skillrepo 4.17.2 → 4.18.0

package/src/test/lib/sync.test.mjs

@@ -29,10 +29,12 @@ import {
   mkdirSync,
   chmodSync,
   writeFileSync,
+  appendFileSync,
   existsSync,
   readFileSync,
+  readdirSync,
 } from "node:fs";
-import { join, dirname } from "node:path";
+import { join } from "node:path";
 import { tmpdir } from "node:os";
 
 import {
@@ -48,7 +50,7 @@ import {
   MIN_SYNC_INTERVAL_MS,
 } from "../../lib/sync.mjs";
 import { resolvePlacementDir } from "../../lib/file-write.mjs";
-import { globalLastSyncPath } from "../../lib/paths.mjs";
+import { globalLastSyncPath, globalQuarantineDir } from "../../lib/paths.mjs";
 import { CliError, EXIT_VALIDATION, EXIT_DISK } from "../../lib/errors.mjs";
 import { computeSkillShas } from "../../lib/crypto-shas.mjs";
 import { walkDetectedPlacements } from "../../lib/placement-walk.mjs";
@@ -996,8 +998,10 @@ describe("runSync — tombstones", () => {
   beforeEach(setupServer);
   afterEach(teardownServer);
 
-  it("applies a tombstone and increments removed", async () => {
-    // Pre-write a skill
+  it("applies a delta tombstone and increments removed", async () => {
+    // First sync writes `doomed` and persists an etag baseline, so the NEXT
+    // sync is a genuine DELTA (sends If-None-Match + `since`).
+    server.setEtag('"v1"');
     server.setLibraryResponse({
       skills: [makeSkill("doomed")],
       removals: [],
@@ -1005,13 +1009,15 @@ describe("runSync — tombstones", () => {
     });
     await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
     assert.ok(existsSync(resolvePlacementDir("claudeProject", "doomed")));
-    // Reset receipt tracking so the tombstone-only sync below is measured
-    // from zero (the first sync legitimately posted one).
-    server.resetReceipts();
 
-    // Now the server says it's removed (the response has the tombstone
-    // AND the skill is no longer in skills[])
-    rmSync(globalLastSyncPath(), { force: true });
+    // DELTA sync (etag advances → 200 with `since` sent): the server carries
+    // the removal as a tombstone and the client deletes it. This is the
+    // CONTROL for #2804 — a tombstone on a delta still deletes. (A FULL sync
+    // carries removals:[] and the orphan reconcile handles absence instead;
+    // see the "#2804 full-sync orphan" test below. Before the mock was fixed
+    // to force removals:[] on full syncs, this test wiped `.last-sync` and
+    // still "passed" against a shape production never sends.)
+    server.setEtag('"v2"');
     server.setLibraryResponse({
       skills: [],
       removals: [{ owner: "alice", name: "doomed", removedAt: "2025-01-02T00:00:00Z" }],
@@ -1024,10 +1030,6 @@ describe("runSync — tombstones", () => {
     });
     assert.equal(result.removed, 1);
     assert.ok(!existsSync(resolvePlacementDir("claudeProject", "doomed")));
-    // The `.last-sync` baseline was reset (rm above) and the only skill
-    // was tombstoned, so the post-sync on-disk set is empty → the
-    // re-assertion receipt has nothing to send and is skipped (#1832).
-    assert.equal(server.getReceiptRequestCount(), 0);
   });
 
   it("re-asserts surviving skills but excludes a tombstoned one", async () => {
@@ -1806,7 +1808,9 @@ describe("runSync — cohort placement classification", () => {
   });
 
   it("tombstone via cohort vendor removes from .agents/skills/ but leaves .claude/skills/", async () => {
-    // Pre-write to BOTH targets via a multi-vendor first sync.
+    // Pre-write to BOTH targets via a multi-vendor first sync; persist an
+    // etag baseline so the tombstone sync below is a genuine DELTA.
