@skillsmith/core 0.12.1 → 0.12.3

package/dist/src/install/agent-pack-installer.antigravity-mcp.d.ts

@@ -0,0 +1,74 @@
+/**
+ * AntiGravity-specific MCP registration step for `sklx agent install`
+ * (SMI-6275 Wave 5, closing the last unshipped ask of GH#2166).
+ *
+ * Split out of `agent-pack-installer.harness.ts`'s generic `installMcpConfig`
+ * for a STRUCTURAL reason (not just a per-harness-quirk reason like Cursor's
+ * split): every other MCP-capable harness's config path is HOME-anchored
+ * (`AGENT_MCP_TARGETS`, `agent-harness-targets.ts`) and resolved via
+ * `relocateUnderHome()`. AntiGravity's `.agents/mcp_config.json` is
+ * WORKSPACE-anchored — relative to the workspace root Wave 4
+ * (`workspace-scope.ts`, ADR-139) resolves — so it cannot live in that
+ * HOME-anchored `Record` at all, and never goes through `relocateUnderHome()`.
+ * This module owns AntiGravity's path resolution + entry-value shape
+ * entirely outside that table, mirroring the Cursor precedent
+ * (`agent-pack-installer.cursor-mcp.ts`, SMI-6279 Wave 9) for the "give it
+ * its own file" convention while differing in WHY: Cursor's shape/key both
+ * diverge from the shared convention; AntiGravity's shape and key both MATCH
+ * the shared convention (see {@link ANTIGRAVITY_MCP_ENTRY_KEY} and
+ * `buildAntigravityMcpEntryValue()` in `agent-pack-installer.entry.ts}) — only
+ * its PATH RESOLUTION diverges structurally.
+ *
+ * ## Schema verification (SMI-6275 Wave 5 Step 2 point 5)
+ *
+ * Confidence: **HIGH**. Verified 2026-08-30 via live web search against two
+ * canonical Google sources (antigravity.google/docs/ide/mcp/ and
+ * antigravity.google/docs/cli/mcp/), corroborated by two independent
+ * third-party write-ups (a Google Cloud Community/Medium walkthrough and a
+ * Composio how-to guide):
+ *   - Path: `.agents/mcp_config.json`, workspace-local, discovered
+ *     automatically by "the SDK" (AntiGravity's own phrasing) — sibling to
+ *     the GLOBAL `~/.gemini/config/mcp_config.json` (itself a sibling of
+ *     `CLIENT_NATIVE_PATHS.antigravity`'s `~/.gemini/config/skills`, `paths.ts`).
+ *     Matches `docs/internal/research/smi-5386-opencode-antigravity-skill-dirs.md`'s
+ *     already-verified `.agents/skills/` sibling convention for the same
+ *     workspace root.
+ *   - Schema: a single top-level `mcpServers` object — the SAME
+ *     `mcpServers`-keyed convention claude-code/copilot/windsurf/hermes
+ *     already use (NOT OpenCode's distinct `local|remote`-typed shape, NOT
+ *     Codex's TOML block, NOT Cursor's resolved-binary-path form). Local/
+ *     command-based servers are defined with `command` + `args` + optional
+ *     `env` — exactly {@link buildAgentMcpEntryValue}'s existing shape, so
+ *     `buildAntigravityMcpEntryValue()` composes over it rather than
+ *     reinventing it.
+ *   - This is reused, not novel: `mergeJsonMcpEntry()` (`agent-config-merge.json.ts`)
+ *     already speaks this exact shape for four other harnesses — only the
+ *     PATH (workspace-anchored) and the entry KEY (package-scoped, matching
+ *     AntiGravity's own docs snippet — see `ANTIGRAVITY_MCP_ENTRY_KEY`) are
+ *     new to this wave.
+ *
+ * @module @skillsmith/core/install/agent-pack-installer.antigravity-mcp
+ */
+import type { HarnessInstallCtx } from './agent-pack-installer.harness.js';
+import type { HarnessInstallReport } from './agent-pack-installer.types.js';
+/**
+ * Relative path segments (from the resolved workspace root) to AntiGravity's
+ * MCP config file. Exported as a fixed constant — not a hand-duplicated
+ * string literal — so `agent-manifest-path-guard.ts`'s uninstall-time
+ * allowlist check can validate against the EXACT same shape this module
+ * writes, rather than an independently-maintained copy that could drift.
+ */
+export declare const ANTIGRAVITY_MCP_CONFIG_RELATIVE_SEGMENTS: readonly [".agents", "mcp_config.json"];
+/**
+ * Merge AntiGravity's MCP server registration into
+ * `<workspaceRoot>/.agents/mcp_config.json` under
+ * {@link ANTIGRAVITY_MCP_ENTRY_KEY}.
+ *
+ * Caller (`agent-pack-installer.ts`) is responsible for having already
+ * confirmed `workspaceRoot` is a genuinely resolved AntiGravity workspace
+ * scope (via `resolveScopedSkillsDir()`) — this function does no scope
+ * resolution or detection of its own, per the "reuse Wave 4's resolver,
+ * don't reimplement detection" requirement.
