mustflow 2.99.2 → 2.103.3

package/dist/cli/commands/skill.js

@@ -5,28 +5,41 @@ import { resolveMustflowRoot } from '../lib/project-root.js';
 import { listScriptPackScripts } from '../lib/script-pack-registry.js';
 import { createScriptPackSuggestionReport, } from '../../core/script-pack-suggestions.js';
 import { resolveSkillRoutes } from '../../core/skill-route-resolution.js';
+import { createExternalSkillImportReport, } from '../lib/external-skill-import.js';
 const SKILL_OPTIONS = [
     { name: '--json', kind: 'boolean' },
     { name: '--task', kind: 'string' },
     { name: '--path', kind: 'string' },
     { name: '--reason', kind: 'string' },
     { name: '--max-candidates', kind: 'string' },
+    { name: '--install', kind: 'boolean' },
+    { name: '--dry-run', kind: 'boolean' },
+    { name: '--name', kind: 'string' },
+    { name: '--ref', kind: 'string' },
 ];
 export function getSkillHelp(lang = 'en') {
     return renderHelp({
         usage: 'mf skill route [options]',
         summary: t(lang, 'command.skill.summary'),
         options: [
+            { label: 'route', description: 'Resolve installed skill route candidates' },
+            { label: 'import <github-url>', description: 'Preview or install an external SKILL.md under .mustflow/external-skills/' },
             { label: '--task <text>', description: 'Task text used for route scoring' },
             { label: '--path <path>', description: 'Changed or expected path; may be repeated' },
             { label: '--reason <reason>', description: 'Classification or verification reason; may be repeated' },
             { label: '--max-candidates <count>', description: 'Maximum candidates to return, from 1 to 10' },
+            { label: '--dry-run', description: 'Preview an external skill import without writing files; default for import' },
+            { label: '--install', description: 'Install an external skill after previewing the same source' },
+            { label: '--name <slug>', description: 'Override the installed external skill directory name' },
+            { label: '--ref <ref>', description: 'Override the GitHub ref used for import' },
             { label: '--json', description: t(lang, 'cli.option.json') },
             { label: '-h, --help', description: t(lang, 'cli.option.help') },
         ],
         examples: [
             'mf skill route --task "change TypeScript CLI output" --path src/cli/index.ts --reason code_change --json',
             'mf skill route --reason docs_change --path docs-site/src/content/docs/en/commands/context.md',
+            'mf skill import https://github.com/example/agent-skills/tree/main/review/security --dry-run --json',
+            'mf skill import https://github.com/example/agent-skills/blob/main/review/security/SKILL.md --install',
         ],
         exitCodes: [
             { label: '0', description: 'Skill route candidates were resolved' },
@@ -51,10 +64,15 @@ function parseSkillArgs(args) {
     return {
         json: hasParsedCliOption(parsed, '--json'),
         action: parsed.positionals[0] ?? null,
+        sourceUrl: parsed.positionals[1] ?? null,
         taskText: getParsedCliStringOption(parsed, '--task'),
         paths: getParsedCliStringOptions(parsed, '--path'),
         reasons: getParsedCliStringOptions(parsed, '--reason'),
         maxCandidates: parseMaxCandidates(getParsedCliStringOption(parsed, '--max-candidates')),
+        install: hasParsedCliOption(parsed, '--install'),
+        dryRun: hasParsedCliOption(parsed, '--dry-run'),
+        name: getParsedCliStringOption(parsed, '--name'),
+        ref: getParsedCliStringOption(parsed, '--ref'),
         error: parsed.error,
     };
 }
@@ -101,7 +119,40 @@ function renderSkillRouteReport(report, lang) {
     lines.push('', 'Read plan', ...report.read_plan.selected_skill_paths.map((skillPath) => `- read selected skill: ${skillPath}`), `- avoid by default: ${report.read_plan.avoid_by_default.join(', ') || t(lang, 'value.none')}`, `- fallback route metadata: ${report.read_plan.fallback_route_metadata.path}`, '', 'Source files', ...report.source_files.map((sourceFile) => `- ${sourceFile}`));
