claudeup 4.41.0 → 4.42.1

package/bin/claudeup.js

@@ -6,6 +6,11 @@
  * optionalDependency (claudeup-<platform>-<arch>) — that binary embeds the Bun
  * runtime, so it runs without Bun installed. Falls back to running from source
  * via Bun for dev checkouts and unsupported platforms.
+ *
+ * Set CLAUDEUP_NO_BINARY=1 to skip the prebuilt binary and force the source
+ * path. That escape hatch exists because the launcher PREFERS the binary: when
+ * a shipped binary cannot start on a given machine, without it claudeup is a
+ * hard block rather than a slow start.
  */
 
 import { spawnSync } from "node:child_process";
@@ -18,7 +23,8 @@ const require = createRequire(import.meta.url);
 const args = process.argv.slice(2);
 const { platform, arch } = process;
 
-// 1. Prefer the prebuilt platform binary.
+// 1. Prefer the prebuilt platform binary, unless the source path is forced.
+const forceSource = process.env.CLAUDEUP_NO_BINARY === "1";
 const pkgName = `claudeup-${platform}-${arch}`;
 let binaryPath = null;
 try {
@@ -29,9 +35,16 @@ try {
 	// optional dep not installed for this platform — fall through
 }
 
-if (binaryPath) {
+if (binaryPath && !forceSource) {
 	const result = spawnSync(binaryPath, args, { stdio: "inherit" });
-	process.exit(result.status ?? 0);
+	// A binary that could not be executed AT ALL (ENOENT, EACCES, bad arch)
+	// leaves status null, and `status ?? 0` then reported SUCCESS for a run that
+	// never happened — the worst answer available. Only trust the status when the
+	// process actually ran; otherwise say so and fall through to the source path.
+	if (!result.error) process.exit(result.status ?? 0);
+	console.error(
+		`claudeup: prebuilt binary could not start (${result.error.message}); falling back to source.`,
+	);
 }
 
 // 2. Fallback: run from source via Bun.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "4.41.0",
+  "version": "4.42.1",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "4.41.0",
-    "claudeup-darwin-x64": "4.41.0",
-    "claudeup-linux-x64": "4.41.0"
+    "claudeup-darwin-arm64": "4.42.1",
+    "claudeup-darwin-x64": "4.42.1",
+    "claudeup-linux-x64": "4.42.1"
   }
 }

package/scripts/build-binaries.ts

@@ -14,6 +14,16 @@
  * only the one matching the host os/cpu, and bin/claudeup.js execs it.
  *
  * Hard constraint: claudeup pins @opentui 0.1.x — 0.4.x breaks --compile.
+ *
+ * Hard constraint: the two --no-compile-autoload flags below must stay. A Bun
+ * standalone executable autoloads .env and bunfig.toml from its CURRENT
+ * DIRECTORY by default, and claudeup reads neither on purpose. Bun 1.4.0 dies
+ * in the .env path when that file is a symlink pointing at a FIFO — exactly how
+ * 1Password serves secrets into a git worktree — exiting 1 with nothing on
+ * stdout or stderr, because the crash lands before any JS runs and therefore
+ * before any error handler exists. A FIFO also hands its bytes to whoever opens
+ * it first, so an autoloading claudeup can swallow the secrets a dev server was
+ * waiting for. Dropping the flags re-arms both failures.
  */
 
 import { $ } from "bun";
@@ -53,7 +63,8 @@ for (const t of TARGETS) {
 	await mkdir(path.join(outDir, "bin"), { recursive: true });
 
 	console.log(`Building ${pkgName} (${t.bunTarget})…`);
-	await $`bun build --compile --target=${t.bunTarget} ${entry} --outfile ${binPath}`;
+	// The --no-compile-autoload flags are load-bearing; see the header.
+	await $`bun build --compile --no-compile-autoload-dotenv --no-compile-autoload-bunfig --target=${t.bunTarget} ${entry} --outfile ${binPath}`;
 
 	// Platform package: os/cpu-restricted, ships only the binary, declares NO
 	// `bin` (the main package's launcher resolves and execs bin/claudeup).