+ */
+export declare function installAntigravityMcpConfig(workspaceRoot: string, ctx: HarnessInstallCtx, report: HarnessInstallReport): void;
+//# sourceMappingURL=agent-pack-installer.antigravity-mcp.d.ts.map

package/dist/src/install/agent-pack-installer.antigravity-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-pack-installer.antigravity-mcp.d.ts","sourceRoot":"","sources":["../../../src/install/agent-pack-installer.antigravity-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AASH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAQ3E;;;;;;GAMG;AACH,eAAO,MAAM,wCAAwC,yCAA0C,CAAA;AAE/F;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,oBAAoB,GAC3B,IAAI,CA+BN"}

package/dist/src/install/agent-pack-installer.antigravity-mcp.js

@@ -0,0 +1,106 @@
+/**
+ * AntiGravity-specific MCP registration step for `sklx agent install`
+ * (SMI-6275 Wave 5, closing the last unshipped ask of GH#2166).
+ *
+ * Split out of `agent-pack-installer.harness.ts`'s generic `installMcpConfig`
+ * for a STRUCTURAL reason (not just a per-harness-quirk reason like Cursor's
+ * split): every other MCP-capable harness's config path is HOME-anchored
+ * (`AGENT_MCP_TARGETS`, `agent-harness-targets.ts`) and resolved via
+ * `relocateUnderHome()`. AntiGravity's `.agents/mcp_config.json` is
+ * WORKSPACE-anchored — relative to the workspace root Wave 4
+ * (`workspace-scope.ts`, ADR-139) resolves — so it cannot live in that
+ * HOME-anchored `Record` at all, and never goes through `relocateUnderHome()`.
+ * This module owns AntiGravity's path resolution + entry-value shape
+ * entirely outside that table, mirroring the Cursor precedent
+ * (`agent-pack-installer.cursor-mcp.ts`, SMI-6279 Wave 9) for the "give it
+ * its own file" convention while differing in WHY: Cursor's shape/key both
+ * diverge from the shared convention; AntiGravity's shape and key both MATCH
+ * the shared convention (see {@link ANTIGRAVITY_MCP_ENTRY_KEY} and
+ * `buildAntigravityMcpEntryValue()` in `agent-pack-installer.entry.ts}) — only
+ * its PATH RESOLUTION diverges structurally.
+ *
+ * ## Schema verification (SMI-6275 Wave 5 Step 2 point 5)
+ *
+ * Confidence: **HIGH**. Verified 2026-08-30 via live web search against two
+ * canonical Google sources (antigravity.google/docs/ide/mcp/ and
+ * antigravity.google/docs/cli/mcp/), corroborated by two independent
+ * third-party write-ups (a Google Cloud Community/Medium walkthrough and a
+ * Composio how-to guide):
+ *   - Path: `.agents/mcp_config.json`, workspace-local, discovered
+ *     automatically by "the SDK" (AntiGravity's own phrasing) — sibling to
+ *     the GLOBAL `~/.gemini/config/mcp_config.json` (itself a sibling of
+ *     `CLIENT_NATIVE_PATHS.antigravity`'s `~/.gemini/config/skills`, `paths.ts`).
+ *     Matches `docs/internal/research/smi-5386-opencode-antigravity-skill-dirs.md`'s
+ *     already-verified `.agents/skills/` sibling convention for the same
+ *     workspace root.
+ *   - Schema: a single top-level `mcpServers` object — the SAME
+ *     `mcpServers`-keyed convention claude-code/copilot/windsurf/hermes
+ *     already use (NOT OpenCode's distinct `local|remote`-typed shape, NOT
+ *     Codex's TOML block, NOT Cursor's resolved-binary-path form). Local/
+ *     command-based servers are defined with `command` + `args` + optional
+ *     `env` — exactly {@link buildAgentMcpEntryValue}'s existing shape, so
+ *     `buildAntigravityMcpEntryValue()` composes over it rather than
+ *     reinventing it.
+ *   - This is reused, not novel: `mergeJsonMcpEntry()` (`agent-config-merge.json.ts`)
+ *     already speaks this exact shape for four other harnesses — only the
+ *     PATH (workspace-anchored) and the entry KEY (package-scoped, matching
+ *     AntiGravity's own docs snippet — see `ANTIGRAVITY_MCP_ENTRY_KEY`) are
+ *     new to this wave.
+ *
+ * @module @skillsmith/core/install/agent-pack-installer.antigravity-mcp
+ */
+import { join } from 'node:path';
+import { mergeJsonMcpEntry } from './agent-config-merge.json.js';
+import { ANTIGRAVITY_MCP_ENTRY_KEY, buildAntigravityMcpEntryValue, } from './agent-pack-installer.entry.js';
+/** Same predicate as `agent-pack-installer.harness.ts`'s private `mergeSucceeded` — duplicated rather than exported to keep that module's helper private. */
+function mergeSucceeded(status) {
+    return status === 'created' || status === 'updated' || status === 'unchanged';
+}
+/**
+ * Relative path segments (from the resolved workspace root) to AntiGravity's
+ * MCP config file. Exported as a fixed constant — not a hand-duplicated
+ * string literal — so `agent-manifest-path-guard.ts`'s uninstall-time
+ * allowlist check can validate against the EXACT same shape this module
+ * writes, rather than an independently-maintained copy that could drift.
+ */
+export const ANTIGRAVITY_MCP_CONFIG_RELATIVE_SEGMENTS = ['.agents', 'mcp_config.json'];
+/**
+ * Merge AntiGravity's MCP server registration into
+ * `<workspaceRoot>/.agents/mcp_config.json` under
+ * {@link ANTIGRAVITY_MCP_ENTRY_KEY}.
