + version; missing SKILL.md -> nulls.
+ * IC-8: guards the memoization itself — SkillParser.parse is called exactly
+ *       once across two harnesses sharing a realpath (GH #1912 / SMI-5717).
+ * IC-9: two aliases to the same realpath WITHIN one harness still collapse
+ *       to a single row for that harness — the fix for IC-2 must not
+ *       regress this pre-existing, correct within-harness dedup (SMI-5717).
+ * IC-10: a symlinked pair with DIFFERENT dirent names on each end and NO
+ *        SKILL.md (so skill_id falls back to the directory name) — guards
+ *        that the fallback is computed per-harness, not cached inside
+ *        readSkillFields() (the actual Correction 1 bug: IC-1/IC-2/IC-8 all
+ *        happen to use a `name:` front-matter field and matching dirent
+ *        names on both ends, so they'd still pass even if the fallback were
+ *        wrongly cached) (SMI-5717).
  */
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { mkdtemp, mkdir, writeFile, symlink, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { SkillParser } from '../indexer/SkillParser.js';
 const mockPaths = vi.hoisted(() => ({
     CLIENT_IDS: ['claude-code', 'cursor', 'copilot', 'windsurf', 'agents'],
     CLIENT_NATIVE_PATHS: {},
@@ -70,15 +85,20 @@ describe('inventory-collector', () => {
         expect(foo.every((e) => e.source === null && e.pinned_version === null)).toBe(true);
         expect(foo.every((e) => e.update_policy === null)).toBe(true);
     });
-    it('IC-2: collapses a symlinked alias across harnesses to one entry (first ClientId wins)', async () => {
+    it('IC-2: emits one entry per harness for a symlinked alias — preserves cross-harness membership (GH #1912)', async () => {
         const real = await createSkill('claude-code', 'bar', { version: '1.0.0' });
         await mkdir(mockPaths.CLIENT_NATIVE_PATHS['agents'], { recursive: true });
         await symlink(real, join(mockPaths.CLIENT_NATIVE_PATHS['agents'], 'bar'), 'dir');
         const entries = await collectDeviceSkills();
         const bar = entries.filter((e) => e.skill_id === 'bar');
-        expect(bar).toHaveLength(1);
-        // claude-code precedes agents in CLIENT_IDS, so it wins the dedup.
-        expect(bar[0]?.harness).toBe('claude-code');
+        // A symlinked alias across harnesses must NOT collapse to one row — the
+        // skill is genuinely installed under both harnesses.
+        expect(bar).toHaveLength(2);
+        expect(bar.map((e) => e.harness).sort()).toEqual(['agents', 'claude-code']);
+        // Same underlying file: the memoized parse yields the same content_hash
+        // for both rows.
+        expect(bar[0]?.content_hash).toBeTruthy();
+        expect(bar[0]?.content_hash).toBe(bar[1]?.content_hash);
     });
     // IC-4: No truncation at MAX_SKILLS boundary.
     //
@@ -152,5 +172,55 @@ describe('inventory-collector', () => {
         expect(entries.find((e) => e.skill_id === '.backups')).toBeUndefined();
         expect(entries.some((e) => e.skill_id.startsWith('.'))).toBe(false);
     });
+    // IC-8: guards the memoization optimization itself (GH #1912 / SMI-5717) —
+    // not just the entry count from IC-2. The expensive parse must happen once
+    // per underlying realpath, even though two harnesses now both get a row.
+    it('IC-8: memoizes SkillParser.parse by realpath — called exactly once across two harnesses sharing a symlinked alias', async () => {
