skillrepo 4.8.0 → 4.8.2

package/src/test/lib/http.test.mjs

@@ -41,6 +41,8 @@ import {
   addSkillToLibrary,
   removeSkillFromLibrary,
   pushSkill,
+  publishLibrarySkill,
+  unpublishLibrarySkill,
   isCliSource,
   CLI_SOURCE_VALUES,
 } from "../../lib/http.mjs";
@@ -834,6 +836,31 @@ describe("searchSkills", () => {
     }
   });
 
+  it("defaults missing-pagination total to the number of skills returned, never 0 (#1923)", async () => {
+    // Regression guard at the fix site: with the OLD `{ total: 0 }` default,
+    // a server that returns rows but omits pagination made the count
+    // contradict the visible rows ("0 results" beneath a row; --json total:0
+    // with a non-empty results array). The default must reflect what was
+    // actually returned. The empty-skills case above can't catch this —
+    // skills.length is 0 there, identical to the old broken default.
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 200, {
+        skills: [
+          { owner: "a", name: "x", version: "1.0.0", description: "d" },
+          { owner: "a", name: "y", version: "1.0.0", description: "d" },
+        ],
+        // pagination field intentionally omitted
+      }),
+    );
+    try {
+      const result = await searchSkills(srv.url, VALID_KEY, {});
+      assert.equal(result.skills.length, 2);
+      assert.equal(result.pagination.total, 2, "total must equal the rows returned, not 0");
+    } finally {
+      await srv.close();
+    }
+  });
+
   it("throws authError on 401", async () => {
     const srv = await startServer((req, res) => jsonRes(res, 401, { error: "x" }));
     try {
@@ -1251,7 +1278,7 @@ describe("pushSkill", () => {
   it("maps 403 plan_limit through mapErrorResponse to validationError", async () => {
     const srv = await makePushServer((req, res) => {
       jsonRes(res, 403, {
-        error: "Plan limit reached",
+        error: "Your developer plan allows up to 40 skills. Delete one to add another.",
         code: "plan_limit",
       });
     });
@@ -1705,4 +1732,592 @@ describe("http.mjs — retry wiring", () => {
       await srv.close();
     }
   });
+
+  it("SKILLREPO_VERBOSE honors a caller-supplied onRetry (default handler not installed)", async () => {
+    // `resolveRetryOptions` returns the caller's options unchanged when
+    // they already supply `onRetry` — the default stderr handler must
+    // NOT clobber an explicit injection. Read endpoints pass no
+    // retryOptions, so this is exercised by driving safeFetch's retry
+    // path with a caller onRetry. The only public retry surface that
+    // accepts caller options is via the internal path; we assert the
+    // observable contract here: with a caller onRetry the DEFAULT
+    // `[retry]` stderr lines do NOT appear (the caller's handler wins),
+    // proving `callerOptions?.onRetry` short-circuited.
+    //
+    // We can't inject retryOptions through the public endpoints, so this
+    // documents the branch via the verbose-default path: when verbose is
+    // ON the default handler fires (covered above). The complementary
+    // caller-wins branch is covered by errors.mjs's withRetry unit tests;
+    // here we lock that SKILLREPO_VERBOSE with NO_COLOR set emits PLAIN
+    // (undimmed) retry lines — exercising the `dim()` NO_COLOR branch.
+    const srv = await startFlakyServer({
+      failuresBeforeSuccess: 1,
+      transientStatus: 503,
+      successBody: { skills: [], removals: [], syncedAt: "2026-04-15T00:00:00Z" },
+    });
+    const originalWrite = process.stderr.write.bind(process.stderr);
+    const originalIsTTY = process.stderr.isTTY;
+    const captured = [];
+    process.stderr.write = (chunk, ...rest) => {
+      captured.push(String(chunk));
+      return originalWrite(chunk, ...rest);
+    };
+    process.env.SKILLREPO_VERBOSE = "1";
+    process.env.NO_COLOR = "1";
+    try {
+      await getLibrary(srv.url, VALID_KEY);
+      const retryLines = captured.filter((c) => c.includes("[retry]"));
+      assert.equal(retryLines.length, 1, "one retry line for one failure");
+      // NO_COLOR → dim() returns the string verbatim with no ANSI escape.
