@skillsmith/core 0.11.4 → 0.11.6

package/dist/tests/unit/services/skill-installation.io.client-agent-path.test.js

@@ -0,0 +1,246 @@
+/**
+ * SMI-5980 (Wave 3): writeInstallFiles must route the companion-subagent
+ * write through COMPANION_AGENT_TARGETS (install/paths.ts) for the caller's
+ * `client`, not a hardcoded `path.join(os.homedir(), '.claude', 'agents')`
+ * literal.
+ *
+ * `homedir()` is mocked to a controlled tmp directory BEFORE `paths.ts` is
+ * first imported — COMPANION_AGENT_TARGETS is a module-level constant
+ * computed once at import time from `homedir()`, so every assertion below
+ * compares against that SAME already-resolved map rather than a second,
+ * independently-hardcoded expectation. This also keeps the test from ever
+ * writing to a real developer/CI machine's actual home directory.
+ *
+ * SMI-5982 (Wave 6): antigravity's `COMPANION_AGENT_TARGETS` entry uses a
+ * RELATIVE `dir` (resolved against `process.cwd()`, not `homedir()`) — its
+ * own dedicated describe block below chdir's into an isolated tmp directory
+ * per test (never TEST_HOME, never the real repo checkout) rather than
+ * relying on the homedir() mock every other client's assertions use.
+ *
+ * SMI-5982 code-review fix #1 (BLOCKING, cwd-dependent resolution):
+ * `writeInstallFiles()` now resolves antigravity's relative `dir` via
+ * `resolveCompanionAgentPath()`'s explicit `baseDir` param (defaulting to
+ * `process.cwd()` at the call site, not deferred to whatever `fs` call
+ * eventually consumes the path) — so `result.subagentPath` is now an
+ * ABSOLUTE path even for antigravity, not the raw relative string. The
+ * `it.each` below covers both the omitted-`companionBaseDir` (falls back to
+ * `process.cwd()`, which this describe block's chdir controls) and an
+ * explicit `companionBaseDir` override.
+ *
+ * Split out of skill-installation.io.test.ts to stay under the 500-line
+ * CI gate (same rationale as skill-installation.io.symlink.test.ts).
+ */
+import { afterAll, afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import * as os from 'node:os';
+const { TEST_HOME, homedirMock } = vi.hoisted(() => {
+    const home = '/tmp/skillsmith-wif-client-agent-path-test-' + process.pid;
+    return { TEST_HOME: home, homedirMock: vi.fn(() => home) };
+});
+vi.mock('node:os', async (importOriginal) => {
+    const actual = await importOriginal();
+    return { ...actual, homedir: homedirMock };
+});
+import { writeInstallFiles } from '../../../src/services/skill-installation.io.js';
+import { CLIENT_IDS, COMPANION_AGENT_TARGETS } from '../../../src/install/paths.js';
+afterAll(async () => {
+    await fs.rm(TEST_HOME, { recursive: true, force: true }).catch(() => { });
+});
+/**
+ * Fresh skillsDir/installPath per test so parallel `it.each` iterations
+ * (all sharing TEST_HOME) never collide with each other.
+ */
+async function freshInstallPath(label) {
+    const skillsDir = path.join(TEST_HOME, 'src', label, 'skills');
+    await fs.mkdir(skillsDir, { recursive: true });
+    return { skillsDir, installPath: path.join(skillsDir, 'my-skill') };
+}
+describe('writeInstallFiles companion-subagent path per client (SMI-5980 regression)', () => {
+    beforeEach(() => {
+        homedirMock.mockReturnValue(TEST_HOME);
+    });
+    // SMI-5982 (Wave 6): antigravity is excluded from this generic 'flat'
+    // it.each — its dir is a RELATIVE path (resolved against process.cwd(),
+    // NOT the mocked homedir()), so writing it here would land outside
+    // TEST_HOME, pollute the real working tree, and never get cleaned up by
+    // this file's afterAll. It gets its own cwd-isolated describe block below.
+    it.each(CLIENT_IDS.filter((id) => id !== 'antigravity'))('writes the companion subagent for client=%s at exactly COMPANION_AGENT_TARGETS[client]', async (client) => {
+        const { skillsDir, installPath } = await freshInstallPath(client);
+        const result = await writeInstallFiles(installPath, skillsDir, 'my-skill', '# hello', [], '---\nname: my-skill-specialist\n---\nbody', client);
+        // Every remaining client uses 'flat' mode (copilot's own
+        // '{name}.agent.md' pattern, SMI-5980 PR-review finding, included).
+        const target = COMPANION_AGENT_TARGETS[client];
+        const expectedPath = path.join(target.dir, target.filenamePattern.replace('{name}', 'my-skill'));
+        expect(result.subagentPath).toBe(expectedPath);
+        expect(await fs.readFile(expectedPath, 'utf8')).toBe('---\nname: my-skill-specialist\n---\nbody');
+    });
+    it('defaults to the canonical (claude-code) target when client is omitted (regression: unchanged)', async () => {
+        const { skillsDir, installPath } = await freshInstallPath('default-client');
+        const result = await writeInstallFiles(installPath, skillsDir, 'my-skill', '# hello', [], 'subagent body'
+        // client omitted — must resolve exactly like the old hardcoded default.
