@skillsmith/mcp-server 0.4.10 → 0.4.12

package/dist/src/tools/install.d.ts

@@ -14,7 +14,7 @@
  * - Wires onProgress to MCP protocol notifications
  */
 import type { ToolContext } from '../context.js';
-import { type InstallInput, type InstallResult } from './install.types.js';
+import { type InstallResult } from './install.types.js';
 export { installTool } from './install.tool.js';
 export { default } from './install.tool.js';
 export { installInputSchema, type InstallInput, type InstallResult } from './install.types.js';
@@ -24,9 +24,15 @@ export { installInputSchema, type InstallInput, type InstallResult } from './ins
  * Delegates core logic to SkillInstallationService from @skillsmith/core.
  * Adds MCP-specific conflict resolution (three-way merge, backup).
  *
- * @param input - Installation parameters (skillId, force, skipScan)
+ * SMI-4288 / GitHub #599: Signature accepts `unknown` so the Zod `safeParse`
+ * guard actually runs at the MCP tool boundary. The prior `InstallInput`
+ * parameter type made the guard unreachable — callers passed a pre-typed
+ * object, leaving the underlying `request.params.arguments` crash surface
+ * unprotected when the dispatcher forwards raw args.
+ *
+ * @param input - Raw MCP tool arguments (unvalidated); parsed via Zod here
  * @param _context - Optional tool context (falls back to singleton)
  * @returns Installation result with success status, security report, and dep intel
  */
-export declare function installSkill(input: InstallInput, _context?: ToolContext): Promise<InstallResult>;
+export declare function installSkill(input: unknown, _context?: ToolContext): Promise<InstallResult>;
 //# sourceMappingURL=install.d.ts.map

package/dist/src/tools/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../src/tools/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAO1E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAG3C,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAc9F;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,YAAY,EACnB,QAAQ,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,aAAa,CAAC,CA4DxB"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../src/tools/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhD,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAO3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAG3C,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAkC9F;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CA4EjG"}

package/dist/src/tools/install.js

@@ -15,6 +15,7 @@
  */
 import { SkillInstallationService, emitInstallEvent, } from '@skillsmith/core';
 import { getToolContext } from '../context.js';
+import { installInputSchema } from './install.types.js';
 import { loadManifest, lookupSkillFromRegistry } from './install.helpers.js';
 // SMI-1867: Conflict resolution logic (extracted per governance review)
 import { checkForConflicts } from './install.conflict.js';
@@ -36,17 +37,57 @@ class McpRegistryLookup {
         return lookupSkillFromRegistry(skillId, this.context);
     }
 }
+/**
+ * Build an application-level validation failure result.
+ *
+ * SMI-4288 / GitHub #599: When an MCP caller passes a malformed argument
+ * payload (e.g. `{}`, wrong `skillId` type, invalid `conflictAction` enum),
+ * return a structured `InstallResult` with `success: false` rather than
+ * throwing. Matches the existing `team-workspace.ts` error-envelope
+ * convention (application-level failure, not MCP protocol-level `isError`).
+ *
+ * @see #599
+ */
+function buildValidationError(message) {
+    return {
+        success: false,
+        skillId: '',
+        installPath: '',
+        error: `Invalid install input: ${message}`,
+    };
+}
 /**
  * Install a skill from GitHub to the local Claude Code skills directory.
  *
  * Delegates core logic to SkillInstallationService from @skillsmith/core.
  * Adds MCP-specific conflict resolution (three-way merge, backup).
  *
- * @param input - Installation parameters (skillId, force, skipScan)
+ * SMI-4288 / GitHub #599: Signature accepts `unknown` so the Zod `safeParse`
+ * guard actually runs at the MCP tool boundary. The prior `InstallInput`
+ * parameter type made the guard unreachable — callers passed a pre-typed
+ * object, leaving the underlying `request.params.arguments` crash surface
+ * unprotected when the dispatcher forwards raw args.
+ *
+ * @param input - Raw MCP tool arguments (unvalidated); parsed via Zod here
  * @param _context - Optional tool context (falls back to singleton)
  * @returns Installation result with success status, security report, and dep intel
  */
 export async function installSkill(input, _context) {
+    // SMI-4288 / #599: Zod validation boundary. Unlike the previous typed
+    // signature, this runs at every call site (tool-dispatch, runFirstTimeSetup,
+    // integration tests). Validation failures return a structured InstallResult
+    // instead of throwing, preserving the MCP application-level error envelope.
+    const parsed = installInputSchema.safeParse(input);
+    if (!parsed.success) {
+        const message = parsed.error.issues
+            .map((issue) => {
+            const path = issue.path.length > 0 ? issue.path.join('.') : '<root>';
+            return `${path}: ${issue.message}`;
+        })
+            .join('; ');
+        return buildValidationError(message);
+    }
+    const validInput = parsed.data;
     const context = _context ?? getToolContext();
     // SMI-3483: Create core service instance with MCP context wiring
     // SMI-3873: aiDefenceFeedback omitted -- MCP server cannot call Ruflo tools.
@@ -60,13 +101,13 @@ export async function installSkill(input, _context) {
     });
     // SMI-1867: Pre-flight conflict check for reinstall with force
     // This is MCP-specific (three-way merge UI, backup, storeOriginal)
-    if (input.force && input.conflictAction) {
+    if (validInput.force && validInput.conflictAction) {
         try {
             const manifest = await loadManifest();
-            const skillName = extractSkillName(input.skillId);
+            const skillName = extractSkillName(validInput.skillId);
             if (manifest.installedSkills[skillName]) {
                 const installPath = manifest.installedSkills[skillName].installPath;
-                const conflictCheck = await checkForConflicts(skillName, installPath, manifest, input.conflictAction, input.skillId);
+                const conflictCheck = await checkForConflicts(skillName, installPath, manifest, validInput.conflictAction, validInput.skillId);
                 if (!conflictCheck.shouldProceed) {
                     return conflictCheck.earlyReturn;
                 }
@@ -78,16 +119,16 @@ export async function installSkill(input, _context) {
     }
     // Delegate to core service
     const installStart = Date.now();
-    const result = await service.install(input.skillId, {
-        force: input.force,
-        skipScan: input.skipScan,
-        skipOptimize: input.skipOptimize,
-        conflictAction: input.conflictAction,
-        confirmed: input.confirmed,
+    const result = await service.install(validInput.skillId, {
+        force: validInput.force,
+        skipScan: validInput.skipScan,
+        skipOptimize: validInput.skipOptimize,
+        conflictAction: validInput.conflictAction,
+        confirmed: validInput.confirmed,
     });
     // SMI-4182: fire-and-forget install telemetry for usage report funnel
     void emitInstallEvent({
-        skillId: input.skillId,
+        skillId: validInput.skillId,
         source: 'mcp',
         success: result.success,
         durationMs: Date.now() - installStart,