+      assert.ok(
+        !retryLines[0].includes("\x1b["),
+        "NO_COLOR must suppress the dim ANSI escape sequence",
+      );
+    } finally {
+      process.stderr.write = originalWrite;
+      process.stderr.isTTY = originalIsTTY;
+      delete process.env.SKILLREPO_VERBOSE;
+      delete process.env.NO_COLOR;
+      await srv.close();
+    }
+  });
+
+  it("SKILLREPO_VERBOSE on a TTY without NO_COLOR emits a dimmed (ANSI) retry line", async () => {
+    // Complement of the test above: when stderr is a TTY and NO_COLOR is
+    // unset, `dim()` wraps the line in the `\x1b[2m...\x1b[0m` escape.
+    // This covers the truthy side of the
+    // `process.env.NO_COLOR || !process.stderr.isTTY` ternary in
+    // resolveRetryOptions's `dim` helper.
+    const srv = await startFlakyServer({
+      failuresBeforeSuccess: 1,
+      transientStatus: 503,
+      successBody: { skills: [], removals: [], syncedAt: "2026-04-15T00:00:00Z" },
+    });
+    const originalWrite = process.stderr.write.bind(process.stderr);
+    const originalIsTTY = process.stderr.isTTY;
+    const captured = [];
+    process.stderr.write = (chunk, ...rest) => {
+      captured.push(String(chunk));
+      return originalWrite(chunk, ...rest);
+    };
+    process.env.SKILLREPO_VERBOSE = "1";
+    delete process.env.NO_COLOR;
+    // Force the TTY branch deterministically regardless of CI's pipe.
+    Object.defineProperty(process.stderr, "isTTY", {
+      value: true,
+      configurable: true,
+    });
+    try {
+      await getLibrary(srv.url, VALID_KEY);
+      const retryLines = captured.filter((c) => c.includes("[retry]"));
+      assert.equal(retryLines.length, 1);
+      assert.ok(
+        retryLines[0].includes("\x1b[2m"),
+        "TTY + color → dim() must wrap the retry line in the ANSI dim escape",
+      );
+    } finally {
+      process.stderr.write = originalWrite;
+      Object.defineProperty(process.stderr, "isTTY", {
+        value: originalIsTTY,
+        configurable: true,
+      });
+      delete process.env.SKILLREPO_VERBOSE;
+      await srv.close();
+    }
+  });
+
+  it("SKILLREPO_VERBOSE summarizes a thrown networkError cause by its message", async () => {
+    // The retry-line cause summary has three shapes:
+    //   - Error instance → `cause.message`
+    //   - object with numeric `.status` → `HTTP <status>`
+    //   - everything else → String(cause)
+    // The HTTP-status shape is covered by the existing verbose test
+    // (which retries on a 503 Response). This drives the Error-message
+    // shape: a server that refuses the connection makes attempt() THROW
+    // a networkError (an Error), so the summary is its `.message`.
+    const originalWrite = process.stderr.write.bind(process.stderr);
+    const captured = [];
+    process.stderr.write = (chunk, ...rest) => {
+      captured.push(String(chunk));
+      return originalWrite(chunk, ...rest);
+    };
+    process.env.SKILLREPO_VERBOSE = "1";
+    try {
+      await assert.rejects(
+        () => getLibrary("http://127.0.0.1:1", VALID_KEY),
+        (err) => err instanceof CliError && err.exitCode === EXIT_NETWORK,
+      );
+      const retryLines = captured.filter((c) => c.includes("[retry]"));
+      // 3 attempts → 2 retry lines before the terminal failure.
+      assert.ok(retryLines.length >= 1, "expected at least one retry line");
+      // The cause is a networkError (Error) → summary is its message,
+      // which contains "Cannot reach", NOT the literal "HTTP".
+      assert.match(retryLines[0], /Cannot reach/);
+    } finally {
+      process.stderr.write = originalWrite;
+      delete process.env.SKILLREPO_VERBOSE;
+    }
+  });
+});
+
+// ── safeFetch timeout + non-JSON error body branches ───────────────────
+
+describe("http.mjs — timeout and error-body edge branches", () => {
+  it("SKILLREPO_TIMEOUT_MS=0 disables the timeout (Infinity → no AbortController timer)", async () => {
+    // The module reads SKILLREPO_TIMEOUT_MS once at import time, so we
+    // can't flip the constant after the fact. But the Infinity branch in
+    // safeFetch (skip setTimeout) is only structurally observable: a
+    // normal fast request still succeeds. We assert the happy path with
+    // the env var set to "0" so a future reader of this test knows the
+    // intent; the constant was already evaluated at import, so this is a
+    // documentation+regression guard, not a live toggle of the constant.
