@skillsmith/mcp-server 0.4.13 → 0.5.0

package/dist/src/tools/install.js

@@ -14,11 +14,17 @@
  * - Wires onProgress to MCP protocol notifications
  */
 import { SkillInstallationService, emitInstallEvent, } from '@skillsmith/core';
+import { addLink, getInstallPath, resolveClientPath } from '@skillsmith/core/install';
+import { resolveAuditMode, isAuditMode } from '@skillsmith/core/config/audit-mode';
 import { getToolContext } from '../context.js';
-import { installInputSchema } from './install.types.js';
+import { CLAUDE_SKILLS_DIR, installInputSchema } from './install.types.js';
 import { loadManifest, lookupSkillFromRegistry } from './install.helpers.js';
+import { FIELD_LIMITS } from './validate.types.js';
 // SMI-1867: Conflict resolution logic (extracted per governance review)
 import { checkForConflicts } from './install.conflict.js';
+// SMI-4588 Wave 2 PR #3: namespace pre-flight + ledger replay + mode gate.
+import { runNamespaceGate } from './install.namespace-gate.js';
+import * as path from 'path';
 // SMI-2741: MCP tool definition extracted to companion file
 export { installTool } from './install.tool.js';
 export { default } from './install.tool.js';
@@ -57,7 +63,22 @@ function buildValidationError(message) {
     };
 }
 /**
- * Install a skill from GitHub to the local Claude Code skills directory.
+ * SMI-4737: structured tool-error envelope for `extractSkillName` throws.
+ * Adversarial `skillId` values that survive Zod's 512-char boundary but
+ * produce an over-cap (>128 char) extracted segment are rejected here so
+ * the throw never escapes the MCP handler. Mirrors the `buildValidationError`
+ * shape (application-level failure, not MCP protocol-level `isError`).
+ */
+function buildInvalidSkillIdError(skillId, message) {
+    return {
+        success: false,
+        skillId,
+        installPath: '',
+        error: `invalid_skill_id: ${message}`,
+    };
+}
+/**
+ * Install a skill from GitHub to the local agent skills directory (~/.claude/skills/).
  *
  * Delegates core logic to SkillInstallationService from @skillsmith/core.
  * Adds MCP-specific conflict resolution (three-way merge, backup).
@@ -81,14 +102,53 @@ export async function installSkill(input, _context) {
     if (!parsed.success) {
         const message = parsed.error.issues
             .map((issue) => {
-            const path = issue.path.length > 0 ? issue.path.join('.') : '<root>';
-            return `${path}: ${issue.message}`;
+            // Renamed from `path` to `issuePath` to avoid shadowing the
+            // module-level `path` import (no-shadow hygiene).
+            const issuePath = issue.path.length > 0 ? issue.path.join('.') : '<root>';
+            return `${issuePath}: ${issue.message}`;
         })
             .join('; ');
         return buildValidationError(message);
     }
     const validInput = parsed.data;
+    // SMI-4588 Wave 2 PR #3: namespace pre-flight + mode gate. Runs BEFORE
+    // service construction so a `preventative`-mode collision short-circuits
+    // the install with no side effects. Pre-flight failure is non-blocking
+    // (Edit 2) — `runNamespaceGate` swallows internal throws and returns
+    // `decision: 'proceed'`.
+    // SMI-4737: extractSkillName (called via buildPreflightCandidate) throws on
+    // over-cap (>128 char) extracted segments; surface as structured envelope.
+    let candidate;
+    try {
+        candidate = buildPreflightCandidate(validInput.skillId);
+    }
+    catch (err) {
+        return buildInvalidSkillIdError(validInput.skillId, err instanceof Error ? err.message : String(err));
+    }
+    const tier = resolveCallerTier();
+    const auditMode = resolveAuditMode({
+        tier,
+        override: readAuditModeOverride(),
+    });
+    const gate = await runNamespaceGate({ candidate, mode: auditMode, tier });
+    if (gate.decision === 'block') {
+        // Decision #2: preventative mode blocks; agent must call
+        // `apply_namespace_rename` then re-invoke install. The skill is NOT
+        // touched on disk.
+        return {
+            success: false,
+            skillId: validInput.skillId,
+            installPath: '',
+            error: 'Namespace collision detected; install blocked in preventative audit mode.',
+            ...gate.resultPatch,
+        };
+    }
     const context = _context ?? getToolContext();
+    // SMI-4578: resolve target install directory. Explicit `client` arg
+    // wins; otherwise fall back to SKILLSMITH_CLIENT env (or claude-code).
