skillrepo 4.17.2 → 4.18.0

package/src/test/lib/file-write.test.mjs

@@ -25,8 +25,10 @@ import {
   rmSync,
   mkdirSync,
   writeFileSync,
+  appendFileSync,
   existsSync,
   readFileSync,
+  readdirSync,
   chmodSync,
 } from "node:fs";
 import { join } from "node:path";
@@ -41,10 +43,14 @@ import {
   placementTargetsFor,
   writeSkillDir,
   removeSkillDir,
+  removeManagedDir,
+  quarantineSkillDir,
+  withFsRetry,
   cleanupOrphans,
   MAX_PATH_DEPTH,
   BLOCKED_EXTENSIONS,
 } from "../../lib/file-write.mjs";
+import { globalQuarantineDir } from "../../lib/paths.mjs";
 import { CliError, EXIT_VALIDATION } from "../../lib/errors.mjs";
 import {
   captureHome,
@@ -1085,6 +1091,168 @@ describe("removeSkillDir", () => {
   );
 });
 
+// ── withFsRetry (Windows-lock retry) ─────────────────────────────────────
+
+describe("withFsRetry", () => {
+  it("returns the op result without retrying on success", () => {
+    let calls = 0;
+    const out = withFsRetry(() => {
+      calls++;
+      return "ok";
+    });
+    assert.equal(out, "ok");
+    assert.equal(calls, 1);
+  });
+
+  it("retries a transient EBUSY, then succeeds", () => {
+    let calls = 0;
+    const out = withFsRetry(
+      () => {
+        calls++;
+        if (calls < 3) {
+          const err = new Error("locked");
+          err.code = "EBUSY";
+          throw err;
+        }
+        return "recovered";
+      },
+      [1, 1, 1, 1], // tiny real backoff — exercises the Atomics.wait sleep
+    );
+    assert.equal(out, "recovered");
+    assert.equal(calls, 3, "failed twice, succeeded on the third attempt");
+  });
+
+  it("rethrows a NON-transient error immediately (no retry)", () => {
+    let calls = 0;
+    assert.throws(
+      () =>
+        withFsRetry(() => {
+          calls++;
+          const err = new Error("denied");
+          err.code = "EACCES";
+          throw err;
+        }, [0, 0, 0]),
+      /denied/,
+    );
+    assert.equal(calls, 1, "EACCES is a real error — fail fast, never retried");
+  });
+
+  it("rethrows the transient error after exhausting the retry budget", () => {
+    let calls = 0;
+    assert.throws(
+      () =>
+        withFsRetry(() => {
+          calls++;
+          const err = new Error("still locked");
+          err.code = "EPERM";
+          throw err;
+        }, [0, 0]),
+      /still locked/,
+    );
+    assert.equal(calls, 3, "initial attempt + 2 retries, then rethrow");
+  });
+});
+
+// ── removeManagedDir ─────────────────────────────────────────────────────
+
+describe("removeManagedDir", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("removes an existing dir and returns true", () => {
+    writeSkillDir(minimalSkill(), { vendors: ["claudeCode"] });
+    const dir = resolvePlacementDir("claudeProject", "pdf-helper");
+    assert.ok(existsSync(dir));
+    assert.equal(removeManagedDir(dir), true);
+    assert.ok(!existsSync(dir));
+  });
+
+  it("returns false when the dir does not exist (idempotent)", () => {
+    const dir = resolvePlacementDir("claudeProject", "nope");
+    assert.equal(removeManagedDir(dir), false);
+  });
+
+  it(
+    "throws a typed diskError when removal fails",
+    { skip: process.platform === "win32" || process.getuid?.() === 0 },
+    () => {
+      writeSkillDir(minimalSkill(), { vendors: ["claudeCode"] });
+      const dir = resolvePlacementDir("claudeProject", "pdf-helper");
+      const root = join(process.cwd(), ".claude", "skills");
+      chmodSync(root, 0o555);
+      try {
+        assert.throws(
+          () => removeManagedDir(dir),
+          (err) => err instanceof CliError && err.exitCode === 3,
+        );
+      } finally {
+        chmodSync(root, 0o755);
+      }
+    },
+  );
+});
+
+// ── quarantineSkillDir ───────────────────────────────────────────────────
+
+describe("quarantineSkillDir", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("moves the dir out of the loadable placement into quarantine, preserving content", () => {
+    writeSkillDir(minimalSkill(), { vendors: ["claudeCode"] });
+    const dir = resolvePlacementDir("claudeProject", "pdf-helper");
+    appendFileSync(join(dir, "SKILL.md"), "\nlocal edit\n");
+    assert.ok(existsSync(dir));
+
+    const dest = quarantineSkillDir(dir, { skillName: "pdf-helper" });
+
+    // Loadable copy is gone; the content lives under
+    // ~/.claude/skillrepo/quarantine/, which no vendor scans.
+    assert.ok(!existsSync(dir), "loadable copy removed");
+    assert.ok(
+      dest.startsWith(globalQuarantineDir()),
+      "dest is under the quarantine root",
+    );
+    assert.ok(existsSync(dest));
+    assert.match(readFileSync(join(dest, "SKILL.md"), "utf-8"), /local edit/);
+  });
+
+  it("gives each quarantined copy a unique dir (no collision across targets)", () => {
+    writeSkillDir(minimalSkill(), { vendors: ["claudeCode"] });
+    const destA = quarantineSkillDir(
+      resolvePlacementDir("claudeProject", "pdf-helper"),
+      { skillName: "pdf-helper" },
+    );
+    // Recreate and quarantine the same name again.
+    writeSkillDir(minimalSkill(), { vendors: ["claudeCode"] });
+    const destB = quarantineSkillDir(
+      resolvePlacementDir("claudeProject", "pdf-helper"),
+      { skillName: "pdf-helper" },
+    );
+    assert.notEqual(destA, destB, "two quarantines of the same name never collide");
+    assert.equal(readdirSync(globalQuarantineDir()).length, 2);
+  });
+
+  it("rejects an invalid skill name (never builds a path from untrusted input)", () => {
+    assert.throws(
+      () => quarantineSkillDir("/tmp/whatever", { skillName: "../evil" }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("throws a typed diskError when the copy fails (source is gone)", () => {
+    // cpSync of a nonexistent source throws ENOENT (not a CliError) → the
+    // catch maps it to a typed disk error, never a raw OS error.
+    assert.throws(
+      () =>
+        quarantineSkillDir(join(process.cwd(), "does-not-exist"), {
+          skillName: "ghost",
+        }),
+      (err) => err instanceof CliError && err.exitCode === 3,
+    );
+  });
+});
+
 // ── cleanupOrphans ──────────────────────────────────────────────────────
 