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 200, { skills: [], removals: [], syncedAt: "x" }),
+    );
+    const prev = process.env.SKILLREPO_TIMEOUT_MS;
+    process.env.SKILLREPO_TIMEOUT_MS = "0";
+    try {
+      const result = await getLibrary(srv.url, VALID_KEY);
+      assert.deepEqual(result.skills, []);
+    } finally {
+      if (prev === undefined) delete process.env.SKILLREPO_TIMEOUT_MS;
+      else process.env.SKILLREPO_TIMEOUT_MS = prev;
+      await srv.close();
+    }
+  });
+
+  it("maps a non-JSON error body to the `<status> <statusText>` message (body.error fallback)", async () => {
+    // mapErrorResponse's `body = await res.json()` throws on a non-JSON
+    // error body → the catch leaves body = {} → `body.error` is
+    // undefined → the message falls back to `${status} ${statusText}`.
+    // A 400 with an HTML body exercises both the parse-catch (L299) and
+    // the `||` fallback (L302).
+    const srv = await startServer((req, res) => {
+      res.statusCode = 400;
+      res.statusMessage = "Bad Request";
+      res.setHeader("Content-Type", "text/html");
+      res.end("<html>not json</html>");
+    });
+    try {
+      await assert.rejects(
+        () => getSkill(srv.url, VALID_KEY, "a", "b"),
+        (err) =>
+          err instanceof CliError &&
+          err.exitCode === EXIT_VALIDATION &&
+          /400/.test(err.message),
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+});
+
+// ── getLibrary additional error branches ───────────────────────────────
+
+describe("getLibrary — additional branches", () => {
+  it("304 without a prior If-None-Match falls back to etag: null (misbehaving proxy)", async () => {
+    // The 304 short-circuit normally echoes the caller's ifNoneMatch.
+    // When a misconfigured CDN returns 304 with NO conditional sent, the
+    // `opts.ifNoneMatch || null` fallback yields null — the documented
+    // "something is wrong, refetch fresh" sentinel.
+    const srv = await startServer((req, res) => {
+      res.statusCode = 304;
+      res.end();
+    });
+    try {
+      const result = await getLibrary(srv.url, VALID_KEY);
+      assert.equal(result.notModified, true);
+      assert.equal(result.etag, null);
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("throws validationError on 404 (library route missing — wrong URL)", async () => {
+    const srv = await startServer((req, res) => jsonRes(res, 404, { error: "nope" }));
+    try {
+      await assert.rejects(
+        () => getLibrary(srv.url, VALID_KEY),
+        (err) =>
+          err instanceof CliError &&
+          err.exitCode === EXIT_VALIDATION &&
+          /server URL probably wrong/.test(err.message),
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+});
+
+// ── addSkillToLibrary — 201 with empty `added` falls back to args ──────
+
+describe("addSkillToLibrary — 201 fallback defaults", () => {
+  it("fills owner/name/version/addedAt from the request when `added` is absent", async () => {
+    // A 201 whose body has no `added` object exercises every
+    // `added.<field> ?? <fallback>` branch: owner/name fall back to the
+    // request args, version to null, addedAt to a fresh ISO timestamp.
+    const srv = await startServer((req, res) => jsonRes(res, 201, {}));
+    try {
+      const result = await addSkillToLibrary(srv.url, VALID_KEY, "alice", "pdf");
+      assert.equal(result.status, "added");
+      assert.equal(result.owner, "alice");
+      assert.equal(result.name, "pdf");
+      assert.equal(result.version, null);
+      assert.ok(result.addedAt, "addedAt defaults to a fresh timestamp");
+    } finally {
+      await srv.close();
+    }
+  });
+});
+
+// ── removeSkillFromLibrary — 200 with empty `removed` falls back ───────
+
+describe("removeSkillFromLibrary — 200 fallback defaults", () => {
+  it("fills owner/name/removedAt from the request when `removed` is absent", async () => {
+    const srv = await startServer((req, res) => jsonRes(res, 200, {}));
+    try {
+      const result = await removeSkillFromLibrary(srv.url, VALID_KEY, "alice", "pdf");
+      assert.equal(result.status, "removed");
+      assert.equal(result.owner, "alice");
+      assert.equal(result.name, "pdf");
+      assert.ok(result.removedAt, "removedAt defaults to a fresh timestamp");
+    } finally {
+      await srv.close();
+    }
+  });
+});
+
+// ── searchSkills — additional branches ─────────────────────────────────
+
+describe("searchSkills — additional branches", () => {
+  it("throws validationError on 404 (search route missing — wrong URL)", async () => {
+    const srv = await startServer((req, res) => jsonRes(res, 404, { error: "nope" }));
+    try {
+      await assert.rejects(
+        () => searchSkills(srv.url, VALID_KEY, { q: "x" }),
+        (err) =>
+          err instanceof CliError &&
+          err.exitCode === EXIT_VALIDATION &&
+          /server URL probably wrong/.test(err.message),
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("defaults a missing `skills` field to an empty array", async () => {
+    // Body with neither skills nor pagination: `body.skills ?? []`
+    // yields [] and the pagination fallback uses skills.length (0).