+    const effectiveSkillsDir = validInput.client
+        ? getInstallPath(validInput.client)
+        : resolveClientPath();
     // SMI-3483: Create core service instance with MCP context wiring
     // SMI-3873: aiDefenceFeedback omitted -- MCP server cannot call Ruflo tools.
     const service = new SkillInstallationService({
@@ -98,6 +158,7 @@ export async function installSkill(input, _context) {
         registryLookup: new McpRegistryLookup(context),
         coInstallRecorder: context.coInstallRepository,
         sessionInstalledSkillIds: context.sessionInstalledSkillIds,
+        skillsDir: effectiveSkillsDir,
     });
     // SMI-1867: Pre-flight conflict check for reinstall with force
     // This is MCP-specific (three-way merge UI, backup, storeOriginal)
@@ -133,17 +194,111 @@ export async function installSkill(input, _context) {
         success: result.success,
         durationMs: Date.now() - installStart,
     });
+    // SMI-4578: fan-out to additional clients after primary install. Failures
+    // are logged but do NOT mark the overall install as failed — canonical
+    // install at `client` is already complete.
+    if (result.success && validInput.alsoLink.length > 0) {
+        const fromClient = validInput.client ?? 'claude-code';
+        const skillName = extractSkillName(validInput.skillId);
+        for (const target of validInput.alsoLink) {
+            if (target === fromClient)
+                continue;
+            try {
+                await addLink({
+                    skillId: skillName,
+                    fromClient,
+                    toClient: target,
+                    preferSymlink: validInput.symlink,
+                    force: validInput.force,
+                });
+            }
+            catch (linkErr) {
+                // Best-effort fan-out — log but don't fail the install
+                console.error(`[install] alsoLink to ${target} failed:`, linkErr instanceof Error ? linkErr.message : String(linkErr));
+            }
+        }
+    }
+    // SMI-4588 Wave 2 PR #3: surface non-blocking namespace warnings (and
+    // installComplete=true marker) on `power_user` / `governance` paths.
+    // `pendingCollision` is intentionally not merged here — it is exclusive
+    // to the blocking-mode early return above.
+    if (gate.resultPatch.warnings && gate.resultPatch.warnings.length > 0) {
+        return {
+            ...result,
+            installComplete: gate.resultPatch.installComplete,
+            warnings: gate.resultPatch.warnings,
+        };
+    }
     return result;
 }
+/**
+ * Build the `CandidateSkill` shape consumed by `runNamespaceGate`. The
+ * pre-flight runs before any disk write, so the path is projected.
+ *
+ * `extractSkillName` mirrors the manifest-key derivation used elsewhere in
+ * this file; the `skillId` is propagated when the input is a registry id
+ * (`<author>/<name>`) so ledger lookups key on the canonical form.
+ */
+function buildPreflightCandidate(skillId) {
+    const skillName = extractSkillName(skillId);
+    const isRegistryId = skillId.includes('/') && !skillId.startsWith('https://');
+    const author = isRegistryId ? skillId.split('/')[0] : null;
+    return {
+        identifier: skillName,
+        projectedSourcePath: path.join(CLAUDE_SKILLS_DIR, skillName),
+        skillId: isRegistryId ? skillId : null,
+        author,
+    };
+}
+/**
+ * Resolve the caller's subscription tier for the audit-mode resolver.
+ * Reads `SKILLSMITH_TIER` env var; falls through to `'community'` (the
+ * resolver's fail-safe default) when unset or invalid. The MCP subprocess
+ * has no JWT context, so env var is the only signal available without
+ * cross-cutting changes (Wave 4 will revisit if richer tier resolution
+ * becomes load-bearing).
+ */
+function resolveCallerTier() {
+    const raw = process.env['SKILLSMITH_TIER'];
+    if (raw === 'community' || raw === 'individual' || raw === 'team' || raw === 'enterprise') {
+        return raw;
+    }
+    return 'community';
+}
+/**
+ * Read the optional `SKILLSMITH_AUDIT_MODE` override. Invalid values fall
+ * through to `null` so the resolver applies the tier default.
+ */
+function readAuditModeOverride() {
+    const raw = process.env['SKILLSMITH_AUDIT_MODE'];
+    return isAuditMode(raw) ? raw : null;
+}
 /**
  * Best-effort skill name extraction for conflict pre-check.
  * Does not need to be perfect -- just needs to match manifest keys.
