skillrepo 4.8.0 → 4.8.2

package/src/test/lib/sync.test.mjs

@@ -253,6 +253,42 @@ describe("readLastSync / writeLastSync", () => {
     assert.equal(readLastSync(), null);
   });
 
+  it("returns null when the JSON parses to a non-object primitive (`null`)", () => {
+    // `!parsed || typeof parsed !== "object"` — a file that parses to a
+    // bare `null` (or a number) is not a usable state object.
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(globalLastSyncPath(), "null");
+    assert.equal(readLastSync(), null);
+  });
+
+  it("a v1 file with a non-string etag migrates to etag: null", () => {
+    // The v1 → v2 migration guards each carried-over field with a
+    // `typeof === "string"` check. A v1 file whose etag is the wrong
+    // type carries forward as null (forces a fresh unconditional sync)
+    // rather than propagating a bogus value.
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(
+      globalLastSyncPath(),
+      JSON.stringify({ schemaVersion: 1, etag: 12345, syncedAt: "2024-12-01T00:00:00Z" }),
+    );
+    const migrated = readLastSync();
+    assert.ok(migrated);
+    assert.equal(migrated.etag, null, "non-string v1 etag becomes null");
+    assert.equal(migrated.syncedAt, "2024-12-01T00:00:00Z");
+  });
+
+  it("a v1 file with a non-string syncedAt migrates to syncedAt: null", () => {
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(
+      globalLastSyncPath(),
+      JSON.stringify({ schemaVersion: 1, etag: '"old"', syncedAt: { not: "a string" } }),
+    );
+    const migrated = readLastSync();
+    assert.ok(migrated);
+    assert.equal(migrated.etag, '"old"');
+    assert.equal(migrated.syncedAt, null, "non-string v1 syncedAt becomes null");
+  });
+
   it("returns null on unknown schema version", () => {
     writeLastSync({ etag: "x", syncedAt: "x" });
     const path = globalLastSyncPath();
@@ -1162,14 +1198,23 @@ describe("runSync — one-time membership heal (#1911)", () => {
     assert.equal(cliVersionBelowFloor("5.0.0", "4.8.0"), false);
   });
 
-  it("FULL_RESYNC_FLOOR equals the shipped CLI version", () => {
-    // The floor MUST equal the version that ships this fix; otherwise the
-    // running CLI's own writes would stamp a version below the floor and
-    // it would re-heal on every run. Lock them together.
+  it("shipped CLI version is at/above the heal floor (no self-re-heal)", () => {
+    // FULL_RESYNC_FLOOR is pinned to the #1911 release (4.8.0) — the version
+    // that shipped the membership fix. The hard invariant is that the CURRENT
+    // shipped version is NOT BELOW the floor: writeLastSync stamps the running
+    // version, and if that were below the floor the CLI would re-heal on every
+    // run. (Earlier this asserted strict equality, which held only at 4.8.0 and
+    // broke on the first patch bump — the real invariant is >=, and the floor
+    // intentionally stays at the #1911 release until a NEW one-time heal
+    // migration supersedes it.) #1923.
     const pkg = JSON.parse(
       readFileSync(new URL("../../../package.json", import.meta.url), "utf-8"),
     );
-    assert.equal(FULL_RESYNC_FLOOR, pkg.version);
+    assert.equal(
+      cliVersionBelowFloor(pkg.version, FULL_RESYNC_FLOOR),
+      false,
+      `shipped version ${pkg.version} must not be below the heal floor ${FULL_RESYNC_FLOOR}`,
+    );
   });
 