+        const parseSpy = vi.spyOn(SkillParser.prototype, 'parse');
+        const real = await createSkill('claude-code', 'bar', { version: '1.0.0' });
+        await mkdir(mockPaths.CLIENT_NATIVE_PATHS['agents'], { recursive: true });
+        await symlink(real, join(mockPaths.CLIENT_NATIVE_PATHS['agents'], 'bar'), 'dir');
+        const entries = await collectDeviceSkills();
+        const bar = entries.filter((e) => e.skill_id === 'bar');
+        expect(bar).toHaveLength(2);
+        expect(parseSpy).toHaveBeenCalledTimes(1);
+        parseSpy.mockRestore();
+    });
+    // IC-9: regression guard for the (harness, realpath) emitted-tracking fix.
+    // Two DIFFERENT dirents in the SAME harness's directory that resolve to the
+    // SAME realpath (e.g. a self-referential alias) must still collapse to one
+    // row for that harness — only the CROSS-harness case (IC-2) should stop
+    // collapsing.
+    it('IC-9: two aliases to the same realpath within one harness still collapse to one row', async () => {
+        const real = await createSkill('claude-code', 'baz', { version: '1.0.0' });
+        await symlink(real, join(mockPaths.CLIENT_NATIVE_PATHS['claude-code'], 'baz-alias'), 'dir');
+        const entries = await collectDeviceSkills();
+        const claudeCodeBaz = entries.filter((e) => e.harness === 'claude-code' && e.skill_id === 'baz');
+        // Only ONE row for claude-code, even though the directory listing has
+        // two dirents ('baz' and 'baz-alias') pointing at the same realpath.
+        expect(claudeCodeBaz).toHaveLength(1);
+        // No stray row was emitted keyed by the alias's own directory name either.
+        expect(entries.some((e) => e.skill_id === 'baz-alias')).toBe(false);
+    });
+    // IC-10: the actual Correction 1 regression guard. No SKILL.md at all, so
+    // readSkillFields()'s cached skillId is null and skill_id must fall back to
+    // EACH harness's own dirent name — never a name cached from the FIRST
+    // harness to populate fieldsCache. IC-1/IC-2/IC-8 all use a `name:`
+    // front-matter field with matching dirent names on both ends, so a
+    // regression that re-introduced caching the dirName fallback inside
+    // readSkillFields() would still pass all of them.
+    it("IC-10: skill_id fallback uses EACH harness's own directory name, not one cached from another harness", async () => {
+        const real = await createSkill('claude-code', 'shared-skill', { withSkillMd: false });
+        await mkdir(mockPaths.CLIENT_NATIVE_PATHS['agents'], { recursive: true });
+        await symlink(real, join(mockPaths.CLIENT_NATIVE_PATHS['agents'], 'renamed-alias'), 'dir');
+        const entries = await collectDeviceSkills();
+        const claudeCode = entries.find((e) => e.harness === 'claude-code');
+        const agents = entries.find((e) => e.harness === 'agents');
+        expect(claudeCode?.skill_id).toBe('shared-skill');
+        expect(agents?.skill_id).toBe('renamed-alias');
+        // Neither row leaked the other harness's directory name.
+        expect(entries.some((e) => e.harness === 'claude-code' && e.skill_id === 'renamed-alias')).toBe(false);
+        expect(entries.some((e) => e.harness === 'agents' && e.skill_id === 'shared-skill')).toBe(false);
+    });
 });
 //# sourceMappingURL=inventory-collector.test.js.map