+    server.setEtag('"v1"');
     server.setLibraryResponse({
       skills: [makeSkill("doomed")],
       removals: [],
@@ -1823,13 +1827,15 @@ describe("runSync — cohort placement classification", () => {
     assert.ok(existsSync(claudeDir));
     assert.ok(existsSync(cohortDir));
 
-    rmSync(globalLastSyncPath(), { force: true });
-
-    // Apply a tombstone with vendors: ["cursor"] only. Vendor-scoped
-    // tombstones map to the cohort target (.agents/skills/) and must
-    // NOT delete the Claude target — only the explicit vendor scope
-    // is touched. This locks the "vendor-scoped removal isn't a
-    // footgun" behavior.
+    // Apply a tombstone with vendors: ["cursor"] only, on a DELTA sync (etag
+    // advances → `since` sent → the mock carries the tombstone, matching
+    // production which only emits removals on deltas). Vendor-scoped
+    // tombstones map to the cohort target (.agents/skills/) and must NOT
+    // delete the Claude target — only the explicit vendor scope is touched.
+    // This locks the "vendor-scoped removal isn't a footgun" behavior.
+    // (Previously this wiped `.last-sync` and rode the mock's unfiltered
+    // removals on a FULL sync — a shape production never sends; #2804.)
+    server.setEtag('"v2"');
     server.setLibraryResponse({
       skills: [],
       removals: [{ owner: "alice", name: "doomed", removedAt: "2025-01-02T00:00:00Z" }],
@@ -1850,6 +1856,470 @@ describe("runSync — cohort placement classification", () => {
   });
 });
 
+// ───────────────────────────────────────────────────────────────────
+// #2804 — full-sync orphan reconcile (guarded auto-delete)
+// ───────────────────────────────────────────────────────────────────
+//
+// On a FULL (non-delta) whole-library fetch the server sends the complete
+// served set with removals:[] (route.ts:624). A skill that has LEFT the
+// library — recalled to absence (#2367), owner-deleted (#2532),
+// membership-removed — is in NEITHER skills[] NOR removals[]. Before the
+// fix it was orphaned on disk forever and kept loading. These drive the
+// REAL production shape (full fetch + removals:[] + skill missing from
+// skills[]) through runSync; the delta-tombstone control lives in the
+// "runSync — tombstones" suite above.
+
+describe("runSync — full-sync orphan reconcile (#2804)", () => {
+  beforeEach(setupServer);
+  afterEach(teardownServer);
+
+  // Force the NEXT sync to be a full fetch while KEEPING the baseline — the
+  // real #2804 trigger (the #1911 upgrade heal / incomplete placements).
+  // Rewriting `.last-sync` with a pre-floor cliVersion makes
+  // runWholeLibrarySync drop BOTH conditional headers → `opts.since` absent
+  // → the server returns the complete authoritative set.
+  function forceFullFetchNextSync() {
+    const prior = readLastSync();
+    writeLastSync({
+      etag: prior.etag,
+      syncedAt: prior.syncedAt,
+      skills: prior.skills,
+      cliVersion: "4.7.0", // below FULL_RESYNC_FLOOR
+    });
+  }
+
+  it("deletes an unmodified skill absent from a full response (the #2804 shape)", async () => {
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("keep"), makeSkill("gone")],
+      removals: [],
+      syncedAt: "2025-01-01T00:00:00Z",
+    });
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+    assert.ok(existsSync(resolvePlacementDir("claudeProject", "gone")));
+
+    forceFullFetchNextSync();
+    server.resetLibraryInspection();
+
+    // Full authoritative set with `gone` dropped and NO tombstone — exactly
+    // what production sends on a full sync after a recall/removal.
+    server.setEtag('"v2"');
+    server.setLibraryResponse({
+      skills: [makeSkill("keep")],
+      removals: [],
+      syncedAt: "2025-01-02T00:00:00Z",
+    });
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+    });
+
+    // Precondition: it really was a full fetch (no `since`).