+ *
+ * Caller (`agent-pack-installer.ts`) is responsible for having already
+ * confirmed `workspaceRoot` is a genuinely resolved AntiGravity workspace
+ * scope (via `resolveScopedSkillsDir()`) — this function does no scope
+ * resolution or detection of its own, per the "reuse Wave 4's resolver,
+ * don't reimplement detection" requirement.
+ */
+export function installAntigravityMcpConfig(workspaceRoot, ctx, report) {
+    const path = join(workspaceRoot, ...ANTIGRAVITY_MCP_CONFIG_RELATIVE_SEGMENTS);
+    const result = mergeJsonMcpEntry({
+        path,
+        keyPath: ['mcpServers'],
+        entryKey: ANTIGRAVITY_MCP_ENTRY_KEY,
+        entryValue: buildAntigravityMcpEntryValue(),
+        backupDir: ctx.backupDir,
+        force: ctx.force,
+        alreadyBackedUpPaths: ctx.backedUpPaths,
+    });
+    report.mcpConfig = result;
+    if (result.status === 'conflict') {
+        report.notes.push(`MCP config at ${path} already has a '${ANTIGRAVITY_MCP_ENTRY_KEY}' entry that doesn't look like ours — left untouched. Re-run with --force to overwrite, or edit ${path} manually.`);
+    }
+    if (result.status === 'error') {
+        report.notes.push(`MCP config merge failed at ${path}: ${result.errorMessage}`);
+    }
+    if (mergeSucceeded(result.status)) {
+        ctx.entries.push({
+            path,
+            kind: 'mcp-config',
+            harness: 'antigravity',
+            backupPath: result.backupPath,
+            executable: false,
+        });
+    }
+}
+//# sourceMappingURL=agent-pack-installer.antigravity-mcp.js.map

package/dist/src/install/agent-pack-installer.antigravity-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-pack-installer.antigravity-mcp.js","sourceRoot":"","sources":["../../../src/install/agent-pack-installer.antigravity-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,iCAAiC,CAAA;AAKxC,6JAA6J;AAC7J,SAAS,cAAc,CAAC,MAA6B;IACnD,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,WAAW,CAAA;AAC/E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAU,CAAA;AAE/F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,aAAqB,EACrB,GAAsB,EACtB,MAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,wCAAwC,CAAC,CAAA;IAE7E,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,IAAI;QACJ,OAAO,EAAE,CAAC,YAAY,CAAC;QACvB,QAAQ,EAAE,yBAAyB;QACnC,UAAU,EAAE,6BAA6B,EAAE;QAC3C,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,oBAAoB,EAAE,GAAG,CAAC,aAAa;KACxC,CAAC,CAAA;IAEF,MAAM,CAAC,SAAS,GAAG,MAAM,CAAA;IACzB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,iBAAiB,IAAI,mBAAmB,yBAAyB,mGAAmG,IAAI,YAAY,CACrL,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B,IAAI,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YACf,IAAI;YACJ,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,aAAa;YACtB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,KAAK;SAClB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/src/install/agent-pack-installer.antigravity-mcp.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-pack-installer.antigravity-mcp.test.d.ts.map

package/dist/src/install/agent-pack-installer.antigravity-mcp.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-pack-installer.antigravity-mcp.test.d.ts","sourceRoot":"","sources":["../../../src/install/agent-pack-installer.antigravity-mcp.test.ts"],"names":[],"mappings":""}

package/dist/src/install/agent-pack-installer.antigravity-mcp.test.js

@@ -0,0 +1,157 @@
+/**
+ * AntiGravity `.agents/mcp_config.json` entry-shape + lifecycle coverage
+ * (SMI-6275 Wave 5, GH#2166 ask 3).
+ *
+ * Split from the sibling `agent-pack-installer.workspace-scope.test.ts`
+ * (which covers detection/scope-resolution behavior) and
+ * `agent-pack-installer.test.ts`/`agent-manifest-path-guard.test.ts`,
+ * mirroring this file family's existing `.cursor-mcp.test.ts` sibling
+ * convention. Covers the four things Wave 5's own required test names:
+ *   1. Entry shape — `@skillsmith/mcp-server` key, `npx` form,
+ *      `SKILLSMITH_CLIENT=antigravity` + `SKILLSMITH_TOOL_PROFILE=agent`.
+ *   2. Idempotency — re-install does not duplicate or corrupt the entry.
+ *   3. Conflict/force — a foreign entry at the same key is preserved unless
+ *      `--force` is passed.
+ *   4. Uninstall — removes only Skillsmith-owned keys, restoring any
+ *      hand-added sibling key untouched (also the regression test for the
+ *      `agent-manifest-path-guard.ts` workspace-relative allowlist fix this
+ *      wave adds — without it, `uninstallAgentPack` would silently REJECT
+ *      every AntiGravity manifest entry as "outside known install targets").
