@skillsmith/core 0.12.1 → 0.12.2

package/dist/src/services/agent-tool-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-tool-profile.js","sourceRoot":"","sources":["../../../src/services/agent-tool-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,yBAAyB,CAAA;AAEnE,uFAAuF;AACvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAA;AAE/C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,QAAQ;IACR,WAAW;IACX,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,YAAY;IACZ,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxB,wBAAwB;IACxB,aAAa;IACb,YAAY;CACb,CAAA"}
+{"version":3,"file":"agent-tool-profile.js","sourceRoot":"","sources":["../../../src/services/agent-tool-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,yBAAyB,CAAA;AAEnE,uFAAuF;AACvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAA;AAE/C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,QAAQ;IACR,WAAW;IACX,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,YAAY;IACZ,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxB,wBAAwB;IACxB,aAAa;IACb,YAAY;IACZ,8DAA8D;IAC9D,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,2BAA2B;IAC3B,0BAA0B;CAC3B,CAAA"}

package/dist/src/services/agent-tool-profile.test.js

@@ -6,8 +6,8 @@
 import { describe, expect, it } from 'vitest';
 import { AGENT_TOOL_PROFILE_ENV_VAR, AGENT_TOOL_PROFILE_NAMES, AGENT_TOOL_PROFILE_VALUE, } from './agent-tool-profile.js';
 describe('AGENT_TOOL_PROFILE_NAMES (core, QD-1 relocation)', () => {
-    it('has 16 entries', () => {
-        expect(AGENT_TOOL_PROFILE_NAMES).toHaveLength(16);
+    it('has 17 entries', () => {
+        expect(AGENT_TOOL_PROFILE_NAMES).toHaveLength(17);
     });
     it('contains undo_apply', () => {
         expect(AGENT_TOOL_PROFILE_NAMES).toContain('undo_apply');

package/dist/src/services/skill-content-comparison.d.ts

@@ -0,0 +1,71 @@
+/**
+ * @fileoverview Shared skill content-hash comparator
+ * @module @skillsmith/core/services/skill-content-comparison
+ * @see SMI-6343 Wave 2 — repair the content-hash comparison
+ *
+ * A single comparison function, consumed by every "is this skill outdated"
+ * reader in the codebase (`packages/mcp-server/src/tools/outdated.ts`,
+ * `packages/mcp-server/src/tools/skill-updates.ts`,
+ * `packages/cli/src/utils/skills-directory.ts`) so they cannot drift apart
+ * on what "current" / "outdated" / "unknown" means again — exactly the class
+ * of bug an adversarial review caught in SMI-6343 Wave 1, where one
+ * implementation was fixed and its siblings were left broken.
+ *
+ * Deliberately narrow: this function only adjudicates "do these two hashes
+ * agree," given whatever installed-side and registry-side hash the caller
+ * already resolved (manifest-recorded hash, on-disk SHA-256, live registry
+ * lookup, cached `skill_versions` row — the callers differ on where the
+ * hash comes from, not on how two hashes are compared). Richer per-caller
+ * diagnosis (offline, quota-exhausted, network-error, identity-mismatch,
+ * etc.) is caller-specific context this function has no visibility into —
+ * callers layer their own explanation on top of the `reason` this returns.
+ */
+/** The three possible outcomes of comparing an installed hash to a registry hash. */
+export type ContentComparisonOutcome = 'current' | 'outdated' | 'unknown';
+/**
+ * Result of {@link compareSkillContentHashes}.
+ */
+export interface ContentComparisonResult {
+    /** current: hashes match. outdated: hashes differ. unknown: no comparison could be made. */
+    outcome: ContentComparisonOutcome;
+    /**
+     * Populated only when `outcome === 'unknown'` — explains why no
+     * comparison could be made (missing installed hash, missing registry
+     * hash, or both). Always `undefined` for `current`/`outdated`.
+     */
+    reason?: string;
+}
+/**
+ * Normalize a hash value: `null`/`undefined`/non-string/blank all collapse
+ * to `null` so every caller's "I don't have this" shape (a missing manifest
+ * field, an absent DB row, an `undefined` API response field) is handled
+ * uniformly regardless of how the caller spells "nothing here."
+ */
+export declare function normalizeHash(hash: string | null | undefined): string | null;
+/**
+ * SMI-6343 (adversarial-review fix): return the first candidate that
+ * normalizes to a non-blank value, else `null`.
+ *
+ * Exists because a bare `a ?? b` precedence chain (the original shape at
+ * both call sites) only falls through on `null`/`undefined` — a blank
+ * string (`''`, whitespace-only) is neither, so `a ?? b` incorrectly
+ * "wins" with a value `normalizeHash()` would itself treat as absent,
+ * silently discarding a legitimate `b`. Every caller selecting between a
+ * manifest's `contentHash`/`originalContentHash` (or an on-disk fallback)
+ * should route through this instead of raw `??` chaining.
+ */
+export declare function firstNonBlankHash(...candidates: Array<string | null | undefined>): string | null;
+/**
+ * Compare an installed-side content hash against a registry-side content
+ * hash and return a comparison outcome plus (when `unknown`) the reason no
+ * comparison could be made.
+ *
+ * @param installedHash SHA-256 hex digest of what is actually installed —
+ *   e.g. a manifest's recorded `contentHash`/`originalContentHash`, or a
+ *   freshly-computed hash of the on-disk SKILL.md.
+ * @param registryHash  SHA-256 hex digest of the registry's current SKILL.md
+ *   content — e.g. a live `lookupSkillFromRegistry()` result's
+ *   `contentHash`, or the most-recently-synced `skill_versions.content_hash`.
+ */
+export declare function compareSkillContentHashes(installedHash: string | null | undefined, registryHash: string | null | undefined): ContentComparisonResult;
+//# sourceMappingURL=skill-content-comparison.d.ts.map

