@skillsmith/mcp-server 0.4.13 → 0.5.0

package/dist/tests/unit/suggestion-chain.test.js

@@ -0,0 +1,191 @@
+/**
+ * Unit tests for SMI-4588 Wave 2 Step 2 — `generateSuggestionChain`.
+ * PR #2 of the Wave 2 stack.
+ *
+ * Coverage (decision #11 — 3-tier fall-through):
+ *   1. Tier 1 wins when `${author}-${token}` is collision-free.
+ *   2. Tier 2 wins when tier 1 collides; packDomain segment included.
+ *   3. Tier 3 wins when tiers 1 and 2 both collide; shortHash suffix added.
+ *   4. All tiers exhaust → `exhausted: true` and full chain returned.
+ *   5. `packDomain` absent → tier 2 skipped (deduped against tier 3).
+ *   6. `shortHash` is deterministic — same input produces same output.
+ *   7. Pre-candidate inventory contract — candidate skill must NOT be in
+ *      the inventory (Edit 7).
+ *   8. No author + no tag fallback → `local-` prefix (plan §1 path 3).
+ */
+import { describe, expect, it } from 'vitest';
+import { computeShortHash, generateSuggestionChain, sanitizeSegment, } from '../../src/audit/suggestion-chain.js';
+const entry = (identifier, kind = 'command') => ({
+    kind,
+    source_path: `/tmp/${identifier}.md`,
+    identifier,
+    triggerSurface: [identifier],
+});
+describe('sanitizeSegment', () => {
+    it('lowercases and replaces non-alphanumerics', () => {
+        expect(sanitizeSegment('Anthropic Inc.')).toBe('anthropic-inc');
+    });
+    it('dedupes consecutive separators', () => {
+        expect(sanitizeSegment('foo  bar___baz')).toBe('foo-bar-baz');
+    });
+    // SMI-4733 ReDoS hardening: defense-in-depth length cap at 256 chars.
+    // Two of four callers (`token`, `packDomain`) have no upstream cap;
+    // unbounded input on the regex chain below caused polynomial backtracking
+    // (CodeQL alert 93). CodeQL re-scan is the regression gate; here we
+    // assert correctness.
+    it('accepts 256-char input at boundary', () => {
+        const input = 'a'.repeat(256);
+        expect(sanitizeSegment(input)).toBe(input);
+    });
+    it('returns empty string on input > 256 chars; chain falls through that tier', () => {
+        expect(sanitizeSegment('a'.repeat(257))).toBe('');
+        // Over-long `packDomain` must not throw; the suggestion chain falls
+        // through to the no-packDomain shape (tier 1 + tier 3 only) per the
+        // existing empty-segment behavior in `generateSuggestionChain`.
+        const result = generateSuggestionChain({
+            token: 'ship',
+            author: 'anthropic',
+            packDomain: 'x'.repeat(300),
+            authorPath: '/repo/x',
+            existingInventory: [],
+        });
+        expect(result.candidates[0]).toBe('anthropic-ship');
+        expect(result.candidates).toHaveLength(2);
+        expect(result.candidates[1]).toMatch(/^anthropic-ship-[0-9a-f]{4}$/);
+        expect(result.exhausted).toBe(false);
+    });
+    it('collapses 200 leading dashes to single segment', () => {
+        expect(sanitizeSegment('-'.repeat(200) + 'x')).toBe('x');
+    });
+});
+describe('computeShortHash', () => {
+    it('is deterministic for identical inputs', () => {
+        const a = computeShortHash('/path/to/skill', 'ship', 'codehelper');
+        const b = computeShortHash('/path/to/skill', 'ship', 'codehelper');
+        expect(a).toBe(b);
+        expect(a).toMatch(/^[0-9a-f]{4}$/);
+    });
+    it('differs across inputs', () => {
+        const a = computeShortHash('/p1', 'ship', 'a');
+        const b = computeShortHash('/p2', 'ship', 'a');
+        expect(a).not.toBe(b);
+    });
+});
+describe('generateSuggestionChain', () => {
+    it('tier 1 wins when ${author}-${token} is collision-free', () => {
+        const result = generateSuggestionChain({
+            token: 'ship',
+            author: 'anthropic',
+            packDomain: 'codehelper',
+            authorPath: '/repo/anthropic/codehelper',
+            existingInventory: [entry('ship'), entry('release')],
+        });
+        expect(result.exhausted).toBe(false);
+        expect(result.candidates[0]).toBe('anthropic-ship');
+        expect(result.candidates).toHaveLength(3);
+        // Walk: tier 1 does not collide → recommended is tier 1.
+        expect(result.candidates[0]).toBe('anthropic-ship');
+    });