     return lines.join('\n');
 }
-export function runSkill(args, reporter, lang = 'en') {
+function renderSkillImportReport(report) {
+    const lines = [
+        'mustflow skill import',
+        `status: ${report.status}`,
+        `mode: ${report.mode}`,
+        `source: ${report.source?.source_url ?? 'none'}`,
+        `target: ${report.target?.skill_dir ?? 'none'}`,
+        `wrote_files: ${String(report.wrote_files)}`,
+        '',
+        'Files',
+    ];
+    if (report.files.length === 0) {
+        lines.push('- none');
+    }
+    else {
+        for (const file of report.files) {
+            lines.push(`- ${file.relative_path} (${file.kind}, ${file.bytes} bytes, ${file.sha256})`);
+        }
+    }
+    if (report.warnings.length > 0) {
+        lines.push('', 'Warnings', ...report.warnings.map((warning) => `- ${warning}`));
+    }
+    if (report.issues.length > 0) {
+        lines.push('', 'Issues', ...report.issues.map((issue) => `- ${issue}`));
+    }
+    return lines.join('\n');
+}
+function parseImportMode(parsed) {
+    if (parsed.install && parsed.dryRun) {
+        return null;
+    }
+    return parsed.install ? 'install' : 'dry_run';
+}
+export async function runSkill(args, reporter, lang = 'en') {
     if (hasCliOptionToken(args, '--help', ['-h'])) {
         reporter.stdout(getSkillHelp(lang));
         return 0;
@@ -111,13 +162,36 @@ export function runSkill(args, reporter, lang = 'en') {
         printUsageError(reporter, formatCliOptionParseError(parsed.error, lang), 'mf skill --help', getSkillHelp(lang), lang);
         return 1;
     }
-    if (parsed.action !== 'route') {
+    if (parsed.action !== 'route' && parsed.action !== 'import') {
         printUsageError(reporter, t(lang, parsed.action ? 'cli.error.unexpectedArgument' : 'cli.error.missingValue', {
             argument: parsed.action ?? '',
             option: 'route',
         }), 'mf skill --help', getSkillHelp(lang), lang);
         return 1;
     }
+    if (parsed.action === 'import') {
+        const mode = parseImportMode(parsed);
+        if (mode === null) {
+            printUsageError(reporter, t(lang, 'cli.error.unexpectedValue', { option: '--install/--dry-run' }), 'mf skill --help', getSkillHelp(lang), lang);
+            return 1;
+        }
+        if (!parsed.sourceUrl) {
+            printUsageError(reporter, t(lang, 'cli.error.missingValue', { option: 'import <github-url>' }), 'mf skill --help', getSkillHelp(lang), lang);
+            return 1;
+        }
+        const report = await createExternalSkillImportReport(resolveMustflowRoot(), parsed.sourceUrl, {
+            mode,
+            name: parsed.name,
+            ref: parsed.ref,
+        });
+        if (parsed.json) {
+            reporter.stdout(JSON.stringify(report, null, 2));
+        }
+        else {
+            reporter.stdout(renderSkillImportReport(report));
+        }
+        return report.ok ? 0 : 1;
+    }
     if (Number.isNaN(parsed.maxCandidates)) {
         printUsageError(reporter, t(lang, 'cli.error.unexpectedValue', { option: '--max-candidates' }), 'mf skill --help', getSkillHelp(lang), lang);
         return 1;

package/dist/cli/lib/external-skill-import.js

@@ -0,0 +1,391 @@
+import { existsSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { ensureFileTargetInsideWithoutSymlinks, writeJsonFileInsideWithoutSymlinks, writeUtf8FileInsideWithoutSymlinks, } from '../../core/safe-filesystem.js';
+const EXTERNAL_SKILL_ROOT = '.mustflow/external-skills';
+const PROVENANCE_FILE = 'mustflow-skill-source.json';
+const DEFAULT_GITHUB_REF = 'HEAD';
+const MAX_IMPORTED_FILES = 40;
+const MAX_TOTAL_BYTES = 512 * 1024;
+const MAX_FILE_BYTES = 256 * 1024;
+const ALLOWED_SUPPORT_DIRECTORIES = new Set(['assets', 'references', 'scripts']);
+const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+const GITHUB_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/u;
+function normalizeRef(ref) {
+    return ref?.trim() || DEFAULT_GITHUB_REF;
+}
+function toPosixPath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\/+/u, '').replace(/\/+$/u, '');
+}
