@skillsmith/core 0.12.0 → 0.12.2

package/CHANGELOG.md

@@ -4,9 +4,174 @@ All notable changes to `@skillsmith/core` are documented here.
 
 ## [Unreleased]
 
+## v0.12.2
+
+- **Feature**: SMI-6343 Wave 4 -- apply_manifest_reconcile tool (#2715)
+- **Other**: SMI-6362: Wire Team/Enterprise analytics tools to cloud-aggregated MCP tool-call data (#2698)
+- **Feature**: SMI-6343 Wave 3 -- tamper-check classification (#2710)
+- **Added**: `SkillManifestEntry` (`services/skill-installation.types.ts`) gains two optional
+  fields per ADR-145 (manifest provenance as a second trust axis, orthogonal to `source`):
+  `provenance?: 'local' | 'registry'` (who asserts this entry's identity — absent means a legacy
+  entry with no assertion ever recorded, never defaulting to `'registry'`) and
+  `verifiedAt?: string` (ISO-8601 UTC timestamp of the last successful re-verification of the
+  entry's on-disk content hash against the registry's current content hash for the claimed `id`).
+  Written by `@skillsmith/mcp-server`'s new `apply_manifest_reconcile` tool (SMI-6343 Wave 4); read
+  by SMI-6345 Wave 2's E1 identity-evidence gate. `AGENT_TOOL_PROFILE_NAMES`
+  (`services/agent-tool-profile.ts`) gains `apply_manifest_reconcile` (17 entries).
+- **Added**: `emitToolCallEvent()` and a pluggable `TelemetryIdentityProvider` in
+  `audit/remote-audit.ts` — posts a `tool_call` telemetry event carrying the
+  server-verified `team_id`/actor identity (never a client-supplied credential,
+  per SMI-6362 D-2a/D-2b) to the `events` edge function, with
+  `getTelemetryEmitStats()`/`_resetTelemetryEmitStatsForTests()` for test
+  observability. `telemetry/wrap.ts` gained `runWithToolNameContext()` so the
+  tool name is available to the emitter without threading it through every
+  call site. `AgentMarker` (`telemetry/agent-marker.ts`) now carries an
+  optional `sessionId`, sourced from the marker file's `session_id` only (no
+  Tier-1 harness injects it via `_meta` yet), so a `tool_call` row can be
+  grouped by harness session (SMI-6362 §1). Wires Team/Enterprise usage
+  analytics to cloud-aggregated MCP tool-call data (SMI-6362 Wave 1).
+- **Added**: `skill-identity-classification.ts` — a shared tamper-check classification module
+  consumed by both `@skillsmith/mcp-server` (`skill_outdated`) and `@skillsmith/cli`
+  (`skillsmith update`), so the two packages cannot drift into two independently-maintained
+  implementations of the same logic (SMI-6343 Wave 3). Runs three contradiction signals
+  against a manifest entry already known to differ from the registry — owner-mismatch
+  (`id` vs `source`), path-unresolved (`installPath` outside the claimed client's root), and
+  front-matter-contradiction (on-disk `author`/`name` vs the registry's record, fail-closed
+  to `unknown` per ADR-144/145 when the registry lookup can't complete) — plus a fourth
+  local-edit check (`hasRecordedLocalEdit()`) that distinguishes a benign local edit
+  (`local-drift`) from a genuine version bump (`outdated`). Exports the full five-state
+  `OutdatedClassificationState` (`current`/`outdated`/`local-drift`/`identity-mismatch`/
+  `unknown`) from `@skillsmith/core`.
+- **Fix**: `skill_versions.content_hash` (`SyncEngine.upsertSkills()`) now records the
+  registry's real SKILL.md content hash instead of a hash of a JSON metadata proxy
+  (`{id, name, description, updated_at}`) — the proxy meant every reader comparing against
+  this column (`skill_outdated`, `skill_updates`, the CLI's `skills-directory.ts`) was
+  structurally unable to detect a real content change (SMI-6343 Wave 2). New migration v18
+  purges pre-fix rows rather than leaving the two incompatible hash spaces mixed in the same
+  table, which would otherwise make every skill with prior history report a universal false
+  "update available". Adds a shared `compareSkillContentHashes()` comparator
+  (`@skillsmith/core`) so the three readers cannot drift apart on this comparison again.
+- **Fix**: `ManifestManager` (`@skillsmith/core/services/skill-manifest`) now refuses to lock
+  or write a manifest located inside the real user home while running under vitest
+  (SMI-6343 Wave 1). This closes a class of leak evidenced by fixture rows found in a real
+  user's `~/.skillsmith/manifest.json`, one of them claiming an unrelated live registry skill
+  id — traced to two mcp-server integration tests whose manifest path defaulted to
+  `os.homedir()/.skillsmith/manifest.json` before ADR-139 (SMI-6274 Wave 4) gave them an
+  override two days before this fix. The primary fix is a per-run `$HOME` sandbox installed