package/dist/src/tools/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../src/tools/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GAGjB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAE5E,wEAAwE;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAEzD,4DAA4D;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,uEAAuE;AACvE,OAAO,EAAE,kBAAkB,EAAyC,MAAM,oBAAoB,CAAA;AAE9F;;;GAGG;AACH,MAAM,iBAAiB;IACD;IAApB,YAAoB,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;IAAG,CAAC;IAE5C,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,OAAO,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAmB,EACnB,QAAsB;IAEtB,MAAM,OAAO,GAAG,QAAQ,IAAI,cAAc,EAAE,CAAA;IAE5C,iEAAiE;IACjE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC;QAC3C,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,OAAO,CAAC,eAAe;QAClC,mBAAmB,EAAE,OAAO,CAAC,yBAAyB;QACtD,cAAc,EAAE,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAC9C,iBAAiB,EAAE,OAAO,CAAC,mBAAmB;QAC9C,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAA;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;YACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAEjD,IAAI,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,WAAW,CAAA;gBAEnE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,SAAS,EACT,WAAW,EACX,QAAQ,EACR,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,CACd,CAAA;gBAED,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;oBACjC,OAAO,aAAa,CAAC,WAAY,CAAA;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE;QAClD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAA;IAEF,sEAAsE;IACtE,KAAK,gBAAgB,CAAC;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;KACtC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../src/tools/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GAGjB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAsB,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAE5E,wEAAwE;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAEzD,4DAA4D;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,uEAAuE;AACvE,OAAO,EAAE,kBAAkB,EAAyC,MAAM,oBAAoB,CAAA;AAE9F;;;GAGG;AACH,MAAM,iBAAiB;IACD;IAApB,YAAoB,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;IAAG,CAAC;IAE5C,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,OAAO,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO;QACL,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,0BAA0B,OAAO,EAAE;KAC3C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAc,EAAE,QAAsB;IACvE,sEAAsE;IACtE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;YACpE,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAA;QACpC,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;IAE9B,MAAM,OAAO,GAAG,QAAQ,IAAI,cAAc,EAAE,CAAA;IAE5C,iEAAiE;IACjE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC;QAC3C,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,OAAO,CAAC,eAAe;QAClC,mBAAmB,EAAE,OAAO,CAAC,yBAAyB;QACtD,cAAc,EAAE,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAC9C,iBAAiB,EAAE,OAAO,CAAC,mBAAmB;QAC9C,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAA;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,IAAI,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;YACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAEtD,IAAI,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,WAAW,CAAA;gBAEnE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,CAAC,cAAc,EACzB,UAAU,CAAC,OAAO,CACnB,CAAA;gBAED,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;oBACjC,OAAO,aAAa,CAAC,WAAY,CAAA;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC,CAAA;IAEF,sEAAsE;IACtE,KAAK,gBAAgB,CAAC;QACpB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;KACtC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/src/tools/install.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @fileoverview Unit tests for install_skill MCP tool Zod boundary guard
+ * @see SMI-4288: Zod validation guard at MCP tool boundary
+ * @see https://github.com/smith-horn/skillsmith/issues/599
+ *
+ * These tests cover the behaviour introduced by the signature change from
+ * `installSkill(input: InstallInput, ...)` to `installSkill(input: unknown, ...)`.
+ * The guard protects against malformed MCP payloads (e.g. `{}`,
+ * `{ skillId: 123 }`, invalid enum) reaching the core installation service.
+ *
+ * The happy path mocks `@skillsmith/core` so no real filesystem or network
+ * work happens — this file is a unit test for the tool-boundary validation
+ * shim, not an integration test for the install flow itself (that lives
+ * in `tests/integration/install.integration.test.ts`).
+ */
+export {};
+//# sourceMappingURL=install.test.d.ts.map