+ *
+ * SMI-4737: throws when the extracted segment exceeds `FIELD_LIMITS.token`
+ * (128 chars). Adversarial `skillId` inputs that survive the Zod 512-char
+ * boundary but produce an over-cap segment are rejected at the derivation
+ * site so they cannot reach `sanitizeSegment`'s defensive 256-char floor
+ * (SMI-4733). Caller sites must wrap in try/catch and surface a structured
+ * tool-error envelope; the throw must not escape the MCP handler.
+ *
+ * Exported for direct unit testing (SMI-4737 tests).
  */
-function extractSkillName(skillId) {
+export function extractSkillName(skillId) {
+    let name;
     if (skillId.includes('/')) {
         const parts = skillId.split('/');
-        return parts[parts.length - 1];
+        name = parts[parts.length - 1];
+    }
+    else {
+        name = skillId;
+    }
+    if (name.length > FIELD_LIMITS.token) {
+        throw new Error(`Extracted skill name exceeds ${FIELD_LIMITS.token} chars (got ${name.length}). ` +
+            `skillId: ${skillId.slice(0, 64)}${skillId.length > 64 ? '...' : ''}`);
     }
-    return skillId;
+    return name;
 }
 //# sourceMappingURL=install.js.map

package/dist/src/tools/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../src/tools/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GAGjB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAsB,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAE5E,wEAAwE;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAEzD,4DAA4D;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,uEAAuE;AACvE,OAAO,EAAE,kBAAkB,EAAyC,MAAM,oBAAoB,CAAA;AAE9F;;;GAGG;AACH,MAAM,iBAAiB;IACD;IAApB,YAAoB,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;IAAG,CAAC;IAE5C,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,OAAO,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO;QACL,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,0BAA0B,OAAO,EAAE;KAC3C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAc,EAAE,QAAsB;IACvE,sEAAsE;IACtE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;YACpE,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAA;QACpC,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;IAE9B,MAAM,OAAO,GAAG,QAAQ,IAAI,cAAc,EAAE,CAAA;IAE5C,iEAAiE;IACjE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC;QAC3C,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,OAAO,CAAC,eAAe;QAClC,mBAAmB,EAAE,OAAO,CAAC,yBAAyB;QACtD,cAAc,EAAE,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAC9C,iBAAiB,EAAE,OAAO,CAAC,mBAAmB;QAC9C,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAA;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,IAAI,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;YACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAEtD,IAAI,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,WAAW,CAAA;gBAEnE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,CAAC,cAAc,EACzB,UAAU,CAAC,OAAO,CACnB,CAAA;gBAED,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;oBACjC,OAAO,aAAa,CAAC,WAAY,CAAA;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC,CAAA;IAEF,sEAAsE;IACtE,KAAK,gBAAgB,CAAC;QACpB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;KACtC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../src/tools/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GAGjB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACrF,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAa,MAAM,oCAAoC,CAAA;AAE7F,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAsB,MAAM,oBAAoB,CAAA;AAC9F,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAElD,wEAAwE;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAEzD,2EAA2E;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,4DAA4D;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,uEAAuE;AACvE,OAAO,EAAE,kBAAkB,EAAyC,MAAM,oBAAoB,CAAA;AAE9F;;;GAGG;AACH,MAAM,iBAAiB;IACD;IAApB,YAAoB,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;IAAG,CAAC;IAE5C,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,OAAO,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO;QACL,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,0BAA0B,OAAO,EAAE;KAC3C,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,OAAe,EAAE,OAAe;IAChE,OAAO;QACL,OAAO,EAAE,KAAK;QACd,OAAO;QACP,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,qBAAqB,OAAO,EAAE;KACtC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAc,EAAE,QAAsB;IACvE,sEAAsE;IACtE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,4DAA4D;YAC5D,kDAAkD;YAClD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;YACzE,OAAO,GAAG,SAAS,KAAK,KAAK,CAAC,OAAO,EAAE,CAAA;QACzC,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;IAE9B,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,qEAAqE;IACrE,yBAAyB;IACzB,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,SAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,uBAAuB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,wBAAwB,CAC7B,UAAU,CAAC,OAAO,EAClB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAA;IAChC,MAAM,SAAS,GAAG,gBAAgB,CAAC;QACjC,IAAI;QACJ,QAAQ,EAAE,qBAAqB,EAAE;KAClC,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzE,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,yDAAyD;QACzD,oEAAoE;QACpE,mBAAmB;QACnB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,2EAA2E;YAClF,GAAG,IAAI,CAAC,WAAW;SACpB,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,IAAI,cAAc,EAAE,CAAA;IAE5