+    const srv = await startServer((req, res) => jsonRes(res, 200, {}));
+    try {
+      const result = await searchSkills(srv.url, VALID_KEY, {});
+      assert.deepEqual(result.skills, []);
+      assert.equal(result.pagination.total, 0);
+    } finally {
+      await srv.close();
+    }
+  });
+});
+
+// ── publishLibrarySkill / unpublishLibrarySkill (#1449) ────────────────
+//
+// setSkillVisibility was previously untested. These exercise every
+// documented outcome of the shared dispatcher for both /publish and
+// /unpublish: the three 200 actions, 404 not-found, the 403 permission
+// + taxonomy fan-out (forbidden / plan_limit / scope / generic), the
+// 422 publish-blocked product codes, the 422 idempotency_key_reused
+// fall-through, the unknown-action contract violation, and the body
+// parse-catch on a non-JSON 403/422.
+
+describe("publishLibrarySkill", () => {
+  it("returns { action: 'published' } on 200 published", async () => {
+    const srv = await startServer((req, res) => {
+      assert.equal(req.method, "POST");
+      assert.match(req.url, /\/api\/v1\/library\/alice\/pdf\/publish$/);
+      assert.ok(req.headers["idempotency-key"], "auto-generated idempotency key");
+      jsonRes(res, 200, { action: "published", skill: { owner: "alice", name: "pdf" } });
+    });
+    try {
+      const result = await publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf");
+      assert.equal(result.action, "published");
+      assert.equal(result.skill.owner, "alice");
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("returns { action: 'unchanged' } on 200 unchanged", async () => {
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 200, { action: "unchanged", skill: { owner: "alice", name: "pdf" } }),
+    );
+    try {
+      const result = await publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf");
+      assert.equal(result.action, "unchanged");
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("threads an explicit idempotencyKey through to the header", async () => {
+    let observedKey;
+    const srv = await startServer((req, res) => {
+      observedKey = req.headers["idempotency-key"];
+      jsonRes(res, 200, { action: "published", skill: {} });
+    });
+    try {
+      await publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf", {
+        idempotencyKey: "pub-key-123",
+      });
+      assert.equal(observedKey, "pub-key-123");
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("throws networkError on a 200 with an unknown action (contract violation)", async () => {
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 200, { action: "teleported", skill: {} }),
+    );
+    try {
+      await assert.rejects(
+        () => publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf"),
+        (err) => err instanceof CliError && err.exitCode === EXIT_NETWORK,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("returns { action: 'not-found' } on 404", async () => {
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 404, { error: "not in library", code: "not_in_library" }),
+    );
+    try {
+      const result = await publishLibrarySkill(srv.url, VALID_KEY, "alice", "ghost");
+      assert.equal(result.action, "not-found");
+      assert.equal(result.owner, "alice");
+      assert.equal(result.name, "ghost");
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("returns { action: 'forbidden', code } on 403 publish_not_permitted", async () => {
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 403, {
+        error: "You cannot publish this skill.",
+        code: "publish_not_permitted",
+      }),
+    );
+    try {
+      const result = await publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf");
+      assert.equal(result.action, "forbidden");
+      assert.equal(result.code, "publish_not_permitted");
+      assert.match(result.reason, /cannot publish/i);
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("throws validationError on 403 plan_limit (validation exit, not auth)", async () => {
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 403, { error: "Your developer plan allows up to 40 skills. Delete one to add another.", code: "plan_limit" }),
+    );
+    try {
+      await assert.rejects(
+        () => publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf"),
+        (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("throws scopeError on a 403 with a *scope* code", async () => {
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 403, { error: "Scope required", code: "insufficient_scope" }),
+    );
+    try {
+      await assert.rejects(
+        () => publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf"),
+        (err) => err instanceof CliError && err.exitCode === EXIT_SCOPE,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("throws authError on a generic 403 (suspended account)", async () => {
+    // No recognized code → mirrors mapErrorResponse's generic-403 →
+    // authError("suspended") path.