package/src/__tests__/component-badge.test.ts

@@ -0,0 +1,98 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import {
+	COMPONENT_BADGE,
+	CONTRAST_REFERENCE_KEYS,
+	componentBadge,
+	resetThemeMode,
+	setThemeMode,
+} from "../ui/theme-mode.js";
+
+afterEach(() => {
+	resetThemeMode();
+});
+
+/** WCAG relative luminance of a #rrggbb string. */
+function luminance(hex: string): number {
+	const channel = (v: number) => {
+		const c = v / 255;
+		return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;
+	};
+	const n = Number.parseInt(hex.slice(1), 16);
+	return (
+		0.2126 * channel((n >> 16) & 0xff) +
+		0.7152 * channel((n >> 8) & 0xff) +
+		0.0722 * channel(n & 0xff)
+	);
+}
+
+function contrast(a: string, b: string): number {
+	const [hi, lo] = [luminance(a), luminance(b)].sort((x, y) => y - x);
+	return (hi + 0.05) / (lo + 0.05);
+}
+
+const KINDS = ["skill", "command", "agent", "mcp"] as const;
+
+describe("componentBadge", () => {
+	it("returns no chip when the terminal never answered the theme query", () => {
+		// Unknown means no tint, the same rule the scope bar's fill follows: a
+		// light wash guessed onto a dark page is a bright band on every row.
+		for (const kind of KINDS) {
+			expect(componentBadge(kind)).toBeNull();
+		}
+	});
+
+	it("serves the light pair on a light terminal", () => {
+		setThemeMode("light");
+
+		expect(componentBadge("skill")).toEqual(COMPONENT_BADGE.skill.light);
+		expect(componentBadge("mcp")).toEqual(COMPONENT_BADGE.mcp.light);
+	});
+
+	it("serves the dark pair on a dark terminal", () => {
+		setThemeMode("dark");
+
+		expect(componentBadge("skill")).toEqual(COMPONENT_BADGE.skill.dark);
+		expect(componentBadge("mcp")).toEqual(COMPONENT_BADGE.mcp.dark);
+	});
+
+	it("keeps every glyph legible on its own chip", () => {
+		// 3:1 is the floor the rest of the palette is measured to. A chip whose
+		// glyph disappears into its wash is worse than no chip at all.
+		for (const kind of KINDS) {
+			for (const mode of ["light", "dark"] as const) {
+				const { bg, fg } = COMPONENT_BADGE[kind][mode];
+				expect(contrast(bg, fg)).toBeGreaterThanOrEqual(3);
+			}
+		}
+	});
+
+	it("keeps every chip quiet against the page it is drawn on", () => {
+		// The wash must read as a tint of the page, not as a block on it. Above
+		// ~1.6 it stops being a chip and starts being a highlight bar.
+		for (const kind of KINDS) {
+			for (const mode of ["light", "dark"] as const) {
+				const { bg } = COMPONENT_BADGE[kind][mode];
+				const page = CONTRAST_REFERENCE_KEYS[mode];
+				expect(contrast(bg, page)).toBeLessThan(1.6);
+			}
+		}
+	});
+
+	it("mirrors the reference pages theme.ts measures accents against", async () => {
+		// The duplicate exists so this module stays free of the renderer import.
+		// If theme.ts ever restates its backgrounds, the chips must move with it.
+		const { CONTRAST_REFERENCE } = await import("../ui/theme.js");
+
+		expect(CONTRAST_REFERENCE_KEYS.light).toBe(CONTRAST_REFERENCE.light);
+		expect(CONTRAST_REFERENCE_KEYS.dark).toBe(CONTRAST_REFERENCE.dark);
+	});
+
+	it("gives each kind a distinguishable hue", () => {
+		// Single-character colour carries no readable hue *shift*, only a readable
+		// hue *difference* — the same reason the scope squares are far apart.
+		for (const mode of ["light", "dark"] as const) {
+			const fills = KINDS.map((k) => COMPONENT_BADGE[k][mode].bg);
+			expect(new Set(fills).size).toBe(KINDS.length);
+		}
+	});
+});

