archgen-skill 0.0.5 → 0.0.6

package/lib/store.js

@@ -59,6 +59,55 @@ const GUARDED_RELPATHS = new Set(['.claude', '.agents', '.claude/skills', '.agen
  */
 export const DEV_ONLY_RELPATHS = ['scripts/test'];
 
+/**
+ * Subtrees that the CURRENT packaged skill no longer ships.
+ *
+ * The skill used to ship a `scripts/` tree (11 scripts + a lib/ folder). It
+ * does any more — every capability moved into the archgen MCP server. An
+ * existing install still carries that tree, and it is dead weight: nothing
+ * reads it, and it makes the store hash as DIVERGED from the packaged skill.
+ *
+ * Pruning it is a MIGRATION, not a repair: the tree is ours (it shipped in a
+ * previous version), so removing it is safe. It is never removed from a store
+ * whose packaged skill still ships the same path — the check is always
+ * "packaged skill has no such directory".
+ */
+export const OBSOLETE_RELPATHS = ['scripts'];
+
+/**
+ * The subtrees the packaged skill no longer ships that are still present in
+ * an installed tree (report-only — nothing is touched).
+ *
+ * @param {string} absRoot the installed skill tree
+ * @param {string} packagedRoot the packaged (vendor) skill tree
+ * @returns {string[]} the relpaths that are obsolete
+ */
+export function findObsolete(absRoot, packagedRoot) {
+  const found = [];
+  for (const rel of OBSOLETE_RELPATHS) {
+    if (existsSync(join(packagedRoot, ...rel.split('/')))) continue; // still shipped — not obsolete
+    if (!existsSync(join(absRoot, ...rel.split('/')))) continue;
+    found.push(rel);
+  }
+  return found;
+}
+
+/**
+ * Remove the subtrees the packaged skill no longer ships.
+ *
+ * @param {string} absRoot the installed skill tree
+ * @param {string} packagedRoot the packaged (vendor) skill tree
+ * @returns {string[]} the relpaths actually removed
+ */
+export function pruneObsolete(absRoot, packagedRoot) {
+  const removed = [];
+  for (const rel of findObsolete(absRoot, packagedRoot)) {
+    rmSync(join(absRoot, ...rel.split('/')), { recursive: true, force: true });
+    removed.push(rel);
+  }
+  return removed;
+}
+
 /** True when relpath `r` is (or lives inside) a dev-only excluded subtree. */
 function isDevOnlyRelPath(r) {
   for (const prefix of DEV_ONLY_RELPATHS) {
@@ -136,17 +185,38 @@ function byName(a, b) {
 export function hashDir(dir, opts = {}) {
   const ignore = new Set([VERSION_FILE, ...(opts.ignore ?? [])]);
   const hash = createHash('sha256');
-  (function walk(abs, rel) {
+  // A directory contributes its marker ONLY when its subtree contributes
+  // something. Without this, a directory holding nothing but excluded
+  // dev-only content hashed a 'd <rel>' marker on one side and nothing on the
+  // other — the two trees then read as divergent even though they are
+  // identical once the exclusions are applied.
+  //
+  // File contents are hashed as BYTES, never as strings: a lossy string
+  // round-trip would change the digest for any non-UTF-8 file.
+  const walk = (abs, rel) => {
     const entries = readdirSync(abs, { withFileTypes: true }).sort((a, b) => byName(a.name, b.name));
+    const chunks = [];
     for (const ent of entries) {
       const r = rel ? rel + '/' + ent.name : ent.name;
       if (ignore.has(r) || isDevOnlyRelPath(r)) continue;
       const p = join(abs, ent.name);
-      if (ent.isSymbolicLink()) hash.update('l ' + r + ' -> ' + readlinkSync(p) + '\n');
-      else if (ent.isDirectory()) { hash.update('d ' + r + '\n'); walk(p, r); }
-      else { hash.update('f ' + r + '\0'); hash.update(readFileSync(p)); hash.update('\n'); }
+      if (ent.isSymbolicLink()) {
+        chunks.push(Buffer.from('l ' + r + ' -> ' + readlinkSync(p) + '\n'));
+      } else if (ent.isDirectory()) {
+        const sub = walk(p, r);
+        if (sub.length > 0) {
+          chunks.push(Buffer.from('d ' + r + '\n'));
+          chunks.push(...sub);
+        }
+      } else {
+        chunks.push(Buffer.from('f ' + r + '\0'));
+        chunks.push(readFileSync(p));
+        chunks.push(Buffer.from('\n'));
+      }
     }
-  })(dir, '');
+    return chunks;
+  };
+  for (const chunk of walk(dir, '')) hash.update(chunk);
   return hash.digest('hex');
 }
 