C,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM;QAC1C,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;QACnC,CAAC,CAAC,iBAAiB,EAAE,CAAA;IAEvB,iEAAiE;IACjE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC;QAC3C,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,OAAO,CAAC,eAAe;QAClC,mBAAmB,EAAE,OAAO,CAAC,yBAAyB;QACtD,cAAc,EAAE,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAC9C,iBAAiB,EAAE,OAAO,CAAC,mBAAmB;QAC9C,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;QAC1D,SAAS,EAAE,kBAAkB;KAC9B,CAAC,CAAA;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,IAAI,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;YACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAEtD,IAAI,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,WAAW,CAAA;gBAEnE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,CAAC,cAAc,EACzB,UAAU,CAAC,OAAO,CACnB,CAAA;gBAED,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;oBACjC,OAAO,aAAa,CAAC,WAAY,CAAA;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC,CAAA;IAEF,sEAAsE;IACtE,KAAK,gBAAgB,CAAC;QACpB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;KACtC,CAAC,CAAA;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,2CAA2C;IAC3C,IAAI,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,IAAI,aAAa,CAAA;QACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QACtD,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,MAAM,KAAK,UAAU;gBAAE,SAAQ;YACnC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC;oBACZ,OAAO,EAAE,SAAS;oBAClB,UAAU;oBACV,QAAQ,EAAE,MAAM;oBAChB,aAAa,EAAE,UAAU,CAAC,OAAO;oBACjC,KAAK,EAAE,UAAU,CAAC,KAAK;iBACxB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,uDAAuD;gBACvD,OAAO,CAAC,KAAK,CACX,yBAAyB,MAAM,UAAU,EACzC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC7D,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,wEAAwE;IACxE,2CAA2C;IAC3C,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO;YACL,GAAG,MAAM;YACT,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe;YACjD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;SACpC,CAAA;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1D,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC;QAC5D,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QACtC,MAAM;KACP,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAC1C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAC1F,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;IAChD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,IAAY,CAAA;IAChB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,gCAAgC,YAAY,CAAC,KAAK,eAAe,IAAI,CAAC,MAAM,KAAK;YAC/E,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACxE,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/src/tools/install.ledger-replay.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @fileoverview Ledger-replay rewriter for the install hot path
+ *               (SMI-4588 Wave 2 Step 6, PR #3).
+ * @module @skillsmith/mcp-server/tools/install.ledger-replay
+ *
+ * Pure rewriter: takes an install candidate and the namespace-overrides
+ * ledger, returns the candidate rewritten to its previously-renamed
+ * identifier when a matching ledger entry exists. Conceptually identical
+ * to git's `rerere` — the user's prior manual rename is silently
+ * re-applied so a pack version bump never resurrects the original
+ * `/ship` filename.
+ *
+ * This module is deliberately pure (no fs, no side effects) so it can
+ * compose into the install hot path without changing the on-disk write
+ * timing. The caller (install.ts) loads the ledger once via
+ * `readLedger()` and passes it in, then runs pre-flight against the
+ * REWRITTEN candidate identifier — the rewrite must happen before
+ * collision detection so a previously-resolved collision doesn't
+ * re-surface as a fresh warning on every install.
+ *
+ * Plan §3 — install integration step 3 (ledger replay).
+ */
+import type { OverrideRecord, OverridesLedger } from '../audit/namespace-overrides.types.js';
+import type { CandidateSkill } from '../audit/install-preflight.js';
+export interface LedgerReplayResult {
+    /** Candidate after applying any ledger overrides (`identifier`/`projectedSourcePath` rewritten). */
+    candidate: CandidateSkill;
+    /** Override entries that matched the candidate. Empty when no replay occurred. */
+    applied: OverrideRecord[];
+}
+/**
+ * Rewrite the candidate skill's identifier (and projected source path)
+ * when a matching ledger override exists. Match keys:
+ *
+ *   - `(skillId, kind: 'skill', originalIdentifier === candidate.identifier)`
+ *
+ * When `candidate.skillId` is provided, the lookup is keyed against the
+ * Skillsmith manifest skillId (`<author>/<name>`). When omitted, the
+ * lookup falls back to identifier-only matching across all `skillId`s —
+ * the user's local override applies regardless of registration state.
+ *
+ * Multiple matches: applies them in iteration order. In practice only
+ * one entry per `(skillId, originalIdentifier)` exists thanks to
+ * `appendOverride`'s dedupe, but the loop is defensive against ledger
+ * mutation outside the writer (e.g., a user hand-edits the JSON).
+ *
+ * Returns the candidate unchanged when no entry matches OR the ledger is
+ * empty. Reference equality on `candidate` is preserved for the no-op
+ * branch so callers can detect "no replay happened" without recomputing.