   it("a pre-fix .last-sync forces ONE full re-fetch, then resumes delta", async () => {
@@ -1424,6 +1469,73 @@ describe("runSync — one-time membership heal (#1911)", () => {
       "remove must not advance the heal-gate version",
     );
   });
+
+  // ── upsert/delete input guards (no state written) ─────────────────
+
+  it("upsertLastSyncEntry no-ops on a non-object skill", () => {
+    // `if (!skill || typeof skill !== "object") return;` — neither a
+    // null nor a primitive can produce a state file.
+    upsertLastSyncEntry(null);
+    upsertLastSyncEntry("not a skill");
+    assert.equal(readLastSync(), null, "no state file written for a bad skill arg");
+  });
+
+  it("upsertLastSyncEntry no-ops when owner/name are not strings", () => {
+    upsertLastSyncEntry({ owner: 1, name: 2, files: [] });
+    assert.equal(readLastSync(), null);
+  });
+
+  it("upsertLastSyncEntry no-ops when files is not an array", () => {
+    upsertLastSyncEntry({ owner: "a", name: "b", files: "nope" });
+    assert.equal(readLastSync(), null);
+  });
+
+  it("upsertLastSyncEntry no-ops when there is no SKILL.md (null SHAs)", () => {
+    // computeSkillShas returns null SHAs when no SKILL.md is present;
+    // persisting those would later misclassify as `edited`, so the
+    // upsert is skipped entirely.
+    upsertLastSyncEntry({
+      owner: "a",
+      name: "b",
+      version: "1.0.0",
+      files: [{ path: "references/only.md", content: "no skill md here" }],
+    });
+    assert.equal(readLastSync(), null, "missing SKILL.md must skip the upsert");
+  });
+
+  it("upsertLastSyncEntry coerces a non-string version to an empty string", () => {
+    // `typeof skill.version === "string" ? skill.version : ""` — a
+    // numeric version is stored as "".
+    upsertLastSyncEntry({
+      owner: "alice",
+      name: "weird",
+      version: 1.0, // not a string
+      files: [
+        { path: "SKILL.md", content: "---\nname: weird\ndescription: d\n---\nbody" },
+      ],
+    });
+    const stored = readLastSync().skills["alice/weird"];
+    assert.ok(stored, "entry should be written");
+    assert.equal(stored.version, "", "non-string version coerces to empty string");
+  });
+
+  it("deleteLastSyncEntry no-ops when owner/name are not strings", () => {
+    upsertLastSyncEntry({
+      owner: "alice",
+      name: "keep",
+      version: "1.0.0",
+      files: [
+        { path: "SKILL.md", content: "---\nname: keep\ndescription: d\n---\nbody" },
+      ],
+    });
+    const before = readLastSync();
+    deleteLastSyncEntry(42, undefined);
+    assert.deepEqual(
+      readLastSync().skills,
+      before.skills,
+      "a non-string owner/name must leave the skills map untouched",
+    );
+  });
 });
 
 describe("runSync — input validation", () => {
@@ -1911,4 +2023,26 @@ describe("placementsAreComplete — direct unit coverage", () => {
     // malformed entry is skipped (continue) — no false negative.
     assert.equal(placementsAreComplete(skills, ["claudeCode"], false), true);
   });
+
+  it("skips a key with a trailing slash (empty skill-name half) without crashing", () => {
+    // `"owner/"` has slashAt >= 0 (passes the no-slash guard) but the
+    // name half is empty → the `if (!skillName) continue` branch skips
+    // it. The valid skill is still on disk, so the result is true.
+    seedSkillMd("claudeProject", "good");
+    const skills = {
+      "alice/good": {
+        version: "1.0.0",
+        skillMdSha256: "a".repeat(64),
+        filesSha256: "b".repeat(64),
+        syncedAt: "x",
+      },
+      "owner-with-no-name/": {
+        version: "1.0.0",
+        skillMdSha256: "a".repeat(64),
+        filesSha256: "b".repeat(64),
+        syncedAt: "x",
+      },
+    };
+    assert.equal(placementsAreComplete(skills, ["claudeCode"], false), true);
+  });
 });

package/src/test/lib/telemetry.test.mjs

@@ -265,6 +265,40 @@ describe("reportInitFailure", () => {
     );
   });
 