+    it('tier 2 wins when tier 1 collides; packDomain segment included', () => {
+        const result = generateSuggestionChain({
+            token: 'ship',
+            author: 'anthropic',
+            packDomain: 'codehelper',
+            authorPath: '/repo/anthropic/codehelper',
+            existingInventory: [entry('anthropic-ship')],
+        });
+        expect(result.candidates[0]).toBe('anthropic-ship');
+        expect(result.candidates[1]).toBe('anthropic-codehelper-ship');
+        expect(result.exhausted).toBe(false);
+    });
+    it('tier 3 wins when tiers 1 and 2 collide; shortHash suffix added', () => {
+        const result = generateSuggestionChain({
+            token: 'ship',
+            author: 'anthropic',
+            packDomain: 'codehelper',
+            authorPath: '/repo/anthropic/codehelper',
+            existingInventory: [entry('anthropic-ship'), entry('anthropic-codehelper-ship')],
+        });
+        expect(result.candidates[2]).toMatch(/^anthropic-codehelper-ship-[0-9a-f]{4}$/);
+        expect(result.exhausted).toBe(false);
+    });
+    it('all tiers exhausted → exhausted: true', () => {
+        const hash = computeShortHash('/repo/x', 'ship', 'codehelper');
+        const result = generateSuggestionChain({
+            token: 'ship',
+            author: 'anthropic',
+            packDomain: 'codehelper',
+            authorPath: '/repo/x',
+            existingInventory: [
+                entry('anthropic-ship'),
+                entry('anthropic-codehelper-ship'),
+                entry(`anthropic-codehelper-ship-${hash}`),
+            ],
+        });
+        expect(result.exhausted).toBe(true);
+        expect(result.candidates).toHaveLength(3);
+    });
+    it('packDomain absent → tier 2 skipped, deduped vs tier 3', () => {
+        const result = generateSuggestionChain({
+            token: 'ship',
+            author: 'anthropic',
+            packDomain: null,
+            authorPath: '/repo/x',
+            existingInventory: [],
+        });
+        // Tier 1 always emitted; tier 2 absent (no packDomain); tier 3 keeps
+        // shortHash suffix without the packDomain segment.
+        expect(result.candidates[0]).toBe('anthropic-ship');
+        // Two candidates total — tier 2 is null, dedupe handles overlap.
+        expect(result.candidates).toHaveLength(2);
+        expect(result.candidates[1]).toMatch(/^anthropic-ship-[0-9a-f]{4}$/);
+    });
+    it('no author and no tag fallback → local- prefix', () => {
+        const result = generateSuggestionChain({
+            token: 'ship',
+            author: null,
+            packDomain: null,
+            authorPath: '/repo/x',
+            existingInventory: [],
+        });
+        expect(result.candidates[0]).toBe('local-ship');
+        expect(result.exhausted).toBe(false);
+    });
+    it('falls back to tagFallback when author is null', () => {
+        const result = generateSuggestionChain({
+            token: 'ship',
+            author: null,
+            tagFallback: 'release-tools',
+            packDomain: null,
+            authorPath: '/repo/x',
+            existingInventory: [],
+        });
+        expect(result.candidates[0]).toBe('release-tools-ship');
+    });
+    it('candidate skill is NOT in pre-candidate inventory (Edit 7)', () => {
+        // The candidate skill itself ("ship") MUST be excluded from the
+        // inventory — otherwise tier 1 would self-collide.
+        const result = generateSuggestionChain({
+            token: 'ship',
+            author: 'anthropic',
+            packDomain: null,
+            authorPath: '/repo/x',
+            // Critically: NOT including entry('ship') here.
+            existingInventory: [entry('release')],
+        });
+        expect(result.candidates[0]).toBe('anthropic-ship');
+        expect(result.exhausted).toBe(false);
+    });
+    it('empty token → empty candidates + exhausted', () => {
+        const result = generateSuggestionChain({
+            token: '...',
+            author: 'anthropic',
+            packDomain: null,
+            authorPath: '/repo/x',
+            existingInventory: [],
+        });
+        expect(result.candidates).toHaveLength(0);
+        expect(result.exhausted).toBe(true);
+    });
+});
+//# sourceMappingURL=suggestion-chain.test.js.map

