skillrepo 4.8.0 → 4.8.2

package/src/test/commands/list.test.mjs

@@ -16,7 +16,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 
 import { runList } from "../../commands/list.mjs";
-import { CliError, EXIT_AUTH } from "../../lib/errors.mjs";
+import { CliError, EXIT_AUTH, EXIT_NETWORK } from "../../lib/errors.mjs";
 import { computeSkillShas } from "../../lib/crypto-shas.mjs";
 import { globalLastSyncPath } from "../../lib/paths.mjs";
 import { createMockServer } from "../e2e/mock-server.mjs";
@@ -198,6 +198,21 @@ describe("runList — error paths", () => {
       (err) => err instanceof CliError && err.exitCode === EXIT_AUTH,
     );
   });
+
+  it("rejects with a network CliError when GET /library returns 500", async () => {
+    // `list` goes straight to getLibrary — no prior validate call —
+    // so a persistent 500 on the library route is the whole request.
+    // getLibrary calls safeFetch with retry:true, but 500 is NOT in
+    // TRANSIENT_STATUS_CODES (429/502/503/504 only), so withRetry
+    // returns the 500 immediately. mapErrorResponse maps `status >=
+    // 500` to networkError → EXIT_NETWORK (exit 1). Asserting the
+    // real mapped exit code, not a guess.
+    server.setLibraryStatus({ status: 500, body: { error: "boom" } });
+    await assert.rejects(
+      () => runList(["--key", VALID_KEY, "--url", serverUrl], { stdout }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_NETWORK,
+    );
+  });
 });
 
 // ── Drift state coverage (#1555) ────────────────────────────────────────
@@ -351,6 +366,54 @@ describe("runList — drift state (#1555)", () => {
     assert.match(out, /library in sync — but \d+ skill/);
   });
 
+  it("footer warns that update will OVERWRITE local edits when ETag matches but a skill is EDITED", async () => {
+    // Gap (#1555 footer coverage): the EDIT-state test above asserts
+    // the *generic* in-sync-with-drift footer line, but NOT the
+    // destructive-edit warning that fires specifically when an
+    // `edited` row is present. printFooter (list.mjs ~355-365) takes
+    // the etagMatches && driftCount > 0 branch, then counts
+    // SKILL_STATE.EDITED rows; when editedCount > 0 it emits the
+    // OVERWRITE warning instead of the non-destructive refresh line.
+    //
+    // Setup mirrors the EDIT-state test: seed disk with one content,
+    // baseline with a DIFFERENT SHA so the skill classifies as
+    // `edited`, ETag matching so the library is "in sync".
+    seedClaudeSkillOnDisk("touched", [
+      { path: "SKILL.md", content: SKILL_MD_BODY("touched-modified") },
+    ]);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/touched": {
+          version: "1.0.0",
+          skillMdSha256: "f".repeat(64),
+          filesSha256: "e".repeat(64),
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "touched", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    // The row itself is EDIT, confirming the precondition.
+    assert.match(out, /\bEDIT\b/);
+    // The destructive-edit footer line — exact substring from
+    // list.mjs's printFooter. A regression that drops the warning (or
+    // reverts to the non-destructive "Run `skillrepo update` to
+    // refresh." line) would let the CLI silently destroy user edits.
+    assert.match(out, /this will OVERWRITE local edits/);
+    assert.match(
+      out,
+      /including 1 with local edit\b/,
+    );
+  });
+
   it("renders MISS when skill is in library but no on-disk placement", async () => {
     // No seedClaudeSkillOnDisk → no dir on disk.
     seedLastSync({
@@ -434,6 +497,147 @@ describe("runList — drift state (#1555)", () => {
     assert.match(stdout.text(), /library has changed since last sync/);
   });
 
+  it("uses plural phrasing for multiple in-sync skills (no drift)", async () => {
+    // Existing no-drift tests render a SINGLE current skill, hitting the
+    // singular `${n} skill in your library` arm (list.mjs ~286). Two
+    // current skills with driftCount === 0 exercises the plural arm
+    // ("skills") of that same ternary.