+    assert.equal(server.getLastLibrarySince(), null, "must be a full fetch");
+
+    assert.equal(result.removed, 1, "the orphaned skill is reconciled off disk");
+    assert.equal(
+      existsSync(resolvePlacementDir("claudeProject", "gone")),
+      false,
+      "recalled skill no longer on disk — agents stop loading it",
+    );
+    assert.ok(
+      existsSync(resolvePlacementDir("claudeProject", "keep")),
+      "still-served skill is untouched",
+    );
+
+    // State no longer lists the orphan (no phantom in `list`).
+    const state = readLastSync();
+    assert.ok(state.skills["alice/keep"], "keep stays in .last-sync");
+    assert.equal(
+      state.skills["alice/gone"],
+      undefined,
+      "gone dropped from .last-sync",
+    );
+
+    // Deleted, NOT quarantined: an unmodified orphan must be removed outright,
+    // never relocated. Without this, an always-quarantine regression would
+    // still satisfy removed===1 above and go undetected (#2879 QA finding).
+    assert.equal(
+      result.quarantined ?? 0,
+      0,
+      "an unmodified orphan is deleted, not quarantined",
+    );
+    assert.ok(
+      !existsSync(globalQuarantineDir()) ||
+        readdirSync(globalQuarantineDir()).length === 0,
+      "quarantine area stays empty for an unmodified delete",
+    );
+  });
+
+  it("quarantines an EDITED orphan instead of deleting it (compliance + no data loss)", async () => {
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("edited-gone")],
+      removals: [],
+      syncedAt: "2025-01-01T00:00:00Z",
+    });
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+
+    // The CLI wrote it; the user edits it locally.
+    const dir = resolvePlacementDir("claudeProject", "edited-gone");
+    appendFileSync(join(dir, "SKILL.md"), "\nmy local edit\n");
+
+    forceFullFetchNextSync();
+    server.setEtag('"v2"');
+    server.setLibraryResponse({
+      skills: [], // recalled to absence
+      removals: [],
+      syncedAt: "2025-01-02T00:00:00Z",
+    });
+    const { createCaptureStream } = await import(
+      "../helpers/capture-stream.mjs"
+    );
+    const stderr = createCaptureStream();
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      io: { stderr },
+    });
+
+    // Removed from the loadable folder (counts as removed so the hook is
+    // never silent) but NOT destroyed — and distinctly counted as quarantined
+    // so the summary can tell the user their edits were preserved.
+    assert.equal(result.removed, 1);
+    assert.equal(result.quarantined, 1, "the move is counted as quarantined, distinct from a delete");
+    assert.equal(existsSync(dir), false, "loadable copy is gone");
+    assert.match(
+      stderr.text(),
+      /edited-gone\/ is no longer in your library but has local edits — moved to quarantine/,
+    );
+
+    const quarantined = readdirSync(globalQuarantineDir()).filter((d) =>
+      d.startsWith("edited-gone-"),
+    );
+    assert.equal(quarantined.length, 1, "exactly one quarantined copy");
+    assert.match(
+      readFileSync(
+        join(globalQuarantineDir(), quarantined[0], "SKILL.md"),
+        "utf-8",
+      ),
+      /my local edit/,
+      "the edit is preserved in quarantine",
+    );
+  });
+
+  it("does NOT reconcile on a DELTA — absence from a partial skills[] is not removal", async () => {
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("keep"), makeSkill("stable")],
+      removals: [],
+      syncedAt: "2025-01-01T00:00:00Z",
+    });
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+    assert.ok(existsSync(resolvePlacementDir("claudeProject", "stable")));
+
+    // A genuine DELTA (cliVersion stays current → `since` IS sent). The
+    // response re-delivers only `keep`; `stable` is absent simply because it
+    // did not change — NOT because it was removed. It must survive.