package/src/__tests__/component-icons.test.ts

@@ -0,0 +1,94 @@
+import { describe, expect, it } from "bun:test";
+import { COMPONENT_ICON } from "../ui/renderers/pluginRenderers.js";
+
+/**
+ * Every component badge is exactly one terminal cell wide.
+ *
+ * This is the constraint that rules out the icons the ecosystem actually uses:
+ * Cursor's skill badge defaults to a lightning bolt and the community VS Code
+ * Skills sidebar uses a sparkle, but `⚡` (U+26A1) and `✨` (U+2728) are both
+ * East-Asian-Width Wide — two cells — and a two-cell badge shifts every name on
+ * the row out of alignment with the plugin names above it.
+ *
+ * Unicode has no `east_asian_width` in the JS standard library, so the wide
+ * ranges are spelled out. They cover the emoji and CJK blocks a plausible icon
+ * would come from; anything outside them is single-width in practice.
+ */
+const WIDE_RANGES: ReadonlyArray<readonly [number, number]> = [
+	[0x1100, 0x115f], // Hangul Jamo
+	[0x2329, 0x232a], // angle brackets
+	[0x2e80, 0x303e], // CJK radicals, Kangxi
+	[0x3041, 0x33ff], // Hiragana through CJK compatibility
+	[0x3400, 0x4dbf], // CJK Extension A
+	[0x4e00, 0x9fff], // CJK Unified Ideographs
+	[0xa000, 0xa4cf], // Yi
+	[0xac00, 0xd7a3], // Hangul syllables
+	[0xf900, 0xfaff], // CJK compatibility ideographs
+	[0xfe30, 0xfe6f], // CJK compatibility forms
+	[0xff00, 0xff60], // fullwidth forms
+	[0xffe0, 0xffe6], // fullwidth signs
+	[0x1f300, 0x1f64f], // misc symbols and pictographs, emoticons
+	[0x1f900, 0x1f9ff], // supplemental symbols and pictographs
+	[0x20000, 0x3fffd], // CJK Extension B and beyond
+	// Individually Wide despite sitting among narrow neighbours. These are the
+	// ones that actually bite: ⚡ and ✨ are exactly the icons a future editor
+	// would reach for.
+	[0x231a, 0x231b], // watch, hourglass
+	[0x23e9, 0x23ec],
+	[0x25fd, 0x25fe],
+	[0x2614, 0x2615],
+	[0x26a1, 0x26a1], // ⚡ HIGH VOLTAGE SIGN
+	[0x2728, 0x2728], // ✨ SPARKLES
+	[0x274c, 0x274c],
+	[0x2b1b, 0x2b1c],
+	[0x2b50, 0x2b50],
+];
+
+function isWide(ch: string): boolean {
+	const cp = ch.codePointAt(0) ?? 0;
+	return WIDE_RANGES.some(([lo, hi]) => cp >= lo && cp <= hi);
+}
+
+describe("component icons", () => {
+	it("covers every component kind", () => {
+		expect(Object.keys(COMPONENT_ICON).sort()).toEqual([
+			"agent",
+			"command",
+			"mcp",
+			"skill",
+		]);
+	});
+
+	it("uses exactly one code point per icon", () => {
+		for (const [kind, icon] of Object.entries(COMPONENT_ICON)) {
+			expect([...icon], `${kind} must be a single code point`).toHaveLength(1);
+		}
+	});
+
+	it("never uses a double-width glyph", () => {
+		for (const [kind, icon] of Object.entries(COMPONENT_ICON)) {
+			expect(isWide(icon), `${kind} icon ${icon} is double-width`).toBe(false);
+		}
+	});
+
+	it("rejects the two emoji a future editor would reach for", () => {
+		// Negative control: the guard above only means something if it fires.
+		expect(isWide("⚡")).toBe(true);
+		expect(isWide("✨")).toBe(true);
+		expect(isWide("📁")).toBe(true);
+	});
+
+	it("gives each kind a distinct glyph", () => {
+		const icons = Object.values(COMPONENT_ICON);
+		expect(new Set(icons).size).toBe(icons.length);
+	});
+
+	it("does not reuse a glyph this screen already means something by", () => {
+		// ★ is "★ Official" on a marketplace row, ● is "● Installed", ■ is a scope
+		// segment, and ▼ / ▶ are the expand arrows. Reusing one would make a badge
+		// read as a status.
+		for (const taken of ["★", "●", "■", "▼", "▶", "○", "✓", "⚠"]) {
+			expect(Object.values(COMPONENT_ICON)).not.toContain(taken);
+		}
+	});
+});