+ */
+export declare function applyLedgerReplay(candidate: CandidateSkill, ledger: OverridesLedger): LedgerReplayResult;
+//# sourceMappingURL=install.ledger-replay.d.ts.map

package/dist/src/tools/install.ledger-replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.ledger-replay.d.ts","sourceRoot":"","sources":["../../../src/tools/install.ledger-replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAA;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAEnE,MAAM,WAAW,kBAAkB;IACjC,oGAAoG;IACpG,SAAS,EAAE,cAAc,CAAA;IACzB,kFAAkF;IAClF,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,cAAc,EACzB,MAAM,EAAE,eAAe,GACtB,kBAAkB,CA+CpB"}

package/dist/src/tools/install.ledger-replay.js

@@ -0,0 +1,88 @@
+/**
+ * @fileoverview Ledger-replay rewriter for the install hot path
+ *               (SMI-4588 Wave 2 Step 6, PR #3).
+ * @module @skillsmith/mcp-server/tools/install.ledger-replay
+ *
+ * Pure rewriter: takes an install candidate and the namespace-overrides
+ * ledger, returns the candidate rewritten to its previously-renamed
+ * identifier when a matching ledger entry exists. Conceptually identical
+ * to git's `rerere` — the user's prior manual rename is silently
+ * re-applied so a pack version bump never resurrects the original
+ * `/ship` filename.
+ *
+ * This module is deliberately pure (no fs, no side effects) so it can
+ * compose into the install hot path without changing the on-disk write
+ * timing. The caller (install.ts) loads the ledger once via
+ * `readLedger()` and passes it in, then runs pre-flight against the
+ * REWRITTEN candidate identifier — the rewrite must happen before
+ * collision detection so a previously-resolved collision doesn't
+ * re-surface as a fresh warning on every install.
+ *
+ * Plan §3 — install integration step 3 (ledger replay).
+ */
+import { findOverride } from '../audit/namespace-overrides.js';
+/**
+ * Rewrite the candidate skill's identifier (and projected source path)
+ * when a matching ledger override exists. Match keys:
+ *
+ *   - `(skillId, kind: 'skill', originalIdentifier === candidate.identifier)`
+ *
+ * When `candidate.skillId` is provided, the lookup is keyed against the
+ * Skillsmith manifest skillId (`<author>/<name>`). When omitted, the
+ * lookup falls back to identifier-only matching across all `skillId`s —
+ * the user's local override applies regardless of registration state.
+ *
+ * Multiple matches: applies them in iteration order. In practice only
+ * one entry per `(skillId, originalIdentifier)` exists thanks to
+ * `appendOverride`'s dedupe, but the loop is defensive against ledger
+ * mutation outside the writer (e.g., a user hand-edits the JSON).
+ *
+ * Returns the candidate unchanged when no entry matches OR the ledger is
+ * empty. Reference equality on `candidate` is preserved for the no-op
+ * branch so callers can detect "no replay happened" without recomputing.
+ */
+export function applyLedgerReplay(candidate, ledger) {
+    if (ledger.overrides.length === 0) {
+        return { candidate, applied: [] };
+    }
+    const applied = [];
+    let workingIdentifier = candidate.identifier;
+    let workingPath = candidate.projectedSourcePath;
+    // Iterate until no more matches. Loop bound: ledger length (defensive).
+    for (let pass = 0; pass < ledger.overrides.length; pass++) {
+        const match = findOverride(ledger, {
+            skillId: candidate.skillId ?? undefined,
+            kind: 'skill',
+            originalIdentifier: workingIdentifier,
+        });
+        if (!match)
+            break;
+        // Avoid cycles: the same entry must not apply twice.
+        if (applied.some((a) => a.id === match.id))
+            break;
+        applied.push(match);
+        workingIdentifier = match.renamedTo;
+        // Project the post-replay source path under the same parent as the
+        // original projection. The ledger stores the absolute renamed path,
+        // but at install time the candidate may have a different parent
+        // (e.g. a `~/.claude/skills/<token>` projection). Replace only the
+        // basename so cross-host path migrations don't break replay.