+function encodeGitHubPath(value) {
+    return toPosixPath(value)
+        .split('/')
+        .filter(Boolean)
+        .map((segment) => encodeURIComponent(segment))
+        .join('/');
+}
+function validateGitHubName(value, label) {
+    if (!value || !GITHUB_NAME_PATTERN.test(value) || value === '.' || value === '..') {
+        throw new Error(`Invalid GitHub ${label}: ${value}`);
+    }
+}
+function validateRelativeImportPath(value) {
+    const normalized = toPosixPath(value);
+    if (!normalized || normalized.includes('\0')) {
+        throw new Error(`Invalid external skill path: ${value}`);
+    }
+    const segments = normalized.split('/');
+    if (segments.some((segment) => segment === '.' || segment === '..' || segment.length === 0)) {
+        throw new Error(`External skill path must not contain traversal segments: ${value}`);
+    }
+    return normalized;
+}
+function skillDirectoryPathForBlobPath(blobPath) {
+    const normalized = validateRelativeImportPath(blobPath);
+    if (!normalized.endsWith('SKILL.md')) {
+        throw new Error('Blob and raw GitHub URLs must point to a SKILL.md file.');
+    }
+    return normalized.split('/').slice(0, -1).join('/');
+}
+function parseGitHubUrl(inputUrl, refOverride) {
+    let url;
+    try {
+        url = new URL(inputUrl);
+    }
+    catch {
+        throw new Error(`Unsupported external skill URL: ${inputUrl}`);
+    }
+    if (url.protocol !== 'https:') {
+        throw new Error('External skill imports require an HTTPS GitHub URL.');
+    }
+    const pathParts = url.pathname.split('/').filter(Boolean);
+    if (url.hostname === 'github.com') {
+        const [owner, repo, mode, ref, ...rest] = pathParts;
+        const ownerName = owner ?? '';
+        const repoName = repo ?? '';
+        validateGitHubName(ownerName, 'owner');
+        validateGitHubName(repoName, 'repo');
+        if (!mode) {
+            const selectedRef = normalizeRef(refOverride);
+            return {
+                host: 'github.com',
+                owner: ownerName,
+                repo: repoName,
+                ref: selectedRef,
+                skillPath: '',
+                sourceUrl: `https://github.com/${ownerName}/${repoName}`,
+            };
+        }
+        if ((mode === 'tree' || mode === 'blob') && ref) {
+            const selectedRef = normalizeRef(refOverride ?? ref);
+            const sourcePath = rest.join('/');
+            const skillPath = mode === 'blob' ? skillDirectoryPathForBlobPath(sourcePath) : validateRelativeImportPath(sourcePath);
+            return {
+                host: 'github.com',
+                owner: ownerName,
+                repo: repoName,
+                ref: selectedRef,
+                skillPath,
+                sourceUrl: `https://github.com/${ownerName}/${repoName}/${mode}/${ref}/${sourcePath}`,
+            };
+        }
+    }
+    if (url.hostname === 'raw.githubusercontent.com') {
+        const [owner, repo, ref, ...rest] = pathParts;
+        const ownerName = owner ?? '';
+        const repoName = repo ?? '';
+        validateGitHubName(ownerName, 'owner');
+        validateGitHubName(repoName, 'repo');
+        if (!ref) {
+            throw new Error('Raw GitHub URLs must include a ref.');
+        }
+        const rawPath = rest.join('/');
+        const selectedRef = normalizeRef(refOverride ?? ref);
+        return {
+            host: 'raw.githubusercontent.com',
+            owner: ownerName,
+            repo: repoName,
+            ref: selectedRef,
+            skillPath: skillDirectoryPathForBlobPath(rawPath),
+            sourceUrl: `https://raw.githubusercontent.com/${ownerName}/${repoName}/${ref}/${rawPath}`,
+        };
+    }
+    throw new Error('Only github.com and raw.githubusercontent.com skill URLs are supported.');
+}
+function externalSkillSourceFromParsed(inputUrl, parsed) {
+    return {
+        input_url: inputUrl,
+        host: parsed.host,
+        owner: parsed.owner,
+        repo: parsed.repo,
+        ref: parsed.ref,
+        skill_path: parsed.skillPath,
+        source_url: parsed.sourceUrl,
+    };
+}