+        );
+        const expectedPath = path.join(COMPANION_AGENT_TARGETS['claude-code'].dir, 'my-skill-specialist.md');
+        expect(result.subagentPath).toBe(expectedPath);
+        expect(await fs.readFile(expectedPath, 'utf8')).toBe('subagent body');
+    });
+    it('claude-code and cursor land in the SAME directory (both default, no independent evidence for cursor)', async () => {
+        const claudeCode = await freshInstallPath('cc-vs-cursor-claude');
+        const cursor = await freshInstallPath('cc-vs-cursor-cursor');
+        const claudeResult = await writeInstallFiles(claudeCode.installPath, claudeCode.skillsDir, 'my-skill', '# hello', [], 'body', 'claude-code');
+        const cursorResult = await writeInstallFiles(cursor.installPath, cursor.skillsDir, 'my-skill', '# hello', [], 'body', 'cursor');
+        expect(path.dirname(cursorResult.subagentPath ?? '')).toBe(path.dirname(claudeResult.subagentPath ?? ''));
+    });
+    it('copilot and opencode land at their own real, literal directories (code-review finding: not just "different from claude-code")', async () => {
+        const copilot = await freshInstallPath('copilot-diff');
+        const opencode = await freshInstallPath('opencode-diff');
+        const copilotResult = await writeInstallFiles(copilot.installPath, copilot.skillsDir, 'my-skill', '# hello', [], 'body', 'copilot');
+        const opencodeResult = await writeInstallFiles(opencode.installPath, opencode.skillsDir, 'my-skill', '# hello', [], 'body', 'opencode');
+        // Independently-constructed literal expected paths (via the SAME mocked
+        // TEST_HOME this file's own homedir() mock uses, but NOT derived from
+        // COMPANION_AGENT_TARGETS itself) — a code-review pass on an earlier
+        // version of this test caught that comparing only against
+        // COMPANION_AGENT_TARGETS['claude-code'].dir proves "different from
+        // claude-code," not "equals the actual intended copilot/opencode value";
+        // a typo in the map (e.g. singular '.copilot/agent') would have still
+        // passed the old assertion.
+        expect(path.dirname(copilotResult.subagentPath ?? '')).toBe(path.join(TEST_HOME, '.copilot', 'agents'));
+        expect(path.dirname(opencodeResult.subagentPath ?? '')).toBe(path.join(TEST_HOME, '.config', 'opencode', 'agents'));
+        // Belt-and-suspenders: still confirm both differ from claude-code's dir.
+        expect(path.dirname(copilotResult.subagentPath ?? '')).not.toBe(COMPANION_AGENT_TARGETS['claude-code'].dir);
+        expect(path.dirname(opencodeResult.subagentPath ?? '')).not.toBe(COMPANION_AGENT_TARGETS['claude-code'].dir);
+    });
+    it('does not write any companion-subagent file when subagentContent is undefined, regardless of client', async () => {
+        const { skillsDir, installPath } = await freshInstallPath('no-subagent');
+        const result = await writeInstallFiles(installPath, skillsDir, 'my-skill', '# hello', [], undefined, 'copilot');
+        expect(result.subagentPath).toBeUndefined();
+    });
+});
+/**
+ * SMI-5982 (Wave 6): antigravity's companion-agent dir is a RELATIVE path
+ * (`.agents/agents`, project-scoped per the plan's Step 1 — no existing
+ * global-vs-project distinction to hook into) resolved against
+ * `process.cwd()`, unlike every other client's `homedir()`-anchored
+ * absolute dir. This describe block is isolated from the rest of the file:
+ * each test chdir's into its own fresh tmp directory (never TEST_HOME, and
+ * never the real repo checkout) and restores the original cwd in
+ * `afterEach` even on assertion failure, so a broken assertion can never
+ * leave the whole test PROCESS's cwd corrupted for later tests/files.
+ */
+describe('writeInstallFiles companion-subagent path for antigravity (directory-package, SMI-5982 Wave 6)', () => {
+    let originalCwd;
+    let projectDir;
+    beforeEach(async () => {
+        originalCwd = process.cwd();
+        projectDir = await fs.mkdtemp(path.join(os.tmpdir(), 'skillsmith-antigravity-cwd-'));
+        process.chdir(projectDir);
+    });
+    afterEach(async () => {
+        process.chdir(originalCwd);
+        await fs.rm(projectDir, { recursive: true, force: true }).catch(() => { });
+    });
+    it('writes agent.md inside a skill-named subdirectory when companionBaseDir is passed explicitly (SMI-5982 code-review fix #1)', async () => {
+        const { skillsDir, installPath } = await freshInstallPath('antigravity-write');
+        const result = await writeInstallFiles(installPath, skillsDir, 'my-skill', '# hello', [], '---\nname: my-skill-specialist\n---\nbody', 'antigravity', 
+        // PR-review follow-up: writeInstallFiles() no longer falls back to
+        // process.cwd() itself when companionBaseDir is omitted — an explicit
+        // value (here, this describe block's chdir target) is required for
+        // directory-package clients. See the dedicated "omitted
+        // companionBaseDir" test below for the fail-closed case.