+        const parentSep = workingPath.lastIndexOf('/');
+        workingPath =
+            parentSep === -1
+                ? match.renamedTo
+                : `${workingPath.slice(0, parentSep + 1)}${match.renamedTo}`;
+    }
+    if (applied.length === 0) {
+        return { candidate, applied: [] };
+    }
+    return {
+        candidate: {
+            ...candidate,
+            identifier: workingIdentifier,
+            projectedSourcePath: workingPath,
+        },
+        applied,
+    };
+}
+//# sourceMappingURL=install.ledger-replay.js.map

package/dist/src/tools/install.ledger-replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.ledger-replay.js","sourceRoot":"","sources":["../../../src/tools/install.ledger-replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAW9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAyB,EACzB,MAAuB;IAEvB,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,IAAI,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAA;IAC5C,IAAI,WAAW,GAAG,SAAS,CAAC,mBAAmB,CAAA;IAE/C,wEAAwE;IACxE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE;YACjC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,SAAS;YACvC,IAAI,EAAE,OAAO;YACb,kBAAkB,EAAE,iBAAiB;SACtC,CAAC,CAAA;QACF,IAAI,CAAC,KAAK;YAAE,MAAK;QAEjB,qDAAqD;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;YAAE,MAAK;QAEjD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnB,iBAAiB,GAAG,KAAK,CAAC,SAAS,CAAA;QACnC,mEAAmE;QACnE,oEAAoE;QACpE,gEAAgE;QAChE,mEAAmE;QACnE,6DAA6D;QAC7D,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9C,WAAW;YACT,SAAS,KAAK,CAAC,CAAC;gBACd,CAAC,CAAC,KAAK,CAAC,SAAS;gBACjB,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;IAClE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACnC,CAAC;IAED,OAAO;QACL,SAAS,EAAE;YACT,GAAG,SAAS;YACZ,UAAU,EAAE,iBAAiB;YAC7B,mBAAmB,EAAE,WAAW;SACjC;QACD,OAAO;KACR,CAAA;AACH,CAAC"}

package/dist/src/tools/install.namespace-gate.d.ts

@@ -0,0 +1,68 @@
+/**
+ * @fileoverview Namespace pre-flight + mode gate for the install hot path
+ *               (SMI-4588 Wave 2 Step 6, PR #3).
+ * @module @skillsmith/mcp-server/tools/install.namespace-gate
+ *
+ * Encapsulates the three steps that bracket `service.install()` in the
+ * MCP install tool:
+ *
+ *   1. Ledger replay — rewrite the candidate skill's identifier when a
+ *      previously-recorded user rename matches.
+ *   2. Pre-flight collision detection + suggestion-chain generation.
+ *   3. Mode gate (`preventative` blocks; `power_user`/`governance` warn).
+ *
+ * Extracted from `install.ts` per Step 6's "unconditional extraction"
+ * directive — keeps the hot-path file under the 500-LOC limit and keeps
+ * the new logic independently testable.
+ *
+ * Edits applied (plan-review 2026-05-02):
+ *   - Edit 2: pre-flight scanner failure is ALWAYS non-blocking. The
+ *     `runInstallPreflight` module already degrades on detector throws;
+ *     this gate additionally swallows ledger-read errors (including
+ *     `namespace.ledger.version_unsupported`) so a downgraded ledger
+ *     never bricks installs.
+ *   - Edit 6: typed `version_unsupported` error caught here, not bubbled.
+ *   - Edit 7: pre-flight returns `auditId` explicitly; this gate threads
+ *     it into the `pendingCollision` envelope without re-deriving.
+ */
+import { type CandidateSkill, type RunInstallPreflightResult } from '../audit/install-preflight.js';
+import type { AuditMode, Tier } from '@skillsmith/core/config/audit-mode';
+import type { InstallResult } from './install.types.js';
+export interface NamespaceGateInput {
+    /** Synthesized candidate for the skill being installed. */
+    candidate: CandidateSkill;
+    /** Resolved audit mode (caller resolves via `resolveAuditMode`). */
+    mode: AuditMode;
+    /** Subscription tier (passed through to detector for telemetry consistency). */
+    tier: Tier;
+}
+export interface NamespaceGateOutcome {
+    /**
+     * `'block'` only fires when `mode === 'preventative'` AND a candidate-
+     * involved collision was detected. Caller short-circuits the install
+     * with the `pendingCollision` envelope.
+     */
+    decision: 'block' | 'proceed';
+    /**
+     * The (possibly ledger-replayed) candidate. Caller MAY use this for
+     * post-install side effects, but Wave 2 PR #3 does not yet wire
+     * post-install rename — the ledger-replay rewrites the candidate in
+     * place at the pre-flight boundary so the surfaced suggestions match.
+     */
+    candidate: CandidateSkill;
+    /** Always present — populated by `runInstallPreflight`. */
+    preflight: RunInstallPreflightResult;
+    /**
+     * `InstallResult` payload to merge into the caller's return value.