package/lib/uninstall-project.js

@@ -20,6 +20,7 @@ import {
   rmIfExists,
 } from './store.js';
 import { resolveSkillSource } from './init.js';
+import { uninstallMcp } from './mcp-server.js';
 
 function lstatSafe(p) {
   try { return lstatSync(p); } catch { return null; }
@@ -33,7 +34,8 @@ function relJoin(rel) {
  * @param {string} projectDir project root to clean
  * @param {string} packageRoot dir containing this CLI package (vendor source)
  * @returns {{root: string, linkRemoved: boolean, strippedBlocks: string[],
- *            storeRemoved: boolean, storeKept: boolean, manifestRemoved: boolean, warnings: string[]}}
+ *            storeRemoved: boolean, storeKept: boolean, manifestRemoved: boolean,
+ *            mcpRemoved: string[], warnings: string[]}}
  */
 export function uninstallProject(projectDir, packageRoot) {
   const root = resolve(projectDir);
@@ -86,10 +88,21 @@ export function uninstallProject(projectDir, packageRoot) {
     }
   }
 
-  // 4. Manifest file — then prune .archgen only if nothing else remains
+  // 4. MCP server entries — remove ONLY the archgen entries this install
+  //    wrote (the MCP server keeps a manifest of exactly what it created, so
+  //    unrelated servers in the same config are never touched).
+  let mcpRemoved = [];
+  const mcp = uninstallMcp({ projectRoot: root });
+  if (mcp.report?.removed?.length) {
+    mcpRemoved = mcp.report.removed;
+  } else if (mcp.detail) {
+    warnings.push(`archgen MCP entries not removed: ${mcp.detail}`);
+  }
+
+  // 5. Manifest file — then prune .archgen only if nothing else remains
   //    (feature folders / backups keep it alive).
   const manifestRemoved = rmIfExists(join(root, relJoin(MANIFEST_REL)));
   if (manifestRemoved) pruneEmptyParents(root, dirname(MANIFEST_REL));
 
-  return { root, linkRemoved, strippedBlocks, storeRemoved, storeKept, manifestRemoved, warnings };
+  return { root, linkRemoved, strippedBlocks, storeRemoved, storeKept, manifestRemoved, mcpRemoved, warnings };
 }

package/lib/version.js

@@ -1,5 +1,6 @@
 // version.js — semver compare + npm registry lookup (zero deps).
 import { spawnSync } from 'node:child_process';
+import { npmInvocation } from './spawn-npm.js';
 
 export function parseSemver(v) {
   const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(v ?? '').trim());
@@ -17,7 +18,14 @@ export function compareSemver(a, b) {
 }
 
 export function fetchLatestVersion(pkg) {
-  const r = spawnSync('npm', ['view', pkg, 'version'], { encoding: 'utf8', timeout: 15000 });
-  if (r.status !== 0 || !r.stdout) return null;
-  return r.stdout.trim().split(/\r?\n/).pop() || null;
+  // Registry-verified constant in every caller; refuse anything else outright.
+  if (!/^[a-z0-9@][a-z0-9._/-]*$/i.test(String(pkg ?? ''))) return null;
+  try {
+    const inv = npmInvocation(['view', String(pkg), 'version']);
+    const r = spawnSync(inv.command, inv.args, { encoding: 'utf8', timeout: 15000, shell: inv.shell });
+    if (r.status !== 0 || !r.stdout) return null;
+    return r.stdout.trim().split(/\r?\n/).pop() || null;
+  } catch {
+    return null;
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "archgen-skill",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "Architecture generation & autonomous task execution for coding agents - conversational requirements in, dependency-ordered tasks out, executed wave-by-wave with verifier gates. Works with Claude Code, OpenCode, Cursor, Codex, Gemini CLI and any agentskills.io harness.",
   "license": "MIT",
   "type": "module",
@@ -14,7 +14,7 @@
     "README.md"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "keywords": [
     "ai",
@@ -44,6 +44,6 @@
     "sync:check": "node scripts/sync-config.mjs --check",
     "sync": "node scripts/sync-config.mjs && node scripts/sync-vendor.mjs",
     "prepublishOnly": "node scripts/sync-config.mjs && node scripts/sync-vendor.mjs",
-    "test": "node --test test/*.test.mjs"
+    "test": "ARCHGEN_CODEGRAPH=0 node --test test/*.test.mjs"
   }
 }