+function sanitizeSkillName(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/gu, '-')
+        .replace(/^-+|-+$/gu, '')
+        .replace(/-{2,}/gu, '-');
+}
+function readFrontmatterScalar(content, key) {
+    if (!content.startsWith('---')) {
+        return null;
+    }
+    const firstLineEnd = content.indexOf('\n');
+    const end = firstLineEnd >= 0 ? content.indexOf('\n---', firstLineEnd + 1) : -1;
+    if (firstLineEnd < 0 || end < 0) {
+        return null;
+    }
+    for (const line of content.slice(firstLineEnd + 1, end).split(/\r?\n/u)) {
+        const match = /^([a-zA-Z0-9_]+):\s*(.*)$/u.exec(line);
+        if (match?.[1] === key) {
+            return match[2].trim().replace(/^["']|["']$/gu, '') || null;
+        }
+    }
+    return null;
+}
+function targetNameForSkill(files, parsed, nameOverride) {
+    const candidate = nameOverride?.trim()
+        ?? readFrontmatterScalar(files.find((file) => file.relativePath === 'SKILL.md')?.content ?? '', 'name')
+        ?? parsed.skillPath.split('/').filter(Boolean).pop()
+        ?? parsed.repo;
+    const sanitized = sanitizeSkillName(candidate);
+    if (!SLUG_PATTERN.test(sanitized)) {
+        throw new Error(`External skill name cannot be converted to a safe slug: ${candidate}`);
+    }
+    return sanitized;
+}
+function kindForRelativePath(relativePath) {
+    if (relativePath === 'SKILL.md') {
+        return 'skill';
+    }
+    const [topLevel] = relativePath.split('/');
+    if (topLevel === 'scripts') {
+        return 'script';
+    }
+    if (topLevel === 'assets') {
+        return 'asset';
+    }
+    return 'reference';
+}
+function validateImportRelativeFilePath(relativePath) {
+    const normalized = validateRelativeImportPath(relativePath);
+    const [topLevel] = normalized.split('/');
+    if (normalized === 'SKILL.md') {
+        return normalized;
+    }
+    if (!ALLOWED_SUPPORT_DIRECTORIES.has(topLevel)) {
+        throw new Error(`External skill import rejected unsupported file path: ${relativePath}`);
+    }
+    return normalized;
+}
+function normalizeTextContent(content) {
+    return content.replace(/\r\n?/gu, '\n');
+}
+function hashContent(content) {
+    return `sha256:${createHash('sha256').update(content).digest('hex')}`;
+}
+function isGitHubNotFoundError(error) {
+    return error instanceof Error && /\(404\)/u.test(error.message);
+}
+async function readResponseText(response, url) {
+    if (!response.ok) {
+        throw new Error(`GitHub request failed (${response.status}) for ${url}`);
+    }
+    const text = await response.text();
+    if (Buffer.byteLength(text, 'utf8') > MAX_FILE_BYTES) {
+        throw new Error(`External skill file exceeds ${MAX_FILE_BYTES} bytes: ${url}`);
+    }
+    return normalizeTextContent(text);
+}
+async function fetchJson(fetchImpl, url) {
+    const response = await fetchImpl(url, {
+        headers: {
+            accept: 'application/vnd.github+json',
+            'user-agent': 'mustflow-external-skill-import',
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`GitHub request failed (${response.status}) for ${url}`);
+    }
+    return response.json();
+}
+function apiContentsUrl(parsed, relativePath) {
+    const fullPath = [parsed.skillPath, relativePath].filter(Boolean).join('/');
+    const encodedPath = encodeGitHubPath(fullPath);
+    const pathSuffix = encodedPath ? `/${encodedPath}` : '';
+    return `https://api.github.com/repos/${parsed.owner}/${parsed.repo}/contents${pathSuffix}?ref=${encodeURIComponent(parsed.ref)}`;
+}
+function decodeGitHubFileContent(entry) {
+    if (entry.encoding !== 'base64' || typeof entry.content !== 'string') {
+        throw new Error(`GitHub content API response did not include base64 content for ${entry.path}`);
+    }
+    return normalizeTextContent(Buffer.from(entry.content.replace(/\s+/gu, ''), 'base64').toString('utf8'));
+}
+function assertGitHubContentEntry(value) {
+    if (!value || typeof value !== 'object') {
+        throw new Error('Unexpected GitHub contents API response.');
+    }
+    const record = value;
+    if (typeof record.type !== 'string' || typeof record.name !== 'string' || typeof record.path !== 'string') {