+     * Populated for both `block` and `proceed` paths so the install hot
+     * path has a single shape to splat.
+     */
+    resultPatch: Pick<InstallResult, 'installComplete' | 'pendingCollision' | 'warnings'>;
+}
+/**
+ * Run the namespace pre-flight + apply the mode gate. Returns a decision
+ * the install hot path branches on. Never throws — all failure paths
+ * degrade to `decision: 'proceed'` with a logged warning (Edit 2).
+ */
+export declare function runNamespaceGate(input: NamespaceGateInput): Promise<NamespaceGateOutcome>;
+//# sourceMappingURL=install.namespace-gate.d.ts.map

package/dist/src/tools/install.namespace-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.namespace-gate.d.ts","sourceRoot":"","sources":["../../../src/tools/install.namespace-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,yBAAyB,EAC/B,MAAM,+BAA+B,CAAA;AAKtC,OAAO,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAA;AAGzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,SAAS,EAAE,cAAc,CAAA;IACzB,oEAAoE;IACpE,IAAI,EAAE,SAAS,CAAA;IACf,gFAAgF;IAChF,IAAI,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAA;IAC7B;;;;;OAKG;IACH,SAAS,EAAE,cAAc,CAAA;IACzB,2DAA2D;IAC3D,SAAS,EAAE,yBAAyB,CAAA;IACpC;;;;OAIG;IACH,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,iBAAiB,GAAG,kBAAkB,GAAG,UAAU,CAAC,CAAA;CACtF;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6E/F"}

package/dist/src/tools/install.namespace-gate.js

@@ -0,0 +1,129 @@
+/**
+ * @fileoverview Namespace pre-flight + mode gate for the install hot path
+ *               (SMI-4588 Wave 2 Step 6, PR #3).
+ * @module @skillsmith/mcp-server/tools/install.namespace-gate
+ *
+ * Encapsulates the three steps that bracket `service.install()` in the
+ * MCP install tool:
+ *
+ *   1. Ledger replay — rewrite the candidate skill's identifier when a
+ *      previously-recorded user rename matches.
+ *   2. Pre-flight collision detection + suggestion-chain generation.
+ *   3. Mode gate (`preventative` blocks; `power_user`/`governance` warn).
+ *
+ * Extracted from `install.ts` per Step 6's "unconditional extraction"
+ * directive — keeps the hot-path file under the 500-LOC limit and keeps
+ * the new logic independently testable.
+ *
+ * Edits applied (plan-review 2026-05-02):
+ *   - Edit 2: pre-flight scanner failure is ALWAYS non-blocking. The
+ *     `runInstallPreflight` module already degrades on detector throws;
+ *     this gate additionally swallows ledger-read errors (including
+ *     `namespace.ledger.version_unsupported`) so a downgraded ledger
+ *     never bricks installs.
+ *   - Edit 6: typed `version_unsupported` error caught here, not bubbled.
+ *   - Edit 7: pre-flight returns `auditId` explicitly; this gate threads
+ *     it into the `pendingCollision` envelope without re-deriving.
+ */
+import { runInstallPreflight, } from '../audit/install-preflight.js';
+import { newAuditId } from '../audit/audit-history.js';
+import { readLedger } from '../audit/namespace-overrides.js';
+import { applyLedgerReplay } from './install.ledger-replay.js';
+import { scanLocalInventory } from '../utils/local-inventory.js';
+/**
+ * Run the namespace pre-flight + apply the mode gate. Returns a decision
+ * the install hot path branches on. Never throws — all failure paths
+ * degrade to `decision: 'proceed'` with a logged warning (Edit 2).
+ */
+export async function runNamespaceGate(input) {
+    const { mode, tier } = input;
+    // Step 1 — ledger replay. Read the ledger; on failure (including
+    // `version_unsupported`), degrade to "no replay, no preflight" because
+    // we cannot trust the candidate's effective identifier without it.
+    let candidate = input.candidate;
+    try {
+        const ledger = await readLedger();
+        const replay = applyLedgerReplay(input.candidate, ledger);
+        candidate = replay.candidate;
+    }
+    catch (err) {
+        // Edit 6: typed version_unsupported (or any other ledger error)
+        // surfaces here. Pre-flight is non-blocking; degrade.
+        console.warn(`[install.namespace-gate] ledger read failed (${err.message}); skipping pre-flight`);
+        return degradedProceed(candidate);
+    }
+    // Step 2 — scan local inventory + run pre-flight. The scanner runs
+    // synchronously per call (Wave 1 plumbing). Errors here also degrade.