package/src/__tests__/dotenv.test.ts

@@ -0,0 +1,190 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { mkdir, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { loadProjectDotenv, parseDotenv } from "../services/dotenv";
+
+function mkfifo(path: string): void {
+	const r = spawnSync("mkfifo", [path]);
+	if (r.status !== 0) {
+		throw new Error(`mkfifo failed: ${r.stderr?.toString() ?? "unknown"}`);
+	}
+}
+
+describe("loadProjectDotenv", () => {
+	let dir: string;
+
+	beforeEach(async () => {
+		dir = await mkdtemp(join(tmpdir(), "claudeup-dotenv-"));
+	});
+
+	afterEach(async () => {
+		await rm(dir, { recursive: true, force: true });
+	});
+
+	it("loads a regular .env", async () => {
+		await writeFile(join(dir, ".env"), "FOO=bar\nBAZ=qux\n");
+		const env: Record<string, string | undefined> = {};
+
+		const r = loadProjectDotenv(dir, env);
+
+		expect(env.FOO).toBe("bar");
+		expect(env.BAZ).toBe("qux");
+		expect(r.loaded).toEqual([".env"]);
+		expect(r.warnings).toEqual([]);
+	});
+
+	it("never overwrites a variable already in the environment", async () => {
+		await writeFile(join(dir, ".env"), "FOO=from-file\n");
+		const env: Record<string, string | undefined> = { FOO: "from-shell" };
+
+		const r = loadProjectDotenv(dir, env);
+
+		expect(env.FOO).toBe("from-shell");
+		expect(r.applied).not.toContain("FOO");
+	});
+
+	it("lets .env.local win over .env", async () => {
+		await writeFile(join(dir, ".env"), "FOO=base\nONLY_BASE=yes\n");
+		await writeFile(join(dir, ".env.local"), "FOO=override\n");
+		const env: Record<string, string | undefined> = {};
+
+		const r = loadProjectDotenv(dir, env);
+
+		expect(env.FOO).toBe("override");
+		expect(env.ONLY_BASE).toBe("yes");
+		expect(r.loaded).toEqual([".env", ".env.local"]);
+	});
+
+	it("says nothing when there is no .env at all", () => {
+		const env: Record<string, string | undefined> = {};
+
+		const r = loadProjectDotenv(dir, env);
+
+		expect(r.loaded).toEqual([]);
+		expect(r.warnings).toEqual([]);
+		expect(env).toEqual({});
+	});
+
+	// The regression this whole module exists for. claudeup 4.41.0 shipped a
+	// binary whose embedded Bun autoloaded .env and aborted on this exact shape:
+	// exit 1, nothing on stdout, nothing on stderr, in every git worktree where
+	// 1Password serves secrets through a pipe.
+	//
+	// Note the failure mode if this ever regresses: opening a FIFO with no writer
+	// BLOCKS, so a broken loader hangs here rather than failing an assertion.
+	// A timeout on this test is the same bug, reported differently.
+	it("skips a .env that is a symlink to a FIFO, and warns", async () => {
+		mkfifo(join(dir, "secrets-pipe"));
+		await symlink(join(dir, "secrets-pipe"), join(dir, ".env"));
+		const env: Record<string, string | undefined> = {};
+
+		const r = loadProjectDotenv(dir, env);
+
+		expect(r.loaded).toEqual([]);
+		expect(env).toEqual({});
+		expect(r.warnings).toHaveLength(1);
+		expect(r.warnings[0]).toContain(".env");