+ *
+ * @module @skillsmith/core/install/agent-pack-installer.antigravity-mcp.test
+ */
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { installAgentPack } from './agent-pack-installer.js';
+import { uninstallAgentPack } from './agent-pack-uninstaller.js';
+import { AGENT_INSTALL_DIR_ENV_VAR } from './agent-manifest.js';
+let homeDir;
+let workspaceDir;
+let manifestDir;
+let prevInstallDirEnv;
+function mcpConfigPath(workspace) {
+    return join(workspace, '.agents', 'mcp_config.json');
+}
+function readAntigravityMcpJson(workspace) {
+    return JSON.parse(readFileSync(mcpConfigPath(workspace), 'utf-8'));
+}
+beforeEach(() => {
+    homeDir = mkdtempSync(join(tmpdir(), 'skillsmith-agent-install-home-'));
+    workspaceDir = mkdtempSync(join(tmpdir(), 'skillsmith-agent-install-workspace-'));
+    mkdirSync(join(workspaceDir, '.git'), { recursive: true });
+    manifestDir = mkdtempSync(join(tmpdir(), 'skillsmith-agent-install-manifest-'));
+    prevInstallDirEnv = process.env[AGENT_INSTALL_DIR_ENV_VAR];
+    process.env[AGENT_INSTALL_DIR_ENV_VAR] = manifestDir;
+});
+afterEach(() => {
+    rmSync(homeDir, { recursive: true, force: true });
+    rmSync(workspaceDir, { recursive: true, force: true });
+    rmSync(manifestDir, { recursive: true, force: true });
+    if (prevInstallDirEnv !== undefined)
+        process.env[AGENT_INSTALL_DIR_ENV_VAR] = prevInstallDirEnv;
+    else
+        delete process.env[AGENT_INSTALL_DIR_ENV_VAR];
+});
+describe('installAgentPack — AntiGravity mcp_config.json entry shape (SMI-6275 Wave 5)', () => {
+    it('writes the entry under the @skillsmith/mcp-server key with the npx form + SKILLSMITH_CLIENT=antigravity', () => {
+        const result = installAgentPack({ homeDir, cwd: workspaceDir, scope: 'workspace' });
+        const doc = readAntigravityMcpJson(workspaceDir);
+        const entry = doc.mcpServers['@skillsmith/mcp-server'];
+        expect(entry?.command).toBe('npx');
+        expect(entry?.args).toEqual(['-y', '@skillsmith/mcp-server']);
+        expect(entry?.env?.SKILLSMITH_CLIENT).toBe('antigravity');
+        expect(entry?.env?.SKILLSMITH_TOOL_PROFILE).toBe('agent');
+        // No stray legacy 'skillsmith'-keyed entry — this is a first-ever
+        // implementation, nothing to migrate away from.
+        expect(doc.mcpServers.skillsmith).toBeUndefined();
+        const report = result.harnessReports.find((r) => r.harness === 'antigravity');
+        expect(report?.mcpConfig?.status).toBe('created');
+    });
+    it('does not regress claude-code’s own entry — still the npx form under the "skillsmith" key, no SKILLSMITH_CLIENT', () => {
+        installAgentPack({ homeDir, cwd: workspaceDir, scope: 'workspace' });
+        const claudeDoc = JSON.parse(readFileSync(join(homeDir, '.claude', 'settings.json'), 'utf-8'));
+        expect(claudeDoc.mcpServers.skillsmith?.command).toBe('npx');
+        expect(claudeDoc.mcpServers.skillsmith?.env?.SKILLSMITH_TOOL_PROFILE).toBe('agent');
+        expect(claudeDoc.mcpServers.skillsmith?.env?.SKILLSMITH_CLIENT).toBeUndefined();
+    });
+});
+describe('installAgentPack — AntiGravity mcp_config.json idempotency (SMI-6275 Wave 5)', () => {
+    it('re-install does not create a duplicate second server entry', () => {
+        installAgentPack({ homeDir, cwd: workspaceDir, scope: 'workspace' });
+        const second = installAgentPack({ homeDir, cwd: workspaceDir, scope: 'workspace' });
+        const doc = readAntigravityMcpJson(workspaceDir);
+        expect(Object.keys(doc.mcpServers)).toEqual(['@skillsmith/mcp-server']);
+        const report = second.harnessReports.find((r) => r.harness === 'antigravity');
+        expect(report?.mcpConfig?.status).toBe('unchanged');
+    });
+    it('a second install run leaves the file byte-identical', () => {
+        installAgentPack({ homeDir, cwd: workspaceDir, scope: 'workspace' });
+        const afterFirst = readFileSync(mcpConfigPath(workspaceDir), 'utf-8');
+        installAgentPack({ homeDir, cwd: workspaceDir, scope: 'workspace' });
+        const afterSecond = readFileSync(mcpConfigPath(workspaceDir), 'utf-8');
+        expect(afterSecond).toBe(afterFirst);
+    });
+});
+describe('installAgentPack — AntiGravity mcp_config.json conflict + --force (SMI-6275 Wave 5)', () => {
+    it('leaves a foreign entry at the same key untouched, reporting a conflict', () => {
+        mkdirSync(join(workspaceDir, '.agents'), { recursive: true });
+        const foreignEntry = { command: 'some-other-tool', args: ['--flag'] };
+        writeFileSync(mcpConfigPath(workspaceDir), JSON.stringify({ mcpServers: { '@skillsmith/mcp-server': foreignEntry } }, null, 2));
+        const result = installAgentPack({ homeDir, cwd: workspaceDir, scope: 'workspace' });
+        const doc = readAntigravityMcpJson(workspaceDir);
+        expect(doc.mcpServers['@skillsmith/mcp-server']).toEqual(foreignEntry);
+        const report = result.harnessReports.find((r) => r.harness === 'antigravity');
+        expect(report?.mcpConfig?.status).toBe('conflict');
+        expect(report?.notes.some((n) => n.includes('--force'))).toBe(true);
+    });
+    it('--force overwrites a foreign entry at the same key', () => {
+        mkdirSync(join(workspaceDir, '.agents'), { recursive: true });
+        writeFileSync(mcpConfigPath(workspaceDir), JSON.stringify({ mcpServers: { '@skillsmith/mcp-server': { command: 'some-other-tool' } } }, null, 2));
+        const result = installAgentPack({
+            homeDir,
+            cwd: workspaceDir,
+            scope: 'workspace',
+            force: true,
+        });
+        const doc = readAntigravityMcpJson(workspaceDir);
+        expect(doc.mcpServers['@skillsmith/mcp-server']?.command).toBe('npx');
+        const report = result.harnessReports.find((r) => r.harness === 'antigravity');
+        expect(report?.mcpConfig?.status).toBe('updated');
+    });
+});
+describe('installAgentPack + uninstallAgentPack — AntiGravity workspace artifacts (SMI-6275 Wave 5)', () => {
+    it('uninstall removes the freshly-created skill pack AND mcp_config.json entirely (no manifest-guard rejection)', () => {
+        installAgentPack({ homeDir, cwd: workspaceDir, scope: 'workspace' });
+        const skillPackPath = join(workspaceDir, '.agents', 'skills', 'skillsmith-agent', 'SKILL.md');
+        expect(existsSync(skillPackPath)).toBe(true);
+        expect(existsSync(mcpConfigPath(workspaceDir))).toBe(true);
+        const result = uninstallAgentPack({ homeDir });
+        // The regression this test guards: without the agent-manifest-path-guard.ts
+        // workspace-relative allowlist fix, both paths would land in `rejected`
+        // (outside the guard's home-relative-only allowlist) and never actually
+        // be deleted.