+        projectDir);
+        // SMI-5982 code-review fix #1: resolveCompanionAgentPath() resolves
+        // antigravity's relative dir against the explicit baseDir BEFORE
+        // returning — so subagentPath is ABSOLUTE, not the raw relative string.
+        // Independently verify the REAL file via an absolute path built from the
+        // known projectDir (not derived from result.subagentPath, so a bug that
+        // silently mis-resolved the value would still be caught).
+        const expectedRelativePath = path.join('.agents', 'agents', 'my-skill', 'agent.md');
+        const expectedAbsolutePath = path.join(projectDir, expectedRelativePath);
+        expect(result.subagentPath).toBe(expectedAbsolutePath);
+        expect(await fs.readFile(expectedAbsolutePath, 'utf8')).toBe('---\nname: my-skill-specialist\n---\nbody');
+        // Directory-package structure: agent.md lives INSIDE a subdirectory
+        // named after the skill, not directly inside the agents dir.
+        expect(path.basename(path.dirname(expectedAbsolutePath))).toBe('my-skill');
+    });
+    it('omitting companionBaseDir for antigravity now rejects the install instead of silently defaulting to process.cwd() (PR-review follow-up)', async () => {
+        const { skillsDir, installPath } = await freshInstallPath('antigravity-omitted-basedir');
+        await expect(writeInstallFiles(installPath, skillsDir, 'my-skill', '# hello', [], '---\nname: my-skill-specialist\n---\nbody', 'antigravity'
+        // companionBaseDir omitted — must now throw (fail closed), not
+        // resolve against process.cwd(). SKILL.md IS written before this
+        // point (the companion-agent step runs last), but writeInstallFiles'
+        // existing rollback-on-failure logic unwinds installPath entirely on
+        // any thrown error — so nothing survives on disk after the throw.
+        )).rejects.toThrow(/directory-package mode.*explicit baseDir is required/s);
+        await expect(fs.access(installPath)).rejects.toThrow();
+    });
+    it('writes agent.md resolved against an explicit companionBaseDir, not process.cwd() (SMI-5982 code-review fix #1)', async () => {
+        // Deliberately DIFFERENT from projectDir (this block's chdir target) to
+        // prove companionBaseDir — not the ambient cwd — drives resolution. This
+        // is exactly the MCP-server scenario the fix targets: a long-running
+        // process whose own cwd does not track the caller's real project.
+        const explicitBaseDir = await fs.mkdtemp(path.join(os.tmpdir(), 'skillsmith-antigravity-explicit-basedir-'));
+        try {
+            const { skillsDir, installPath } = await freshInstallPath('antigravity-explicit-basedir');
+            const result = await writeInstallFiles(installPath, skillsDir, 'my-skill', '# hello', [], '---\nname: my-skill-specialist\n---\nbody', 'antigravity', explicitBaseDir);
+            const expectedAbsolutePath = path.join(explicitBaseDir, '.agents', 'agents', 'my-skill', 'agent.md');
+            expect(result.subagentPath).toBe(expectedAbsolutePath);
+            expect(result.subagentPath?.startsWith(projectDir)).toBe(false);
+            expect(await fs.readFile(expectedAbsolutePath, 'utf8')).toBe('---\nname: my-skill-specialist\n---\nbody');
+        }
+        finally {
+            await fs.rm(explicitBaseDir, { recursive: true, force: true }).catch(() => { });
+        }
+    });
+    it('a safeWriteFile failure on the companion-agent path does not crash, and never force-removes a non-empty per-skill directory', async () => {
+        // Reachable, non-mocked failure mode for the LAST step in
+        // writeInstallFiles's try block (companion-agent write): a symlink
+        // already sitting at the exact target path. safeWriteFile's O_NOFOLLOW
+        // open() refuses it (SymlinkError), so the rollback branch added in
+        // SMI-5982 runs with subagentPath already assigned. The per-skill
+        // directory is NOT empty (the symlink itself is still inside it), so
+        // the rollback's rmdir() must be a safe no-op here, never a force-delete
+        // — this proves the fix degrades safely rather than that it always
+        // reclaims disk space (an EMPTY orphaned directory can only arise from a
+        // transient I/O failure between mkdir and the write, not reproducible
+        // deterministically without mocking fs internals).
+        const { skillsDir, installPath } = await freshInstallPath('antigravity-symlink');
+        const agentSkillDir = path.join(projectDir, '.agents', 'agents', 'my-skill');
+        await fs.mkdir(agentSkillDir, { recursive: true });
+        await fs.symlink('/nonexistent-target', path.join(agentSkillDir, 'agent.md'));
+        await expect(writeInstallFiles(installPath, skillsDir, 'my-skill', '# hello', [], '---\nname: my-skill-specialist\n---\nbody', 'antigravity', 
+        // PR-review follow-up: explicit now that writeInstallFiles() no
+        // longer defaults a missing companionBaseDir to process.cwd() —
+        // required so this test still reaches the symlink failure it is
+        // actually exercising, rather than the (also-now-thrown)
+        // required-baseDir guard.
