archgen-skill 0.0.4 → 0.0.6

package/lib/uninstall-project.js

@@ -20,6 +20,7 @@ import {
   rmIfExists,
 } from './store.js';
 import { resolveSkillSource } from './init.js';
+import { uninstallMcp } from './mcp-server.js';
 
 function lstatSafe(p) {
   try { return lstatSync(p); } catch { return null; }
@@ -33,7 +34,8 @@ function relJoin(rel) {
  * @param {string} projectDir project root to clean
  * @param {string} packageRoot dir containing this CLI package (vendor source)
  * @returns {{root: string, linkRemoved: boolean, strippedBlocks: string[],
- *            storeRemoved: boolean, storeKept: boolean, manifestRemoved: boolean, warnings: string[]}}
+ *            storeRemoved: boolean, storeKept: boolean, manifestRemoved: boolean,
+ *            mcpRemoved: string[], warnings: string[]}}
  */
 export function uninstallProject(projectDir, packageRoot) {
   const root = resolve(projectDir);
@@ -86,10 +88,21 @@ export function uninstallProject(projectDir, packageRoot) {
     }
   }
 
-  // 4. Manifest file — then prune .archgen only if nothing else remains
+  // 4. MCP server entries — remove ONLY the archgen entries this install
+  //    wrote (the MCP server keeps a manifest of exactly what it created, so
+  //    unrelated servers in the same config are never touched).
+  let mcpRemoved = [];
+  const mcp = uninstallMcp({ projectRoot: root });
+  if (mcp.report?.removed?.length) {
+    mcpRemoved = mcp.report.removed;
+  } else if (mcp.detail) {
+    warnings.push(`archgen MCP entries not removed: ${mcp.detail}`);
+  }
+
+  // 5. Manifest file — then prune .archgen only if nothing else remains
   //    (feature folders / backups keep it alive).
   const manifestRemoved = rmIfExists(join(root, relJoin(MANIFEST_REL)));
   if (manifestRemoved) pruneEmptyParents(root, dirname(MANIFEST_REL));
 
-  return { root, linkRemoved, strippedBlocks, storeRemoved, storeKept, manifestRemoved, warnings };
+  return { root, linkRemoved, strippedBlocks, storeRemoved, storeKept, manifestRemoved, mcpRemoved, warnings };
 }

package/lib/version-stamp.js

@@ -13,7 +13,7 @@
 
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { VERSION_FILE } from './store.js';
+import { VERSION_FILE, assertNotSymlink } from './store.js';
 
 const SEMVER_RE = /^\d+\.\d+\.\d+$/;
 
@@ -42,6 +42,8 @@ export function readStamp(skillRoot) {
  */
 export function writeStamp(skillRoot, version) {
   const p = join(skillRoot, VERSION_FILE);
+  assertNotSymlink(skillRoot);
   mkdirSync(dirname(p), { recursive: true });
+  assertNotSymlink(p);
   writeFileSync(p, version + '\n', 'utf8');
 }

package/lib/version.js

@@ -1,5 +1,6 @@
 // version.js — semver compare + npm registry lookup (zero deps).
 import { spawnSync } from 'node:child_process';
+import { npmInvocation } from './spawn-npm.js';
 
 export function parseSemver(v) {
   const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(v ?? '').trim());
@@ -17,7 +18,14 @@ export function compareSemver(a, b) {
 }
 
 export function fetchLatestVersion(pkg) {
-  const r = spawnSync('npm', ['view', pkg, 'version'], { encoding: 'utf8', timeout: 15000 });
-  if (r.status !== 0 || !r.stdout) return null;
-  return r.stdout.trim().split(/\r?\n/).pop() || null;
+  // Registry-verified constant in every caller; refuse anything else outright.
+  if (!/^[a-z0-9@][a-z0-9._/-]*$/i.test(String(pkg ?? ''))) return null;
+  try {
+    const inv = npmInvocation(['view', String(pkg), 'version']);
+    const r = spawnSync(inv.command, inv.args, { encoding: 'utf8', timeout: 15000, shell: inv.shell });
+    if (r.status !== 0 || !r.stdout) return null;
+    return r.stdout.trim().split(/\r?\n/).pop() || null;
+  } catch {
+    return null;
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "archgen-skill",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "Architecture generation & autonomous task execution for coding agents - conversational requirements in, dependency-ordered tasks out, executed wave-by-wave with verifier gates. Works with Claude Code, OpenCode, Cursor, Codex, Gemini CLI and any agentskills.io harness.",
   "license": "MIT",
   "type": "module",
@@ -14,7 +14,7 @@
     "README.md"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "keywords": [
     "ai",
@@ -38,11 +38,12 @@
   "bugs": {
     "url": "https://github.com/akashmaurya99/archgen/issues"
   },
-  "//": "vendor/skills/archgen is synced from ../skills/archgen by scripts/sync-vendor.mjs (run automatically via prepublishOnly). The extension ships separately as a VS Code vsix.",
+  "//": "vendor/skills/archgen is a full mirror of ../../skill synced by scripts/sync-vendor.mjs (run automatically via prepublishOnly). The extension ships separately as a VS Code vsix.",
   "scripts": {
     "sync:config": "node scripts/sync-config.mjs",
+    "sync:check": "node scripts/sync-config.mjs --check",
     "sync": "node scripts/sync-config.mjs && node scripts/sync-vendor.mjs",
     "prepublishOnly": "node scripts/sync-config.mjs && node scripts/sync-vendor.mjs",
-    "test": "node --test test/*.test.mjs"
+    "test": "ARCHGEN_CODEGRAPH=0 node --test test/*.test.mjs"
   }
 }