package/dist/src/services/skill-content-comparison.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-content-comparison.d.ts","sourceRoot":"","sources":["../../../src/services/skill-content-comparison.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,qFAAqF;AACrF,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzE;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,OAAO,EAAE,wBAAwB,CAAA;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAI5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,CAMhG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,uBAAuB,CAwBzB"}

package/dist/src/services/skill-content-comparison.js

@@ -0,0 +1,90 @@
+/**
+ * @fileoverview Shared skill content-hash comparator
+ * @module @skillsmith/core/services/skill-content-comparison
+ * @see SMI-6343 Wave 2 — repair the content-hash comparison
+ *
+ * A single comparison function, consumed by every "is this skill outdated"
+ * reader in the codebase (`packages/mcp-server/src/tools/outdated.ts`,
+ * `packages/mcp-server/src/tools/skill-updates.ts`,
+ * `packages/cli/src/utils/skills-directory.ts`) so they cannot drift apart
+ * on what "current" / "outdated" / "unknown" means again — exactly the class
+ * of bug an adversarial review caught in SMI-6343 Wave 1, where one
+ * implementation was fixed and its siblings were left broken.
+ *
+ * Deliberately narrow: this function only adjudicates "do these two hashes
+ * agree," given whatever installed-side and registry-side hash the caller
+ * already resolved (manifest-recorded hash, on-disk SHA-256, live registry
+ * lookup, cached `skill_versions` row — the callers differ on where the
+ * hash comes from, not on how two hashes are compared). Richer per-caller
+ * diagnosis (offline, quota-exhausted, network-error, identity-mismatch,
+ * etc.) is caller-specific context this function has no visibility into —
+ * callers layer their own explanation on top of the `reason` this returns.
+ */
+/**
+ * Normalize a hash value: `null`/`undefined`/non-string/blank all collapse
+ * to `null` so every caller's "I don't have this" shape (a missing manifest
+ * field, an absent DB row, an `undefined` API response field) is handled
+ * uniformly regardless of how the caller spells "nothing here."
+ */
+export function normalizeHash(hash) {
+    if (typeof hash !== 'string')
+        return null;
+    const trimmed = hash.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+/**
+ * SMI-6343 (adversarial-review fix): return the first candidate that
+ * normalizes to a non-blank value, else `null`.
+ *
+ * Exists because a bare `a ?? b` precedence chain (the original shape at
+ * both call sites) only falls through on `null`/`undefined` — a blank
+ * string (`''`, whitespace-only) is neither, so `a ?? b` incorrectly
+ * "wins" with a value `normalizeHash()` would itself treat as absent,
+ * silently discarding a legitimate `b`. Every caller selecting between a
+ * manifest's `contentHash`/`originalContentHash` (or an on-disk fallback)
+ * should route through this instead of raw `??` chaining.
+ */
+export function firstNonBlankHash(...candidates) {
+    for (const candidate of candidates) {
+        const normalized = normalizeHash(candidate);
+        if (normalized !== null)
+            return normalized;
+    }
+    return null;
+}
+/**
+ * Compare an installed-side content hash against a registry-side content
+ * hash and return a comparison outcome plus (when `unknown`) the reason no
+ * comparison could be made.
+ *
+ * @param installedHash SHA-256 hex digest of what is actually installed —
+ *   e.g. a manifest's recorded `contentHash`/`originalContentHash`, or a
+ *   freshly-computed hash of the on-disk SKILL.md.
+ * @param registryHash  SHA-256 hex digest of the registry's current SKILL.md
+ *   content — e.g. a live `lookupSkillFromRegistry()` result's
+ *   `contentHash`, or the most-recently-synced `skill_versions.content_hash`.
+ */
+export function compareSkillContentHashes(installedHash, registryHash) {
+    const installed = normalizeHash(installedHash);
+    const registry = normalizeHash(registryHash);
+    if (installed === null && registry === null) {
+        return {
+            outcome: 'unknown',
+            reason: 'No installed content hash and no registry content hash available for comparison.',
+        };
+    }
+    if (installed === null) {
+        return {
+            outcome: 'unknown',
+            reason: 'No installed content hash recorded — cannot compare against the registry.',
+        };
+    }
+    if (registry === null) {
+        return {
+            outcome: 'unknown',
+            reason: 'No registry content hash available — cannot compare against the installed skill.',
+        };
+    }
+    return installed === registry ? { outcome: 'current' } : { outcome: 'outdated' };
+}
+//# sourceMappingURL=skill-content-comparison.js.map