+        projectDir)).rejects.toThrow(/symlink/i);
+        // The directory (and its symlink) must still exist — rollback did not
+        // blindly force-delete non-empty content.
+        const stats = await fs.lstat(agentSkillDir);
+        expect(stats.isDirectory()).toBe(true);
+    });
+    it('rejects a path-traversal skillName ("..") for the companion-agent path and rolls back the already-written SKILL.md (SMI-5982 code-review fix #2)', async () => {
+        // resolveCompanionAgentPath()'s own directory-package validation (fix #2)
+        // is the last line of defense here: this test passes a malicious
+        // skillName distinct from what installPath was built from, exactly the
+        // "a future caller bypasses upstream sanitization" scenario the fix's
+        // doc comment calls out.
+        const { skillsDir, installPath } = await freshInstallPath('antigravity-traversal');
+        await expect(writeInstallFiles(installPath, skillsDir, '..', '# hello', [], '---\nname: specialist\n---\nbody', 'antigravity', 
+        // PR-review follow-up: explicit now that writeInstallFiles() no
+        // longer defaults a missing companionBaseDir to process.cwd() —
+        // required so this test still reaches the skillName traversal
+        // guard it is actually exercising, rather than the
+        // (also-now-thrown) required-baseDir guard.
+        projectDir)).rejects.toThrow(/Unsafe skill name for directory-package companion path/);
+        // Rollback: the existing catch block in writeInstallFiles() already
+        // covers this — SKILL.md was written before the throw (subagentPath is
+        // resolved last), so it (and installPath itself) must be gone. Nothing
+        // was ever created under the companion-agent dir, since the throw
+        // happens BEFORE any fs.mkdir/write for that path.
+        await expect(fs.access(installPath)).rejects.toThrow();
+        const agentsParentDir = path.join(projectDir, '.agents');
+        await expect(fs.access(agentsParentDir)).rejects.toThrow();
+    });
+});
+//# sourceMappingURL=skill-installation.io.client-agent-path.test.js.map

package/dist/tests/unit/services/skill-installation.io.client-agent-path.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.io.client-agent-path.test.js","sourceRoot":"","sources":["../../../../tests/unit/services/skill-installation.io.client-agent-path.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAClF,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAE7B,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;IACjD,MAAM,IAAI,GAAG,6CAA6C,GAAG,OAAO,CAAC,GAAG,CAAA;IACxE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAA;AAC5D,CAAC,CAAC,CAAA;AAEF,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC1C,MAAM,MAAM,GAAG,MAAM,cAAc,EAA4B,CAAA;IAC/D,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;AAC5C,CAAC,CAAC,CAAA;AAEF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAiB,MAAM,+BAA+B,CAAA;AAElG,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AAC1E,CAAC,CAAC,CAAA;AAEF;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAC7B,KAAa;IAEb,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAA;AACrE,CAAC;AAED,QAAQ,CAAC,4EAA4E,EAAE,GAAG,EAAE;IAC1F,UAAU,CAAC,GAAG,EAAE;QACd,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,wEAAwE;IACxE,2EAA2E;IAC3E,EAAE,CAAC,IAAI,CAAW,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAChE,wFAAwF,EACxF,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAEjE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,EAAE,EACF,2CAA2C,EAC3C,MAAM,CACP,CAAA;QAED,yDAAyD;QACzD,oEAAoE;QACpE,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CACrD,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAClD,2CAA2C,CAC5C,CAAA;IACH,CAAC,CACF,CAAA;IAED,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC7G,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;QAE3E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,EAAE,EACF,eAAe;QACf,wEAAwE;SACzE,CAAA;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,uBAAuB,CAAC,aAAa,CAAC,CAAC,GAAG,EAC1C,wBAAwB,CACzB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;QACpH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;QAE5D,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAC1C,UAAU,CAAC,WAAW,EACtB,UAAU,CAAC,SAAS,EACpB,UAAU,EACV,SAAS,EACT,EAAE,EACF,MAAM,EACN,aAAa,CACd,CAAA;QACD,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAC1C,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,SAAS,EAChB,UAAU,EACV,SAAS,EACT,EAAE,EACF,MAAM,EACN,QAAQ,CACT,CAAA;QAED,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CACxD,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAC9C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+HAA+H,EAAE,KAAK,IAAI,EAAE;QAC7I,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAA;QAExD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,SAAS,EACjB,UAAU,EACV,SAAS,EACT,EAAE,EACF,MAAM,EACN,SAAS,CACV,CAAA;QACD,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAC5C,QAAQ,CAAC,WAAW,EACpB,QAAQ,CAAC,SAAS,EAClB,UAAU,EACV,SAAS,EACT,EAAE,EACF,MAAM,EACN,UAAU,CACX,CAAA;QAED,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,0DAA0D;QAC1D,oEAAoE;QACpE,yEAAyE;QACzE,sEAAsE;QACtE,4BAA4B;QAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CACzD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAC3C,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CACtD,CAAA;QACD,yEAAyE;QACzE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAC7D,uBAAuB,CAAC,aAAa,CAAC,CAAC,GAAG,CAC3C,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAC9D,uBAAuB,CAAC,aAAa,CAAC,CAAC,GAAG,CAC3C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;QAClH,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAA;QAExE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,EAAE,EACF,SAAS,EACT,SAAS,CACV,CAAA;QAED,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,QAAQ,CAAC,gGAAgG,EAAE,GAAG,EAAE;IAC9G,IAAI,WAAmB,CAAA;IACvB,IAAI,UAAkB,CAAA;IAEtB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;QAC3B,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAA;QACpF,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAC1B,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4HAA4H,EAAE,KAAK,IAAI,EAAE;QAC1I,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAA;QAE9E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,EAAE,EACF,2CAA2C,EAC3C,aAAa;QACb,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,wDAAwD;QACxD,yDAAyD;QACzD,UAAU,CACX,CAAA;QAED,oEAAoE;QACpE,iEAAiE;QACjE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,0DAA0D;QAC1D,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QACnF,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAA;QACxE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACtD,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAC1D,2CAA2C,CAC5C,CAAA;QACD,oEAAoE;QACpE,6DAA6D;QAC7D,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yIAAyI,EAAE,KAAK,IAAI,EAAE;QACvJ,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC,6BAA6B,CAAC,CAAA;QAExF,MAAM,MAAM,CACV,iBAAiB,CACf,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,EAAE,EACF,2CAA2C,EAC3C,aAAa;QACb,+DAA+D;QAC/D,iEAAiE;QACjE,qEAAqE;QACrE,qEAAqE;QACrE,kEAAkE;SACnE,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAA;QAE1E,MAAM,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gHAAgH,EAAE,KAAK,IAAI,EAAE;QAC9H,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,OAAO,CACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,0CAA0C,CAAC,CACnE,CAAA;QACD,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC,8BAA8B,CAAC,CAAA;YAEzF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,EAAE,EACF,2CAA2C,EAC3C,aAAa,EACb,eAAe,CAChB,CAAA;YAED,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CACpC,eAAe,EACf,SAAS,EACT,QAAQ,EACR,UAAU,EACV,UAAU,CACX,CAAA;YACD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;YACtD,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC/D,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAC1D,2CAA2C,CAC5C,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAChF,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6HAA6H,EAAE,KAAK,IAAI,EAAE;QAC3I,0DAA0D;QAC1D,mEAAmE;QACnE,uEAAuE;QACvE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,yEAAyE;QACzE,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,mDAAmD;QACnD,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;QAEhF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;QAC5E,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAA;QAE7E,MAAM,MAAM,CACV,iBAAiB,CACf,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,EAAE,EACF,2CAA2C,EAC3C,aAAa;QACb,gEAAgE;QAChE,gEAAgE;QAChE,gEAAgE;QAChE,yDAAyD;QACzD,0BAA0B;QAC1B,UAAU,CACX,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAE7B,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QAC3C,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kJAAkJ,EAAE,KAAK,IAAI,EAAE;QAChK,0EAA0E;QAC1E,iEAAiE;QACjE,uEAAuE;QACvE,sEAAsE;QACtE,yBAAyB;QACzB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,CAAA;QAElF,MAAM,MAAM,CACV,iBAAiB,CACf,WAAW,EACX,SAAS,EACT,IAAI,EACJ,SAAS,EACT,EAAE,EACF,kCAAkC,EAClC,aAAa;QACb,gEAAgE;QAChE,gEAAgE;QAChE,8DAA8D;QAC9D,mDAAmD;QACnD,4CAA4C;QAC5C,UAAU,CACX,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAA;QAE3E,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE,mDAAmD;QACnD,MAAM,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QACtD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QACxD,MAAM,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IAC5D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/unit/services/skill-installation.io.symlink.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @fileoverview writeInstallFiles nested sub-skill path + symlink-safety tests
+ * @see SMI-5905 final code review (Sol, GPT-5.6-Sol via NEEDLE) findings #2/#4
+ *
+ * Split out of skill-installation.io.test.ts (515/500 lines once these tests landed).
+ */
+export {};
+//# sourceMappingURL=skill-installation.io.symlink.test.d.ts.map

package/dist/tests/unit/services/skill-installation.io.symlink.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.io.symlink.test.d.ts","sourceRoot":"","sources":["../../../../tests/unit/services/skill-installation.io.symlink.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/tests/unit/services/skill-installation.io.symlink.test.js

@@ -0,0 +1,72 @@
+/**
+ * @fileoverview writeInstallFiles nested sub-skill path + symlink-safety tests
+ * @see SMI-5905 final code review (Sol, GPT-5.6-Sol via NEEDLE) findings #2/#4
+ *
+ * Split out of skill-installation.io.test.ts (515/500 lines once these tests landed).
+ */
+import { describe, it, expect } from 'vitest';
+import * as fs from 'fs/promises';
+import * as os from 'os';
+import * as path from 'path';
+import { writeInstallFiles } from '../../../src/services/skill-installation.io.js';
+/**
+ * SMI-5905 Sol final-code-review findings #2/#4: nested sub-skill filenames (e.g.