package/dist/src/tools/install.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.test.d.ts","sourceRoot":"","sources":["../../../src/tools/install.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/src/tools/install.test.js

@@ -0,0 +1,237 @@
+/**
+ * @fileoverview Unit tests for install_skill MCP tool Zod boundary guard
+ * @see SMI-4288: Zod validation guard at MCP tool boundary
+ * @see https://github.com/smith-horn/skillsmith/issues/599
+ *
+ * These tests cover the behaviour introduced by the signature change from
+ * `installSkill(input: InstallInput, ...)` to `installSkill(input: unknown, ...)`.
+ * The guard protects against malformed MCP payloads (e.g. `{}`,
+ * `{ skillId: 123 }`, invalid enum) reaching the core installation service.
+ *
+ * The happy path mocks `@skillsmith/core` so no real filesystem or network
+ * work happens — this file is a unit test for the tool-boundary validation
+ * shim, not an integration test for the install flow itself (that lives
+ * in `tests/integration/install.integration.test.ts`).
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+// SMI-4288: Mock the core service so the happy-path test exercises only the
+// Zod gate + delegation. `vi.hoisted` is required because `vi.mock` is
+// hoisted above regular `const` declarations and would otherwise reference
+// the stubs before they are initialised.
+const { mockInstall, mockEmitInstallEvent } = vi.hoisted(() => ({
+    mockInstall: vi.fn(),
+    mockEmitInstallEvent: vi.fn(),
+}));
+vi.mock('@skillsmith/core', async (importActual) => {
+    const actual = await importActual();
+    class MockSkillInstallationService {
+        install = mockInstall;
+    }
+    return {
+        ...actual,
+        SkillInstallationService: MockSkillInstallationService,
+        emitInstallEvent: mockEmitInstallEvent,
+    };
+});
+// Prevent getToolContext() from throwing when no context is passed — the
+// installSkill helper calls it before delegating. A minimal stub is enough
+// because the mocked SkillInstallationService ignores the params.
+vi.mock('../context.js', () => ({
+    getToolContext: vi.fn().mockReturnValue({
+        db: {},
+        skillRepository: {},
+        skillDependencyRepository: {},
+        coInstallRepository: undefined,
+        sessionInstalledSkillIds: [],
+    }),
+}));
+// SMI-4288: Mock install.helpers so the conflict-preflight path exercises
+// deterministic behaviour. Each test configures loadManifest explicitly.
+const { mockLoadManifest, mockLookupSkillFromRegistry } = vi.hoisted(() => ({
+    mockLoadManifest: vi.fn(),
+    mockLookupSkillFromRegistry: vi.fn(),
+}));
+vi.mock('./install.helpers.js', () => ({
+    loadManifest: mockLoadManifest,
+    lookupSkillFromRegistry: mockLookupSkillFromRegistry,
+}));
+// Conflict check helper — return a shouldProceed:true stub so the flow
+// falls through to the core service unless a test overrides.
+const { mockCheckForConflicts } = vi.hoisted(() => ({
+    mockCheckForConflicts: vi.fn(),
+}));
+vi.mock('./install.conflict.js', () => ({
+    checkForConflicts: mockCheckForConflicts,
+}));
+import { installSkill } from './install.js';
+const HAPPY_RESULT = {
+    success: true,
+    skillId: 'owner/repo/test-skill',
+    installPath: '/tmp/mock/test-skill',
+};
+describe('installSkill() Zod boundary guard (SMI-4288 / #599)', () => {
+    beforeEach(() => {
+        mockInstall.mockReset();
+        mockEmitInstallEvent.mockReset();
+        mockLoadManifest.mockReset();
+        mockLookupSkillFromRegistry.mockReset();
+        mockCheckForConflicts.mockReset();
+        mockInstall.mockResolvedValue(HAPPY_RESULT);
+        // By default no conflict preflight interception.
+        mockLoadManifest.mockResolvedValue({ version: '1', installedSkills: {} });
+        mockCheckForConflicts.mockResolvedValue({ shouldProceed: true });
+    });
+    afterEach(() => {
+        vi.clearAllMocks();
+    });
+    describe('happy path', () => {
+        it('delegates a valid InstallInput to SkillInstallationService.install', async () => {
+            const result = await installSkill({
+                skillId: 'owner/repo/test-skill',
+                force: false,
+                skipScan: true,
+                skipOptimize: true,
+                confirmed: true,
+            });
+            expect(result).toEqual(HAPPY_RESULT);
+            expect(mockInstall).toHaveBeenCalledTimes(1);
+            expect(mockInstall).toHaveBeenCalledWith('owner/repo/test-skill', {
+                force: false,
+                skipScan: true,
+                skipOptimize: true,
+                conflictAction: undefined,
+                confirmed: true,
+            });
+        });
+    });
+    describe('validation failures return structured InstallResult', () => {
+        it('rejects undefined input with success: false and surfaces the Zod issue', async () => {
+            const result = await installSkill(undefined);
+            expect(result.success).toBe(false);
+            expect(result.skillId).toBe('');
+            expect(result.installPath).toBe('');
+            expect(result.error).toBeDefined();
+            expect(result.error).toContain('Invalid install input');
+            // Core service must never be invoked when validation fails.
+            expect(mockInstall).not.toHaveBeenCalled();
+        });
+        it('rejects input missing skillId', async () => {
+            const result = await installSkill({});