+  it("sends serverUrlHost 'unknown' when the server URL can't be parsed", async () => {
+    // `hostnameFrom` wraps `new URL(serverUrl).host` in try/catch and
+    // returns "unknown" on a parse failure. A non-URL string reaches the
+    // payload builder (telemetry is still enabled, stage is valid) and
+    // exercises the catch branch. The endpoint URL still gets built via
+    // `serverUrl.replace(...)` — only the host extraction falls back.
+    const fetchSpy = makeFetchSpy();
+    await reportInitFailure({
+      serverUrl: "::::not a url::::",
+      config: { telemetry: true },
+      stage: "library_sync",
+      errorCode: 1,
+      deps: { fetch: fetchSpy },
+    });
+    assert.equal(fetchSpy.calls.length, 1);
+    const body = JSON.parse(fetchSpy.calls[0].init.body);
+    assert.equal(body.serverUrlHost, "unknown");
+  });
+
+  it("does nothing when the injected fetch is not a function (defensive)", async () => {
+    // `(deps && deps.fetch) || globalThis.fetch` selects the injected
+    // value when it's truthy; a truthy-but-not-callable value then trips
+    // the `typeof fetchImpl !== "function"` guard and the function
+    // returns before constructing an AbortController or calling fetch.
+    await reportInitFailure({
+      serverUrl: "https://skillrepo.dev",
+      config: { telemetry: true },
+      stage: "post_paste_validate",
+      errorCode: 401,
+      deps: { fetch: 12345 },
+    });
+    // No throw, no network call — reaching this line is the assertion.
+  });
+
   it("does not fire on unsupported platforms (server would 400)", async () => {
     // Simulate by swapping global fetch with a sentinel — we can't
     // easily monkey `os.platform()`, so this verifies the symmetric

package/src/test/mergers/claude-mcp.test.mjs

@@ -75,4 +75,34 @@ describe("Claude Code MCP config merger", () => {
 
     assert.throws(() => mergeClaudeMcpConfig("https://mcp.skillrepo.dev"), /invalid JSON/);
   });
+
+  it("rebuilds mcpServers when the existing field is not an object", async () => {
+    const { mergeClaudeMcpConfig } = await import("../../lib/mergers/claude-mcp.mjs");
+
+    // mcpServers present but not an object — the merger must replace it
+    // with {} before adding skillrepo (the typeof guard branch).
+    writeFileSync(join(tempDir, ".mcp.json"), JSON.stringify({ mcpServers: "nope" }));
+
+    const result = mergeClaudeMcpConfig("https://mcp.skillrepo.dev");
+
+    // No prior skillrepo entry → "merged" (added to existing file).
+    assert.equal(result.action, "merged");
+    const content = JSON.parse(readFileSync(join(tempDir, ".mcp.json"), "utf-8"));
+    assert.equal(typeof content.mcpServers, "object");
+    assert.ok(content.mcpServers.skillrepo);
+  });
+
+  it("creates mcpServers when the key is entirely absent", async () => {
+    const { mergeClaudeMcpConfig } = await import("../../lib/mergers/claude-mcp.mjs");
+
+    // Valid JSON object, no mcpServers key (falsy branch of the guard).
+    writeFileSync(join(tempDir, ".mcp.json"), JSON.stringify({ unrelated: true }));
+
+    const result = mergeClaudeMcpConfig("https://mcp.skillrepo.dev");
+
+    assert.equal(result.action, "merged");
+    const content = JSON.parse(readFileSync(join(tempDir, ".mcp.json"), "utf-8"));
+    assert.ok(content.mcpServers.skillrepo);
+    assert.equal(content.unrelated, true, "unrelated keys preserved");
+  });
 });