+ * "scripts/run.sh", used by private-registry content installs) previously had no parent
+ * directory created (ENOENT on any clean install) and, once fixed, must not silently write
+ * through a pre-existing symlink at an intermediate path component.
+ */
+describe('writeInstallFiles nested sub-skill paths (SMI-5905 final review #2/#4)', () => {
+    it('creates the parent directory for a nested sub-skill filename', async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'wif-nested-'));
+        try {
+            const skillsDir = path.join(root, 'skills');
+            await fs.mkdir(skillsDir, { recursive: true });
+            const installPath = path.join(skillsDir, 'my-skill');
+            const result = await writeInstallFiles(installPath, skillsDir, 'my-skill', '# hello', [{ filename: 'scripts/run.sh', content: 'echo hi' }], undefined);
+            expect(await fs.readFile(path.join(installPath, 'scripts', 'run.sh'), 'utf8')).toBe('echo hi');
+            expect(result.writtenFiles).toContain(path.join(installPath, 'scripts', 'run.sh'));
+        }
+        finally {
+            await fs.rm(root, { recursive: true, force: true }).catch(() => { });
+        }
+    });
+    it('creates parents for two nested files sharing the same new subdirectory (concurrent-write race)', async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'wif-nested-race-'));
+        try {
+            const skillsDir = path.join(root, 'skills');
+            await fs.mkdir(skillsDir, { recursive: true });
+            const installPath = path.join(skillsDir, 'my-skill');
+            await writeInstallFiles(installPath, skillsDir, 'my-skill', '# hello', [
+                { filename: 'scripts/a.sh', content: 'a' },
+                { filename: 'scripts/b.sh', content: 'b' },
+            ], undefined);
+            expect(await fs.readFile(path.join(installPath, 'scripts', 'a.sh'), 'utf8')).toBe('a');
+            expect(await fs.readFile(path.join(installPath, 'scripts', 'b.sh'), 'utf8')).toBe('b');
+        }
+        finally {
+            await fs.rm(root, { recursive: true, force: true }).catch(() => { });
+        }
+    });
+    it('refuses to write through a pre-existing symlinked intermediate directory', async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'wif-symlink-'));
+        try {
+            const skillsDir = path.join(root, 'skills');
+            await fs.mkdir(skillsDir, { recursive: true });
+            const installPath = path.join(skillsDir, 'my-skill');
+            await fs.mkdir(installPath, { recursive: true });
+            // A directory OUTSIDE skillsDir the attack would try to write into.
+            const outsideTarget = path.join(root, 'outside-target');
+            await fs.mkdir(outsideTarget, { recursive: true });
+            // Plant "scripts" as a symlink pointing outside skillsDir, as if left behind by a
+            // prior force-reinstall or planted directly by an attacker with local write access.
+            await fs.symlink(outsideTarget, path.join(installPath, 'scripts'));
+            await expect(writeInstallFiles(installPath, skillsDir, 'my-skill', '# hello', [{ filename: 'scripts/run.sh', content: 'malicious' }], undefined)).rejects.toThrow(/symlink/);
+            // Nothing was written to the symlink target.
+            await expect(fs.access(path.join(outsideTarget, 'run.sh'))).rejects.toThrow();
+        }
+        finally {
+            await fs.rm(root, { recursive: true, force: true }).catch(() => { });
+        }
+    });
+});
+//# sourceMappingURL=skill-installation.io.symlink.test.js.map

package/dist/tests/unit/services/skill-installation.io.symlink.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.io.symlink.test.js","sourceRoot":"","sources":["../../../../tests/unit/services/skill-installation.io.symlink.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAA;AAElF;;;;;GAKG;AACH,QAAQ,CAAC,wEAAwE,EAAE,GAAG,EAAE;IACtF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAA;QACpE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;YAEpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EACpD,SAAS,CACV,CAAA;YAED,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC9F,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAA;QACpF,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;QAC9G,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;QACzE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;YAEpD,MAAM,iBAAiB,CACrB,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT;gBACE,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE;gBAC1C,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE;aAC3C,EACD,SAAS,CACV,CAAA;YAED,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtF,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxF,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAA;QACrE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;YACpD,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAEhD,oEAAoE;YACpE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAA;YACvD,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAElD,kFAAkF;YAClF,oFAAoF;YACpF,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;YAElE,MAAM,MAAM,CACV,iBAAiB,CACf,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EACtD,SAAS,CACV,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAE5B,6CAA6C;YAC7C,MAAM,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QAC/E,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/unit/services/skill-installation.service.companion-basedir.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * SMI-5982 code-review fix #1 (BLOCKING, cwd-dependent resolution):
+ * `SkillInstallationService`'s `companionBaseDir` constructor param must
+ * thread all the way through `install()` -> `writeInstallFiles()` ->
+ * `resolveCompanionAgentPath()` so the Antigravity companion-agent file
+ * lands under an explicitly-passed root, not whatever `process.cwd()`
+ * happens to be at the moment the write actually runs — the exact hazard
+ * for a long-running MCP server whose cwd is fixed at launch and does not
+ * track the calling editor/agent's real project.