+        throw new Error('Unexpected GitHub contents API entry shape.');
+    }
+    return record;
+}
+async function loadGitHubFile(fetchImpl, parsed, relativePath) {
+    const normalizedRelativePath = validateImportRelativeFilePath(relativePath);
+    const apiUrl = apiContentsUrl(parsed, normalizedRelativePath);
+    const entry = assertGitHubContentEntry(await fetchJson(fetchImpl, apiUrl));
+    if (entry.type !== 'file') {
+        throw new Error(`Expected a file in GitHub contents API response: ${normalizedRelativePath}`);
+    }
+    const content = entry.download_url
+        ? await readResponseText(await fetchImpl(entry.download_url), entry.download_url)
+        : decodeGitHubFileContent(entry);
+    return {
+        relativePath: normalizedRelativePath,
+        kind: kindForRelativePath(normalizedRelativePath),
+        content,
+    };
+}
+async function listGitHubDirectory(fetchImpl, parsed, relativePath) {
+    const apiUrl = apiContentsUrl(parsed, relativePath);
+    const value = await fetchJson(fetchImpl, apiUrl);
+    if (!Array.isArray(value)) {
+        throw new Error(`Expected a directory in GitHub contents API response: ${relativePath || '.'}`);
+    }
+    return value.map(assertGitHubContentEntry);
+}
+async function loadSupportDirectory(fetchImpl, parsed, directory) {
+    let entries;
+    try {
+        entries = await listGitHubDirectory(fetchImpl, parsed, directory);
+    }
+    catch (error) {
+        if (isGitHubNotFoundError(error)) {
+            return [];
+        }
+        throw error;
+    }
+    const files = [];
+    const pending = entries
+        .filter((entry) => entry.type === 'file')
+        .map((entry) => `${directory}/${entry.name}`)
+        .sort((left, right) => left.localeCompare(right));
+    for (const relativePath of pending) {
+        files.push(await loadGitHubFile(fetchImpl, parsed, relativePath));
+    }
+    return files;
+}
+async function loadExternalSkillFiles(fetchImpl, parsed) {
+    const files = [
+        await loadGitHubFile(fetchImpl, parsed, 'SKILL.md'),
+        ...(await loadSupportDirectory(fetchImpl, parsed, 'assets')),
+        ...(await loadSupportDirectory(fetchImpl, parsed, 'references')),
+        ...(await loadSupportDirectory(fetchImpl, parsed, 'scripts')),
+    ].sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+    if (files.length > MAX_IMPORTED_FILES) {
+        throw new Error(`External skill import exceeds ${MAX_IMPORTED_FILES} files.`);
+    }
+    const totalBytes = files.reduce((total, file) => total + Buffer.byteLength(file.content, 'utf8'), 0);
+    if (totalBytes > MAX_TOTAL_BYTES) {
+        throw new Error(`External skill import exceeds ${MAX_TOTAL_BYTES} bytes.`);
+    }
+    return files;
+}
+function fileReports(files) {
+    return files.map((file) => ({
+        relative_path: file.relativePath,
+        kind: file.kind,
+        bytes: Buffer.byteLength(file.content, 'utf8'),
+        sha256: hashContent(file.content),
+    }));
+}
+function createTarget(skillName) {
+    const skillDir = `${EXTERNAL_SKILL_ROOT}/${skillName}`;
+    return {
+        root: EXTERNAL_SKILL_ROOT,
+        skill_name: skillName,
+        skill_dir: skillDir,
+        provenance_path: `${skillDir}/${PROVENANCE_FILE}`,
+    };
+}
+function writeImportedSkillFiles(projectRoot, target, source, files, fileReport, warnings) {
+    const skillPath = path.join(projectRoot, ...target.skill_dir.split('/'), 'SKILL.md');
+    if (existsSync(skillPath)) {
+        throw new Error(`External skill already exists: ${target.skill_dir}`);
+    }
+    ensureFileTargetInsideWithoutSymlinks(projectRoot, skillPath, { allowMissingLeaf: true });
+    for (const file of files) {
+        writeUtf8FileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, ...target.skill_dir.split('/'), ...file.relativePath.split('/')), file.content);
+    }
+    writeJsonFileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, ...target.provenance_path.split('/')), {
+        schema_version: '1',
+        kind: 'external_skill_source',
+        source,