package/dist/tests/unit/suggestion-chain.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggestion-chain.test.js","sourceRoot":"","sources":["../../../tests/unit/suggestion-chain.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAG7C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,GAChB,MAAM,qCAAqC,CAAA;AAE5C,MAAM,KAAK,GAAG,CAAC,UAAkB,EAAE,OAA+B,SAAS,EAAkB,EAAE,CAAC,CAAC;IAC/F,IAAI;IACJ,WAAW,EAAE,QAAQ,UAAU,KAAK;IACpC,UAAU;IACV,cAAc,EAAE,CAAC,UAAU,CAAC;CAC7B,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,sEAAsE;IACtE,oEAAoE;IACpE,0EAA0E;IAC1E,oEAAoE;IACpE,sBAAsB;IACtB,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAEjD,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAC3B,UAAU,EAAE,SAAS;YACrB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAA;QACpE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;QAClE,MAAM,CAAC,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;QAClE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QAC9C,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QAC9C,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,YAAY;YACxB,UAAU,EAAE,4BAA4B;YACxC,iBAAiB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;SACrD,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACzC,yDAAyD;QACzD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,YAAY;YACxB,UAAU,EAAE,4BAA4B;YACxC,iBAAiB,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;SAC7C,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAC9D,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,YAAY;YACxB,UAAU,EAAE,4BAA4B;YACxC,iBAAiB,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC;SACjF,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAA;QAC/E,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;QAC9D,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,YAAY;YACxB,UAAU,EAAE,SAAS;YACrB,iBAAiB,EAAE;gBACjB,KAAK,CAAC,gBAAgB,CAAC;gBACvB,KAAK,CAAC,2BAA2B,CAAC;gBAClC,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC;aAC3C;SACF,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,SAAS;YACrB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAA;QACF,qEAAqE;QACrE,mDAAmD;QACnD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACnD,iEAAiE;QACjE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,SAAS;YACrB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC/C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,eAAe;YAC5B,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,SAAS;YACrB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,gEAAgE;QAChE,mDAAmD;QACnD,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,SAAS;YACrB,gDAAgD;YAChD,iBAAiB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;SACtC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,SAAS;YACrB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/webhooks/standalone-shutdown.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * SMI-4694: Listener-count audit for standalone webhook + stripe-webhook
+ * shutdown handlers (Module 4).
+ *
+ * Verifies that attachShutdownHandlers() registers SIGTERM/SIGINT
+ * idempotently — repeated calls do not accumulate listeners — and that the
+ * returned detach() restores baseline counts.
+ *
+ * Reference pattern: packages/core/tests/api/client.events.test.ts:39-72
+ */
+export {};
+//# sourceMappingURL=standalone-shutdown.test.d.ts.map

package/dist/tests/webhooks/standalone-shutdown.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone-shutdown.test.d.ts","sourceRoot":"","sources":["../../../tests/webhooks/standalone-shutdown.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/tests/webhooks/standalone-shutdown.test.js