package/dist/src/services/skill-content-comparison.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-content-comparison.js","sourceRoot":"","sources":["../../../src/services/skill-content-comparison.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAmBH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAA+B;IAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,UAA4C;IAC/E,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,UAAU,CAAA;IAC5C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,aAAwC,EACxC,YAAuC;IAEvC,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;IAE5C,IAAI,SAAS,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,kFAAkF;SAC3F,CAAA;IACH,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,2EAA2E;SACpF,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,kFAAkF;SAC3F,CAAA;IACH,CAAC;IAED,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AAClF,CAAC"}

package/dist/src/services/skill-content-comparison.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @fileoverview Unit tests for the shared skill content-hash comparator
+ * @see SMI-6343 Wave 2 — repair the content-hash comparison
+ */
+export {};
+//# sourceMappingURL=skill-content-comparison.test.d.ts.map

package/dist/src/services/skill-content-comparison.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-content-comparison.test.d.ts","sourceRoot":"","sources":["../../../src/services/skill-content-comparison.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/src/services/skill-content-comparison.test.js

@@ -0,0 +1,83 @@
+/**
+ * @fileoverview Unit tests for the shared skill content-hash comparator
+ * @see SMI-6343 Wave 2 — repair the content-hash comparison
+ */
+import { describe, it, expect } from 'vitest';
+import { compareSkillContentHashes, firstNonBlankHash } from './skill-content-comparison.js';
+describe('compareSkillContentHashes', () => {
+    it('returns current when both hashes match exactly', () => {
+        const result = compareSkillContentHashes('abc123', 'abc123');
+        expect(result.outcome).toBe('current');
+        expect(result.reason).toBeUndefined();
+    });
+    it('returns outdated when the hashes differ', () => {
+        const result = compareSkillContentHashes('abc123', 'def456');
+        expect(result.outcome).toBe('outdated');
+        expect(result.reason).toBeUndefined();
+    });
+    it('returns unknown with a reason when the installed hash is missing', () => {
+        const result = compareSkillContentHashes(null, 'def456');
+        expect(result.outcome).toBe('unknown');
+        expect(result.reason).toMatch(/no installed content hash/i);
+    });
+    it('returns unknown with a reason when the installed hash is undefined', () => {
+        const result = compareSkillContentHashes(undefined, 'def456');
+        expect(result.outcome).toBe('unknown');
+        expect(result.reason).toMatch(/no installed content hash/i);
+    });
+    it('returns unknown with a reason when the registry hash is missing', () => {
+        const result = compareSkillContentHashes('abc123', null);
+        expect(result.outcome).toBe('unknown');
+        expect(result.reason).toMatch(/no registry content hash/i);
+    });
+    it('returns unknown with a reason when the registry hash is undefined', () => {
+        const result = compareSkillContentHashes('abc123', undefined);
+        expect(result.outcome).toBe('unknown');
+        expect(result.reason).toMatch(/no registry content hash/i);
+    });
+    it('returns unknown when both hashes are missing', () => {
+        const result = compareSkillContentHashes(null, null);
+        expect(result.outcome).toBe('unknown');
+        expect(result.reason).toMatch(/no installed content hash and no registry content hash/i);
+    });
+    it('treats a blank/whitespace-only hash the same as missing', () => {
+        expect(compareSkillContentHashes('   ', 'abc123').outcome).toBe('unknown');
+        expect(compareSkillContentHashes('abc123', '   ').outcome).toBe('unknown');
+        expect(compareSkillContentHashes('', '').outcome).toBe('unknown');
+    });
+    it('is case-sensitive — differently-cased hex digests are treated as different hashes', () => {
+        const result = compareSkillContentHashes('ABC123', 'abc123');
+        expect(result.outcome).toBe('outdated');
+    });
+    it('trims surrounding whitespace before comparing', () => {
+        const result = compareSkillContentHashes('  abc123  ', 'abc123');
+        expect(result.outcome).toBe('current');
+    });
+});
+describe('firstNonBlankHash (adversarial-review addition, SMI-6343)', () => {
+    it('returns the first candidate when it is non-blank', () => {
+        expect(firstNonBlankHash('abc123', 'def456')).toBe('abc123');
+    });
+    it('falls through past null/undefined to the next candidate', () => {
+        expect(firstNonBlankHash(null, 'def456')).toBe('def456');
+        expect(firstNonBlankHash(undefined, 'def456')).toBe('def456');
+    });
+    it('falls through past a BLANK (whitespace-only) first candidate — the exact case a raw `??` chain gets wrong', () => {
+        // `'   ' ?? 'def456'` would incorrectly return '   ' (?? only falls
+        // through on null/undefined) — this is the whole reason this helper
+        // exists instead of a raw `??` chain at each call site.
+        expect(firstNonBlankHash('   ', 'def456')).toBe('def456');
+        expect(firstNonBlankHash('', 'def456')).toBe('def456');
+    });
+    it('trims a winning candidate', () => {
+        expect(firstNonBlankHash('  abc123  ')).toBe('abc123');
+    });
+    it('returns null when every candidate is blank/null/undefined', () => {
+        expect(firstNonBlankHash(null, undefined, '   ', '')).toBeNull();
+        expect(firstNonBlankHash()).toBeNull();
+    });
+    it('supports three or more candidates (on-disk-hash fallback chains)', () => {
+        expect(firstNonBlankHash('   ', undefined, 'on-disk-hash')).toBe('on-disk-hash');
+    });
+});
+//# sourceMappingURL=skill-content-comparison.test.js.map

package/dist/src/services/skill-content-comparison.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-content-comparison.test.js","sourceRoot":"","sources":["../../../src/services/skill-content-comparison.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAE5F,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC5D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC5D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC7D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC7D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACpD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1E,MAAM,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1E,MAAM,CAAC,yBAAyB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC5D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,yBAAyB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAChE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACzE,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxD,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2GAA2G,EAAE,GAAG,EAAE;QACnH,oEAAoE;QACpE,oEAAoE;QACpE,wDAAwD;QACxD,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAChE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/services/skill-identity-classification.d.ts