package/src/test/mergers/cursor-mcp.test.mjs

@@ -0,0 +1,115 @@
+/**
+ * Unit tests for src/lib/mergers/cursor-mcp.mjs.
+ *
+ * Cursor's .cursor/mcp.json uses `mcpServers` with a `url` key and
+ * ${env:VAR} interpolation. These cover the branches the mcp-merge
+ * integration tests don't reach directly: invalid-JSON throw and the
+ * non-object `mcpServers` rebuild.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+let originalCwd;
+let tempDir;
+
+beforeEach(() => {
+  originalCwd = process.cwd;
+  tempDir = mkdtempSync(join(tmpdir(), "cli-test-cursor-"));
+  process.cwd = () => tempDir;
+  mkdirSync(join(tempDir, ".cursor"), { recursive: true });
+});
+
+afterEach(() => {
+  process.cwd = originalCwd;
+  rmSync(tempDir, { recursive: true, force: true });
+});
+
+const cursorPath = () => join(tempDir, ".cursor", "mcp.json");
+
+describe("Cursor MCP config merger", () => {
+  it("creates .cursor/mcp.json when file does not exist", async () => {
+    const { mergeCursorMcpConfig } = await import("../../lib/mergers/cursor-mcp.mjs");
+    const result = mergeCursorMcpConfig("https://mcp.skillrepo.dev");
+
+    assert.equal(result.action, "created");
+    assert.equal(result.path, ".cursor/mcp.json");
+
+    const content = JSON.parse(readFileSync(cursorPath(), "utf-8"));
+    assert.equal(content.mcpServers.skillrepo.url, "https://mcp.skillrepo.dev");
+    assert.equal(
+      content.mcpServers.skillrepo.headers.Authorization,
+      "Bearer ${env:SKILLREPO_ACCESS_KEY}",
+    );
+  });
+
+  it("merges into existing config preserving other servers", async () => {
+    const { mergeCursorMcpConfig } = await import("../../lib/mergers/cursor-mcp.mjs");
+
+    writeFileSync(
+      cursorPath(),
+      JSON.stringify({ mcpServers: { other: { url: "https://other.example" } } }),
+    );
+
+    const result = mergeCursorMcpConfig("https://mcp.skillrepo.dev");
+
+    assert.equal(result.action, "created");
+    const content = JSON.parse(readFileSync(cursorPath(), "utf-8"));
+    assert.ok(content.mcpServers.other, "other server preserved");
+    assert.ok(content.mcpServers.skillrepo, "skillrepo added");
+  });
+
+  it("returns 'merged' when a skillrepo entry already exists", async () => {
+    const { mergeCursorMcpConfig } = await import("../../lib/mergers/cursor-mcp.mjs");
+
+    writeFileSync(
+      cursorPath(),
+      JSON.stringify({ mcpServers: { skillrepo: { url: "https://old.example" } } }),
+    );
+
+    const result = mergeCursorMcpConfig("https://new.example/mcp");
+
+    assert.equal(result.action, "merged");
+    const content = JSON.parse(readFileSync(cursorPath(), "utf-8"));
+    assert.equal(content.mcpServers.skillrepo.url, "https://new.example/mcp");
+  });
+
+  it("rebuilds mcpServers when the existing field is not an object", async () => {
+    const { mergeCursorMcpConfig } = await import("../../lib/mergers/cursor-mcp.mjs");
+
+    writeFileSync(cursorPath(), JSON.stringify({ mcpServers: 42 }));
+
+    const result = mergeCursorMcpConfig("https://mcp.skillrepo.dev");
+
+    assert.equal(result.action, "created");
+    const content = JSON.parse(readFileSync(cursorPath(), "utf-8"));
+    assert.equal(typeof content.mcpServers, "object");
+    assert.ok(content.mcpServers.skillrepo);
+  });
+
+  it("creates mcpServers when the key is entirely absent", async () => {
+    const { mergeCursorMcpConfig } = await import("../../lib/mergers/cursor-mcp.mjs");
+
+    writeFileSync(cursorPath(), JSON.stringify({ unrelated: true }));
+
+    const result = mergeCursorMcpConfig("https://mcp.skillrepo.dev");
+
+    assert.equal(result.action, "created");
+    const content = JSON.parse(readFileSync(cursorPath(), "utf-8"));
+    assert.ok(content.mcpServers.skillrepo);
+    assert.equal(content.unrelated, true, "unrelated keys preserved");
+  });
+
+  it("throws on invalid JSON", async () => {
+    const { mergeCursorMcpConfig } = await import("../../lib/mergers/cursor-mcp.mjs");
+    writeFileSync(cursorPath(), "not json {{{");
+
+    assert.throws(
+      () => mergeCursorMcpConfig("https://mcp.skillrepo.dev"),
+      /invalid JSON/,
+    );
+  });
+});

