skillrepo 2.0.0 → 3.1.0

package/src/test/mergers/uninstall-claude-mcp.test.mjs

@@ -0,0 +1,145 @@
+/**
+ * Unit tests for src/lib/removers/claude-mcp.mjs (#885).
+ *
+ * Covers the core surgical-JSON contract: delete only
+ * `mcpServers.skillrepo`, preserve every other entry, skip cleanly
+ * when the target key isn't present.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { removeClaudeMcp } from "../../lib/removers/claude-mcp.mjs";
+
+let sandbox;
+let originalCwd;
+
+function setup() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-unrm-claude-"));
+  originalCwd = process.cwd();
+  process.chdir(sandbox);
+}
+
+function teardown() {
+  process.chdir(originalCwd);
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+describe("removeClaudeMcp", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("is a no-op when .mcp.json does not exist", () => {
+    const result = removeClaudeMcp();
+    assert.equal(result.action, "skipped");
+    assert.ok(!existsSync(".mcp.json"));
+  });
+
+  it("is a no-op when mcpServers.skillrepo is absent", () => {
+    const content = JSON.stringify(
+      { mcpServers: { otherTool: { type: "http", url: "https://example.com" } } },
+      null,
+      2,
+    );
+    writeFileSync(".mcp.json", content);
+
+    const result = removeClaudeMcp();
+    assert.equal(result.action, "skipped");
+    assert.equal(readFileSync(".mcp.json", "utf-8"), content);
+  });
+
+  it("removes only the skillrepo entry, preserves other servers", () => {
+    writeFileSync(
+      ".mcp.json",
+      JSON.stringify(
+        {
+          mcpServers: {
+            skillrepo: {
+              type: "http",
+              url: "https://skillrepo.dev/api/mcp",
+              headers: { Authorization: "Bearer ${SKILLREPO_ACCESS_KEY}" },
+            },
+            otherTool: {
+              type: "http",
+              url: "https://example.com/mcp",
+            },
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const result = removeClaudeMcp();
+    assert.equal(result.action, "removed");
+
+    const parsed = JSON.parse(readFileSync(".mcp.json", "utf-8"));
+    assert.equal(parsed.mcpServers.skillrepo, undefined);
+    assert.ok(parsed.mcpServers.otherTool, "sibling server entry must survive");
+    assert.equal(parsed.mcpServers.otherTool.url, "https://example.com/mcp");
+  });
+
+  it("leaves an empty mcpServers object when skillrepo was the only entry", () => {
+    // The design explicitly says `mcpServers` parent may become {}
+    // — don't delete the file or collapse the parent. The user's
+    // IDE will accept an empty servers object.
+    writeFileSync(
+      ".mcp.json",
+      JSON.stringify({ mcpServers: { skillrepo: { type: "http", url: "x" } } }, null, 2),
+    );
+
+    const result = removeClaudeMcp();
+    assert.equal(result.action, "removed");
+
+    const parsed = JSON.parse(readFileSync(".mcp.json", "utf-8"));
+    assert.deepEqual(parsed, { mcpServers: {} });
+    assert.ok(existsSync(".mcp.json"), "file must not be deleted");
+  });
+
+  it("preserves unrelated top-level keys (e.g. a future Claude Code setting)", () => {
+    writeFileSync(
+      ".mcp.json",
+      JSON.stringify(
+        {
+          mcpServers: { skillrepo: { type: "http", url: "x" } },
+          someFutureField: { x: 1 },
+        },
+        null,
+        2,
+      ),
+    );
+
+    removeClaudeMcp();
+
+    const parsed = JSON.parse(readFileSync(".mcp.json", "utf-8"));
+    assert.deepEqual(parsed.someFutureField, { x: 1 });
+  });
+
+  it("returns a structured error (does not throw) on unparseable JSON", () => {
+    // The uninstall command relies on removers returning errors in
+    // their result objects rather than throwing — continue-with-
+    // errors semantics require a structured signal.