+    const a = [{ path: "SKILL.md", content: SKILL_MD_BODY("alpha") }];
+    const aShas = seedClaudeSkillOnDisk("alpha", a);
+    const b = [{ path: "SKILL.md", content: SKILL_MD_BODY("beta") }];
+    const bShas = seedClaudeSkillOnDisk("beta", b);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/alpha": {
+          version: "1.0.0",
+          skillMdSha256: aShas.skillMdSha256,
+          filesSha256: aShas.filesSha256,
+          syncedAt: "x",
+        },
+        "alice/beta": {
+          version: "1.0.0",
+          skillMdSha256: bShas.skillMdSha256,
+          filesSha256: bShas.filesSha256,
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [
+        makeSkill("alice", "alpha", "1.0.0"),
+        makeSkill("alice", "beta", "1.0.0"),
+      ],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    // Plural "skills", no "needs attention" suffix (driftCount === 0).
+    assert.match(out, /\b2 skills in your library\.\n/);
+    assert.match(out, /library in sync — local skills up to date/);
+  });
+
+  it("uses plural phrasing in the OVERWRITE footer when multiple skills are edited", async () => {
+    // The destructive-edit footer (list.mjs ~360-363) has singular/plural
+    // ternaries on driftCount and editedCount. The single-edit tests cover
+    // only the singular arms ("skill"/"shows"/"edit"). TWO edited skills
+    // exercises the plural arms ("skills"/"show"/"edits").
+    seedClaudeSkillOnDisk("one", [
+      { path: "SKILL.md", content: SKILL_MD_BODY("one-modified") },
+    ]);
+    seedClaudeSkillOnDisk("two", [
+      { path: "SKILL.md", content: SKILL_MD_BODY("two-modified") },
+    ]);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        // Both baselines carry SHAs that won't match disk → both EDITED.
+        "alice/one": {
+          version: "1.0.0",
+          skillMdSha256: "f".repeat(64),
+          filesSha256: "e".repeat(64),
+          syncedAt: "x",
+        },
+        "alice/two": {
+          version: "1.0.0",
+          skillMdSha256: "d".repeat(64),
+          filesSha256: "c".repeat(64),
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [
+        makeSkill("alice", "one", "1.0.0"),
+        makeSkill("alice", "two", "1.0.0"),
+      ],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    // Plural drift phrase ("2 skills show") + plural edit count
+    // ("including 2 with local edits").
+    assert.match(out, /2 skills show local drift/);
+    assert.match(out, /including 2 with local edits/);
+    assert.match(out, /this will OVERWRITE local edits/);
+  });
+
+  it("treats a null library version as no-version (computeSkillState null arm)", async () => {
+    // augmentSkill passes `skill.version ?? null` (list.mjs ~172). Every
+    // other test supplies a string version, so the `?? null` right side
+    // never ran. A library skill with a null version exercises it — and
+    // must not crash; with no baseline it rolls up MISSING.
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [
+        { ...makeSkill("alice", "nullver"), version: null },
+      ],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl, "--json"], { stdout });
+    const [item] = JSON.parse(stdout.text());
+    assert.equal(item.name, "nullver");
+    assert.equal(item.state, "missing");
+  });
+
+  it("sorts same-owner skills when a name field is missing (|| '' guard on name)", async () => {
+    // sortByOwnerAndName (list.mjs ~473) compares names only AFTER owners
+    // tie. The earlier missing-fields test used distinct owners, so the
+    // owner comparison short-circuited and the `(a.name || "")` /
+    // `(b.name || "")` guards on the name line never ran. Two skills with
+    // the SAME owner — one missing its name — forces the name comparison
+    // and exercises the `|| ""` false sides.
+    const named = { ...makeSkill("dup", "has-name") };
+    const noName = {
+      owner: "dup",
+      name: undefined,
+      version: "1.0.0",
+      description: "missing name",
+      files: [],
+      updatedAt: "2025-01-01T12:00:00Z",
+    };
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [named, noName],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    // No crash; the named skill still renders and both are counted.
+    assert.match(out, /has-name/);
+    assert.match(out, /2 skills in your library/);
+  });
+
   it("--json includes state and placements per item; no library wrapper", async () => {
     const files = [{ path: "SKILL.md", content: SKILL_MD_BODY("scripted") }];
     const shas = seedClaudeSkillOnDisk("scripted", files);
@@ -698,3 +902,371 @@ describe("runList — drift state (#1555)", () => {
     assert.equal(item.placements[0].localVersion, null);
   });
 });
+
+// ── TTY glyph rendering ─────────────────────────────────────────────────
+//
+// `canUseGlyphs(stream)` (list.mjs ~385) returns false when NO_COLOR is
+// set OR the stream is not a TTY. The default capture stream is non-TTY,
+// so every test above exercises only the ASCII branch (OK/STALE/MISS/EDIT
+// and the [ok]/[!] footer tokens). These tests flip `stream.isTTY = true`
+// (and clear NO_COLOR for the duration) so the glyph branches of
+// renderLocalCell (✓ / ⚠ stale / ✗ miss / ✎ edit) and the footer
+// (✓ / ⚠) render their TRUE side. The stream also carries a numeric
+// `.columns` to exercise streamColumns' first arm (list.mjs ~415).