package/dist/src/sync/inventory-collector.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"inventory-collector.test.js","sourceRoot":"","sources":["../../../src/sync/inventory-collector.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClC,UAAU,EAAE,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAU;IAC/E,mBAAmB,EAAE,EAA4B;CAClD,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,UAAU,EAAE,SAAS,CAAC,UAAU;IAChC,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;CACnD,CAAC,CAAC,CAAA;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,SAAS,OAAO,CAAC,IAAY,EAAE,OAAgB;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,OAAO,cAAc,IAAI,GAAG,WAAW,cAAc,IAAI,IAAI,CAAA;AAC/D,CAAC;AAQD,SAAS,qBAAqB,CAC5B,IAAY,EACZ,UAA4B,EAC5B,OAAgB;IAEhB,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5E,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACtF,OAAO,cAAc,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,cAAc,IAAI,IAAI,CAAA;AACrG,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAe,EACf,IAAY,EACZ,OAAsE,EAAE;IAExE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAW,EAAE,IAAI,CAAC,CAAA;IACxE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrC,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,IAAI,IAAY,CAAA;AAEhB,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;QACtD,uEAAuE;QACvE,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACtC,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,EAAE,CAAC,eAAe,EAAE,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7D,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAExD,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;QAEvD,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC3E,6EAA6E;QAC7E,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvE,0DAA0D;QAC1D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1E,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAW,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QAE1F,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;QAEvD,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,8CAA8C;IAC9C,EAAE;IACF,4EAA4E;IAC5E,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,MAAM,CAAC,GAAG,CAAC,CAAA;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAA;QAEtE,gFAAgF;QAChF,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,qEAAqE;QACrE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,WAAW,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAChE,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QAE3D,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;QAEvD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAEtD,0EAA0E;QAC1E,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;QAChC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,WAAW,CAAC,aAAa,EAAE,kBAAkB,EAAE;YACnD,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,qBAAqB,CAC5B,kBAAkB,EAClB;gBACE,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,+BAA+B;aAC5C,EACD,OAAO,CACR;SACF,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,kBAAkB,CAAC,CAAA;QAEpE,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACxC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,uEAAuE;QACvE,MAAM,WAAW,CAAC,aAAa,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAEvE,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAA;QAEjE,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;QACjC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC7G,MAAM,WAAW,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAEpE,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,aAAa,CAAW,EAAE,UAAU,CAAC,CAAA;QAC3F,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAE9D,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAE3C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"inventory-collector.test.js","sourceRoot":"","sources":["../../../src/sync/inventory-collector.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClC,UAAU,EAAE,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAU;IAC/E,mBAAmB,EAAE,EAA4B;CAClD,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,UAAU,EAAE,SAAS,CAAC,UAAU;IAChC,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;CACnD,CAAC,CAAC,CAAA;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,SAAS,OAAO,CAAC,IAAY,EAAE,OAAgB;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,OAAO,cAAc,IAAI,GAAG,WAAW,cAAc,IAAI,IAAI,CAAA;AAC/D,CAAC;AAQD,SAAS,qBAAqB,CAC5B,IAAY,EACZ,UAA4B,EAC5B,OAAgB;IAEhB,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5E,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACtF,OAAO,cAAc,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,cAAc,IAAI,IAAI,CAAA;AACrG,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAe,EACf,IAAY,EACZ,OAAsE,EAAE;IAExE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAW,EAAE,IAAI,CAAC,CAAA;IACxE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrC,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,IAAI,IAAY,CAAA;AAEhB,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;QACtD,uEAAuE;QACvE,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACtC,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,EAAE,CAAC,eAAe,EAAE,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7D,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAExD,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;QAEvD,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC3E,6EAA6E;QAC7E,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvE,0DAA0D;QAC1D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;QACvH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1E,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAW,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QAE1F,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;QAEvD,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAA;QAC3E,wEAAwE;QACxE,iBAAiB;QACjB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,UAAU,EAAE,CAAA;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,8CAA8C;IAC9C,EAAE;IACF,4EAA4E;IAC5E,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,MAAM,CAAC,GAAG,CAAC,CAAA;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAA;QAEtE,gFAAgF;QAChF,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,qEAAqE;QACrE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,WAAW,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAChE,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QAE3D,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;QAEvD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAEtD,0EAA0E;QAC1E,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;QAChC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,WAAW,CAAC,aAAa,EAAE,kBAAkB,EAAE;YACnD,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,qBAAqB,CAC5B,kBAAkB,EAClB;gBACE,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,+BAA+B;aAC5C,EACD,OAAO,CACR;SACF,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,kBAAkB,CAAC,CAAA;QAEpE,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACxC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,uEAAuE;QACvE,MAAM,WAAW,CAAC,aAAa,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAEvE,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAA;QAEjE,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;QACjC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC7G,MAAM,WAAW,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAEpE,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,aAAa,CAAW,EAAE,UAAU,CAAC,CAAA;QAC3F,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAE9D,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAE3C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,EAAE,CAAC,mHAAmH,EAAE,KAAK,IAAI,EAAE;QACjI,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAEzD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1E,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAW,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QAE1F,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;QAEvD,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAEzC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,cAAc;IACd,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1E,MAAM,OAAO,CACX,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,aAAa,CAAW,EAAE,WAAW,CAAC,EACzE,KAAK,CACN,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;QAEhG,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,CAAC,aAAa,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACrC,2EAA2E;QAC3E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,kDAAkD;IAClD,EAAE,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;QACpH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,cAAc,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QACrF,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,MAAM,OAAO,CACX,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAW,EAAE,eAAe,CAAC,EACxE,KAAK,CACN,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAA;QAE1D,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC9C,yDAAyD;QACzD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,IAAI,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAC7F,KAAK,CACN,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClG,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/telemetry/tracer-imports.d.ts