+		expect(r.warnings[0]).toContain("named pipe");
+	});
+
+	it("skips a .env that is a FIFO directly, and warns", () => {
+		mkfifo(join(dir, ".env"));
+		const env: Record<string, string | undefined> = {};
+
+		const r = loadProjectDotenv(dir, env);
+
+		expect(r.loaded).toEqual([]);
+		expect(r.warnings).toHaveLength(1);
+		expect(r.warnings[0]).toContain("named pipe");
+	});
+
+	it("follows a symlink that points at a regular file", async () => {
+		await writeFile(join(dir, "real-env"), "FOO=bar\n");
+		await symlink(join(dir, "real-env"), join(dir, ".env"));
+		const env: Record<string, string | undefined> = {};
+
+		const r = loadProjectDotenv(dir, env);
+
+		expect(env.FOO).toBe("bar");
+		expect(r.loaded).toEqual([".env"]);
+		expect(r.warnings).toEqual([]);
+	});
+
+	it("warns instead of throwing on a dangling symlink", async () => {
+		await symlink(join(dir, "nothing-here"), join(dir, ".env"));
+		const env: Record<string, string | undefined> = {};
+
+		const r = loadProjectDotenv(dir, env);
+
+		expect(r.loaded).toEqual([]);
+		expect(r.warnings).toHaveLength(1);
+		expect(r.warnings[0]).toContain("does not resolve");
+	});
+
+	it("skips a .env that is a directory, and warns", async () => {
+		await mkdir(join(dir, ".env"));
+		const env: Record<string, string | undefined> = {};
+
+		const r = loadProjectDotenv(dir, env);
+
+		expect(r.loaded).toEqual([]);
+		expect(r.warnings[0]).toContain("directory");
+	});
+
+	it("loads what it can from a file with unparseable lines", async () => {
+		await writeFile(
+			join(dir, ".env"),
+			"this is not a pair\nFOO=bar\n=novalue\n",
+		);
+		const env: Record<string, string | undefined> = {};
+
+		const r = loadProjectDotenv(dir, env);
+
+		expect(env.FOO).toBe("bar");
+		expect(r.warnings).toEqual([]);
+	});
+});
+
+describe("parseDotenv", () => {
+	it("ignores comments and blank lines", () => {
+		expect(parseDotenv("# note\n\nFOO=bar\n")).toEqual({ FOO: "bar" });
+	});
+
+	it("strips an export prefix", () => {
+		expect(parseDotenv("export FOO=bar\n")).toEqual({ FOO: "bar" });
+	});
+
+	it("strips surrounding quotes", () => {
+		expect(parseDotenv(`FOO="bar"\nBAZ='qux'\n`)).toEqual({
+			FOO: "bar",
+			BAZ: "qux",
+		});
+	});
+
+	it("expands escapes in double quotes but not single quotes", () => {
+		expect(parseDotenv(`A="one\\ntwo"\nB='one\\ntwo'\n`)).toEqual({
+			A: "one\ntwo",
+			B: "one\\ntwo",
+		});
+	});
+
+	it("drops a trailing comment from an unquoted value", () => {
+		expect(parseDotenv("FOO=bar # why\n")).toEqual({ FOO: "bar" });
+	});
+
+	it("keeps a # that is part of a quoted value", () => {
+		expect(parseDotenv(`FOO="bar # why"\n`)).toEqual({ FOO: "bar # why" });
+	});
+
+	it("keeps an = that appears inside a value", () => {
+		expect(parseDotenv("URL=postgres://u:p@h/db?a=b\n")).toEqual({
+			URL: "postgres://u:p@h/db?a=b",
+		});
+	});
+
+	it("rejects a key that is not a valid identifier", () => {
+		expect(parseDotenv("not-a-key=x\nOK=y\n")).toEqual({ OK: "y" });
+	});
+});