+
+/**
+ * A capture stream that reports as an interactive TTY with a fixed
+ * width. Used to drive the glyph (Unicode) rendering branches.
+ */
+function createTtyCaptureStream(columns = 120) {
+  const stream = createCaptureStream();
+  stream.isTTY = true;
+  stream.columns = columns;
+  return stream;
+}
+
+describe("runList — TTY glyph rendering", () => {
+  let noColorSnapshot;
+  let ttyStdout;
+
+  beforeEach(async () => {
+    await setup();
+    forceClaudeCodeDetected();
+    // canUseGlyphs short-circuits to false if NO_COLOR is set at all
+    // (even ""), so clear it for these tests and restore afterward.
+    noColorSnapshot = process.env.NO_COLOR;
+    delete process.env.NO_COLOR;
+    ttyStdout = createTtyCaptureStream();
+  });
+  afterEach(async () => {
+    unforceDetection();
+    if (noColorSnapshot === undefined) {
+      delete process.env.NO_COLOR;
+    } else {
+      process.env.NO_COLOR = noColorSnapshot;
+    }
+    await teardown();
+  });
+
+  it("renders ✓ glyph + ✓ footer glyph when current and in sync (TTY)", async () => {
+    const files = [{ path: "SKILL.md", content: SKILL_MD_BODY("clean") }];
+    const shas = seedClaudeSkillOnDisk("clean", files);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/clean": {
+          version: "1.0.0",
+          skillMdSha256: shas.skillMdSha256,
+          filesSha256: shas.filesSha256,
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "clean", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout: ttyStdout });
+    const out = ttyStdout.text();
+    // Row glyph (renderLocalCell CURRENT → "✓") and footer glyph
+    // (printFooter ok → "✓").
+    assert.match(out, /✓/);
+    // The in-sync footer line, now glyph-prefixed.
+    assert.match(out, /✓ library in sync/);
+    // No ASCII fallback tokens should appear in TTY mode.
+    assert.doesNotMatch(out, /\bOK\b/);
+    assert.doesNotMatch(out, /\[ok\]/);
+  });
+
+  it("renders ⚠ stale glyph when library version is newer (TTY)", async () => {
+    const files = [{ path: "SKILL.md", content: SKILL_MD_BODY("aging") }];
+    const shas = seedClaudeSkillOnDisk("aging", files);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/aging": {
+          version: "1.0.0",
+          skillMdSha256: shas.skillMdSha256,
+          filesSha256: shas.filesSha256,
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v2"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "aging", "1.1.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout: ttyStdout });
+    const out = ttyStdout.text();
+    // renderLocalCell STALE → "⚠ stale".
+    assert.match(out, /⚠ stale/);
+    // ETag differs → "library has changed" footer, glyph-prefixed.
+    assert.match(out, /⚠ library has changed since last sync/);
+    assert.doesNotMatch(out, /\bSTALE\b/);
+  });
+
+  it("renders ✗ miss glyph when skill has no on-disk placement (TTY)", async () => {
+    // No seedClaudeSkillOnDisk → placement missing.
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/absent": {
+          version: "1.0.0",
+          skillMdSha256: "a".repeat(64),
+          filesSha256: "b".repeat(64),
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "absent", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout: ttyStdout });
+    const out = ttyStdout.text();
+    // renderLocalCell MISSING → "✗ miss".
+    assert.match(out, /✗ miss/);
+    assert.doesNotMatch(out, /\bMISS\b/);
+  });
+
+  it("renders ✎ edit glyph + ⚠ footer when SHA differs but version matches (TTY)", async () => {
+    seedClaudeSkillOnDisk("touched", [
+      { path: "SKILL.md", content: SKILL_MD_BODY("touched-modified") },
+    ]);
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/touched": {
+          version: "1.0.0",
+          skillMdSha256: "f".repeat(64),
+          filesSha256: "e".repeat(64),
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "touched", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout: ttyStdout });
+    const out = ttyStdout.text();
+    // renderLocalCell EDITED → "✎ edit".
+    assert.match(out, /✎ edit/);
+    // ETag matches + drift incl. an edit → ⚠-prefixed destructive
+    // warning footer (printFooter warn glyph + OVERWRITE line).