@@ -0,0 +1,91 @@
+/**
+ * SMI-4694: Listener-count audit for standalone webhook + stripe-webhook
+ * shutdown handlers (Module 4).
+ *
+ * Verifies that attachShutdownHandlers() registers SIGTERM/SIGINT
+ * idempotently — repeated calls do not accumulate listeners — and that the
+ * returned detach() restores baseline counts.
+ *
+ * Reference pattern: packages/core/tests/api/client.events.test.ts:39-72
+ */
+import { describe, it, expect } from 'vitest';
+import { attachShutdownHandlers as attachWebhookShutdown } from '../../src/webhooks/webhook-endpoint.js';
+import { attachShutdownHandlers as attachStripeShutdown } from '../../src/webhooks/stripe-webhook-endpoint.js';
+/**
+ * Mock WebhookServer minimal enough that the shutdown closure can hold a
+ * reference. The closure calls process.exit(0) after stopWebhookServer; the
+ * audit test never invokes the closure (we only assert listener counts).
+ */
+function createMockWebhookServer() {
+    return {
+        server: { close: (cb) => cb?.() },
+        handler: {},
+        queue: { clear: () => { } },
+    };
+}
+function createMockStripeWebhookServer() {
+    return {
+        server: {},
+        rateLimiter: {},
+        stop: async () => { },
+    };
+}
+describe('SMI-4694: webhook-endpoint attachShutdownHandlers listener-count audit', () => {
+    it('does NOT leak SIGTERM/SIGINT listeners across 5 attach/detach cycles', () => {
+        const before = {
+            sigterm: process.listenerCount('SIGTERM'),
+            sigint: process.listenerCount('SIGINT'),
+        };
+        for (let i = 0; i < 5; i++) {
+            const server = createMockWebhookServer();
+            const detach = attachWebhookShutdown(server);
+            detach();
+        }
+        const after = {
+            sigterm: process.listenerCount('SIGTERM'),
+            sigint: process.listenerCount('SIGINT'),
+        };
+        expect(after.sigterm).toBe(before.sigterm);
+        expect(after.sigint).toBe(before.sigint);
+    });
+    it('idempotent re-attach with the same server does not double-register', () => {
+        const before = {
+            sigterm: process.listenerCount('SIGTERM'),
+            sigint: process.listenerCount('SIGINT'),
+        };
+        const server = createMockWebhookServer();
+        const detach1 = attachWebhookShutdown(server);
+        const detach2 = attachWebhookShutdown(server);
+        // Each call creates a new closure, so net +2 listeners after two attaches.
+        // The idempotency guarantee is per-closure (re-attaching the SAME closure
+        // is a no-op). detach() removes both closures by reference.
+        detach1();
+        detach2();
+        const after = {
+            sigterm: process.listenerCount('SIGTERM'),
+            sigint: process.listenerCount('SIGINT'),
+        };
+        expect(after.sigterm).toBe(before.sigterm);
+        expect(after.sigint).toBe(before.sigint);
+    });
+});
+describe('SMI-4694: stripe-webhook-endpoint attachShutdownHandlers listener-count audit', () => {
+    it('does NOT leak SIGTERM/SIGINT listeners across 5 attach/detach cycles', () => {
+        const before = {
+            sigterm: process.listenerCount('SIGTERM'),
+            sigint: process.listenerCount('SIGINT'),
+        };
+        for (let i = 0; i < 5; i++) {
+            const server = createMockStripeWebhookServer();
+            const detach = attachStripeShutdown(server);
+            detach();
+        }
+        const after = {
+            sigterm: process.listenerCount('SIGTERM'),
+            sigint: process.listenerCount('SIGINT'),
+        };
+        expect(after.sigterm).toBe(before.sigterm);
+        expect(after.sigint).toBe(before.sigint);
+    });
+});
+//# sourceMappingURL=standalone-shutdown.test.js.map