+    writeFileSync(".mcp.json", "{ not valid json");
+
+    const result = removeClaudeMcp();
+    assert.equal(result.action, "skipped");
+    assert.ok(result.error, "unparseable JSON must surface as a structured error");
+    assert.match(result.error, /parse/i);
+  });
+
+  it("is idempotent — second call is a no-op", () => {
+    writeFileSync(
+      ".mcp.json",
+      JSON.stringify({ mcpServers: { skillrepo: { url: "x" } } }, null, 2),
+    );
+
+    const first = removeClaudeMcp();
+    assert.equal(first.action, "removed");
+
+    const second = removeClaudeMcp();
+    assert.equal(second.action, "skipped");
+  });
+});

package/src/test/mergers/uninstall-cursor-mcp.test.mjs

@@ -0,0 +1,108 @@
+/**
+ * Unit tests for src/lib/removers/cursor-mcp.mjs (#885).
+ *
+ * Shares the JSON-key-surgery shape with claude-mcp. Focus tests
+ * on the path-specific and schema-specific details (cursor's env
+ * interpolation is `${env:...}` not `${...}`, but that's a writer
+ * concern — the remover just deletes the key).
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { removeCursorMcp } from "../../lib/removers/cursor-mcp.mjs";
+
+let sandbox;
+let originalCwd;
+
+function setup() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-unrm-cursor-"));
+  originalCwd = process.cwd();
+  process.chdir(sandbox);
+  mkdirSync(join(sandbox, ".cursor"), { recursive: true });
+}
+
+function teardown() {
+  process.chdir(originalCwd);
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+describe("removeCursorMcp", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("is a no-op when .cursor/mcp.json does not exist", () => {
+    const result = removeCursorMcp();
+    assert.equal(result.action, "skipped");
+  });
+
+  it("removes only skillrepo, preserves siblings", () => {
+    writeFileSync(
+      ".cursor/mcp.json",
+      JSON.stringify(
+        {
+          mcpServers: {
+            skillrepo: { url: "x", headers: {} },
+            otherTool: { url: "y" },
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const result = removeCursorMcp();
+    assert.equal(result.action, "removed");
+
+    const parsed = JSON.parse(readFileSync(".cursor/mcp.json", "utf-8"));
+    assert.equal(parsed.mcpServers.skillrepo, undefined);
+    assert.ok(parsed.mcpServers.otherTool);
+  });
+
+  it("is a no-op when mcpServers.skillrepo is absent", () => {
+    const content = JSON.stringify({ mcpServers: {} }, null, 2);
+    writeFileSync(".cursor/mcp.json", content);
+
+    const result = removeCursorMcp();
+    assert.equal(result.action, "skipped");
+    assert.equal(readFileSync(".cursor/mcp.json", "utf-8"), content);
+  });
+
+  it("returns a structured error on unparseable JSON", () => {
+    writeFileSync(".cursor/mcp.json", "not json");
+
+    const result = removeCursorMcp();
+    assert.equal(result.action, "skipped");
+    assert.ok(result.error);
+  });
+
+  it("is idempotent — second call is a no-op", () => {
+    writeFileSync(
+      ".cursor/mcp.json",
+      JSON.stringify({ mcpServers: { skillrepo: { url: "x" } } }, null, 2),
+    );
+
+    const first = removeCursorMcp();
+    assert.equal(first.action, "removed");
+
+    const second = removeCursorMcp();
+    assert.equal(second.action, "skipped");
+  });
+
+  it("dryRun does not modify the file and returns would-remove", () => {
+    const content = JSON.stringify(
+      { mcpServers: { skillrepo: { url: "x" } } },
+      null,
+      2,
+    );
+    writeFileSync(".cursor/mcp.json", content);
+
+    const result = removeCursorMcp({ dryRun: true });
+    assert.equal(result.action, "would-remove");
+    // Byte-for-byte unchanged.
+    assert.equal(readFileSync(".cursor/mcp.json", "utf-8"), content);
+  });
+});

package/src/test/mergers/uninstall-env-local.test.mjs

@@ -0,0 +1,144 @@
+/**
+ * Unit tests for src/lib/removers/env-local.mjs (#885).