package/src/test/mergers/env-local.test.mjs

@@ -0,0 +1,126 @@
+/**
+ * Unit tests for src/lib/mergers/env-local.mjs.
+ *
+ * mergeEnvLocal is append-only: it writes SKILLREPO_ACCESS_KEY into
+ * .env.local, creating the file if absent, updating the line in place
+ * if the value differs, skipping if identical, and appending if the
+ * key is missing — preserving the file's existing line endings.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+let originalCwd;
+let tempDir;
+
+beforeEach(() => {
+  originalCwd = process.cwd;
+  tempDir = mkdtempSync(join(tmpdir(), "cli-test-envlocal-"));
+  process.cwd = () => tempDir;
+});
+
+afterEach(() => {
+  process.cwd = originalCwd;
+  rmSync(tempDir, { recursive: true, force: true });
+});
+
+const envPath = () => join(tempDir, ".env.local");
+const KEY = "SKILLREPO_ACCESS_KEY";
+
+describe("env-local merger", () => {
+  it("creates .env.local when file does not exist", async () => {
+    const { mergeEnvLocal } = await import("../../lib/mergers/env-local.mjs");
+    const result = mergeEnvLocal("sk_live_abc");
+
+    assert.equal(result.action, "created");
+    assert.equal(result.path, ".env.local");
+    assert.equal(readFileSync(envPath(), "utf-8"), `${KEY}=sk_live_abc\n`);
+  });
+
+  it("skips when the key is already present with the same value", async () => {
+    const { mergeEnvLocal } = await import("../../lib/mergers/env-local.mjs");
+    writeFileSync(envPath(), `${KEY}=sk_live_abc\n`);
+
+    const result = mergeEnvLocal("sk_live_abc");
+
+    assert.equal(result.action, "skipped");
+    // File is untouched.
+    assert.equal(readFileSync(envPath(), "utf-8"), `${KEY}=sk_live_abc\n`);
+  });
+
+  it("updates in place when the existing value differs", async () => {
+    const { mergeEnvLocal } = await import("../../lib/mergers/env-local.mjs");
+    writeFileSync(envPath(), `FOO=bar\n${KEY}=sk_live_old\nBAZ=qux\n`);
+
+    const result = mergeEnvLocal("sk_live_new");
+
+    assert.equal(result.action, "updated");
+    const content = readFileSync(envPath(), "utf-8");
+    assert.match(content, new RegExp(`${KEY}=sk_live_new`));
+    assert.doesNotMatch(content, /sk_live_old/);
+    // Surrounding lines preserved.
+    assert.match(content, /FOO=bar/);
+    assert.match(content, /BAZ=qux/);
+  });
+
+  it("appends when the key is missing and the file ends with a newline", async () => {
+    const { mergeEnvLocal } = await import("../../lib/mergers/env-local.mjs");
+    writeFileSync(envPath(), `FOO=bar\n`);
+
+    const result = mergeEnvLocal("sk_live_abc");
+
+    assert.equal(result.action, "added");
+    assert.equal(readFileSync(envPath(), "utf-8"), `FOO=bar\n${KEY}=sk_live_abc\n`);
+  });
+
+  it("appends a newline first when the file has no trailing newline", async () => {
+    const { mergeEnvLocal } = await import("../../lib/mergers/env-local.mjs");
+    // No trailing newline — exercises the content += lineEnding branch.
+    writeFileSync(envPath(), `FOO=bar`);
+
+    const result = mergeEnvLocal("sk_live_abc");
+
+    assert.equal(result.action, "added");
+    assert.equal(readFileSync(envPath(), "utf-8"), `FOO=bar\n${KEY}=sk_live_abc\n`);
+  });
+
+  it("preserves CRLF line endings when updating in place", async () => {
+    const { mergeEnvLocal } = await import("../../lib/mergers/env-local.mjs");
+    writeFileSync(envPath(), `FOO=bar\r\n${KEY}=sk_live_old\r\n`);
+
+    const result = mergeEnvLocal("sk_live_new");
+
+    assert.equal(result.action, "updated");
+    const content = readFileSync(envPath(), "utf-8");
+    assert.ok(content.includes("\r\n"), "CRLF endings preserved");
+    assert.match(content, new RegExp(`${KEY}=sk_live_new`));
+  });
+
+  it("preserves CRLF line endings when appending", async () => {
+    const { mergeEnvLocal } = await import("../../lib/mergers/env-local.mjs");
+    writeFileSync(envPath(), `FOO=bar\r\n`);
+
+    const result = mergeEnvLocal("sk_live_abc");
+
+    assert.equal(result.action, "added");
+    assert.equal(
+      readFileSync(envPath(), "utf-8"),
+      `FOO=bar\r\n${KEY}=sk_live_abc\r\n`,
+    );
+  });
+
+  it("treats an empty existing file as create-on-append (no leading newline)", async () => {
+    const { mergeEnvLocal } = await import("../../lib/mergers/env-local.mjs");
+    // Empty string is non-null → goes through the append path, but the
+    // `content &&` guard skips the newline prefix for empty content.
+    writeFileSync(envPath(), "");
+
+    const result = mergeEnvLocal("sk_live_abc");
+
+    assert.equal(result.action, "added");
+    assert.equal(readFileSync(envPath(), "utf-8"), `${KEY}=sk_live_abc\n`);
+  });
+});