+    let existingInventory;
+    try {
+        const scan = await scanLocalInventory();
+        existingInventory = scan.entries;
+    }
+    catch (err) {
+        console.warn(`[install.namespace-gate] scanLocalInventory failed (${err.message}); skipping pre-flight`);
+        return degradedProceed(candidate);
+    }
+    let preflight;
+    try {
+        preflight = await runInstallPreflight({
+            existingInventory,
+            candidate,
+            mode,
+            tier,
+        });
+    }
+    catch (err) {
+        // `runInstallPreflight` itself already catches detector throws and
+        // degrades, but a defensive outer catch keeps the install hot path
+        // bulletproof against any future regression.
+        console.warn(`[install.namespace-gate] runInstallPreflight threw (${err.message}); proceeding non-blocking`);
+        return degradedProceed(candidate);
+    }
+    // Step 3 — mode gate.
+    const hasCollision = preflight.pendingCollision !== null;
+    if (mode === 'preventative' && hasCollision) {
+        return {
+            decision: 'block',
+            candidate,
+            preflight,
+            resultPatch: {
+                installComplete: false,
+                pendingCollision: preflight.pendingCollision ?? undefined,
+                warnings: preflight.warnings.length > 0 ? preflight.warnings : undefined,
+            },
+        };
+    }
+    // power_user / governance / preventative-without-collision all proceed.
+    return {
+        decision: 'proceed',
+        candidate,
+        preflight,
+        resultPatch: {
+            installComplete: true,
+            warnings: preflight.warnings.length > 0 ? preflight.warnings : undefined,
+        },
+    };
+}
+/**
+ * Degraded-proceed shape used when ledger read, inventory scan, or
+ * pre-flight throws. Caller continues the install with no warnings.
+ *
+ * `auditId` is allocated via `newAuditId()` even on the degraded path so
+ * the `AuditId` brand invariant holds for any defensive consumer that
+ * reads `preflight.auditId` without checking `decision` first.
+ */
+function degradedProceed(candidate) {
+    return {
+        decision: 'proceed',
+        candidate,
+        preflight: {
+            warnings: [],
+            pendingCollision: null,
+            auditId: newAuditId(),
+        },
+        resultPatch: {
+            installComplete: true,
+        },
+    };
+}
+//# sourceMappingURL=install.namespace-gate.js.map

package/dist/src/tools/install.namespace-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.namespace-gate.js","sourceRoot":"","sources":["../../../src/tools/install.namespace-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,mBAAmB,GAGpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAuChE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAyB;IAC9D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IAE5B,iEAAiE;IACjE,uEAAuE;IACvE,mEAAmE;IACnE,IAAI,SAAS,GAAmB,KAAK,CAAC,SAAS,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACzD,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gEAAgE;QAChE,sDAAsD;QACtD,OAAO,CAAC,IAAI,CACV,gDAAiD,GAAa,CAAC,OAAO,wBAAwB,CAC/F,CAAA;QACD,OAAO,eAAe,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,IAAI,iBAAgD,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAA;QACvC,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAA;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,uDAAwD,GAAa,CAAC,OAAO,wBAAwB,CACtG,CAAA;QACD,OAAO,eAAe,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;IAED,IAAI,SAAoC,CAAA;IACxC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,mBAAmB,CAAC;YACpC,iBAAiB;YACjB,SAAS;YACT,IAAI;YACJ,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,mEAAmE;QACnE,6CAA6C;QAC7C,OAAO,CAAC,IAAI,CACV,uDAAwD,GAAa,CAAC,OAAO,4BAA4B,CAC1G,CAAA;QACD,OAAO,eAAe,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;IAED,sBAAsB;IACtB,MAAM,YAAY,GAAG,SAAS,CAAC,gBAAgB,KAAK,IAAI,CAAA;IAExD,IAAI,IAAI,KAAK,cAAc,IAAI,YAAY,EAAE,CAAC;QAC5C,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,SAAS;YACT,SAAS;YACT,WAAW,EAAE;gBACX,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,IAAI,SAAS;gBACzD,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;aACzE;SACF,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,SAAS;QACT,SAAS;QACT,WAAW,EAAE;YACX,eAAe,EAAE,IAAI;YACrB,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACzE;KACF,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,SAAyB;IAChD,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,SAAS;QACT,SAAS,EAAE;YACT,QAAQ,EAAE,EAAE;YACZ,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE,UAAU,EAAE;SACtB;QACD,WAAW,EAAE;YACX,eAAe,EAAE,IAAI;SACtB;KACF,CAAA;AACH,CAAC"}