+    server.resetLibraryInspection();
+    server.setEtag('"v2"');
+    server.setLibraryResponse({
+      skills: [makeSkill("keep")],
+      removals: [],
+      syncedAt: "2025-01-02T00:00:00Z",
+    });
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+    });
+
+    assert.notEqual(
+      server.getLastLibrarySince(),
+      null,
+      "must be a delta (since sent)",
+    );
+    assert.equal(result.removed, 0, "a delta never reconciles by absence");
+    assert.ok(
+      existsSync(resolvePlacementDir("claudeProject", "stable")),
+      "unchanged skill absent from the delta is NOT deleted",
+    );
+    assert.ok(
+      readLastSync().skills["alice/stable"],
+      "and it stays in state for a later full sync",
+    );
+  });
+
+  it("drops a departed skill from .last-sync even when its dir was already gone", async () => {
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("keep"), makeSkill("manually-deleted")],
+      removals: [],
+      syncedAt: "2025-01-01T00:00:00Z",
+    });
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+
+    // User manually deletes the dir; it is still listed in `.last-sync`.
+    rmSync(resolvePlacementDir("claudeProject", "manually-deleted"), {
+      recursive: true,
+      force: true,
+    });
+
+    forceFullFetchNextSync();
+    server.setEtag('"v2"');
+    server.setLibraryResponse({
+      skills: [makeSkill("keep")],
+      removals: [],
+      syncedAt: "2025-01-02T00:00:00Z",
+    });
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+    });
+
+    // Nothing on disk to remove (removed stays 0), but state is cleaned so
+    // `list` won't report a phantom managed skill.
+    assert.equal(result.removed, 0);
+    assert.equal(
+      readLastSync().skills["alice/manually-deleted"],
+      undefined,
+      "phantom entry dropped from .last-sync",
+    );
+    assert.ok(readLastSync().skills["alice/keep"]);
+  });
+
+  it("counts a removed skill ONCE even when placed at multiple vendor targets (review HIGH)", async () => {
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("keep"), makeSkill("gone")],
+      removals: [],
+      syncedAt: "2025-01-01T00:00:00Z",
+    });
+    await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode", "cursor"],
+    });
+    // `gone` is on disk at BOTH targets (claudeProject + agentsProject).
+    assert.ok(existsSync(resolvePlacementDir("claudeProject", "gone")));
+    assert.ok(existsSync(resolvePlacementDir("agentsProject", "gone")));
+
+    forceFullFetchNextSync();
+    server.setEtag('"v2"');
+    server.setLibraryResponse({
+      skills: [makeSkill("keep")],
+      removals: [],
+      syncedAt: "2025-01-02T00:00:00Z",
+    });
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode", "cursor"],
+    });
+
+    // One skill left the library → removed:1, NOT 2 (once per skill, not
+    // once per placement target — mirrors the tombstone/skillset paths).
+    assert.equal(result.removed, 1, "counted per skill, not per target");
+    assert.equal(existsSync(resolvePlacementDir("claudeProject", "gone")), false);
+    assert.equal(existsSync(resolvePlacementDir("agentsProject", "gone")), false);
+  });
+
+  it("does NOT foreclose a --global recalled skill's cleanup during a project sync (review B-1)", async () => {
+    // Write `gskill` GLOBALLY; it is recorded in the machine-global .last-sync.
+    server.setEtag('"vg1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("gskill")],
+      removals: [],
+      syncedAt: "2025-01-01T00:00:00Z",
+    });
+    await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      global: true,
+    });
+    const globalDir = resolvePlacementDir("claudeGlobal", "gskill");
+    assert.ok(existsSync(globalDir), "global dir written");
+
+    // A PROJECT full fetch fires with `gskill` recalled. The project scope
+    // has no `gskill` dir; the reconcile must NOT purge its state key (that
+    // would strand the global dir loadable forever) and must NOT touch it.