+    assert.match(out, /⚠ library in sync — but/);
+    assert.match(out, /this will OVERWRITE local edits/);
+    assert.doesNotMatch(out, /\bEDIT\b/);
+    assert.doesNotMatch(out, /\[!\]/);
+  });
+
+  it("renders ⚠ footer (non-destructive) when ETag matches with non-edit drift (TTY)", async () => {
+    // MISS drift (no on-disk placement) with a matching ETag → the
+    // etagMatches && driftCount > 0 branch with editedCount === 0, which
+    // emits the ⚠ non-destructive "Run `skillrepo update` to refresh"
+    // footer (printFooter ~366-371).
+    seedLastSync({
+      etag: '"v1"',
+      skills: {
+        "alice/absent": {
+          version: "1.0.0",
+          skillMdSha256: "a".repeat(64),
+          filesSha256: "b".repeat(64),
+          syncedAt: "x",
+        },
+      },
+    });
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "absent", "1.0.0")],
+      removals: [],
+      syncedAt: "x",
+    });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout: ttyStdout });
+    const out = ttyStdout.text();
+    assert.match(out, /⚠ library in sync — but/);
+    assert.match(out, /Run `skillrepo update` to refresh\./);
+    // The destructive variant must NOT fire (no EDITED rows).
+    assert.doesNotMatch(out, /OVERWRITE local edits/);
+  });
+});
+
+// ── canUseGlyphs NO_COLOR + narrow-width + cell defaults ────────────────
+
+describe("runList — ASCII / formatting branches", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("forces ASCII tokens when NO_COLOR is set even on a TTY stream", async () => {
+    // canUseGlyphs (list.mjs ~386) short-circuits to false the moment
+    // NO_COLOR is present, BEFORE checking isTTY. Drive the TRUE side of
+    // that guard with a TTY stream + NO_COLOR set: the row must render
+    // the ASCII token, not the glyph.
+    const prior = process.env.NO_COLOR;
+    process.env.NO_COLOR = "1";
+    const ttyStream = createCaptureStream();
+    ttyStream.isTTY = true;
+    ttyStream.columns = 120;
+    try {
+      server.setLibraryResponse({
+        skills: [makeSkill("alice", "pdf-helper")],
+        removals: [],
+        syncedAt: "x",
+      });
+      await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout: ttyStream });
+      const out = ttyStream.text();
+      assert.match(out, /pdf-helper/);
+      // NO_COLOR wins over isTTY → ASCII MISS token, no glyph.
+      assert.match(out, /\bMISS\b/);
+      assert.doesNotMatch(out, /✗ miss/);
+    } finally {
+      if (prior === undefined) delete process.env.NO_COLOR;
+      else process.env.NO_COLOR = prior;
+    }
+  });
+
+  it("falls back to the 100-col default for a narrow (<=60) terminal width", async () => {
+    // computeColWidths (list.mjs ~429) uses `terminalColumns > 60 ?
+    // Math.min(..., 120) : 100`. A stream reporting width <= 60 takes
+    // the `: 100` floor arm.
+    const narrowStream = createCaptureStream();
+    narrowStream.columns = 40;
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "pdf-helper")],
+      removals: [],
+      syncedAt: "x",
+    });
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout: narrowStream });
+    assert.match(narrowStream.text(), /pdf-helper/);
+  });
+
+  it("renders em-dash version + singular count for a single skill missing version/description", async () => {
+    // Three branches in one realistic render:
+    //   - `s.version || "—"` false side (empty version) — list.mjs ~274
+    //   - `truncate(s.description || "", 60)` empty-string fallback — ~277
+    //   - `sorted.length === 1 ? "" : "s"` singular arm — ~286
+    const bare = makeSkill("alice", "bare", "", "");
+    server.setLibraryResponse({
+      skills: [bare],
+      removals: [],
+      syncedAt: "x",
+    });
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    assert.match(out, /bare/);
+    assert.match(out, /—/);
+    // Singular phrasing ("1 skill", not "1 skills").
+    assert.match(out, /\b1 skill in your library\b/);
+  });
+
+  it("renders relative timestamps across all formatRelativeDate buckets", async () => {
+    // formatRelativeDate (list.mjs ~451) walks just-now → m → h → d → w
+    // → ISO-date buckets plus the no-date and invalid-date `—` arms. The
+    // fixed `2025-01-01` updatedAt used everywhere else only ever hits
+    // the oldest (ISO) bucket. Build one skill per bucket with a
+    // computed updatedAt so every branch renders.