+        expect(result.rejected).toEqual([]);
+        expect(result.removed).toContain(skillPackPath);
+        expect(result.removed).toContain(mcpConfigPath(workspaceDir));
+        expect(existsSync(skillPackPath)).toBe(false);
+        expect(existsSync(mcpConfigPath(workspaceDir))).toBe(false);
+    });
+    it('uninstall restores a hand-added sibling key in mcp_config.json untouched, removing only our own key', () => {
+        mkdirSync(join(workspaceDir, '.agents'), { recursive: true });
+        const siblingDoc = { mcpServers: { 'my-other-tool': { command: 'foo', args: ['bar'] } } };
+        writeFileSync(mcpConfigPath(workspaceDir), JSON.stringify(siblingDoc, null, 2));
+        installAgentPack({ homeDir, cwd: workspaceDir, scope: 'workspace' });
+        const afterInstall = readAntigravityMcpJson(workspaceDir);
+        expect(afterInstall.mcpServers['my-other-tool']).toEqual(siblingDoc.mcpServers['my-other-tool']);
+        expect(afterInstall.mcpServers['@skillsmith/mcp-server']).toBeDefined();
+        const result = uninstallAgentPack({ homeDir });
+        expect(result.rejected).toEqual([]);
+        expect(result.restored).toContain(mcpConfigPath(workspaceDir));
+        const afterUninstall = readAntigravityMcpJson(workspaceDir);
+        expect(afterUninstall.mcpServers['my-other-tool']).toEqual(siblingDoc.mcpServers['my-other-tool']);
+        expect(afterUninstall.mcpServers['@skillsmith/mcp-server']).toBeUndefined();
+    });
+});
+//# sourceMappingURL=agent-pack-installer.antigravity-mcp.test.js.map

package/dist/src/install/agent-pack-installer.antigravity-mcp.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-pack-installer.antigravity-mcp.test.js","sourceRoot":"","sources":["../../../src/install/agent-pack-installer.antigravity-mcp.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACjG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,IAAI,OAAe,CAAA;AACnB,IAAI,YAAoB,CAAA;AACxB,IAAI,WAAmB,CAAA;AACvB,IAAI,iBAAqC,CAAA;AASzC,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAsB,CAAA;AACzF,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAC,CAAA;IACvE,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qCAAqC,CAAC,CAAC,CAAA;IACjF,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oCAAoC,CAAC,CAAC,CAAA;IAC/E,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;IAC1D,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,WAAW,CAAA;AACtD,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACtD,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,iBAAiB,CAAA;;QAC1F,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;AACpD,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,8EAA8E,EAAE,GAAG,EAAE;IAC5F,EAAE,CAAC,yGAAyG,EAAE,GAAG,EAAE;QACjH,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAA;QACtD,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAA;QAC7D,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACzD,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzD,kEAAkE;QAClE,gDAAgD;QAChD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAA;QAEjD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAA;QAC7E,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gHAAgH,EAAE,GAAG,EAAE;QACxH,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QAEpE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAC1B,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAC5C,CAAA;QACtB,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5D,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnF,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAA;IACjF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,8EAA8E,EAAE,GAAG,EAAE;IAC5F,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QACpE,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAA;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAEvE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAA;QAC7E,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QACpE,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAA;QACrE,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QACpE,MAAM,WAAW,GAAG,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAA;QAEtE,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qFAAqF,EAAE,GAAG,EAAE;IACnG,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,MAAM,YAAY,GAAG,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAA;QACrE,aAAa,CACX,aAAa,CAAC,YAAY,CAAC,EAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,wBAAwB,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CACpF,CAAA;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAA;QAChD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAEtE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAA;QAC7E,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAClD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,aAAa,CACX,aAAa,CAAC,YAAY,CAAC,EAC3B,IAAI,CAAC,SAAS,CACZ,EAAE,UAAU,EAAE,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAC5E,IAAI,EACJ,CAAC,CACF,CACF,CAAA;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;YAC9B,OAAO;YACP,GAAG,EAAE,YAAY;YACjB,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAA;QAChD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAA;QAC7E,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,2FAA2F,EAAE,GAAG,EAAE;IACzG,EAAE,CAAC,6GAA6G,EAAE,GAAG,EAAE;QACrH,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAA;QAC7F,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE1D,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAE9C,4EAA4E;QAC5E,wEAAwE;QACxE,wEAAwE;QACxE,cAAc;QACd,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAC/C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAA;QAC7D,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qGAAqG,EAAE,GAAG,EAAE;QAC7G,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,MAAM,UAAU,GAAG,EAAE,UAAU,EAAE,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAA;QACzF,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAE/E,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QACpE,MAAM,YAAY,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAA;QACzD,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAA;QAChG,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAEvE,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC9C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAA;QAE9D,MAAM,cAAc,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAA;QAC3D,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CACxD,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,CACvC,CAAA;QACD,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/install/agent-pack-installer.cursor-mcp.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Cursor-specific MCP registration step for `sklx agent install`
+ * (SMI-6279 Wave 9).