+ *
+ * `applyOptimization` (skill-installation.helpers.ts) is mocked to force a
+ * deterministic `subagentContent` without depending on the real
+ * TransformationService's content-shape heuristics — this test is about
+ * PATH WIRING, not optimization behavior, which is covered elsewhere.
+ */
+export {};
+//# sourceMappingURL=skill-installation.service.companion-basedir.test.d.ts.map

package/dist/tests/unit/services/skill-installation.service.companion-basedir.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.service.companion-basedir.test.d.ts","sourceRoot":"","sources":["../../../../tests/unit/services/skill-installation.service.companion-basedir.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/tests/unit/services/skill-installation.service.companion-basedir.test.js

@@ -0,0 +1,112 @@
+/**
+ * SMI-5982 code-review fix #1 (BLOCKING, cwd-dependent resolution):
+ * `SkillInstallationService`'s `companionBaseDir` constructor param must
+ * thread all the way through `install()` -> `writeInstallFiles()` ->
+ * `resolveCompanionAgentPath()` so the Antigravity companion-agent file
+ * lands under an explicitly-passed root, not whatever `process.cwd()`
+ * happens to be at the moment the write actually runs — the exact hazard
+ * for a long-running MCP server whose cwd is fixed at launch and does not
+ * track the calling editor/agent's real project.
+ *
+ * `applyOptimization` (skill-installation.helpers.ts) is mocked to force a
+ * deterministic `subagentContent` without depending on the real
+ * TransformationService's content-shape heuristics — this test is about
+ * PATH WIRING, not optimization behavior, which is covered elsewhere.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import * as os from 'node:os';
+vi.mock('../../../src/services/skill-installation.helpers.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        applyOptimization: vi.fn(async (_db, _skillId, skillName, skillMdContent) => ({
+            finalSkillContent: skillMdContent,
+            subSkillFiles: [],
+            subagentContent: `---\nname: ${skillName}-specialist\n---\nCompanion subagent body`,
+            claudeMdSnippet: undefined,
+            optimizationInfo: {
+                optimized: true,
+                subSkills: [],
+                subagentGenerated: true,
+            },
+        })),
+    };
+});
+import { SkillInstallationService } from '../../../src/services/skill-installation.service.js';
+import { SkillRepository } from '../../../src/repositories/SkillRepository.js';
+import { SkillDependencyRepository } from '../../../src/repositories/SkillDependencyRepository.js';
+import { createTestDatabase } from '../../helpers/database.js';
+const VALID_SKILL_MD = '---\nname: my-skill\ndescription: test skill for SMI-5982 companionBaseDir wiring\n---\n\n' +
+    '# My Skill\n\nEnough content here to clear the 100-character minimum validation threshold ' +
+    'the installer enforces before proceeding with the rest of the install pipeline.';
+describe('SkillInstallationService companionBaseDir wiring (SMI-5982 code-review fix #1)', () => {
+    let db;
+    let originalCwd;
+    let projectDir;
+    let skillsDir;
+    let manifestPath;
+    beforeEach(async () => {
+        db = await createTestDatabase();
+        originalCwd = process.cwd();
+        projectDir = await fs.mkdtemp(path.join(os.tmpdir(), 'skillsmith-service-companion-basedir-'));
+        process.chdir(projectDir);
+        skillsDir = path.join(projectDir, 'skills');
+        manifestPath = path.join(projectDir, 'manifest.json');
+        await fs.mkdir(skillsDir, { recursive: true });
+        vi.stubGlobal('fetch', vi.fn());
+        vi.mocked(fetch).mockImplementation(async (url) => {
+            const urlStr = typeof url === 'string' ? url : url.toString();
+            if (urlStr.includes('SKILL.md')) {
+                return new Response(VALID_SKILL_MD, { status: 200 });
+            }
+            return new Response('Not found', { status: 404 });
+        });
+    });
+    afterEach(async () => {
+        process.chdir(originalCwd);
+        db.close();
+        vi.restoreAllMocks();
+        await fs.rm(projectDir, { recursive: true, force: true }).catch(() => { });
+    });
+    function buildService(overrides = {}) {
+        return new SkillInstallationService({
+            db,
+            skillRepo: new SkillRepository(db),
+            skillDependencyRepo: new SkillDependencyRepository(db),
+            skillsDir,
+            manifestPath,
+            client: 'antigravity',
+            ...overrides,
+        });
+    }
+    it('lands the antigravity companion file under an explicit companionBaseDir, not process.cwd()', async () => {
+        const explicitBaseDir = await fs.mkdtemp(path.join(os.tmpdir(), 'skillsmith-service-explicit-basedir-'));
+        try {
+            const service = buildService({ companionBaseDir: explicitBaseDir });
+            const result = await service.install('https://github.com/owner/my-skill');
+            expect(result.success).toBe(true);
+            const expectedPath = path.join(explicitBaseDir, '.agents', 'agents', 'my-skill', 'agent.md');
+            expect(result.optimization?.subagentPath).toBe(expectedPath);
+            await expect(fs.access(expectedPath)).resolves.toBeUndefined();
+            // Must NOT have landed under process.cwd() (this describe block's projectDir) —
+            // the whole point of the fix.