 describe("cleanupOrphans", () => {

package/src/test/lib/http.test.mjs

@@ -487,6 +487,54 @@ describe("getLibrary", () => {
     }
   });
 
+  it("throws networkError on a valid-JSON 200 whose skills is not an array (#2879 over-deletion guard)", async () => {
+    // A 200 with valid JSON but no top-level skills[] array — an upstream
+    // proxy/CDN body, an API-gateway health envelope, or a future
+    // server-envelope refactor (e.g. {data:{skills}}). Before the guard this
+    // collapsed to skills:[] and a full-sync reconcile (#2804) treated it as
+    // "everything was removed", deleting the user's whole local library. It
+    // must fail loud instead. Covers null/absent AND truthy-non-array shapes
+    // (the old `?? []` passed the latter straight into a later `.map` crash).
+    for (const malformed of [
+      {},
+      { removals: [] },
+      { data: { skills: [] } },
+      { skills: null },
+      { skills: "nope" },
+      { skills: { 0: "x" } },
+    ]) {
+      const srv = await startServer((req, res) => jsonRes(res, 200, malformed));
+      try {
+        await assert.rejects(
+          () => getLibrary(srv.url, VALID_KEY),
+          (err) =>
+            err instanceof CliError &&
+            err.exitCode === EXIT_NETWORK &&
+            /no skills\[\] array/.test(err.message),
+          `malformed body ${JSON.stringify(malformed)} must reject`,
+        );
+      } finally {
+        await srv.close();
+      }
+    }
+  });
+
+  it("still returns a genuine empty library (skills: []) without throwing (#2879)", async () => {
+    // The guard fires ONLY on a missing/non-array skills — a real empty
+    // library sends skills: [] (an array), and the #2804 reconcile that
+    // removes a truly-departed skill depends on this legitimate 200.
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 200, { skills: [], removals: [], syncedAt: "2025-01-01T00:00:00Z" }),
+    );
+    try {
+      const result = await getLibrary(srv.url, VALID_KEY);
+      assert.deepEqual(result.skills, []);
+      assert.equal(result.notModified, false);
+    } finally {
+      await srv.close();
+    }
+  });
+
   it("sends If-None-Match when ifNoneMatch is provided", async () => {
     const srv = await startServer((req, res) => {
       // Echo the conditional check
@@ -537,9 +585,14 @@ describe("getLibrary", () => {
     }
   });
 