package/dist/tests/webhooks/standalone-shutdown.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone-shutdown.test.js","sourceRoot":"","sources":["../../../tests/webhooks/standalone-shutdown.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,sBAAsB,IAAI,qBAAqB,EAAE,MAAM,wCAAwC,CAAA;AACxG,OAAO,EAAE,sBAAsB,IAAI,oBAAoB,EAAE,MAAM,+CAA+C,CAAA;AAI9G;;;;GAIG;AACH,SAAS,uBAAuB;IAC9B,OAAO;QACL,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAA0B,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAwC;QAC/F,OAAO,EAAE,EAA8B;QACvC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAuC;KAChE,CAAA;AACH,CAAC;AAED,SAAS,6BAA6B;IACpC,OAAO;QACL,MAAM,EAAE,EAAmC;QAC3C,WAAW,EAAE,EAAwC;QACrD,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KACrB,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,wEAAwE,EAAE,GAAG,EAAE;IACtF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC;SACxC,CAAA;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAA;YACxC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;YAC5C,MAAM,EAAE,CAAA;QACV,CAAC;QAED,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC;SACxC,CAAA;QAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC;SACxC,CAAA;QAED,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;QAE7C,2EAA2E;QAC3E,0EAA0E;QAC1E,4DAA4D;QAC5D,OAAO,EAAE,CAAA;QACT,OAAO,EAAE,CAAA;QAET,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC;SACxC,CAAA;QAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,+EAA+E,EAAE,GAAG,EAAE;IAC7F,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC;SACxC,CAAA;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,6BAA6B,EAAE,CAAA;YAC9C,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;YAC3C,MAAM,EAAE,CAAA;QACV,CAAC;QAED,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC;SACxC,CAAA;QAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,16 +1,28 @@
 {
   "name": "@skillsmith/mcp-server",
-  "version": "0.4.13",
+  "version": "0.5.0",
   "mcpName": "io.github.smith-horn/skillsmith",
   "description": "MCP server for Skillsmith skill discovery",
   "type": "module",
   "main": "./dist/src/index.js",
   "types": "./dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "import": "./dist/src/index.js",
+      "default": "./dist/src/index.js"
+    },
+    "./audit": {
+      "types": "./dist/src/audit/index.d.ts",
+      "import": "./dist/src/audit/index.js",
+      "default": "./dist/src/audit/index.js"
+    }
+  },
   "bin": {
     "skillsmith-mcp": "./dist/src/index.js"
   },
   "scripts": {
-    "prepublishOnly": "npm run build && npm run test && chmod +x dist/src/index.js",
+    "prepublishOnly": "node ../../scripts/lib/forbid-local-publish.mjs && npm run build && npm run test && chmod +x dist/src/index.js",
     "build": "tsc",
     "postbuild": "chmod +x dist/src/index.js || true",
     "dev": "tsx watch src/index.ts",
@@ -22,8 +34,9 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@skillsmith/core": "^0.5.7",
-    "esbuild": "0.27.2"
+    "@skillsmith/core": "^0.6.0",
+    "esbuild": "0.27.2",
+    "ulid": "3.0.1"
   },
   "devDependencies": {
     "tsx": "4.21.0",

package/server.json

@@ -2,13 +2,13 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.smith-horn/skillsmith",
   "title": "Skillsmith",
-  "description": "Discover, install, and manage Claude Code skills via MCP with 14,000+ curated skills.",
+  "description": "Discover, install, and manage agent skills via MCP — 14,000+ curated skills for any MCP-compatible agent (Claude Code, Cursor, Copilot, Codex, Windsurf).",
   "websiteUrl": "https://skillsmith.app",
   "repository": {
     "url": "https://github.com/smith-horn/skillsmith",
     "source": "github"
   },
-  "version": "0.4.13",
+  "version": "0.5.0",
   "_meta": {
     "io.skillsmith/categories": ["developer-tools", "ai-agents", "skill-management"],
     "io.skillsmith/keywords": [
@@ -23,7 +23,7 @@
     {
       "registryType": "npm",
       "identifier": "@skillsmith/mcp-server",
-      "version": "0.4.13",
+      "version": "0.5.0",
       "transport": {
         "type": "stdio"
       },

package/src/assets/skills/skillsmith/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: "Skillsmith"
-description: "Discover, install, compare, and manage Claude Code skills. Use when searching for skills, evaluating quality, understanding trust tiers, checking quotas, or creating custom skills. Triggers: 'find skill', 'search skills', 'install skill', 'trust tier', 'create skill', 'skill quality', 'skill quota'."
+description: "Discover, install, compare, and manage agent skills. Use when searching for skills, evaluating quality, understanding trust tiers, checking quotas, or creating custom skills. Triggers: 'find skill', 'search skills', 'install skill', 'trust tier', 'create skill', 'skill quality', 'skill quota'."
 ---
 
 # Skillsmith
 
-Skillsmith is your skill discovery and management system for Claude Code. It provides access to 500+ community skills with trust verification, quality scoring, and security scanning.
+Skillsmith is your skill discovery and management system for any MCP-compatible agent (Claude Code, Cursor, Copilot, Codex, Windsurf, and others). It provides access to 500+ community skills with trust verification, quality scoring, and security scanning.
 
 ## Quick Reference: MCP Tools