+            expect(result.optimization?.subagentPath?.startsWith(projectDir)).toBe(false);
+        }
+        finally {
+            await fs.rm(explicitBaseDir, { recursive: true, force: true }).catch(() => { });
+        }
+    });
+    it('PR-review follow-up: omitting companionBaseDir now fails the install closed instead of silently defaulting to process.cwd()', async () => {
+        const service = buildService(); // companionBaseDir omitted
+        const result = await service.install('https://github.com/owner/my-skill');
+        expect(result.success).toBe(false);
+        expect(result.error).toMatch(/directory-package mode.*explicit baseDir is required/s);
+        // Nothing must have been written anywhere under projectDir (this describe
+        // block's process.cwd()) — the whole point of the fix is that a missing
+        // companionBaseDir can no longer resolve here at all, not even by accident.
+        await expect(fs.access(path.join(projectDir, '.agents'))).rejects.toThrow();
+    });
+});
+//# sourceMappingURL=skill-installation.service.companion-basedir.test.js.map

package/dist/tests/unit/services/skill-installation.service.companion-basedir.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.service.companion-basedir.test.js","sourceRoot":"","sources":["../../../../tests/unit/services/skill-installation.service.companion-basedir.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAE7B,EAAE,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACtF,MAAM,MAAM,GACV,MAAM,cAAc,EAAwE,CAAA;IAC9F,OAAO;QACL,GAAG,MAAM;QACT,iBAAiB,EAAE,EAAE,CAAC,EAAE,CACtB,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,SAAiB,EAAE,cAAsB,EAAE,EAAE,CAAC,CAAC;YACpF,iBAAiB,EAAE,cAAc;YACjC,aAAa,EAAE,EAAE;YACjB,eAAe,EAAE,cAAc,SAAS,2CAA2C;YACnF,eAAe,EAAE,SAAS;YAC1B,gBAAgB,EAAE;gBAChB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,EAAE;gBACb,iBAAiB,EAAE,IAAI;aACxB;SACF,CAAC,CACH;KACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAA;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAA;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAG9D,MAAM,cAAc,GAClB,4FAA4F;IAC5F,4FAA4F;IAC5F,iFAAiF,CAAA;AAEnF,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,IAAI,EAAY,CAAA;IAChB,IAAI,WAAmB,CAAA;IACvB,IAAI,UAAkB,CAAA;IACtB,IAAI,SAAiB,CAAA;IACrB,IAAI,YAAoB,CAAA;IAExB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,EAAE,GAAG,MAAM,kBAAkB,EAAE,CAAA;QAC/B,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;QAC3B,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uCAAuC,CAAC,CAAC,CAAA;QAC9F,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACzB,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAC3C,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAA;QACrD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAE9C,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QAC/B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAChD,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;YAC7D,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACtD,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAC1B,EAAE,CAAC,KAAK,EAAE,CAAA;QACV,EAAE,CAAC,eAAe,EAAE,CAAA;QACpB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,SAAS,YAAY,CACnB,YAAgF,EAAE;QAElF,OAAO,IAAI,wBAAwB,CAAC;YAClC,EAAE;YACF,SAAS,EAAE,IAAI,eAAe,CAAC,EAAE,CAAC;YAClC,mBAAmB,EAAE,IAAI,yBAAyB,CAAC,EAAE,CAAC;YACtD,SAAS;YACT,YAAY;YACZ,MAAM,EAAE,aAAa;YACrB,GAAG,SAAS;SACb,CAAC,CAAA;IACJ,CAAC;IAED,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,OAAO,CACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sCAAsC,CAAC,CAC/D,CAAA;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAA;YAEnE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAA;YAEzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;YAC5F,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC5D,MAAM,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAA;YAC9D,gFAAgF;YAChF,8BAA8B;YAC9B,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/E,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAChF,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6HAA6H,EAAE,KAAK,IAAI,EAAE;QAC3I,MAAM,OAAO,GAAG,YAAY,EAAE,CAAA,CAAC,2BAA2B;QAE1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAA;QAEzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAA;QACrF,0EAA0E;QAC1E,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/unit/services/skill-installation.service.error-codes.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * SMI-4795: errorCode taxonomy on install failures
+ *
+ * Each failing return path inside install() must populate `errorCode` with
+ * a code from InstallErrorCode. Telemetry (emitInstallEvent) reads this
+ * field; without it the install funnel cannot classify failures.
+ *
+ * Split out of skill-installation.service.test.ts (CLAUDE.md's 500-line
+ * file cap) after SMI-5894 Wave 1 added its own multi-client suite there —
+ * this block predates that change and is unrelated to it, but moving it
+ * out (rather than the newly-added block alone) was the smallest change
+ * that got the original file back under the cap.
+ */
+export {};
+//# sourceMappingURL=skill-installation.service.error-codes.test.d.ts.map

package/dist/tests/unit/services/skill-installation.service.error-codes.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.service.error-codes.test.d.ts","sourceRoot":"","sources":["../../../../tests/unit/services/skill-installation.service.error-codes.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}