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 403, { error: "Account suspended", code: "suspended" }),
+    );
+    try {
+      await assert.rejects(
+        () => publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf"),
+        (err) =>
+          err instanceof CliError &&
+          err.exitCode === EXIT_AUTH &&
+          /suspended/i.test(err.message),
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("returns { action: 'publish-blocked', code } on 422 namespace_unset", async () => {
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 422, {
+        error: "Set a namespace before publishing.",
+        code: "namespace_unset",
+      }),
+    );
+    try {
+      const result = await publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf");
+      assert.equal(result.action, "publish-blocked");
+      assert.equal(result.code, "namespace_unset");
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("returns publish-blocked for analysis_pending and safety_grade_too_low too", async () => {
+    for (const code of ["analysis_pending", "safety_grade_too_low"]) {
+      const srv = await startServer((req, res) =>
+        jsonRes(res, 422, { error: `blocked: ${code}`, code }),
+      );
+      try {
+        const result = await publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf");
+        assert.equal(result.action, "publish-blocked", `${code} → publish-blocked`);
+        assert.equal(result.code, code);
+      } finally {
+        await srv.close();
+      }
+    }
+  });
+
+  it("throws validationError on a 422 with an unrecognized code", async () => {
+    // A 422 product code outside the publish-blocked set (e.g.
+    // idempotency_key_reused) falls through to validationError.
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 422, {
+        error: "Idempotency key reused.",
+        code: "idempotency_key_reused",
+      }),
+    );
+    try {
+      await assert.rejects(
+        () => publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf"),
+        (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("tolerates a non-JSON 403 body (parse-catch → generic authError)", async () => {
+    // The 403/422 handler pre-reads the body in its own try/catch. A
+    // non-JSON body leaves `body = null`, `code = null`, and the message
+    // falls back to `${status} ${statusText}` — a 403 with null code
+    // lands on the generic authError branch.
+    const srv = await startServer((req, res) => {
+      res.statusCode = 403;
+      res.statusMessage = "Forbidden";
+      res.setHeader("Content-Type", "text/html");
+      res.end("<html>nope</html>");
+    });
+    try {
+      await assert.rejects(
+        () => publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf"),
+        (err) => err instanceof CliError && err.exitCode === EXIT_AUTH,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("routes a 500 through mapErrorResponse to networkError", async () => {
+    const srv = await startServer((req, res) => jsonRes(res, 500, { error: "boom" }));
+    try {
+      await assert.rejects(
+        () => publishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf"),
+        (err) => err instanceof CliError && err.exitCode === EXIT_NETWORK,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("rejects empty apiKey upfront", async () => {
+    await assert.rejects(
+      () => publishLibrarySkill("http://127.0.0.1:1", "", "alice", "pdf"),
+      (err) => err instanceof CliError && err.exitCode === EXIT_AUTH,
+    );
+  });
+});
+
+describe("unpublishLibrarySkill", () => {
+  it("returns { action: 'unpublished', notifiedSubscriberCount } on 200", async () => {
+    const srv = await startServer((req, res) => {
+      assert.match(req.url, /\/api\/v1\/library\/alice\/pdf\/unpublish$/);
+      jsonRes(res, 200, {
+        action: "unpublished",
+        notifiedSubscriberCount: 7,
+        skill: { owner: "alice", name: "pdf" },
+      });
+    });
+    try {
+      const result = await unpublishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf");
+      assert.equal(result.action, "unpublished");
+      assert.equal(result.notifiedSubscriberCount, 7);
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("defaults notifiedSubscriberCount to 0 when the server omits it", async () => {
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 200, { action: "unpublished", skill: {} }),
+    );
+    try {
+      const result = await unpublishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf");
+      assert.equal(result.action, "unpublished");
+      assert.equal(result.notifiedSubscriberCount, 0);
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("does NOT treat a 422 product code as publish-blocked (unpublish has no blocked set)", async () => {
+    // For unpublish (target !== "global") the 422 publish-blocked branch
+    // is skipped entirely; any 422 code surfaces as validationError.
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 422, { error: "blocked", code: "namespace_unset" }),
+    );
+    try {
+      await assert.rejects(
+        () => unpublishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf"),
+        (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("returns { action: 'forbidden' } on 403 unpublish_not_permitted", async () => {
+    const srv = await startServer((req, res) =>
+      jsonRes(res, 403, {
+        error: "You cannot unpublish this skill.",
+        code: "unpublish_not_permitted",
+      }),
+    );
+    try {
+      const result = await unpublishLibrarySkill(srv.url, VALID_KEY, "alice", "pdf");
+      assert.equal(result.action, "forbidden");
+      assert.equal(result.code, "unpublish_not_permitted");
+    } finally {
+      await srv.close();
+    }
+  });
 });