+            expect(result.success).toBe(false);
+            expect(result.error).toContain('Invalid install input');
+            expect(result.error).toContain('skillId');
+            expect(mockInstall).not.toHaveBeenCalled();
+        });
+        it('rejects input with non-string skillId', async () => {
+            const result = await installSkill({ skillId: 123 });
+            expect(result.success).toBe(false);
+            expect(result.error).toContain('Invalid install input');
+            expect(result.error).toContain('skillId');
+            expect(mockInstall).not.toHaveBeenCalled();
+        });
+        it('rejects input with invalid conflictAction enum value', async () => {
+            const result = await installSkill({
+                skillId: 'owner/repo/test-skill',
+                conflictAction: 'stomp',
+            });
+            expect(result.success).toBe(false);
+            expect(result.error).toContain('Invalid install input');
+            expect(result.error).toContain('conflictAction');
+            expect(mockInstall).not.toHaveBeenCalled();
+        });
+        it('rejects empty-string skillId (min(1) constraint)', async () => {
+            const result = await installSkill({ skillId: '' });
+            expect(result.success).toBe(false);
+            expect(result.error).toContain('Invalid install input');
+            expect(mockInstall).not.toHaveBeenCalled();
+        });
+    });
+    describe('pre-existing failure paths still work after guard', () => {
+        it('surfaces a service-level failure result untouched', async () => {
+            const serviceFailure = {
+                success: false,
+                skillId: 'owner/repo/test-skill',
+                installPath: '',
+                error: 'Skill indexed for discovery only',
+            };
+            mockInstall.mockResolvedValueOnce(serviceFailure);
+            const result = await installSkill({
+                skillId: 'owner/repo/test-skill',
+                skipScan: true,
+            });
+            expect(result).toEqual(serviceFailure);
+            expect(result.error).toBe('Skill indexed for discovery only');
+        });
+    });
+    describe('conflict preflight path (force + conflictAction)', () => {
+        it('returns the early-exit conflict result when checkForConflicts signals stop', async () => {
+            const conflictResult = {
+                success: false,
+                skillId: 'owner/repo/test-skill',
+                installPath: '/existing/path',
+                error: 'User cancelled due to local modifications',
+            };
+            mockLoadManifest.mockResolvedValueOnce({
+                version: '1',
+                installedSkills: {
+                    'test-skill': {
+                        id: 'owner/repo/test-skill',
+                        name: 'test-skill',
+                        version: '1.0.0',
+                        source: 'registry',
+                        installPath: '/existing/path',
+                        installedAt: '2026-01-01T00:00:00Z',
+                        lastUpdated: '2026-01-01T00:00:00Z',
+                    },
+                },
+            });
+            mockCheckForConflicts.mockResolvedValueOnce({
+                shouldProceed: false,
+                earlyReturn: conflictResult,
+            });
+            const result = await installSkill({
+                skillId: 'owner/repo/test-skill',
+                force: true,
+                conflictAction: 'cancel',
+            });
+            expect(result).toEqual(conflictResult);
+            expect(mockCheckForConflicts).toHaveBeenCalledTimes(1);
+            expect(mockInstall).not.toHaveBeenCalled();
+        });
+        it('falls through to core install when manifest lookup throws', async () => {
+            // Conflict preflight swallows errors and continues with normal install.
+            mockLoadManifest.mockRejectedValueOnce(new Error('manifest missing'));
+            const result = await installSkill({
+                skillId: 'owner/repo/test-skill',
+                force: true,
+                conflictAction: 'overwrite',
+            });
+            expect(result).toEqual(HAPPY_RESULT);
+            expect(mockInstall).toHaveBeenCalledTimes(1);
+        });
+        it('resolves bare skillId (no slash) via extractSkillName', async () => {
+            mockLoadManifest.mockResolvedValueOnce({
+                version: '1',
+                installedSkills: {
+                    'bare-name': {
+                        id: 'bare-name',
+                        name: 'bare-name',
+                        version: '1.0.0',
+                        source: 'registry',
+                        installPath: '/x',
+                        installedAt: '2026-01-01T00:00:00Z',
+                        lastUpdated: '2026-01-01T00:00:00Z',
+                    },
+                },
+            });
+            const result = await installSkill({
+                skillId: 'bare-name',
+                force: true,
+                conflictAction: 'overwrite',
+            });
+            expect(result).toEqual(HAPPY_RESULT);
+            expect(mockCheckForConflicts).toHaveBeenCalledWith('bare-name', '/x', expect.objectContaining({ installedSkills: expect.any(Object) }), 'overwrite', 'bare-name');
+        });
+    });
+});
+//# sourceMappingURL=install.test.js.map