package/src/test/mergers/vscode-mcp.test.mjs

@@ -0,0 +1,177 @@
+/**
+ * Unit tests for src/lib/mergers/vscode-mcp.mjs.
+ *
+ * VS Code's .vscode/mcp.json is the complex merger: it carries an
+ * `inputs` array (the access-key prompt) AND a `servers` object (note:
+ * "servers", not "mcpServers"). Both sections must be created/merged
+ * idempotently while preserving unrelated user entries.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+let originalCwd;
+let tempDir;
+
+beforeEach(() => {
+  originalCwd = process.cwd;
+  tempDir = mkdtempSync(join(tmpdir(), "cli-test-vscode-"));
+  process.cwd = () => tempDir;
+  // Pre-create .vscode so existing-file tests can seed mcp.json directly;
+  // the create-path test writes to a fresh subdir and doesn't depend on it.
+  mkdirSync(join(tempDir, ".vscode"), { recursive: true });
+});
+
+afterEach(() => {
+  process.cwd = originalCwd;
+  rmSync(tempDir, { recursive: true, force: true });
+});
+
+const vscodePath = () => join(tempDir, ".vscode", "mcp.json");
+
+describe("VS Code + Copilot MCP config merger", () => {
+  it("creates .vscode/mcp.json when file does not exist", async () => {
+    const { mergeVscodeMcpConfig } = await import("../../lib/mergers/vscode-mcp.mjs");
+    const result = mergeVscodeMcpConfig("https://mcp.skillrepo.dev");
+
+    assert.equal(result.action, "created");
+    assert.equal(result.path, ".vscode/mcp.json");
+
+    const content = JSON.parse(readFileSync(vscodePath(), "utf-8"));
+    assert.equal(content.servers.skillrepo.type, "http");
+    assert.equal(content.servers.skillrepo.url, "https://mcp.skillrepo.dev");
+    assert.equal(
+      content.servers.skillrepo.headers.Authorization,
+      "Bearer ${input:skillrepo-api-key}",
+    );
+    // The input prompt entry must be seeded on create.
+    assert.equal(content.inputs.length, 1);
+    assert.equal(content.inputs[0].id, "skillrepo-api-key");
+    assert.equal(content.inputs[0].password, true);
+  });
+
+  it("merges into existing config preserving other servers and inputs", async () => {
+    const { mergeVscodeMcpConfig } = await import("../../lib/mergers/vscode-mcp.mjs");
+
+    const existing = {
+      inputs: [{ id: "other-tool-key", type: "promptString" }],
+      servers: {
+        other: { type: "http", url: "https://other.example" },
+      },
+    };
+    writeFileSync(vscodePath(), JSON.stringify(existing));
+
+    const result = mergeVscodeMcpConfig("https://mcp.skillrepo.dev");
+
+    // No skillrepo server existed yet → "created".
+    assert.equal(result.action, "created");
+    const content = JSON.parse(readFileSync(vscodePath(), "utf-8"));
+    assert.ok(content.servers.other, "other server preserved");
+    assert.ok(content.servers.skillrepo, "skillrepo added");
+    // Both the pre-existing input and our seeded input must be present.
+    assert.equal(content.inputs.length, 2);
+    assert.ok(content.inputs.some((i) => i.id === "other-tool-key"));
+    assert.ok(content.inputs.some((i) => i.id === "skillrepo-api-key"));
+  });
+
+  it("returns 'merged' when a skillrepo server entry already exists", async () => {
+    const { mergeVscodeMcpConfig } = await import("../../lib/mergers/vscode-mcp.mjs");
+
+    const existing = {
+      inputs: [{ id: "skillrepo-api-key", type: "promptString" }],
+      servers: {
+        skillrepo: { type: "http", url: "https://old.example", headers: {} },
+      },