@@ -0,0 +1,202 @@
+/**
+ * @fileoverview Shared skill-identity contradiction-signal classification
+ * @module @skillsmith/core/services/skill-identity-classification
+ * @see SMI-6343 Wave 3 — tamper-check classification (AC#3)
+ *
+ * Three deterministic-or-best-effort "does this manifest entry's recorded
+ * identity contradict what's actually installed" signals, plus a
+ * "has this on-disk content been locally edited since install" check —
+ * consumed by BOTH `packages/mcp-server/src/tools/outdated.ts` (via
+ * `outdated.identity.ts`) and `packages/cli/src/commands/manage.update.ts`,
+ * so the two packages cannot drift into two independently-maintained
+ * implementations of the same contradiction logic (exactly the "sibling
+ * implementation" bug class both Wave 1 and Wave 2 of SMI-6343 already hit).
+ *
+ * Deliberately decoupled from either caller's own `RegistrySkillInfo` shape
+ * (mcp-server's `install.types.ts` and core's own `skill-installation.types.ts`
+ * both have independently-evolved versions) — callers adapt their own
+ * registry-lookup result into the minimal {@link RegistryLookupOutcome} shape
+ * this module needs.
+ *
+ * Every function here is synchronous and filesystem-free by design: signal 3
+ * (path containment) is a pure string check against an already-resolved
+ * expected root directory, not a `fs.realpath` call — the callers of this
+ * module (`outdated.ts`, `manage.update.ts`) only ever reach the "outdated"
+ * classification branch after already having successfully read the
+ * installed skill's SKILL.md this same iteration, so "does installPath
+ * exist" is already established by the time these signals run.
+ */
+import type { ContentComparisonOutcome } from './skill-content-comparison.js';
+import type { ClientId } from '../install/paths.js';
+/** Which of the three contradiction signals fired. */
+export type IdentitySignal = 'owner-mismatch' | 'frontmatter-contradiction' | 'path-unresolved';
+/** Why a classification could not be conclusively determined. */
+export type IdentityInconclusiveReason = 'offline' | 'quota-exhausted' | 'network-error' | 'no-registry-record' | 'no-history';
+/** The five-state classification `outdated.ts`/`manage.update.ts` report against a divergent entry. */
+export type OutdatedClassificationState = 'current' | 'outdated' | 'local-drift' | 'identity-mismatch' | 'unknown';
+/** Minimal registry-record shape signal 2 needs. */
+export interface IdentityRegistryRecord {
+    author?: string | null;
+    name?: string | null;
+}
+/**
+ * The outcome of a caller's OWN registry lookup for the entry's claimed
+ * `id`, adapted into this module's minimal shape.
+ *
+ * `attempted: false` means the caller never even tried this run (offline,
+ * or an earlier skill in the same batch already exhausted quota) —
+ * `failureReason` in that case names WHY it wasn't attempted. `attempted:
+ * true` with `record: null` means the lookup completed but found nothing
+ * for this id (a distinct case from a failed lookup — see
+ * `no-registry-record` below).
+ */
+export interface RegistryLookupOutcome {
+    attempted: boolean;
+    record: IdentityRegistryRecord | null;
+    /** Populated when the lookup either wasn't attempted or didn't complete. */
+    failureReason?: 'offline' | 'quota-exhausted' | 'network-error' | null;
+}
+/** The subset of a manifest entry every signal needs. */
+export interface ManifestEntryForIdentity {
+    id: string;
+    source: string;
+    installPath: string;
+    client?: ClientId;
+    contentHash?: string;
+    originalContentHash?: string;