+    forceFullFetchNextSync();
+    server.setEtag('"vp1"');
+    server.setLibraryResponse({ skills: [], removals: [], syncedAt: "2025-01-02T00:00:00Z" });
+    const project = await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+
+    assert.equal(project.removed, 0, "a project sync cleans nothing in the global scope");
+    assert.ok(existsSync(globalDir), "global dir untouched by the project sync");
+    assert.ok(
+      readLastSync().skills["alice/gskill"],
+      "state key retained so a later --global sync can still reconcile it",
+    );
+
+    // A --global full fetch then reconciles it correctly (no foreclosure).
+    forceFullFetchNextSync();
+    server.setEtag('"vg2"');
+    server.setLibraryResponse({ skills: [], removals: [], syncedAt: "2025-01-03T00:00:00Z" });
+    const glob = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      global: true,
+    });
+    assert.equal(glob.removed, 1, "the --global sync finally removes it");
+    assert.equal(existsSync(globalDir), false);
+    assert.equal(readLastSync().skills["alice/gskill"], undefined);
+  });
+
+  it("does not reconcile a re-attributed skill (same name, new owner) (review B-2)", async () => {
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [{ ...makeSkill("foo"), owner: "skillrepo" }],
+      removals: [],
+      syncedAt: "2025-01-01T00:00:00Z",
+    });
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+    const dir = resolvePlacementDir("claudeProject", "foo");
+    assert.ok(existsSync(dir));
+    assert.ok(readLastSync().skills["skillrepo/foo"], "baseline keyed by original owner");
+
+    // A claim re-attributes `foo` skillrepo/foo → alice/foo. On the next full
+    // fetch the OLD key is absent from servedKeys but the NAME is still served
+    // (a library has one owner per name) — it must NOT be reconciled; the
+    // apply loop rewrites the same dir under the new key, and the stale key
+    // is dropped from state.
+    forceFullFetchNextSync();
+    server.setEtag('"v2"');
+    server.setLibraryResponse({
+      skills: [{ ...makeSkill("foo"), owner: "alice" }],
+      removals: [],
+      syncedAt: "2025-01-02T00:00:00Z",
+    });
+    const result = await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+
+    assert.equal(result.removed, 0, "re-attribution is not a removal");
+    assert.equal(result.quarantined ?? 0, 0, "and never a spurious quarantine");
+    assert.ok(existsSync(dir), "the dir survives (rewritten under the new owner)");
+    assert.ok(readLastSync().skills["alice/foo"], "state carries the new key");
+    assert.equal(
+      readLastSync().skills["skillrepo/foo"],
+      undefined,
+      "stale old key dropped",
+    );
+  });
+
+  it("never resolves a traversal-shaped .last-sync key into a path — no arbitrary-dir deletion (#2879)", async () => {
+    // `.last-sync` is local data, not trusted input (corruption or a local
+    // tamper). The reconcile's isValidSkillName guard is the ONLY barrier
+    // between "remove this orphan" and an rm -rf on an escaped path — nothing
+    // downstream (resolvePlacementDir → removeManagedDir) re-validates. Prove
+    // the guard: a traversal key whose target is byte-identical to a real
+    // baseline (so a guard-LESS delete branch WOULD match SHAs and delete it)
+    // must be a clean no-op. Delete the guard line and this goes red.
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("victim")],
+      removals: [],
+      syncedAt: "2025-01-01T00:00:00Z",
+    });
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+    const victimDir = resolvePlacementDir("claudeProject", "victim");
+
+    // Plant a sentinel OUTSIDE the placement root, byte-identical to victim so
+    // its on-disk SHAs match victim's recorded baseline.
+    const sentinelDir = join(sandbox, "project", "PWNED-SENTINEL");
+    mkdirSync(sentinelDir, { recursive: true });
+    writeFileSync(
+      join(sentinelDir, "SKILL.md"),
+      readFileSync(join(victimDir, "SKILL.md")),
+    );
+
+    // Inject a traversal key that resolves into the sentinel (join normalizes
+    // the `..`), reusing victim's SHAs so a guard-less reconcile would treat
+    // it as an unmodified orphan and delete it.