+ *
+ * The remover strips every line whose prefix matches `SKILLREPO_ACCESS_KEY=`.
+ * It does NOT strip lines that merely contain the string `SKILLREPO_ACCESS_KEY`
+ * — a user-authored comment or template line is preserved by the
+ * prefix-match contract.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { removeEnvLocal } from "../../lib/removers/env-local.mjs";
+
+let sandbox;
+let originalCwd;
+
+function setup() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-unrm-env-"));
+  originalCwd = process.cwd();
+  process.chdir(sandbox);
+}
+
+function teardown() {
+  process.chdir(originalCwd);
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+describe("removeEnvLocal", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("is a no-op when .env.local does not exist", () => {
+    const result = removeEnvLocal();
+    assert.equal(result.action, "skipped");
+    assert.equal(result.removed, 0);
+    assert.ok(!existsSync(".env.local"));
+  });
+
+  it("is a no-op when .env.local exists but has no SKILLREPO_ACCESS_KEY line", () => {
+    const content = "NODE_ENV=production\nDATABASE_URL=postgres://...\n";
+    writeFileSync(".env.local", content, "utf-8");
+
+    const result = removeEnvLocal();
+    assert.equal(result.action, "skipped");
+    assert.equal(result.removed, 0);
+    assert.equal(readFileSync(".env.local", "utf-8"), content);
+  });
+
+  it("removes the SKILLREPO_ACCESS_KEY line, preserves everything else", () => {
+    const content = [
+      "NODE_ENV=production",
+      "SKILLREPO_ACCESS_KEY=sk_live_abc123",
+      "DATABASE_URL=postgres://localhost",
+      "",
+    ].join("\n");
+    writeFileSync(".env.local", content, "utf-8");
+
+    const result = removeEnvLocal();
+    assert.equal(result.action, "removed");
+    assert.equal(result.removed, 1);
+
+    const after = readFileSync(".env.local", "utf-8");
+    assert.match(after, /NODE_ENV=production/);
+    assert.match(after, /DATABASE_URL=postgres:\/\/localhost/);
+    assert.doesNotMatch(after, /SKILLREPO_ACCESS_KEY/);
+  });
+
+  it("preserves a commented-out SKILLREPO_ACCESS_KEY line", () => {
+    // The prefix match requires the line to START with
+    // `SKILLREPO_ACCESS_KEY=` — a comment line doesn't match. This
+    // avoids surprising a user whose `.env.local` has template
+    // documentation referencing the variable.
+    const content = [
+      "# SKILLREPO_ACCESS_KEY=sk_live_example",
+      "SKILLREPO_ACCESS_KEY=sk_live_real",
+      "OTHER_VAR=value",
+      "",
+    ].join("\n");
+    writeFileSync(".env.local", content, "utf-8");
+
+    removeEnvLocal();
+
+    const after = readFileSync(".env.local", "utf-8");
+    // The comment survives.
+    assert.match(after, /# SKILLREPO_ACCESS_KEY=sk_live_example/);
+    // The real credential line is gone.
+    assert.doesNotMatch(after, /^SKILLREPO_ACCESS_KEY=sk_live_real$/m);
+  });
+
+  it("removes multiple SKILLREPO_ACCESS_KEY lines if the file has them", () => {
+    // Edge case: a file with duplicate entries (e.g. from a bad
+    // merge conflict or manual edit). All of them are SkillRepo-
+    // owned and should go.