+    };
+    writeFileSync(vscodePath(), JSON.stringify(existing));
+
+    const result = mergeVscodeMcpConfig("https://new.example/mcp");
+
+    assert.equal(result.action, "merged");
+    const content = JSON.parse(readFileSync(vscodePath(), "utf-8"));
+    assert.equal(content.servers.skillrepo.url, "https://new.example/mcp");
+    // The input must NOT be duplicated (hasInput true branch).
+    assert.equal(
+      content.inputs.filter((i) => i.id === "skillrepo-api-key").length,
+      1,
+    );
+  });
+
+  it("rebuilds inputs when the existing inputs field is not an array", async () => {
+    const { mergeVscodeMcpConfig } = await import("../../lib/mergers/vscode-mcp.mjs");
+
+    // `inputs` is an object, not an array — the merger must replace it.
+    writeFileSync(
+      vscodePath(),
+      JSON.stringify({ inputs: { bogus: true }, servers: {} }),
+    );
+
+    const result = mergeVscodeMcpConfig("https://mcp.skillrepo.dev");
+
+    assert.equal(result.action, "created");
+    const content = JSON.parse(readFileSync(vscodePath(), "utf-8"));
+    assert.ok(Array.isArray(content.inputs));
+    assert.equal(content.inputs.length, 1);
+    assert.equal(content.inputs[0].id, "skillrepo-api-key");
+  });
+
+  it("rebuilds servers when the existing servers field is missing/non-object", async () => {
+    const { mergeVscodeMcpConfig } = await import("../../lib/mergers/vscode-mcp.mjs");
+
+    // `servers` is a string — the merger must replace it with {}.
+    writeFileSync(
+      vscodePath(),
+      JSON.stringify({ inputs: [], servers: "nope" }),
+    );
+
+    const result = mergeVscodeMcpConfig("https://mcp.skillrepo.dev");
+
+    assert.equal(result.action, "created");
+    const content = JSON.parse(readFileSync(vscodePath(), "utf-8"));
+    assert.equal(typeof content.servers, "object");
+    assert.ok(content.servers.skillrepo);
+  });
+
+  it("creates servers object when the key is entirely absent", async () => {
+    const { mergeVscodeMcpConfig } = await import("../../lib/mergers/vscode-mcp.mjs");
+
+    // Valid JSON object but no `servers` key at all (falsy branch).
+    writeFileSync(vscodePath(), JSON.stringify({ inputs: [] }));
+
+    const result = mergeVscodeMcpConfig("https://mcp.skillrepo.dev");
+
+    assert.equal(result.action, "created");
+    const content = JSON.parse(readFileSync(vscodePath(), "utf-8"));
+    assert.ok(content.servers.skillrepo);
+  });
+
+  it("throws on invalid JSON", async () => {
+    const { mergeVscodeMcpConfig } = await import("../../lib/mergers/vscode-mcp.mjs");
+    writeFileSync(vscodePath(), "not json {{{");
+
+    assert.throws(
+      () => mergeVscodeMcpConfig("https://mcp.skillrepo.dev"),
+      /invalid JSON/,
+    );
+  });
+
+  it("is idempotent — second run re-asserts the same entry as 'merged'", async () => {
+    const { mergeVscodeMcpConfig } = await import("../../lib/mergers/vscode-mcp.mjs");
+
+    const first = mergeVscodeMcpConfig("https://mcp.skillrepo.dev");
+    assert.equal(first.action, "created");
+
+    const second = mergeVscodeMcpConfig("https://mcp.skillrepo.dev");
+    assert.equal(second.action, "merged");
+
+    const content = JSON.parse(readFileSync(vscodePath(), "utf-8"));
+    // Still exactly one input entry — no duplication across runs.
+    assert.equal(
+      content.inputs.filter((i) => i.id === "skillrepo-api-key").length,
+      1,
+    );
+  });
+});