+    const prior = readLastSync();
+    writeLastSync({
+      ...prior,
+      cliVersion: "4.7.0", // force a full fetch
+      skills: {
+        ...prior.skills,
+        "alice/../../PWNED-SENTINEL": { ...prior.skills["alice/victim"] },
+      },
+    });
+
+    // Full authoritative set WITHOUT the traversal key → it would be reconciled.
+    server.setEtag('"v2"');
+    server.setLibraryResponse({
+      skills: [makeSkill("victim")],
+      removals: [],
+      syncedAt: "2025-01-02T00:00:00Z",
+    });
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+    });
+
+    assert.equal(server.getLastLibrarySince(), null, "must be a full fetch");
+    assert.ok(
+      existsSync(join(sentinelDir, "SKILL.md")),
+      "traversal target is UNTOUCHED — the guard rejected the name before any fs op",
+    );
+    assert.equal(result.removed, 0, "a traversal key reconciles nothing");
+    assert.equal(result.quarantined ?? 0, 0, "and quarantines nothing");
+  });
+
+  it("preserves ALL files of a multi-file edited orphan in quarantine (#2879)", async () => {
+    // Quarantine must copy the WHOLE dir tree, not just SKILL.md. A real skill
+    // carries scripts/ and references/; prove every file survives byte-for-byte
+    // (the existing quarantine tests only cover single-file skills).
+    const multi = {
+      owner: "alice",
+      name: "multi",
+      version: "1.0.0",
+      description: "multi-file skill",
+      files: [
+        { path: "SKILL.md", content: "---\nname: multi\ndescription: m\n---\n\nbody\n", sha256: "x", size: 1, contentType: "text/markdown" },
+        { path: "scripts/run.sh", content: "#!/bin/sh\necho hi\n", sha256: "x", size: 1, contentType: "text/x-shellscript" },
+        { path: "references/guide.md", content: "# Guide\nreference body\n", sha256: "x", size: 1, contentType: "text/markdown" },
+      ],
+    };
+    server.setEtag('"v1"');
+    server.setLibraryResponse({ skills: [multi], removals: [], syncedAt: "2025-01-01T00:00:00Z" });
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+    const dir = resolvePlacementDir("claudeProject", "multi");
+    assert.ok(existsSync(join(dir, "scripts", "run.sh")), "multi-file skill written with scripts/");
+
+    // User edits one nested file → whole dir diverges from baseline → quarantine.
+    appendFileSync(join(dir, "references", "guide.md"), "\nMY EDIT\n");
+
+    forceFullFetchNextSync();
+    server.setEtag('"v2"');
+    server.setLibraryResponse({ skills: [], removals: [], syncedAt: "2025-01-02T00:00:00Z" });
+    const result = await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+
+    assert.equal(result.quarantined, 1, "the edited multi-file orphan is quarantined");
+    assert.equal(existsSync(dir), false, "loadable dir removed");
+    const q = readdirSync(globalQuarantineDir()).filter((d) => d.startsWith("multi-"));
+    assert.equal(q.length, 1, "exactly one quarantined copy");
+    const qdir = join(globalQuarantineDir(), q[0]);
+    assert.ok(existsSync(join(qdir, "SKILL.md")), "SKILL.md preserved in quarantine");
+    assert.ok(existsSync(join(qdir, "scripts", "run.sh")), "scripts/run.sh preserved in quarantine");
+    assert.match(
+      readFileSync(join(qdir, "scripts", "run.sh"), "utf-8"),
+      /echo hi/,
+      "nested script content intact",
+    );
+    assert.match(
+      readFileSync(join(qdir, "references", "guide.md"), "utf-8"),
+      /MY EDIT/,
+      "the user's edit is preserved byte-for-byte",
+    );
+  });
+});
+
 // ───────────────────────────────────────────────────────────────────
 // placementsAreComplete unit tests (PR #1575 hotfix)
 // ───────────────────────────────────────────────────────────────────