+ *
+ * Split out of `agent-pack-installer.harness.ts`'s generic `installMcpConfig`
+ * — mirrors the existing `agent-pack-installer.cursor-hooks.ts` split
+ * (SMI-5893 Wave 8a) for the same reason: Cursor's on-disk shape/resolution
+ * needs diverge structurally from the other 6 MCP-capable harnesses, so
+ * folding cursor-only logic into the shared function would either bloat it
+ * past the 500-line gate or force every other harness through cursor-only
+ * branches it doesn't need.
+ *
+ * Two independent, confirmed-broken things this fixes (GH#2368 V3 repro —
+ * see the SMI-6266 Wave 9 plan doc):
+ *   1. `buildAgentMcpEntryValue()` wrote the `npx`/`args` form into Cursor's
+ *      `mcp.json` — the exact shape two live UAT passes proved ENOENTs
+ *      inside Cursor's bundled Node (GH#2368 C-01) — and never set
+ *      `SKILLSMITH_CLIENT`, so re-running `agent install` (the very
+ *      remediation `formatUpdateNotification()` tells a user to run)
+ *      silently rewrote the SAME broken entry, even after the website docs
+ *      snippet was corrected (SMI-5893 Wave 11). {@link installCursorMcpConfig}
+ *      now writes `buildCursorMcpEntryValue()` instead — resolved binary
+ *      path (or the documented paste-here placeholder) plus
+ *      `SKILLSMITH_CLIENT=cursor`.
+ *   2. The installer wrote its entry under the JSON key `skillsmith`, while
+ *      the website/CLI-template docs snippet (which users are told to
+ *      hand-paste) uses the package-scoped key `@skillsmith/mcp-server` — a
+ *      user who did both ended up with TWO different server entries
+ *      coexisting in the same file, neither ever recognized as "the
+ *      other's" by the installer's own conflict-detection (which matches
+ *      purely on key). {@link installCursorMcpConfig} now writes under
+ *      `CURSOR_MCP_ENTRY_KEY` (`'@skillsmith/mcp-server'`) so a docs-paste
+ *      and an `agent install` reconcile as ONE entry, and
+ *      {@link stripStaleLegacyMcpKey} removes a pre-fix install's stale
+ *      `'skillsmith'`-keyed entry (mirroring the cursor-hooks legacy-key
+ *      cleanup precedent) so a re-install doesn't leave both keys present.
+ *
+ * Scoped to Cursor ONLY — `mergeJsonMcpEntry`'s default `entryKey`
+ * (`'skillsmith'`) and `buildAgentMcpEntryValue()`'s `npx` form are
+ * UNCHANGED for claude-code/copilot/windsurf/opencode/codex/hermes; nothing
+ * in this module is reachable from any other harness's install path.
+ *
+ * @module @skillsmith/core/install/agent-pack-installer.cursor-mcp
+ */
+import type { HarnessInstallCtx } from './agent-pack-installer.harness.js';
+import type { HarnessInstallReport } from './agent-pack-installer.types.js';
+/**
+ * Merge Cursor's `skillsmith` MCP server registration into `~/.cursor/mcp.json`
+ * under {@link CURSOR_MCP_ENTRY_KEY}, then clean up a stale legacy-keyed
+ * entry from a pre-SMI-6279 install (see module header).
+ */
+export declare function installCursorMcpConfig(ctx: HarnessInstallCtx, report: HarnessInstallReport): void;
+//# sourceMappingURL=agent-pack-installer.cursor-mcp.d.ts.map

package/dist/src/install/agent-pack-installer.cursor-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-pack-installer.cursor-mcp.d.ts","sourceRoot":"","sources":["../../../src/install/agent-pack-installer.cursor-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAeH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAQ3E;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAqDjG"}

package/dist/src/install/agent-pack-installer.cursor-mcp.js

@@ -0,0 +1,207 @@
+/**
+ * Cursor-specific MCP registration step for `sklx agent install`
+ * (SMI-6279 Wave 9).
+ *
+ * Split out of `agent-pack-installer.harness.ts`'s generic `installMcpConfig`
+ * — mirrors the existing `agent-pack-installer.cursor-hooks.ts` split
+ * (SMI-5893 Wave 8a) for the same reason: Cursor's on-disk shape/resolution
+ * needs diverge structurally from the other 6 MCP-capable harnesses, so
+ * folding cursor-only logic into the shared function would either bloat it
+ * past the 500-line gate or force every other harness through cursor-only
+ * branches it doesn't need.