package/dist/src/tools/install.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.test.js","sourceRoot":"","sources":["../../../src/tools/install.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAExE,4EAA4E;AAC5E,uEAAuE;AACvE,2EAA2E;AAC3E,yCAAyC;AACzC,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC9B,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;IACjD,MAAM,MAAM,GAAG,MAAM,YAAY,EAA2B,CAAA;IAC5D,MAAM,4BAA4B;QAChC,OAAO,GAAG,WAAW,CAAA;KACtB;IACD,OAAO;QACL,GAAG,MAAM;QACT,wBAAwB,EAAE,4BAA4B;QACtD,gBAAgB,EAAE,oBAAoB;KACvC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,yEAAyE;AACzE,2EAA2E;AAC3E,kEAAkE;AAClE,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9B,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC;QACtC,EAAE,EAAE,EAAE;QACN,eAAe,EAAE,EAAE;QACnB,yBAAyB,EAAE,EAAE;QAC7B,mBAAmB,EAAE,SAAS;QAC9B,wBAAwB,EAAE,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC,CAAA;AAEH,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1E,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;IACzB,2BAA2B,EAAE,EAAE,CAAC,EAAE,EAAE;CACrC,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,YAAY,EAAE,gBAAgB;IAC9B,uBAAuB,EAAE,2BAA2B;CACrD,CAAC,CAAC,CAAA;AAEH,uEAAuE;AACvE,6DAA6D;AAC7D,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC/B,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,iBAAiB,EAAE,qBAAqB;CACzC,CAAC,CAAC,CAAA;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAG3C,MAAM,YAAY,GAAkB;IAClC,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,uBAAuB;IAChC,WAAW,EAAE,sBAAsB;CACpC,CAAA;AAED,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;IACnE,UAAU,CAAC,GAAG,EAAE;QACd,WAAW,CAAC,SAAS,EAAE,CAAA;QACvB,oBAAoB,CAAC,SAAS,EAAE,CAAA;QAChC,gBAAgB,CAAC,SAAS,EAAE,CAAA;QAC5B,2BAA2B,CAAC,SAAS,EAAE,CAAA;QACvC,qBAAqB,CAAC,SAAS,EAAE,CAAA;QACjC,WAAW,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;QAC3C,iDAAiD;QACjD,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAA;QACzE,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,OAAO,EAAE,uBAAuB;gBAChC,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAA;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YACpC,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;YAC5C,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,CAAC,uBAAuB,EAAE;gBAChE,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,SAAS;gBACzB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;QACnE,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;YACtF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;YAE5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC/B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;YAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YACvD,4DAA4D;YAC5D,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QAC5C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAA;YAErC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YACzC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QAC5C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;YAEnD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YACzC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QAC5C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,OAAO,EAAE,uBAAuB;gBAChC,cAAc,EAAE,OAAO;aACxB,CAAC,CAAA;YAEF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;YAChD,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QAC5C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;YAElD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YACvD,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QAC5C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACjE,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,cAAc,GAAkB;gBACpC,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,uBAAuB;gBAChC,WAAW,EAAE,EAAE;gBACf,KAAK,EAAE,kCAAkC;aAC1C,CAAA;YACD,WAAW,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAA;YAEjD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,OAAO,EAAE,uBAAuB;gBAChC,QAAQ,EAAE,IAAI;aACf,CAAC,CAAA;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;YACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAChE,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;YAC1F,MAAM,cAAc,GAAkB;gBACpC,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,uBAAuB;gBAChC,WAAW,EAAE,gBAAgB;gBAC7B,KAAK,EAAE,2CAA2C;aACnD,CAAA;YACD,gBAAgB,CAAC,qBAAqB,CAAC;gBACrC,OAAO,EAAE,GAAG;gBACZ,eAAe,EAAE;oBACf,YAAY,EAAE;wBACZ,EAAE,EAAE,uBAAuB;wBAC3B,IAAI,EAAE,YAAY;wBAClB,OAAO,EAAE,OAAO;wBAChB,MAAM,EAAE,UAAU;wBAClB,WAAW,EAAE,gBAAgB;wBAC7B,WAAW,EAAE,sBAAsB;wBACnC,WAAW,EAAE,sBAAsB;qBACpC;iBACF;aACF,CAAC,CAAA;YACF,qBAAqB,CAAC,qBAAqB,CAAC;gBAC1C,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,cAAc;aAC5B,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,OAAO,EAAE,uBAAuB;gBAChC,KAAK,EAAE,IAAI;gBACX,cAAc,EAAE,QAAQ;aACzB,CAAC,CAAA;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;YACtC,MAAM,CAAC,qBAAqB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;YACtD,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QAC5C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;YACzE,wEAAwE;YACxE,gBAAgB,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAA;YAErE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,OAAO,EAAE,uBAAuB;gBAChC,KAAK,EAAE,IAAI;gBACX,cAAc,EAAE,WAAW;aAC5B,CAAC,CAAA;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YACpC,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,gBAAgB,CAAC,qBAAqB,CAAC;gBACrC,OAAO,EAAE,GAAG;gBACZ,eAAe,EAAE;oBACf,WAAW,EAAE;wBACX,EAAE,EAAE,WAAW;wBACf,IAAI,EAAE,WAAW;wBACjB,OAAO,EAAE,OAAO;wBAChB,MAAM,EAAE,UAAU;wBAClB,WAAW,EAAE,IAAI;wBACjB,WAAW,EAAE,sBAAsB;wBACnC,WAAW,EAAE,sBAAsB;qBACpC;iBACF;aACF,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,OAAO,EAAE,WAAW;gBACpB,KAAK,EAAE,IAAI;gBACX,cAAc,EAAE,WAAW;aAC5B,CAAC,CAAA;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YACpC,MAAM,CAAC,qBAAqB,CAAC,CAAC,oBAAoB,CAChD,WAAW,EACX,IAAI,EACJ,MAAM,CAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAChE,WAAW,EACX,WAAW,CACZ,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/tools/integration-tools.d.ts