+        files: fileReport,
+        warnings,
+    });
+}
+function rejectionReport(mode, issue) {
+    return {
+        schema_version: '1',
+        kind: 'skill_import_report',
+        command: 'skill',
+        action: 'import',
+        ok: false,
+        mode,
+        status: 'rejected',
+        source: null,
+        target: null,
+        files: [],
+        warnings: [],
+        issues: [issue],
+        wrote_files: false,
+    };
+}
+export async function createExternalSkillImportReport(projectRoot, inputUrl, options) {
+    const mode = options.mode;
+    try {
+        const parsed = parseGitHubUrl(inputUrl, options.ref);
+        const fetchImpl = options.fetch ?? globalThis.fetch;
+        if (typeof fetchImpl !== 'function') {
+            throw new Error('This runtime does not provide fetch.');
+        }
+        const files = await loadExternalSkillFiles(fetchImpl, parsed);
+        const skillName = targetNameForSkill(files, parsed, options.name);
+        const target = createTarget(skillName);
+        const source = externalSkillSourceFromParsed(inputUrl, parsed);
+        const reports = fileReports(files);
+        const warnings = [
+            ...(reports.some((file) => file.kind === 'script')
+                ? ['Imported scripts are inert reference files; mustflow does not grant command authority for external scripts.']
+                : []),
+            'External skills are untrusted until the agent reads and evaluates the selected SKILL.md.',
+        ];
+        if (mode === 'install') {
+            writeImportedSkillFiles(projectRoot, target, source, files, reports, warnings);
+        }
+        return {
+            schema_version: '1',
+            kind: 'skill_import_report',
+            command: 'skill',
+            action: 'import',
+            ok: true,
+            mode,
+            status: mode === 'install' ? 'installed' : 'preview',
+            source,
+            target,
+            files: reports,
+            warnings,
+            issues: [],
+            wrote_files: mode === 'install',
+        };
+    }
+    catch (error) {
+        return rejectionReport(mode, error instanceof Error ? error.message : String(error));
+    }
+}

package/dist/cli/lib/local-index/index.js

@@ -158,6 +158,10 @@ function indexedFilesMatch(database, currentFiles) {
     }
     return true;
 }
+const INDEXED_FILE_MTIME_TOLERANCE_MS = 1;
+function indexedFileMtimeMsEqual(storedMtimeMs, currentMtimeMs) {
+    return storedMtimeMs !== null && Math.abs(storedMtimeMs - currentMtimeMs) <= INDEXED_FILE_MTIME_TOLERANCE_MS;
+}
 function indexedFileMetadataMatch(database, currentFiles) {
     const rows = queryRows(database, 'SELECT path, source_scope, size_bytes, mtime_ms, parser_version FROM indexed_files ORDER BY path');
     if (rows.length !== currentFiles.length) {
@@ -172,7 +176,7 @@ function indexedFileMetadataMatch(database, currentFiles) {
         }
         if (normalizeIndexedFileSourceScope(toSearchString(row.source_scope)) !== current.sourceScope ||
             toNullableNumber(row.size_bytes) !== current.sizeBytes ||
-            toNullableNumber(row.mtime_ms) !== current.mtimeMs ||
+            !indexedFileMtimeMsEqual(toNullableNumber(row.mtime_ms), current.mtimeMs) ||
             toSearchString(row.parser_version) !== LOCAL_INDEX_PARSER_VERSION) {
             return false;
         }

package/dist/core/public-json-contracts.js

@@ -566,6 +566,22 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
             '--json',
         ],
     },
+    {
+        id: 'skill-import-report',
+        schemaFile: 'skill-import-report.schema.json',
+        producer: 'mf skill import <github-url> --json',
+        packaged: true,
+        documented: true,
+        installedCommand: [
+            'mf',
+            'skill',
+            'import',
+            'https://github.com/example/agent-skills/blob/main/security-review/SKILL.md',
+            '--dry-run',
+            '--json',
+        ],
+        expectedExitCodes: [0, 1],
+    },
     {
         id: 'route-fixture',
         schemaFile: 'route-fixture.schema.json',