-  it("tolerates missing fields in the response (defaults applied)", async () => {
+  it("tolerates missing removals/syncedAt when skills[] is present (defaults applied)", async () => {
+    // Resilience for the NON-deletion fields survives the #2879 skills[]
+    // guard: a 200 that carries skills[] but omits removals/syncedAt still
+    // defaults them. (A missing/non-array skills[] now throws instead of
+    // defaulting to [] — see the over-deletion guard test above — because a
+    // full-sync reconcile would treat that empty set as authoritative.)
     const srv = await startServer((req, res) => {
-      jsonRes(res, 200, {});
+      jsonRes(res, 200, { skills: [] });
     });
     try {
       const result = await getLibrary(srv.url, VALID_KEY);

package/src/test/lib/sync-skillset.test.mjs

@@ -48,7 +48,7 @@ import {
   repoStatePathFor,
   REPO_SYNC_GRACE_WINDOW_MS,
 } from "../../lib/repo-sync-state.mjs";
-import { globalLastSyncPath } from "../../lib/paths.mjs";
+import { globalLastSyncPath, globalQuarantineDir } from "../../lib/paths.mjs";
 import { CliError, EXIT_NETWORK, EXIT_UNRESOLVABLE } from "../../lib/errors.mjs";
 import { getLibrary, postSyncReceipt } from "../../lib/http.mjs";
 import { createMockServer } from "../e2e/mock-server.mjs";
@@ -403,11 +403,12 @@ describe("skillset-scoped sync — 200 full-set reconcile (#2365)", () => {
     assert.deepEqual(receipt.skills, []);
   });
 
-  it("empty skillset honors the delete guards: a modified managed dir survives the wipe", async () => {
+  it("empty skillset reconcile quarantines a modified managed dir (#2804): loadable copy removed, edit preserved", async () => {
     declareRepo();
     server.setSkillsetEtag(SS_ETAG_A);
     server.setSkillsetResponse(scopedResponse([makeSkill("alpha")]));
     await scopedSync();
+    // The CLI wrote alpha (per-repo baseline); the user then edits it.
     appendFileSync(join(repoRoot(), ".claude", "skills", "alpha", "SKILL.md"), "\nedited\n");
 
     server.setSkillsetEtag(SS_ETAG_B);
@@ -416,12 +417,156 @@ describe("skillset-scoped sync — 200 full-set reconcile (#2365)", () => {
     const stderr = createCaptureStream();
     const result = await scopedSync({ io: { stderr } });
 
-    assert.equal(result.removed, 0);
-    assert.ok(existsSync(join(repoRoot(), ".claude", "skills", "alpha", "SKILL.md")));
-    assert.match(stderr.text(), /alpha\/ was removed from this repo's skillset but has local changes/);
+    // Compliance (#2804 owner decision): a recalled/removed skill the CLI
+    // wrote must leave the loadable folder even when locally edited — the
+    // edit is preserved in quarantine, never destroyed. This REPLACES the
+    // old warn-and-keep, which left the recalled skill loadable by agents.
+    assert.equal(result.removed, 1, "the edited managed dir is reconciled (quarantined)");
+    assert.equal(
+      existsSync(join(repoRoot(), ".claude", "skills", "alpha")),
+      false,
+      "loadable copy is gone — agents no longer load the recalled skill",
+    );
+    assert.match(
+      stderr.text(),
+      /alpha\/ was removed from this repo's skillset but has local edits — moved to quarantine/,
+    );
+
+    // The edit survives in the non-loaded quarantine area.
+    const quarantined = readdirSync(globalQuarantineDir()).filter((d) =>
+      d.startsWith("alpha-"),
+    );
+    assert.equal(quarantined.length, 1, "exactly one quarantined copy of alpha");
+    assert.match(
+      readFileSync(join(globalQuarantineDir(), quarantined[0], "SKILL.md"), "utf-8"),
+      /edited/,
+      "the user's edit is preserved in quarantine",
+    );
+
     assert.deepEqual(server.getLastReceipt().repo.resolved, []);
   });
 