+}
+/** Result of {@link classifyManifestEntryIdentity}. */
+export interface IdentityClassificationResult {
+    /** Which signal fired. Null when no signal fired (regardless of `inconclusive`). */
+    signal: IdentitySignal | null;
+    /** True when signal 2 (frontmatter) could not be checked at all. */
+    inconclusive: boolean;
+    /** Populated only when `inconclusive` is true. */
+    inconclusiveReason: IdentityInconclusiveReason | null;
+}
+/** Result of {@link classifyDivergentEntry}. */
+export interface DivergentEntryClassification {
+    state: Exclude<OutdatedClassificationState, 'current'>;
+    signal: IdentitySignal | null;
+    inconclusiveReason: IdentityInconclusiveReason | null;
+}
+/**
+ * Parse the owner segment out of a manifest `source` string. Real installs
+ * write `source` as `'github:' + owner + '/' + repo` (`skill-installation.
+ * service.ts`) — the `'github:'` prefix is optional here so a bare
+ * `owner/repo` (or a future non-GitHub source shape) still parses. Returns
+ * `null` for the `'unknown'` distrust sentinel, a raw URL, or anything else
+ * with no parseable `owner/name` shape.
+ */
+export declare function parseOwnerFromSource(source: string | undefined | null): string | null;
+/**
+ * Parse the owner segment out of a manifest entry's `id`. Returns `null`
+ * for anything that isn't a clean `owner/name` pair — most importantly a
+ * raw GitHub URL, which a direct-URL install records as `id` verbatim (see
+ * {@link parseOwnerFromOwnerNamePair}).
+ */
+export declare function parseOwnerFromId(id: string | undefined | null): string | null;
+/**
+ * Signal 1: `id` parses as `owner/name` and `source` names a DIFFERENT
+ * owner. Deterministic, offline, zero network dependency. Catches the real
+ * `linear` skill corruption (`source: "github:lobehub/lobehub"` vs
+ * `id: "wrsmith108/linear"`).
+ */
+export declare function detectOwnerMismatch(entry: Pick<ManifestEntryForIdentity, 'id' | 'source'>): boolean;
+/**
+ * Signal 3: `installPath` is absent, or resolves OUTSIDE `expectedRootDir`
+ * (the claimed client's native install root, or a workspace-scoped
+ * equivalent the caller resolves — see each caller's own scope handling).
+ *
+ * Deliberately a pure string containment check (`path.relative`), not a
+ * filesystem call: both callers of this module only reach this signal after
+ * already having successfully read the entry's SKILL.md this same
+ * iteration, so filesystem existence is already established. This also
+ * catches the exact shape of the SMI-6343 Wave 1 test-fixture leak (an
+ * OS-temp-dir `installPath` written into the real manifest) via simple
+ * string comparison, with no need to resolve symlinks.
+ *
+ * NOT a symlink-escape check (Wave 3 adversarial review, considered and
+ * scoped out): a real `installPath` inside `expectedRootDir` that is
+ * ITSELF a symlink pointing elsewhere is a local-filesystem-tampering
+ * threat distinct from this signal's actual purpose (catching a manifest
+ * entry whose *recorded* path doesn't match a legitimate install
+ * location — a software-bug/registry-tamper shape, not local attacker
+ * capability); an attacker with write access to plant such a symlink
+ * inside the client root already has equivalent-or-greater capability to
+ * edit SKILL.md content directly, making a `fs.realpath` upgrade here
+ * (which would also force this whole synchronous, filesystem-free module
+ * to become async) address a threat this signal was never meant to cover.
+ *
+ * The parent-segment check below (`rel === '..' || rel.startsWith('..' +