+  by `vitest.setup.ts` and inherited by every vitest config through `vitest.preset.ts`; the
+  new `assertNotRealUserHome()` guard (now exported as `assertNotRealUserHome`) is the
+  defense-in-depth backstop for a manifest path that reaches the real home anyway. It is
+  gated on `process.env.VITEST` and compares against the pre-sandbox home captured in
+  `SKILLSMITH_TEST_REAL_HOME`, falling back to `os.userInfo()` (which ignores `$HOME`) when
+  that is absent. No production code path is affected.
+
+  Adversarial review found three sibling manifest-write implementations with the identical
+  homedir-derived, no-override-parameter shape, each now wired to the same guard:
+  `packages/mcp-server/src/tools/install.helpers.manifest.ts` (`saveManifest`,
+  `acquireManifestLock`), `packages/cli/src/utils/manifest.ts` (`saveManifest`), and
+  `packages/core/src/install/fan-out.ts` (`saveManifest`, writing
+  `~/.skillsmith/links/manifest.json`). Also fixed: a `vitest.setup.ts` idempotency gap under
+  `vitest run --no-isolate` (empirically demonstrated) that could silently disable the guard's
+  ground truth after the first test file in a reused worker; `scripts/audit-standards.mjs`
+  Check 65's `manifestPath` override-evidence pattern tightened from a bare word-boundary
+  match (which a stray comment could satisfy) to require assignment/property context; and its
+  `SKILLSMITH_HOME` override credit removed since no writer honors that variable.
+
+- **Feature**: companion subagent files (`generateSubagent`/`generateMinimalSubagent`,
+  `@skillsmith/core/services/SubagentGenerator`, SMI-6276 Wave 6 Step 1) now generate
+  client-specific frontmatter instead of Claude-shaped tool names/model tiers for every
+  client. New `SubagentGenerator.client-profiles.ts` defines an exhaustive per-client
+  generation profile (frontmatter fields, tool-vocabulary policy, model policy). AntiGravity
+  gets its own mapped tool vocabulary as a YAML array (its own docs warn an unmapped tool
+  name can hang the subagent process) and no Claude model field (a different vendor/model
+  family); Cursor mirrors Claude Code's shape exactly (documented compatibility surface);
+  Copilot/OpenCode/Windsurf/others omit `tools:`/`model:` per each client's own confirmed
+  reasoning. `TransformationService`'s cache key now includes the target client (a
+  same-skill-different-client request could otherwise be served a stale other-client's
+  cached result); `generateSubagentContent()`'s `description:` frontmatter field is now
+  JSON.stringify()-quoted as a valid YAML double-quoted scalar (previously broke on a
+  description containing `: ` or ` #`). `installFromContent()` now correctly forwards its
+  resolved client into `applyOptimization()` instead of silently defaulting to claude-code.
+
+- **Feature**: `sklx agent install` now supports AntiGravity as a harness (`@skillsmith/core/install`,
+  SMI-6275 Wave 5, closing the last unshipped ask of GH#2166). `HarnessId` gains `'antigravity'`,
+  but — unlike every other MCP-capable harness — it is deliberately excluded from `McpHarnessId`
+  and has no entry in `AGENT_MCP_TARGETS`: AntiGravity's MCP config is WORKSPACE-anchored
+  (`.agents/mcp_config.json`, verified live against antigravity.google/docs/ide/mcp/ and
+  antigravity.google/docs/cli/mcp/ — same standard `mcpServers`-keyed JSON shape as
+  claude-code/copilot/windsurf, registered under the package-scoped key `@skillsmith/mcp-server`
+  to match AntiGravity's own docs snippet, the same key-alignment fix SMI-6279 made for Cursor),
+  not home-anchored like the shared `Record`'s other entries. New
+  `agent-pack-installer.antigravity-mcp.ts` (mirroring the Cursor split) owns its path resolution
+  + entry-value shape entirely; only the entry-value builder is genuinely new code, reusing
+  `mergeJsonMcpEntry()` for the actual write. `installAgentPack` now resolves AntiGravity's scope
+  on every run (not just `--scope workspace`) — a bare `agent install` auto-detects an
+  already-existing `.agents/` marker (ADR-139 point 2 rank 4) and configures it, while
+  `--scope workspace` remains the only path that can CREATE one (ADR-139 point 5); AntiGravity now
+  always gets a report row (`detected: false` with an explanatory note when its workspace scope
+  doesn't resolve), matching every other harness's reporting shape instead of Wave 4's
+  row-omission. Support tier 3 (MCP config only) — no hooks (no documented AntiGravity hook
+  system found) and no named-agent shim this wave, both stated decisions. `agent-manifest-path-guard.ts`
+  gains a second, WORKSPACE-relative allowlist (alongside the existing home-relative one) so