package/src/__tests__/local-marketplace-scan.test.ts

@@ -0,0 +1,174 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import os from "node:os";
+import path from "node:path";
+import fs from "fs-extra";
+import {
+	scanMcpServers,
+	scanSkillDirs,
+} from "../services/local-marketplace.js";
+import { walkMarkdown, walkSkillDirs } from "../services/skills-manager.js";
+
+/**
+ * The skill count in the plugin detail panel comes from a scan of the cloned
+ * marketplace. It used to read only the top level of `skills/`, which counts
+ * the *grouping* directories rather than the skills: dev reported 9 against 43
+ * on disk, mattpocock 5 against 37.
+ */
+describe("scanSkillDirs", () => {
+	let root: string;
+
+	beforeEach(async () => {
+		root = await fs.mkdtemp(path.join(os.tmpdir(), "claudeup-skills-"));
+	});
+
+	afterEach(async () => {
+		await fs.remove(root);
+	});
+
+	async function writeSkill(...segments: string[]): Promise<void> {
+		const dir = path.join(root, ...segments);
+		await fs.ensureDir(dir);
+		await fs.writeFile(path.join(dir, "SKILL.md"), "---\nname: x\n---\n");
+	}
+
+	it("counts skills nested under grouping directories", async () => {
+		await writeSkill("skills", "frontend", "design-system");
+		await writeSkill("skills", "frontend", "forms");
+		await writeSkill("skills", "backend", "db-branching");
+		await writeSkill("skills", "flat-skill");
+
+		const found = await scanSkillDirs(path.join(root, "skills"));
+
+		expect(found.sort()).toEqual([
+			"db-branching",
+			"design-system",
+			"flat-skill",
+			"forms",
+		]);
+	});
+
+	it("never counts a grouping directory as a skill", async () => {
+		await writeSkill("skills", "engineering", "code-review");
+		await writeSkill("skills", "engineering", "tdd");
+
+		const found = await scanSkillDirs(path.join(root, "skills"));
+
+		expect(found.sort()).toEqual(["code-review", "tdd"]);
+		expect(found).not.toContain("engineering");
+	});
+
+	it("returns nothing when the directory is absent", async () => {
+		expect(await scanSkillDirs(path.join(root, "nope"))).toEqual([]);
+	});
+
+	it("stops descending past four levels rather than walking the whole tree", async () => {
+		await writeSkill("skills", "a", "b", "c", "d", "too-deep");
+
+		expect(await scanSkillDirs(path.join(root, "skills"))).toEqual([]);
+	});
+});
+
+/**
+ * mnemex ships one MCP server and nothing else. The scan only looked in an
+ * `mcp-servers/` directory, so it reported zero of every component kind and the
+ * plugin read as shipping nothing at all.
+ */
+describe("scanMcpServers", () => {
+	let root: string;
+
+	beforeEach(async () => {
+		root = await fs.mkdtemp(path.join(os.tmpdir(), "claudeup-mcp-"));
+	});
+
+	afterEach(async () => {
+		await fs.remove(root);
+	});
+
+	it("reads server names from a root .mcp.json", async () => {
+		await fs.writeJson(path.join(root, ".mcp.json"), {
+			mnemex: { command: "mnemex", args: ["--mcp"] },
+		});
+
+		expect(await scanMcpServers(root)).toEqual(["mnemex"]);
+	});
+
+	it("reads the mcpServers wrapper shape too", async () => {
+		await fs.writeJson(path.join(root, ".mcp.json"), {
+			mcpServers: { alpha: { command: "a" }, beta: { command: "b" } },
+		});
+
+		expect((await scanMcpServers(root)).sort()).toEqual(["alpha", "beta"]);
+	});
+
+	it("still reads an mcp-servers/ directory", async () => {
+		await fs.ensureDir(path.join(root, "mcp-servers"));
+		await fs.writeJson(path.join(root, "mcp-servers", "tmux.json"), {});
+
+		expect(await scanMcpServers(root)).toEqual(["tmux"]);
+	});
+
+	it("reports a server rather than zero when .mcp.json will not parse", async () => {
+		await fs.writeFile(path.join(root, ".mcp.json"), "{ not json");
+
+		expect(await scanMcpServers(root)).toEqual(["mcp"]);
+	});
+
+	it("reports none when the plugin declares no server", async () => {
+		expect(await scanMcpServers(root)).toEqual([]);
+	});
+});
+
+/**
+ * The clone walkers behind the local-first read. A marketplace the user has
+ * added is on disk, so listing its plugins must cost no GitHub request — the
+ * hourly cap of 60 unauthenticated requests is shared across every repo on
+ * screen, and once it ran out every expand answered "Could not read the plugin",
+ * including for marketplaces sitting complete in the cache.
+ */
+describe("clone walkers", () => {
+	let root: string;
+
+	beforeEach(async () => {
+		root = await fs.mkdtemp(path.join(os.tmpdir(), "claudeup-walk-"));
+	});
+
+	afterEach(async () => {
+		await fs.remove(root);
+	});
+
+	async function write(rel: string, body = "x"): Promise<void> {
+		const full = path.join(root, rel);
+		await fs.ensureDir(path.dirname(full));
+		await fs.writeFile(full, body);
+	}
+
+	it("carries the grouping path so nested skills match the network shape", async () => {
+		await write("skills/frontend/design-system/SKILL.md");
+		await write("skills/backend/db/SKILL.md");
+		await write("skills/flat/SKILL.md");
+
+		const found = await walkSkillDirs(path.join(root, "skills"));
+		const byName = Object.fromEntries(found.map((f) => [f.name, f.group]));
+
+		expect(Object.keys(byName).sort()).toEqual(["db", "design-system", "flat"]);
+		expect(byName["design-system"]).toBe("frontend");
+		expect(byName.db).toBe("backend");
+		expect(byName.flat).toBeUndefined();
+	});
+
+	it("lists markdown commands and skips README", async () => {
+		await write("commands/go.md");
+		await write("commands/README.md");
+		await write("commands/deep/trace.md");
+
+		const found = await walkMarkdown(path.join(root, "commands"));
+
+		expect(found.map((f) => f.name).sort()).toEqual(["go", "trace"]);
+		expect(found.find((f) => f.name === "trace")?.group).toBe("deep");
+	});
+
+	it("returns nothing for a directory that is not there", async () => {
+		expect(await walkSkillDirs(path.join(root, "nope"))).toEqual([]);
+		expect(await walkMarkdown(path.join(root, "nope"))).toEqual([]);
+	});
+});