+    const content = [
+      "NODE_ENV=dev",
+      "SKILLREPO_ACCESS_KEY=sk_live_old",
+      "FOO=bar",
+      "SKILLREPO_ACCESS_KEY=sk_live_new",
+      "",
+    ].join("\n");
+    writeFileSync(".env.local", content, "utf-8");
+
+    const result = removeEnvLocal();
+    assert.equal(result.action, "removed");
+    assert.equal(result.removed, 2);
+
+    const after = readFileSync(".env.local", "utf-8");
+    assert.doesNotMatch(after, /SKILLREPO_ACCESS_KEY=/);
+    assert.match(after, /NODE_ENV=dev/);
+    assert.match(after, /FOO=bar/);
+  });
+
+  it("idempotent — second call is a no-op", () => {
+    writeFileSync(".env.local", "SKILLREPO_ACCESS_KEY=sk_live_x\n", "utf-8");
+
+    const first = removeEnvLocal();
+    assert.equal(first.action, "removed");
+
+    const second = removeEnvLocal();
+    assert.equal(second.action, "skipped");
+    assert.equal(second.removed, 0);
+  });
+
+  it("preserves CRLF line endings when the source file used them", () => {
+    const crlf = [
+      "NODE_ENV=production",
+      "SKILLREPO_ACCESS_KEY=sk_live_abc",
+      "DATABASE_URL=postgres://localhost",
+      "",
+    ].join("\r\n");
+    writeFileSync(".env.local", crlf, "utf-8");
+
+    removeEnvLocal();
+
+    const after = readFileSync(".env.local", "utf-8");
+    // Surviving lines keep CRLF.
+    assert.ok(after.includes("NODE_ENV=production\r\n"));
+    assert.ok(after.includes("DATABASE_URL=postgres://localhost\r\n"));
+  });
+});

package/src/test/mergers/uninstall-gitignore.test.mjs

@@ -0,0 +1,209 @@
+/**
+ * Unit tests for src/lib/removers/gitignore.mjs (#885).
+ *
+ * The gitignore remover is the attribution-sensitive one: the `.env.local`
+ * line in particular is commonly added manually by developers for
+ * reasons unrelated to SkillRepo. The remover MUST only strip lines
+ * that appeared under the SkillRepo section header — never lines that
+ * happen to match an entry-text but live outside the section.
+ *
+ * Mirrors the coverage shape of `src/test/mergers/gitignore.test.mjs`
+ * (the installer tests). Inline-seeds file content with `writeFileSync`
+ * so failure modes are readable — each test's fixture is right there
+ * in the test body.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { removeGitignore } from "../../lib/removers/gitignore.mjs";
+
+let sandbox;
+let originalCwd;
+
+function setup() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-unrm-gitignore-"));
+  originalCwd = process.cwd();
+  process.chdir(sandbox);
+}
+
+function teardown() {
+  process.chdir(originalCwd);
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+describe("removeGitignore", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("is a no-op when .gitignore does not exist", () => {
+    const result = removeGitignore();
+    assert.equal(result.action, "skipped");
+    assert.equal(result.removed, 0);
+    assert.ok(!existsSync(".gitignore"));
+  });
+
+  it("is a no-op when .gitignore exists but has no SkillRepo section", () => {
+    const content = "node_modules/\n.DS_Store\n";
+    writeFileSync(".gitignore", content, "utf-8");
+
+    const result = removeGitignore();
+    assert.equal(result.action, "skipped");
+    assert.equal(result.removed, 0);
+    // File content is unchanged — byte-for-byte, including trailing
+    // newline presence.
+    assert.equal(readFileSync(".gitignore", "utf-8"), content);
+  });
+
+  it("removes the SkillRepo section and its entries (happy path)", () => {
+    const content = [
+      "node_modules/",
+      ".DS_Store",
+      "",
+      "# SkillRepo CLI (added by `skillrepo init`)",
+      ".env.local",
+      ".claude/skills/",
+      ".claude/settings.local.json",
+      "",
+      "dist/",
+      "",
+    ].join("\n");
+    writeFileSync(".gitignore", content, "utf-8");
+
+    const result = removeGitignore();
+    assert.equal(result.action, "removed");
+    assert.equal(result.removed, 4); // header + 3 entries
+
+    const after = readFileSync(".gitignore", "utf-8");
+    // Survives: the three non-SkillRepo lines.
+    assert.match(after, /node_modules\//);
+    assert.match(after, /\.DS_Store/);
+    assert.match(after, /dist\//);
+    // Does NOT survive: any SkillRepo line.