+  `uninstallAgentPack` can actually remove AntiGravity's two workspace-scoped artifacts instead of
+  silently rejecting them as outside every known install target — closes a latent gap in Wave 4's
+  own skill-pack-only implementation, caught while extending the same guard for the MCP config file.
+
+- **Feature**: ADR-139 global-vs-workspace install scope resolution (`@skillsmith/core/install`,
+  SMI-6274 Wave 4). New `resolveSkillScope()`/`resolveScopedSkillsDir()` resolve whether an
+  install/list/update/remove targets a client's global directory (`CLIENT_NATIVE_PATHS`) or a
+  workspace-local one (`<workspace-root>/<client's CLIENT_WORKSPACE_SEGMENTS>`, a new sibling
+  table to `CLIENT_NATIVE_PATHS`), by a five-rank precedence: explicit scope > `SKILLSMITH_SCOPE`
+  env var > per-client `~/.skillsmith/config.json` default (new `defaultScope` field) >
+  auto-detection of an EXISTING workspace marker > global. The workspace-root boundary is
+  marker-first, then nearest-ancestor `.git` (file OR directory, so worktrees and submodules
+  each resolve to their own root) via a new `findWorkspaceRoot()` — deliberately not a reuse of
+  `findMainRepoRoot()` (`doc-retrieval-mcp`), whose opposite `.git`-must-be-a-directory predicate
+  exists for a different purpose. Workspace-scoped installs record in a workspace-local
+  `<root>/.skillsmith/manifest.json`, leaving the global manifest and `manifestKeyFor()`
+  completely untouched. `installAgentPack({ scope: 'workspace' })` can now bootstrap AntiGravity
+  as a target in a fresh repo by creating `.agents/skills` — the only path permitted to create a
+  workspace directory implicitly. `performUninstall()` now adopts an untracked skill (present on
+  disk, no manifest entry) by reconstructing a manifest entry from disk state instead of requiring
+  `force=true`. `ManifestManager` gained a public `path` getter. `buildAdoptedManifestEntry()` —
+  the reconstruction builder `performUninstall()` uses — is now exported at the package root
+  (`@skillsmith/core`) alongside `manifestKeyFor`/`hashContent` so `@skillsmith/cli`'s `update`
+  path reuses the identical adoption logic instead of a second, driftable copy (PR review
+  follow-up: `update` previously never adopted an untracked skill at all, only `remove` did, and
+  could dead-end at `'unresolvable'` with zero side effects even when a skill's source genuinely
+  couldn't be recovered).
+
+- **Fix**: `agent install` no longer writes a broken Cursor MCP registration. Two independent
+  bugs, both from before Cursor's MCP snippet was fixed in SMI-5893: the installer still wrote
+  the `npx`-form command that reliably fails inside Cursor's bundled Node, without the
+  `SKILLSMITH_CLIENT` variable, so even the documented fix-it command (`agent install`) rewrote
+  the same broken config; and the installer's entry lived under a different JSON key than the
+  one users are told to paste from the website, so following both instructions left two
+  unreconciled server entries in the same file instead of one. Re-running `agent install` now
+  also cleans up a pre-fix install's stale entry (GH#2368, SMI-6279)
+
+- **Breaking**: `SyncEngine` now fetches via a new `registry-sync` Edge Function instead of
+  abusing the public `skills-search` endpoint with 8 hardcoded broad queries — this transport
+  is Team+ tier only server-side (see `@skillsmith/cli`'s changelog and ADR-136), so `SyncEngine.
+  sync()` will fail for a Community/Individual-tier API client. Also fixes a real completeness
+  gap in the old mechanism: any skill whose name/tags never matched one of the 8 hardcoded terms
+  was silently never synced. `since` is now forwarded server-side for differential syncs instead
+  of filtering client-side after downloading the entire registry. New `SkillsmithApiClient`
+  methods `syncRegistry()`/`getStats()` back this change (SMI-6236)
+
+## v0.12.1
+
+- **Fix**: logout/whoami now detect JWT device-code sessions (#2578)
+- **Fix**: new `clearCredentials()` export (`config/token-credentials.ts`) clears a stored
+  JWT device-code session (access/refresh token, expiry) from both the config file and the
+  OS keyring `refresh-token` entry — previously there was no way to end a JWT session at all;
+  `clearApiKey()` only ever touched the separate legacy `apiKey` field. (SMI-6235)
+- **Docs**: README's framing sentence updated from the "lifecycle layer" tagline to a plain
+  descriptive sentence ("a registry for sharing, scanning, and tracking agent skills across
+  teams") as part of the site-wide positioning reframe. Wording-only. (SMI-6194)
+
 ## v0.12.0
 