+ * sep)`) is deliberately NOT a bare `rel.startsWith('..')`: a literal
+ * directory name that happens to start with two dots (e.g. `..cache`) is a
+ * legitimate contained child — `path.relative('/r', '/r/..cache')` returns
+ * `'..cache'`, which a bare `startsWith('..')` would misclassify as an
+ * escape (Wave 3 adversarial review finding).
+ */
+export declare function detectPathUnresolved(installPath: string | undefined | null, expectedRootDir: string): boolean;
+/**
+ * Run all three contradiction signals against a manifest entry. Any one
+ * conclusively firing means `signal` is non-null — order (1, 3, 2) checks
+ * the two deterministic/offline signals first, only falling to the
+ * network-dependent signal 2 when neither of those already answered the
+ * question.
+ */
+export declare function classifyManifestEntryIdentity(params: {
+    entry: ManifestEntryForIdentity;
+    localContent: string | null;
+    expectedRootDir: string;
+    registryLookup: RegistryLookupOutcome;
+}): IdentityClassificationResult;
+/**
+ * Has the on-disk content changed since the manifest's own recorded
+ * install/update-time hash? This is what distinguishes a benign local edit
+ * (`local-drift`) from a genuine registry version bump (`outdated`) once
+ * no identity signal has fired.
+ *
+ * When the manifest never recorded a comparable hash at all (a legacy or
+ * adopted entry, `contentHash`/`originalContentHash` both absent), this
+ * deliberately defaults to `false` (no edit evidence) rather than `true`
+ * (conservative) — absence of a recorded hash is a data-quality gap, not
+ * positive evidence of tampering, and defaulting to `true` here would
+ * misclassify the large population of legacy/adopted entries that never had
+ * a hash recorded as `local-drift` even when they are genuinely just
+ * outdated (SMI-6343 Wave 3 review finding).
+ */
+export declare function hasRecordedLocalEdit(entry: Pick<ManifestEntryForIdentity, 'contentHash' | 'originalContentHash'>, localHash: string | null): boolean;
+/**
+ * Classify an entry the caller has ALREADY determined is divergent from the
+ * registry (mcp-server: `compareSkillContentHashes(...).outcome ===
+ * 'outdated'`; CLI: `getSkillDiff()` found a version/content difference).
+ * Never returns `'current'` — callers own that trivial case themselves,
+ * since it never needs signal evaluation at all.
+ */
+export declare function classifyDivergentEntry(params: {
+    entry: ManifestEntryForIdentity;
+    localHash: string | null;
+    localContent: string | null;
+    expectedRootDir: string;
+    registryLookup: RegistryLookupOutcome;
+}): DivergentEntryClassification;
+/**
+ * Full 5-state classification given an already-computed content-comparison
+ * outcome (from `compareSkillContentHashes`) plus the caller-derived reason
+ * a plain `'unknown'` comparison outcome couldn't be resolved (offline,
+ * quota-exhausted, network-error, or no-history — the caller already tracks
+ * which applies; see `outdated.ts`'s `deriveUnknownReason`).
+ */
+export declare function classifyOutdatedState(params: {
+    comparisonOutcome: ContentComparisonOutcome;
+    unknownReasonWhenComparisonUnknown: IdentityInconclusiveReason;
+    entry: ManifestEntryForIdentity;
+    localHash: string | null;
+    localContent: string | null;
+    expectedRootDir: string;
+    registryLookup: RegistryLookupOutcome;
+}): {
+    state: OutdatedClassificationState;
+    signal: IdentitySignal | null;
+    inconclusiveReason: IdentityInconclusiveReason | null;
+};
+//# sourceMappingURL=skill-identity-classification.d.ts.map