@@ -18,17 +18,17 @@ export declare const webhookConfigureInputSchema: z.ZodObject<{
     webhookId: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    action: "test" | "create" | "list" | "get" | "delete" | "rotate_secret";
+    action: "test" | "get" | "create" | "list" | "delete" | "rotate_secret";
     description?: string | undefined;
     url?: string | undefined;
-    webhookId?: string | undefined;
     events?: string[] | undefined;
+    webhookId?: string | undefined;
 }, {
-    action: "test" | "create" | "list" | "get" | "delete" | "rotate_secret";
+    action: "test" | "get" | "create" | "list" | "delete" | "rotate_secret";
     description?: string | undefined;
     url?: string | undefined;
-    webhookId?: string | undefined;
     events?: string[] | undefined;
+    webhookId?: string | undefined;
 }>;
 export type WebhookConfigureInput = z.infer<typeof webhookConfigureInputSchema>;
 export declare const apiKeyManageInputSchema: z.ZodObject<{
@@ -38,17 +38,17 @@ export declare const apiKeyManageInputSchema: z.ZodObject<{
     permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     expiresIn: z.ZodDefault<z.ZodOptional<z.ZodEnum<["30d", "90d", "365d", "never"]>>>;
 }, "strip", z.ZodTypeAny, {
-    action: "create" | "list" | "get" | "revoke";
-    expiresIn: "never" | "30d" | "90d" | "365d";
+    action: "get" | "create" | "list" | "revoke";
+    expiresIn: "30d" | "90d" | "365d" | "never";
     name?: string | undefined;
     permissions?: string[] | undefined;
     keyId?: string | undefined;
 }, {
-    action: "create" | "list" | "get" | "revoke";
+    action: "get" | "create" | "list" | "revoke";
     name?: string | undefined;
     permissions?: string[] | undefined;
     keyId?: string | undefined;
-    expiresIn?: "never" | "30d" | "90d" | "365d" | undefined;
+    expiresIn?: "30d" | "90d" | "365d" | "never" | undefined;
 }>;
 export type ApiKeyManageInput = z.infer<typeof apiKeyManageInputSchema>;
 export declare const webhookConfigureToolSchema: {