+  it("never resolves a traversal-shaped manifest entry into a path — no arbitrary-dir deletion (#2879)", async () => {
+    // Same guard on the skillset reconcile path (reconcileDeleteGuarded): the
+    // per-repo manifest is local data, not trusted input. A traversal-named
+    // entry must be rejected before resolvePlacementDir. Plant a byte-identical
+    // sentinel OUTSIDE the placement root so a guard-LESS delete branch would
+    // rm it, inject a traversal entry reusing victim's SHAs, then re-sync.
+    declareRepo();
+    server.setSkillsetEtag(SS_ETAG_A);
+    server.setSkillsetResponse(scopedResponse([makeSkill("victim")]));
+    await scopedSync();
+    const victimDir = join(repoRoot(), ".claude", "skills", "victim");
+
+    const sentinelDir = join(sandbox, "project", "PWNED-SENTINEL");
+    mkdirSync(sentinelDir, { recursive: true });
+    writeFileSync(
+      join(sentinelDir, "SKILL.md"),
+      readFileSync(join(victimDir, "SKILL.md")),
+    );
+
+    const state = readRepoSyncState(repoRoot());
+    const victimEntry = state.resolved.find((e) => e.name === "victim");
+    state.resolved.push({ ...victimEntry, name: "../../PWNED-SENTINEL" });
+    writeRepoSyncState(repoRoot(), state);
+
+    // victim stays served; the traversal entry is absent → it would reconcile.
+    server.setSkillsetEtag(SS_ETAG_B);
+    server.setSkillsetResponse(scopedResponse([makeSkill("victim")]));
+    const result = await scopedSync();
+
+    assert.ok(
+      existsSync(join(sentinelDir, "SKILL.md")),
+      "traversal target UNTOUCHED — the guard rejected the name before any fs op",
+    );
+    assert.equal(result.removed, 0, "a traversal entry reconciles nothing");
+    assert.equal(result.quarantined ?? 0, 0, "and quarantines nothing");
+  });
+
+  it("reconcile keeps (never quarantines) an absent member the CLI never wrote — no authorship proof (#2108 preserved)", async () => {
+    declareRepo();
+    // Hand-author a dir at a member's name BEFORE the CLI ever writes it, so
+    // the serve is refused as unmanaged and the resolved entry carries NO
+    // baseline SHAs — the CLI has no proof it wrote this dir.
+    const dir = join(repoRoot(), ".claude", "skills", "squatter");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "SKILL.md"), "---\nname: squatter\n---\nhand-authored\n");
+
+    server.setSkillsetEtag(SS_ETAG_A);
+    server.setSkillsetResponse(scopedResponse([makeSkill("squatter", "server body")]));
+    await scopedSync(); // serve-refused (unmanaged) → resolved entry, no SHAs
+
+    // squatter leaves the set. With no authorship proof the reconcile must
+    // NOT touch it — the owner's remove-and-quarantine covers CLI-authored
+    // edits ONLY, never hand-authored content. Keep it with a warning.
+    server.setSkillsetEtag(SS_ETAG_B);
+    server.setSkillsetResponse(scopedResponse([]));
+    const stderr = createCaptureStream();
+    const result = await scopedSync({ io: { stderr } });
+
+    assert.equal(result.removed, 0, "hand-authored dir is never removed by the reconcile");
+    assert.match(
+      readFileSync(join(dir, "SKILL.md"), "utf-8"),
+      /hand-authored/,
+      "the user's hand-authored content survives byte-for-byte",
+    );
+    assert.match(
+      stderr.text(),
+      /squatter\/ was removed from this repo's skillset but was not written by this CLI/,
+    );
+    // And it is NOT quarantined — quarantine is for CLI-authored edits only.
+    const quarantined = existsSync(globalQuarantineDir())
+      ? readdirSync(globalQuarantineDir()).filter((d) => d.startsWith("squatter-"))
+      : [];
+    assert.equal(quarantined.length, 0, "hand-authored content is never moved to quarantine");
+  });
+
+  it("reconcile does not quarantine a re-attributed member (same name, new owner) (#2804 review)", async () => {
+    declareRepo();
+    server.setSkillsetEtag(SS_ETAG_A);
+    server.setSkillsetResponse(scopedResponse([{ ...makeSkill("foo"), owner: "skillrepo" }]));
+    await scopedSync();
+    const dir = join(repoRoot(), ".claude", "skills", "foo");
+    assert.ok(existsSync(dir));
+    appendFileSync(join(dir, "SKILL.md"), "\nlocal edit\n");
+
+    // The member is re-attributed skillrepo/foo → acme/foo (a claim). It is
+    // STILL in the skillset, just re-keyed — the reconcile must NOT quarantine
+    // the edited copy; it defers to the apply loop, which serve-refuses the
+    // edit and keeps it, exactly as for any edited member.
+    server.setSkillsetEtag(SS_ETAG_B);
+    server.setSkillsetResponse(scopedResponse([{ ...makeSkill("foo"), owner: "acme" }]));
+    const stderr = createCaptureStream();
+    const result = await scopedSync({ io: { stderr } });
+
+    assert.equal(result.quarantined ?? 0, 0, "a re-attributed member is never quarantined");
+    assert.doesNotMatch(stderr.text(), /moved to quarantine/);
+    assert.match(
+      readFileSync(join(dir, "SKILL.md"), "utf-8"),
+      /local edit/,
+      "the edit survives (served-but-refused, not quarantined)",
+    );
+    const quarantined = existsSync(globalQuarantineDir())
+      ? readdirSync(globalQuarantineDir()).filter((d) => d.startsWith("foo-"))
+      : [];
+    assert.equal(quarantined.length, 0, "no quarantine copy is made");
+
+    // Classified as a local EDIT of CLI-authored content, NOT as
+    // hand-authored/unmanaged — the re-attribution must not lose the CLI's
+    // authorship record via the owner-keyed lookup (#2804 review). This is
+    // the durable signal that goes to state + the server receipt.
+    const resolved = readRepoSyncState(repoRoot()).resolved.find(
+      (e) => e.name === "foo",
+    );
+    assert.equal(resolved.owner, "acme", "manifest carries the new owner");
+    assert.equal(resolved.written, false, "served-but-refused (a local edit)");
+    assert.equal(
+      resolved.unwrittenReason,
+      "modified",
+      "labeled 'modified' (CLI wrote it, user edited), not 'unmanaged'",
+    );
+  });
+
   it("prints each skippedExtras message VERBATIM and stores/echoes reason only", async () => {
     declareRepo(["acme/db-migrations"]);
     server.setSkillsetEtag(SS_ETAG_A);
@@ -1124,7 +1269,7 @@ describe("skillset-scoped sync — guards compose across multiple targets (#2365
     ]);
   });
 