package/dist/src/services/skill-identity-classification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-identity-classification.d.ts","sourceRoot":"","sources":["../../../src/services/skill-identity-classification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAMnD,sDAAsD;AACtD,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,2BAA2B,GAAG,iBAAiB,CAAA;AAE/F,iEAAiE;AACjE,MAAM,MAAM,0BAA0B,GAClC,SAAS,GACT,iBAAiB,GACjB,eAAe,GACf,oBAAoB,GACpB,YAAY,CAAA;AAEhB,uGAAuG;AACvG,MAAM,MAAM,2BAA2B,GACnC,SAAS,GACT,UAAU,GACV,aAAa,GACb,mBAAmB,GACnB,SAAS,CAAA;AAEb,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAA;IACrC,4EAA4E;IAC5E,aAAa,CAAC,EAAE,SAAS,GAAG,iBAAiB,GAAG,eAAe,GAAG,IAAI,CAAA;CACvE;AAED,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,QAAQ,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,uDAAuD;AACvD,MAAM,WAAW,4BAA4B;IAC3C,oFAAoF;IACpF,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;IAC7B,oEAAoE;IACpE,YAAY,EAAE,OAAO,CAAA;IACrB,kDAAkD;IAClD,kBAAkB,EAAE,0BAA0B,GAAG,IAAI,CAAA;CACtD;AAED,gDAAgD;AAChD,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,OAAO,CAAC,2BAA2B,EAAE,SAAS,CAAC,CAAA;IACtD,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;IAC7B,kBAAkB,EAAE,0BAA0B,GAAG,IAAI,CAAA;CACtD;AAwBD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAIrF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG7E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,IAAI,GAAG,QAAQ,CAAC,GACrD,OAAO,CAKT;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACtC,eAAe,EAAE,MAAM,GACtB,OAAO,CAKT;AA6FD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,wBAAwB,CAAA;IAC/B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,qBAAqB,CAAA;CACtC,GAAG,4BAA4B,CAkB/B;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,aAAa,GAAG,qBAAqB,CAAC,EAC5E,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAIT;AAMD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,KAAK,EAAE,wBAAwB,CAAA;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,qBAAqB,CAAA;CACtC,GAAG,4BAA4B,CAa/B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAC5C,iBAAiB,EAAE,wBAAwB,CAAA;IAC3C,kCAAkC,EAAE,0BAA0B,CAAA;IAC9D,KAAK,EAAE,wBAAwB,CAAA;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,qBAAqB,CAAA;CACtC,GAAG;IACF,KAAK,EAAE,2BAA2B,CAAA;IAClC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;IAC7B,kBAAkB,EAAE,0BAA0B,GAAG,IAAI,CAAA;CACtD,CAYA"}