+    assert.doesNotMatch(after, /SkillRepo/);
+    assert.doesNotMatch(after, /^\.env\.local$/m);
+    assert.doesNotMatch(after, /\.claude\/skills\//);
+    assert.doesNotMatch(after, /settings\.local\.json/);
+  });
+
+  it("preserves a user-authored `.env.local` line outside the SkillRepo section", () => {
+    // CRITICAL attribution test: the user has their own `.env.local`
+    // line from before they installed SkillRepo. The remover must NOT
+    // touch it — only lines inside the SkillRepo section are owned.
+    const content = [
+      ".env.local", // user-owned
+      "",
+      "# SkillRepo CLI (added by `skillrepo init`)",
+      ".env.local",
+      ".claude/skills/",
+      ".claude/settings.local.json",
+      "",
+    ].join("\n");
+    writeFileSync(".gitignore", content, "utf-8");
+
+    const result = removeGitignore();
+    assert.equal(result.action, "removed");
+
+    const after = readFileSync(".gitignore", "utf-8");
+    // The user's .env.local line at the TOP survives. The one inside
+    // the SkillRepo section is gone. Line-count-of-match assertion
+    // captures this precisely.
+    const envLocalLines = after
+      .split(/\r?\n/)
+      .filter((l) => l === ".env.local");
+    assert.equal(
+      envLocalLines.length,
+      1,
+      "exactly one .env.local line should remain — the user-authored one",
+    );
+  });
+
+  it("handles the section at the end of the file with no trailing blank line", () => {
+    const content = [
+      "node_modules/",
+      "",
+      "# SkillRepo CLI (added by `skillrepo init`)",
+      ".env.local",
+      ".claude/skills/",
+      ".claude/settings.local.json",
+    ].join("\n");
+    writeFileSync(".gitignore", content, "utf-8");
+
+    const result = removeGitignore();
+    assert.equal(result.action, "removed");
+
+    const after = readFileSync(".gitignore", "utf-8");
+    assert.match(after, /node_modules\//);
+    assert.doesNotMatch(after, /SkillRepo/);
+    assert.doesNotMatch(after, /\.env\.local/);
+  });
+
+  it("is idempotent — running twice after a removal is a no-op on the second call", () => {
+    const content = [
+      "# SkillRepo CLI (added by `skillrepo init`)",
+      ".env.local",
+      ".claude/skills/",
+      ".claude/settings.local.json",
+      "",
+    ].join("\n");
+    writeFileSync(".gitignore", content, "utf-8");
+
+    const first = removeGitignore();
+    assert.equal(first.action, "removed");
+
+    const second = removeGitignore();
+    assert.equal(second.action, "skipped");
+    assert.equal(second.removed, 0);
+  });
+
+  it("preserves CRLF line endings when the source file used them", () => {
+    const crlf = [
+      "node_modules/",
+      "",
+      "# SkillRepo CLI (added by `skillrepo init`)",
+      ".env.local",
+      ".claude/skills/",
+      ".claude/settings.local.json",
+      "",
+      "dist/",
+      "",
+    ].join("\r\n");
+    writeFileSync(".gitignore", crlf, "utf-8");
+
+    removeGitignore();
+
+    const after = readFileSync(".gitignore", "utf-8");
+    // Non-SkillRepo lines survive with CRLF preserved.
+    assert.ok(after.includes("node_modules/\r\n"));
+    assert.ok(after.includes("dist/\r\n"));
+  });
+
+  it("does not collapse consecutive blank lines in surrounding user content", () => {
+    // Cosmetic-but-important: if the remover aggressively normalizes
+    // whitespace, a user who deliberately uses multiple blank lines
+    // as visual separators loses that structure. The remover should
+    // remove the section and nothing else.
+    const content = [
+      "node_modules/",
+      "",
+      "",
+      "# SkillRepo CLI (added by `skillrepo init`)",
+      ".env.local",
+      ".claude/skills/",
+      ".claude/settings.local.json",
+      "",
+      "",
+      "dist/",
+    ].join("\n");
+    writeFileSync(".gitignore", content, "utf-8");
+
+    removeGitignore();
+
+    const after = readFileSync(".gitignore", "utf-8");
+    // The double-blank before dist/ is preserved.
+    assert.match(after, /\n\n\ndist\/|\n\ndist\//);
+  });
+});