-  it("delete guard keeps ALL targets when one mismatches: baseline-clean copy survives alongside the modified one", async () => {
+  it("reconcile removes the clean target and quarantines only the edited one (#2804, per-target)", async () => {
     declareRepo();
     server.setSkillsetEtag(SS_ETAG_A);
     server.setSkillsetResponse(scopedResponse([makeSkill("beta")]));
@@ -1140,16 +1285,36 @@ describe("skillset-scoped sync — guards compose across multiple targets (#2365
     const stderr = createCaptureStream();
     const result = await scopedSync({ vendors: TWO_VENDORS, io: { stderr } });
 
-    assert.equal(result.removed, 0, "one mismatch keeps every target");
-    assert.ok(
+    // #2804: per-target, not all-or-nothing. The baseline-clean copy is
+    // exactly what the CLI wrote, so it is deleted; the edited copy leaves
+    // the loadable folder too but is quarantined so the edit survives. Both
+    // loadable copies of the recalled skill are gone (compliance) — the old
+    // all-or-nothing keep left BOTH loadable.
+    assert.equal(result.removed, 1, "beta reconciled (clean deleted + edited quarantined = one entry)");
+    assert.equal(
       existsSync(join(claudeDir("beta"), "SKILL.md")),
-      "baseline-clean copy survives too (all-or-nothing delete)",
+      false,
+      "baseline-clean copy is deleted — it is exactly what the CLI wrote",
+    );
+    assert.equal(
+      existsSync(join(agentsDir("beta"), "SKILL.md")),
+      false,
+      "edited copy leaves the loadable folder (moved to quarantine)",
+    );
+    assert.match(
+      stderr.text(),
+      /beta\/ was removed from this repo's skillset but has local edits — moved to quarantine/,
+    );
+
+    // Only the edited target is quarantined; its content is preserved.
+    const quarantined = readdirSync(globalQuarantineDir()).filter((d) =>
+      d.startsWith("beta-"),
     );
+    assert.equal(quarantined.length, 1, "exactly one quarantined copy — the edited target");
     assert.match(
-      readFileSync(join(agentsDir("beta"), "SKILL.md"), "utf-8"),
+      readFileSync(join(globalQuarantineDir(), quarantined[0], "SKILL.md"), "utf-8"),
       /local edit/,
     );
-    assert.match(stderr.text(), /beta\/ was removed from this repo's skillset but has local changes/);
     assert.deepEqual(server.getLastReceipt().repo.resolved, [], "emptied set still attested");
   });
 });