package/dist/src/tools/rbac-tools.d.ts

@@ -58,18 +58,18 @@ export declare const rbacCreatePolicyInputSchema: z.ZodObject<{
     resources: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     actions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
-    action: "create" | "list" | "get" | "delete";
+    action: "get" | "create" | "list" | "delete";
     name?: string | undefined;
+    resources?: string[] | undefined;
     policyId?: string | undefined;
     effect?: "allow" | "deny" | undefined;
-    resources?: string[] | undefined;
     actions?: string[] | undefined;
 }, {
-    action: "create" | "list" | "get" | "delete";
+    action: "get" | "create" | "list" | "delete";
     name?: string | undefined;
+    resources?: string[] | undefined;
     policyId?: string | undefined;
     effect?: "allow" | "deny" | undefined;
-    resources?: string[] | undefined;
     actions?: string[] | undefined;
 }>;
 export type RbacCreatePolicyInput = z.infer<typeof rbacCreatePolicyInputSchema>;

package/dist/src/tools/recommend.types.d.ts

@@ -30,14 +30,14 @@ export declare const recommendInputSchema: z.ZodObject<{
     detect_overlap: boolean;
     min_similarity: number;
     project_context?: string | undefined;
-    role?: "testing" | "documentation" | "security" | "workflow" | "code-quality" | "development-partner" | undefined;
+    role?: "testing" | "documentation" | "security" | "code-quality" | "workflow" | "development-partner" | undefined;
 }, {
     installed_skills?: string[] | undefined;
-    project_context?: string | undefined;
     limit?: number | undefined;
+    project_context?: string | undefined;
     detect_overlap?: boolean | undefined;
     min_similarity?: number | undefined;
-    role?: "testing" | "documentation" | "security" | "workflow" | "code-quality" | "development-partner" | undefined;
+    role?: "testing" | "documentation" | "security" | "code-quality" | "workflow" | "development-partner" | undefined;
 }>;
 /**
  * Input type (before parsing, allows optional fields)

package/dist/src/tools/registry-tools.d.ts

@@ -31,11 +31,11 @@ export declare const privateRegistryManageInputSchema: z.ZodObject<{
     skillId: z.ZodOptional<z.ZodString>;
     version: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    action: "list" | "get" | "deprecate" | "undeprecate";
+    action: "get" | "list" | "deprecate" | "undeprecate";
     skillId?: string | undefined;
     version?: string | undefined;
 }, {
-    action: "list" | "get" | "deprecate" | "undeprecate";
+    action: "get" | "list" | "deprecate" | "undeprecate";
     skillId?: string | undefined;
     version?: string | undefined;
 }>;