-- **Cadence**: Mechanical cadence alignment (no changes since v0.11.7).
 - **Feature**: new `resolveSessionTier` client (`sync/license-status-client.ts`, SMI-6098) —
   authenticates the stored device-login session against `/license-status` (proactively refreshing
   via the existing `resolveAccessToken` helper) so the MCP server can resolve a real subscription

package/README.md

@@ -2,23 +2,22 @@
 
 Core library for Skillsmith — database operations, search, caching, security, analytics, and **multi-language codebase analysis** for agent skill management.
 
-Part of Skillsmith: a lifecycle layer for agent skills across teams.
+Part of Skillsmith: a registry for sharing, scanning, and tracking agent skills across teams.
 
 ## Contents
 
-- [What's New](#whats-new-in-v0120)
+- [What's New](#whats-new-in-v0122)
 - [Installation](#installation)
 - [Quick Start](#quick-start)
 - [Features](#features)
 - [Exports](#exports)
 
-## What's New in v0.12.0
+## What's New in v0.12.2
 
-- **Security-status reporting unified**: CLI and MCP now derive security-scan status (pass/fail, risk score, findings count) from one shared `deriveSecuritySummaryFromApiSkill`/`deriveSecuritySummaryFromSkillRow`, instead of two independently-maintained copies that could disagree on the same skill.
-- **`skill_compare` reuses `get_skill`'s resolution**: new shared `resolveSkillApiFirst()` fixes compare only ever hitting the local SQLite cache (no longer kept in sync with the remote-first registry), which made real, searchable skills report "not found."
-- **New two-level owned-lock primitive** (`config/owned-lock`) replacing the single-level, age-based config lock — closes a case where two concurrent reclaimers could both treat a stale lock as safe to unlink.
-- **Private-registry install support**: `SkillInstallationService.installFromContent()` installs an already-resolved skill (e.g. from a private registry) through the same scan/write/manifest pipeline as a GitHub-fetched install.
-- **Quiet mode covers one more warning path**: `SKILLSMITH_QUIET` now also suppresses the WASM-SQLite-driver fallback notice, previously printed unconditionally.
+- **New `resolveSessionTier` client** (`sync/license-status-client.ts`): authenticates a stored `skillsmith login` session against `/license-status` so the MCP server can resolve a real subscription tier without a separately-configured `SKILLSMITH_API_KEY`, instead of silently falling back to `community`.
+- **Scanner: bundled-file scan expanded to operational code** (Gap 8 of the ClawHavoc remediation): the indexer now reads `scripts/`, `src/`, and `bin/` alongside `SKILL.md`, closing a blind spot where a backdoor buried mid-function in working operational code was structurally invisible.
+- **Scanner fix**: the markdown indented-code-block heuristic was silently downgrading real non-markdown source findings from `high` to `medium` — `analyzeMarkdownContext`/`SecurityScanner.scan()` now take an explicit `isMarkdown` parameter instead of assuming every scanned file is documentation.
+- **Five new scanner detectors** (SMI-6033 Waves 3–4): `gatekeeper_bypass` (macOS quarantine-attribute stripping), `archive_evasion` (password-protected archives correlated with a fetch), a paste/snippet-host reputation detector, an encoded-payload decode-and-recursively-rescan detector, and `decoy_misdirection` (a fetch domain that doesn't match a nearby vendor-authority claim) — plus a stronger multi-signal co-signal escalation model so several individually sub-threshold findings can now jointly escalate a weak `code_execution` finding to critical.
 
 See [CHANGELOG.md](./CHANGELOG.md) for previous releases.