+ *
+ * Two independent, confirmed-broken things this fixes (GH#2368 V3 repro —
+ * see the SMI-6266 Wave 9 plan doc):
+ *   1. `buildAgentMcpEntryValue()` wrote the `npx`/`args` form into Cursor's
+ *      `mcp.json` — the exact shape two live UAT passes proved ENOENTs
+ *      inside Cursor's bundled Node (GH#2368 C-01) — and never set
+ *      `SKILLSMITH_CLIENT`, so re-running `agent install` (the very
+ *      remediation `formatUpdateNotification()` tells a user to run)
+ *      silently rewrote the SAME broken entry, even after the website docs
+ *      snippet was corrected (SMI-5893 Wave 11). {@link installCursorMcpConfig}
+ *      now writes `buildCursorMcpEntryValue()` instead — resolved binary
+ *      path (or the documented paste-here placeholder) plus
+ *      `SKILLSMITH_CLIENT=cursor`.
+ *   2. The installer wrote its entry under the JSON key `skillsmith`, while
+ *      the website/CLI-template docs snippet (which users are told to
+ *      hand-paste) uses the package-scoped key `@skillsmith/mcp-server` — a
+ *      user who did both ended up with TWO different server entries
+ *      coexisting in the same file, neither ever recognized as "the
+ *      other's" by the installer's own conflict-detection (which matches
+ *      purely on key). {@link installCursorMcpConfig} now writes under
+ *      `CURSOR_MCP_ENTRY_KEY` (`'@skillsmith/mcp-server'`) so a docs-paste
+ *      and an `agent install` reconcile as ONE entry, and
+ *      {@link stripStaleLegacyMcpKey} removes a pre-fix install's stale
+ *      `'skillsmith'`-keyed entry (mirroring the cursor-hooks legacy-key
+ *      cleanup precedent) so a re-install doesn't leave both keys present.
+ *
+ * Scoped to Cursor ONLY — `mergeJsonMcpEntry`'s default `entryKey`
+ * (`'skillsmith'`) and `buildAgentMcpEntryValue()`'s `npx` form are
+ * UNCHANGED for claude-code/copilot/windsurf/opencode/codex/hermes; nothing
+ * in this module is reachable from any other harness's install path.
+ *
+ * @module @skillsmith/core/install/agent-pack-installer.cursor-mcp
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { AGENT_MCP_TARGETS } from './agent-harness-targets.js';
+import { mergeJsonMcpEntry } from './agent-config-merge.json.js';
+import { writeBackup } from './agent-config-merge.json-array.js';
+import { deepEqualJson, markBackedUp, shouldBackup } from './agent-config-merge.types.js';
+import { CURSOR_MCP_ENTRY_KEY, LEGACY_MCP_ENTRY_KEY, buildAgentMcpEntryValue, buildCursorMcpEntryValue, } from './agent-pack-installer.entry.js';
+import { relocateUnderHome } from './agent-home-relocate.js';
+/** Same predicate as `agent-pack-installer.harness.ts`'s private `mergeSucceeded` — duplicated rather than exported to keep that module's helper private. */
+function mergeSucceeded(status) {
+    return status === 'created' || status === 'updated' || status === 'unchanged';
+}
+/**
+ * Merge Cursor's `skillsmith` MCP server registration into `~/.cursor/mcp.json`
+ * under {@link CURSOR_MCP_ENTRY_KEY}, then clean up a stale legacy-keyed
+ * entry from a pre-SMI-6279 install (see module header).
+ */
+export function installCursorMcpConfig(ctx, report) {
+    const target = AGENT_MCP_TARGETS.cursor;
+    const path = relocateUnderHome(target.path, ctx.homeDir);
+    const entryValue = buildCursorMcpEntryValue();
+    const result = mergeJsonMcpEntry({
+        path,
+        keyPath: target.keyPath,
+        entryKey: CURSOR_MCP_ENTRY_KEY,
+        entryValue,
+        backupDir: ctx.backupDir,
+        force: ctx.force,
+        alreadyBackedUpPaths: ctx.backedUpPaths,
+    });
+    report.mcpConfig = result;
+    if (result.status === 'conflict') {
+        report.notes.push(`MCP config at ${path} already has a '${CURSOR_MCP_ENTRY_KEY}' entry that doesn't look like ours — left untouched. Re-run with --force to overwrite, or edit ${path} manually.`);
+    }
+    if (result.status === 'error') {
+        report.notes.push(`MCP config merge failed at ${path}: ${result.errorMessage}`);
+    }
+    // Only attempt the legacy-key cleanup once our own write succeeded (or was
+    // already correct) — same data-loss guard as the cursor-hooks precedent:
+    // a 'conflict'/'error' write means we deliberately left the file alone (or
+    // couldn't touch it), so removing the legacy key too would still mutate a
+    // file the real merge just refused to touch.