+    const now = Date.now();
+    const iso = (msAgo) => new Date(now - msAgo).toISOString();
+    const min = 60 * 1000;
+    const hour = 60 * min;
+    const day = 24 * hour;
+    const week = 7 * day;
+
+    const skills = [
+      { ...makeSkill("o", "a-justnow"), updatedAt: iso(10 * 1000) }, // <60s → "just now"
+      { ...makeSkill("o", "b-minutes"), updatedAt: iso(5 * min) }, // minutes
+      { ...makeSkill("o", "c-hours"), updatedAt: iso(5 * hour) }, // hours
+      { ...makeSkill("o", "d-days"), updatedAt: iso(3 * day) }, // days
+      { ...makeSkill("o", "e-weeks"), updatedAt: iso(3 * week) }, // weeks
+      { ...makeSkill("o", "f-old"), updatedAt: iso(40 * week) }, // > 26w → ISO date
+      { ...makeSkill("o", "g-nodate"), updatedAt: null }, // no date → "—"
+      { ...makeSkill("o", "h-baddate"), updatedAt: "not-a-date" }, // invalid → "—"
+    ];
+    server.setLibraryResponse({ skills, removals: [], syncedAt: "x" });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    assert.match(out, /just now/);
+    assert.match(out, /\d+m ago/);
+    assert.match(out, /\d+h ago/);
+    assert.match(out, /\d+d ago/);
+    assert.match(out, /\d+w ago/);
+    // The ISO-date fallback for the > 26w skill.
+    assert.match(out, /\d{4}-\d{2}-\d{2}/);
+  });
+
+  it("sorts skills with missing owner/name fields without crashing (|| '' guards)", async () => {
+    // sortByOwnerAndName (list.mjs ~469) defaults owner/name to "" so a
+    // skill missing either field still sorts deterministically instead
+    // of throwing on `undefined.localeCompare`. Exercise the false side
+    // of those `||` guards with skills that omit owner and/or name.
+    const skills = [
+      { ...makeSkill("zebra", "z-named") },
+      { owner: undefined, name: undefined, version: "1.0.0", description: "no ids", files: [], updatedAt: "2025-01-01T12:00:00Z" },
+      { owner: "alpha", name: undefined, version: "1.0.0", description: "no name", files: [], updatedAt: "2025-01-01T12:00:00Z" },
+    ];
+    server.setLibraryResponse({ skills, removals: [], syncedAt: "x" });
+
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    const out = stdout.text();
+    // Did not crash; the fully-named skill still renders.
+    assert.match(out, /z-named/);
+    assert.match(out, /3 skills in your library/);
+  });
+});
+
+// ── streamColumns: process.stdout fallback ──────────────────────────────
+//
+// streamColumns (list.mjs ~414) tries the injected stream's `.columns`
+// first, then falls back to `process.stdout.columns`, then to 100. The
+// TTY tests above cover the first arm (injected `.columns`). This test
+// covers the SECOND arm by injecting a stream with NO numeric `.columns`
+// while temporarily giving process.stdout a numeric column count.
+describe("runList — streamColumns process.stdout fallback", () => {
+  let stdoutColumnsSnapshot;
+  let hadOwnColumns;
+
+  beforeEach(async () => {
+    await setup();
+    // The capture stream injected by setup() has no `.columns`, so
+    // streamColumns falls through to process.stdout.columns. Force a
+    // numeric value there for the duration of this test.
+    hadOwnColumns = Object.prototype.hasOwnProperty.call(process.stdout, "columns");
+    stdoutColumnsSnapshot = process.stdout.columns;
+    process.stdout.columns = 90;
+  });
+  afterEach(async () => {
+    if (hadOwnColumns) {
+      process.stdout.columns = stdoutColumnsSnapshot;
+    } else {
+      delete process.stdout.columns;
+    }
+    await teardown();
+  });
+
+  it("uses process.stdout.columns when the injected stream has none", async () => {
+    server.setLibraryResponse({
+      skills: [makeSkill("alice", "pdf-helper")],
+      removals: [],
+      syncedAt: "x",
+    });
+    // stdout here is the plain (non-columns) capture stream from setup().
+    await runList(["--key", VALID_KEY, "--url", serverUrl], { stdout });
+    // The table still renders; the assertion is that we exercised the
+    // process.stdout.columns branch without crashing.
+    assert.match(stdout.text(), /pdf-helper/);
+  });
+});