package/dist/src/tools/registry-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-tools.d.ts","sourceRoot":"","sources":["../../../src/tools/registry-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAOhD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;EAU5C,CAAA;AAEF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAE3F,eAAO,MAAM,gCAAgC;;;;;;;;;;;;EAQ3C,CAAA;AAEF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAMzF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAwB5C,CAAA;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;CAwB3C,CAAA;AAMD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3B,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3B,MAAM,CAAC,EAAE,aAAa,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,MAAM,WAAW,sBAAsB;IACrC,OAAO,CACL,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,aAAa,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IACrF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/D;AAMD,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,sBAAsB,CA6ClE;AAKD,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,sBAAsB,GAAG,IAAI,CAE3E;AAED,gDAAgD;AAChD,wBAAgB,yBAAyB,IAAI,sBAAsB,CAElE;AAcD;;GAEG;AACH,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,2BAA2B,EAClC,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,4BAA4B,CAAC,CAavC;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,0BAA0B,EACjC,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,2BAA2B,CAAC,CAwEtC"}
+{"version":3,"file":"registry-tools.d.ts","sourceRoot":"","sources":["../../../src/tools/registry-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAQhD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;EAU5C,CAAA;AAEF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAE3F,eAAO,MAAM,gCAAgC;;;;;;;;;;;;EAQ3C,CAAA;AAEF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAMzF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAwB5C,CAAA;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;CAwB3C,CAAA;AAMD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3B,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3B,MAAM,CAAC,EAAE,aAAa,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,MAAM,WAAW,sBAAsB;IACrC,OAAO,CACL,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,aAAa,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IACrF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/D;AAMD,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,sBAAsB,CA6ClE;AAKD,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,sBAAsB,GAAG,IAAI,CAE3E;AAED,gDAAgD;AAChD,wBAAgB,yBAAyB,IAAI,sBAAsB,CAElE;AAkCD;;GAEG;AACH,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,2BAA2B,EAClC,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,4BAA4B,CAAC,CAsBvC;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,0BAA0B,EACjC,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,2BAA2B,CAAC,CAiFtC"}

package/dist/src/tools/registry-tools.js

@@ -12,6 +12,7 @@
  */
 import { z } from 'zod';
 import { isSupabaseConfigured } from '../supabase-client.js';
+import { resolveLicenseTeamId, readLicenseKey } from './team-resolver.js';
 // ============================================================================
 // Input schemas
 // ============================================================================
@@ -151,17 +152,44 @@ export function getPrivateRegistryService() {
 // ============================================================================
 /**
  * Resolve team ID from license key.
- * TODO: Replace with Supabase RPC when Supabase integration is ready.
+ *
+ * SMI-4292 (finding C3): unified resolution — calls the same
+ * `resolve_team_from_license` RPC as team-workspace.ts. When Supabase is
+ * configured but the license key is missing/invalid, the caller receives
+ * a typed error (bubbled up via thrown Error).
+ *
+ * Falls back to a static stub id when Supabase is not configured (local dev).
  */
 async function resolveTeamId() {
-    return 'team_stub_00000000-0000-0000-0000-000000000000';
+    if (!isSupabaseConfigured())
+        return 'team_stub_00000000-0000-0000-0000-000000000000';
+    const licenseKey = readLicenseKey();
+    if (!licenseKey) {
+        throw new Error('SKILLSMITH_LICENSE_KEY is required for private registry operations. ' +
+            'Set it in your MCP server config — shell exports do not reach MCP subprocesses.');
+    }
+    const teamId = await resolveLicenseTeamId(licenseKey);
+    if (!teamId) {
+        throw new Error('Unable to resolve team from license key. Ensure the key is active and attached to a Team-tier subscription.');
+    }
+    return teamId;
 }
 /**
  * Execute a private_registry_publish operation.
  */
 export async function executePrivateRegistryPublish(input, _context) {
     const dataSource = isSupabaseConfigured() ? 'live' : 'stub';
-    const teamId = await resolveTeamId();
+    let teamId;
+    try {
+        teamId = await resolveTeamId();
+    }
+    catch (err) {
+        return {
+            success: false,
+            dataSource,
+            error: err instanceof Error ? err.message : 'Failed to resolve team from license key.',
+        };
+    }
     const skill = await service.publish(teamId, input.skillId, input.version, input.description);
     return {
         success: true,
@@ -176,7 +204,17 @@ export async function executePrivateRegistryPublish(input, _context) {
  */
 export async function executePrivateRegistryManage(input, _context) {
     const dataSource = isSupabaseConfigured() ? 'live' : 'stub';
-    const teamId = await resolveTeamId();
+    let teamId;
+    try {
+        teamId = await resolveTeamId();
+    }
+    catch (err) {
+        return {
+            success: false,
+            dataSource,
+            error: err instanceof Error ? err.message : 'Failed to resolve team from license key.',
+        };
+    }
     switch (input.action) {
         case 'list': {
             const skills = await service.list(teamId, input.version);