+    const cleanup = mergeSucceeded(result.status)
+        ? stripStaleLegacyMcpKey(path, target.keyPath, ctx)
+        : null;
+    if (cleanup?.status === 'updated') {
+        report.notes.push(`Removed stale legacy '${LEGACY_MCP_ENTRY_KEY}' MCP entry at ${path} — superseded by '${CURSOR_MCP_ENTRY_KEY}' (aligns with the website/CLI docs snippet key, SMI-6279 Wave 9).`);
+    }
+    if (cleanup?.status === 'error') {
+        report.notes.push(`Found a stale legacy '${LEGACY_MCP_ENTRY_KEY}' MCP entry at ${path} but could not remove it: ${cleanup.errorMessage}. The new '${CURSOR_MCP_ENTRY_KEY}' entry above was written successfully; the stale entry was left in place — remove it manually.`);
+    }
+    if (mergeSucceeded(result.status) || cleanup?.status === 'updated') {
+        ctx.entries.push({
+            path,
+            kind: 'mcp-config',
+            harness: 'cursor',
+            backupPath: result.backupPath ?? cleanup?.backupPath ?? null,
+            executable: false,
+        });
+    }
+}
+/**
+ * Strict, purpose-built ownership fingerprint for the destructive delete in
+ * {@link stripStaleLegacyMcpKey} — deliberately NOT the shared
+ * `looksLikeOurMcpEntry` heuristic (`agent-config-merge.types.ts`).
+ *
+ * `looksLikeOurMcpEntry` is intentionally loose (substring-matches an
+ * `args` element, or merely checks a `SKILLSMITH_TOOL_PROFILE` key is
+ * PRESENT regardless of its value) because its only job is gating a
+ * same-key OVERWRITE — a false positive there is non-destructive, the
+ * entry we'd write next replaces whatever was there either way. Deleting a
+ * DIFFERENT key entirely (this function) is a strictly higher-risk
+ * operation: a false positive here permanently removes a user's config
+ * with nothing to replace it — e.g. a custom wrapper script whose `args`
+ * happen to reference the package name in one element among several, or a
+ * user's own hand-authored `skillsmith`-keyed entry that happens to set a
+ * `SKILLSMITH_TOOL_PROFILE` env var with a DIFFERENT value for unrelated
+ * reasons (code-review finding, GPT-5.6-Sol / SMI-6279).
+ *
+ * The bar here is "structurally identical to exactly what
+ * `buildAgentMcpEntryValue()` itself would have written" — checked via
+ * `deepEqualJson` against that function's actual return value (not a
+ * hand-duplicated literal, so this can never drift out of sync with the
+ * real shape): exact `command`, exact `args` sequence (not "contains"),
+ * exact `env` key SET (not just key presence) and exact value.
+ */
+function looksLikeExactLegacyNpxEntry(value) {
+    return deepEqualJson(value, buildAgentMcpEntryValue());
+}
+/**
+ * Remove a stale `LEGACY_MCP_ENTRY_KEY` (`'skillsmith'`)-keyed MCP entry
+ * left behind by a pre-SMI-6279 `agent install` run, but ONLY when it is
+ * structurally IDENTICAL to what that installer itself would have written
+ * (`looksLikeExactLegacyNpxEntry` above). A user's own hand-written
+ * `skillsmith`-named entry — even one that superficially resembles ours —
+ * is left completely untouched — this never silently deletes a foreign or
+ * near-miss entry just because it shares the old key name.
+ *
+ * Read-modify-write is scoped to exactly the `mcpServers.skillsmith` key —
+ * every other key in the file (including the entry this function's caller
+ * just wrote under `CURSOR_MCP_ENTRY_KEY`) is preserved byte-for-byte.
+ *
+ * @returns `null` when there's genuinely nothing to clean up (file missing,
+ *   no `mcpServers` object, no legacy key, or the legacy key isn't an EXACT
+ *   match for our own legacy shape) — a real no-op, not surfaced as a report
+ *   entry. A `MergeResult` with `status: 'updated'` when the legacy key was
+ *   removed, or `status: 'error'` when a match WAS found but reading,
+ *   backing up, or writing the file failed — this must reach the caller as
+ *   a reported failure, not collapse into the same `null` "nothing to do"
+ *   return as the routine no-match case (PR-07 finding, GPT-5.6-Sol /
+ *   SMI-6279): a swallowed write failure here would silently leave a
+ *   confirmed-stale, confirmed-broken legacy entry in place with no
+ *   indication anything went wrong.
+ */
+function stripStaleLegacyMcpKey(path, keyPath, ctx) {
+    if (!existsSync(path))
+        return null;
+    let doc;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        doc = parsed;
+    }
+    catch {
+        // Unparsable/unreadable — not a match we can act on either way; the
+        // main merge above already succeeded reading+writing this same file
+        // moments earlier, so this is a genuine no-op, not a swallowed failure.
+        return null;
+    }
+    const containerKey = keyPath[0];
+    if (containerKey === undefined)
+        return null;
+    const container = doc[containerKey];
+    if (!container || typeof container !== 'object' || Array.isArray(container))
+        return null;
+    const containerObj = container;
+    const legacyEntry = containerObj[LEGACY_MCP_ENTRY_KEY];
+    if (legacyEntry === undefined)
+        return null;
+    // Foreign OR near-miss — never touch, even if named 'skillsmith'.
+    if (!looksLikeExactLegacyNpxEntry(legacyEntry))
+        return null;
+    // Past this point we've confirmed a real match to delete — any failure
+    // from here on is a genuine error, not a no-op, and must be reported.
+    try {
+        delete containerObj[LEGACY_MCP_ENTRY_KEY];
+        const backupPath = shouldBackup(path, ctx.backedUpPaths)
+            ? writeBackup(path, ctx.backupDir)
+            : null;
+        markBackedUp(path, ctx.backedUpPaths);
+        writeFileSync(path, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
+        return { status: 'updated', path, backupPath };
+    }
+    catch (error) {
+        return {
+            status: 'error',
+            path,
+            backupPath: null,
+            errorMessage: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+//# sourceMappingURL=agent-pack-installer.cursor-mcp.js.map