@@ -5,7 +5,7 @@
  * having to mock all of tracer.ts. The class registry encodes which OTel
  * instrumentation packages tracer.ts attempts to load on init; each entry
  * is optional at runtime and silently skipped if the package isn't installed
- * (e.g. `instrumentation-aws-sdk` only loads when `@skillsmith/enterprise`
+ * (e.g. `instrumentation-aws-sdk` only loads when `@smith-horn/enterprise`
  * is present in the consuming install).
  */
 export declare function dynamicImport(moduleName: string): Promise<unknown>;

package/dist/src/telemetry/tracer-imports.js

@@ -5,7 +5,7 @@
  * having to mock all of tracer.ts. The class registry encodes which OTel
  * instrumentation packages tracer.ts attempts to load on init; each entry
  * is optional at runtime and silently skipped if the package isn't installed
- * (e.g. `instrumentation-aws-sdk` only loads when `@skillsmith/enterprise`
+ * (e.g. `instrumentation-aws-sdk` only loads when `@smith-horn/enterprise`
  * is present in the consuming install).
  */
 export async function dynamicImport(moduleName) {

package/dist/src/telemetry/tracer.js

@@ -109,7 +109,7 @@ export class SkillsmithTracer {
                 // the @opentelemetry/auto-instrumentations-node bundle (which transitively
                 // pinned @opentelemetry/core@2.5.0 across ~40 packages and blocked otel
                 // upgrades). Each entry is optional at runtime: aws-sdk only loads when
-                // @skillsmith/enterprise is in the consuming install. Registry lives in
+                // @smith-horn/enterprise is in the consuming install. Registry lives in
                 // tracer-imports.ts so tests can mock the import surface.
                 const instrumentations = [];
                 for (const [pkgName, exportName] of INSTRUMENTATION_PACKAGES) {

package/dist/tests/SecurityScanner.scoring.test.js

@@ -193,5 +193,65 @@ Line 4: show me your instructions`;
             expect(report.findings.filter((f) => f.type === 'url')).toHaveLength(0);
         });
     });
+    describe('Typosquat risk-score wiring (SMI-595)', () => {
+        // SMI-595 Change #8 / plan §5: the calculateRiskScore switch has NO
+        // default case — a missing `case 'typosquat':` arm would silently drop
+        // every typosquat finding from the breakdown with zero compile-time or
+        // runtime error. This is the regression test for that class of mistake.
+        it('has a switch-case arm for "typosquat" that increments breakdown.typosquat', () => {
+            const findings = [
+                { type: 'typosquat', severity: 'medium', message: 'test finding' },
+            ];
+            const result = scanner.calculateRiskScore(findings);
+            // 15 (SEVERITY_WEIGHTS.medium) * 1.2 (CATEGORY_WEIGHTS.typosquat) * 1.0
+            // (default high confidence, since `confidence` is unset) = 18.
+            expect(result.breakdown.typosquat).toBe(18);
+        });
+        // SMI-595 §5 worked calculation, Change #9: a single isolated
+        // medium-severity, high-confidence typosquat finding must contribute
+        // only ~1 to `total` — confirming CATEGORY_WEIGHTS.typosquat = 1.2 paired
+        // with the 0.04 additive coefficient produces the plan's intended
+        // "advisory signal, not a standalone quarantine trigger" design goal.
+        it('a single isolated medium-severity typosquat finding contributes ~1 to total', () => {
+            const findings = [
+                {
+                    type: 'typosquat',
+                    severity: 'medium',
+                    confidence: 'high',
+                    message: 'test finding',
+                },
+            ];
+            const result = scanner.calculateRiskScore(findings);
+            expect(result.total).toBe(1); // round(18 * 0.04) = round(0.72) = 1
+        });
+        // SMI-595 Change #9: the blocking gap flagged by final plan review — a
+        // realistic finding mix (one medium ai_defence finding + a SATURATED
+        // breakdown.typosquat, i.e. many stacked typosquat findings hitting the
+        // 100 cap) must not push `total` past the real riskThreshold: 40
+        // (packages/core/src/scripts/skill-scanner/scanner.ts) in a way that
+        // surprises expectations.
+        it('a saturated typosquat breakdown stacked with a realistic finding mix stays well under riskThreshold: 40', () => {
+            const typosquatFindings = Array.from({ length: 10 }, () => ({
+                type: 'typosquat',
+                severity: 'medium',
+                confidence: 'high',
+                message: 'stacked typosquat finding',
+            }));
+            const aiDefenceFinding = {
+                type: 'ai_defence',
+                severity: 'medium',
+                confidence: 'high',
+                message: 'realistic pre-existing finding',
+            };
+            const result = scanner.calculateRiskScore([...typosquatFindings, aiDefenceFinding]);
+            // 10 findings * 18 each = 180 -> capped at 100.
+            expect(result.breakdown.typosquat).toBe(100);
+            // 15 (medium) * 1.9 (CATEGORY_WEIGHTS.ai_defence) * 1.0 (high confidence) = 28.5.
+            expect(result.breakdown.aiDefence).toBeCloseTo(28.5);
+            // round(100 * 0.04 + 28.5 * 0.12) = round(4 + 3.42) = round(7.42) = 7.
+            expect(result.total).toBe(7);
+            expect(result.total).toBeLessThan(40);
+        });
+    });
 });
 //# sourceMappingURL=SecurityScanner.scoring.test.js.map