skillrepo 4.9.2 → 4.10.0

package/src/test/lib/gitignore-section.test.mjs

@@ -0,0 +1,213 @@
+/**
+ * Unit tests for src/lib/gitignore-section.mjs (#2361).
+ *
+ * The single marked-section writer shared by the init merger and the
+ * sync-time pre-flight. Attribution-sensitive: every CLI-authored line
+ * must land inside the ONE marked section (never a duplicate header),
+ * the retired pre-4.10.0 sync-time section must be healed into it, and
+ * user content must survive byte-exact outside the CLI's own lines.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import {
+  ensureGitignoreEntries,
+  ensureManagedRootIgnores,
+  MANAGED_ROOT_ENTRIES,
+} from "../../lib/gitignore-section.mjs";
+import {
+  GITIGNORE_SECTION_HEADER,
+  LEGACY_GITIGNORE_SECTION_HEADER,
+} from "../../lib/artifact-registry.mjs";
+
+let originalCwd;
+let tempDir;
+
+beforeEach(() => {
+  originalCwd = process.cwd;
+  tempDir = mkdtempSync(join(tmpdir(), "cli-gi-section-"));
+  process.cwd = () => tempDir;
+});
+
+afterEach(() => {
+  process.cwd = originalCwd;
+  rmSync(tempDir, { recursive: true, force: true });
+});
+
+function gitignore() {
+  return readFileSync(join(tempDir, ".gitignore"), "utf-8");
+}
+
+describe("ensureGitignoreEntries — section management", () => {
+  it("creates a fresh file with one marked section", () => {
+    const result = ensureGitignoreEntries([".claude/skills/"]);
+    assert.equal(result.action, "created");
+    assert.deepEqual(result.added, [".claude/skills/"]);
+    const content = gitignore();
+    assert.equal(
+      content,
+      `${GITIGNORE_SECTION_HEADER}\n.claude/skills/\n`,
+    );
+  });
+
+  it("inserts missing entries INTO an existing marked section — no duplicate header", () => {
+    writeFileSync(
+      join(tempDir, ".gitignore"),
+      `node_modules/\n\n${GITIGNORE_SECTION_HEADER}\n.env.local\n\nuser-tail/\n`,
+    );
+    const result = ensureGitignoreEntries([".agents/skills/"]);
+    assert.equal(result.action, "updated");
+    const content = gitignore();
+    const headers = content.match(
+      new RegExp(GITIGNORE_SECTION_HEADER.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"),
+    );
+    assert.equal(headers.length, 1, "must never write a second header");
+    // The new entry sits inside the section: after .env.local, before
+    // the blank line that closes the section.
+    assert.match(content, /\.env\.local\n\.agents\/skills\/\n\nuser-tail\//);
+  });
+
+  it("appends a new section when no header exists, separated by one blank line", () => {
+    writeFileSync(join(tempDir, ".gitignore"), "node_modules/\n");
+    ensureGitignoreEntries([".claude/skills/"]);
+    assert.equal(
+      gitignore(),
+      `node_modules/\n\n${GITIGNORE_SECTION_HEADER}\n.claude/skills/\n`,
+    );
+  });
+
+  it("is idempotent — a second identical call reports skipped and does not rewrite", () => {
+    ensureGitignoreEntries([".claude/skills/"]);
+    const before = gitignore();
+    const result = ensureGitignoreEntries([".claude/skills/"]);
+    assert.equal(result.action, "skipped");
+    assert.equal(gitignore(), before);
+  });
+
+  it("honors an entry the user already has anywhere in the file", () => {
+    writeFileSync(join(tempDir, ".gitignore"), ".claude/skills/\n");
+    const result = ensureGitignoreEntries([".claude/skills/"]);
+    assert.equal(result.action, "skipped");
+    assert.equal(gitignore(), ".claude/skills/\n");
+  });
+
+  it("preserves CRLF line endings", () => {
+    writeFileSync(
+      join(tempDir, ".gitignore"),
+      "node_modules/\r\n.env\r\n",
+    );
+    ensureGitignoreEntries([".claude/skills/"]);
+    const content = gitignore();
+    assert.ok(content.includes("\r\n"), "CRLF must be preserved");
+    assert.ok(
+      !/[^\r]\n/.test(content.replace(/\r\n/g, "")),
+      "no mixed line endings introduced",
+    );
+    assert.match(content, /\.claude\/skills\//);
+  });
+
+  it("does not treat a comment mentioning an entry as the entry", () => {
+    writeFileSync(join(tempDir, ".gitignore"), "# .claude/skills/ is synced\n");
+    const result = ensureGitignoreEntries([".claude/skills/"]);
+    assert.equal(result.action, "updated");
+    assert.deepEqual(result.added, [".claude/skills/"]);
+  });
+});
+
+describe("ensureGitignoreEntries — legacy sync-time section heal", () => {
+  it("migrates the exact legacy shape into the marked section", () => {
+    writeFileSync(
+      join(tempDir, ".gitignore"),
+      `node_modules/\n\n${LEGACY_GITIGNORE_SECTION_HEADER}\n.agents/skills/\n`,
+    );
+    const result = ensureGitignoreEntries([".agents/skills/"]);
+    assert.equal(result.action, "updated");
+    const content = gitignore();
+    assert.ok(
+      !content.includes(LEGACY_GITIGNORE_SECTION_HEADER),
+      "legacy header must be healed away",
+    );
+    assert.match(content, /\.agents\/skills\//);
+    assert.ok(content.includes(GITIGNORE_SECTION_HEADER));
+  });
+
+  it("reports updated (and heals) even when no entries are missing", () => {
+    writeFileSync(
+      join(tempDir, ".gitignore"),
+      `${GITIGNORE_SECTION_HEADER}\n.agents/skills/\n\n${LEGACY_GITIGNORE_SECTION_HEADER}\n.agents/skills/\n`,
+    );
+    const result = ensureGitignoreEntries([".agents/skills/"]);
+    assert.equal(result.action, "updated");
+    assert.deepEqual(result.added, []);
+    const content = gitignore();
+    assert.ok(!content.includes(LEGACY_GITIGNORE_SECTION_HEADER));
+    // Exactly one .agents/skills/ line remains (the marked-section one).
+    const matches = content.match(/\.agents\/skills\//g);
+    assert.equal(matches.length, 1);
+  });
+
+  it("never removes user content sitting under the legacy header", () => {
+    writeFileSync(
+      join(tempDir, ".gitignore"),
+      `${LEGACY_GITIGNORE_SECTION_HEADER}\nmy-own-line/\n.agents/skills/\n`,
+    );
+    ensureGitignoreEntries([".agents/skills/"]);
+    const content = gitignore();
+    // Only the header vanished — the user line survives, and the
+    // `.agents/skills/` line NOT directly under the header survives
+    // too (it satisfies the ensure, so no insertion happened).
+    assert.match(content, /my-own-line\//);
+    assert.match(content, /\.agents\/skills\//);
+    assert.ok(!content.includes(LEGACY_GITIGNORE_SECTION_HEADER));
+  });
+});
+
+describe("ensureManagedRootIgnores — target mapping", () => {
+  it("writes both project-root entries for claudeProject + agentsProject", () => {
+    const result = ensureManagedRootIgnores(["claudeProject", "agentsProject"]);
+    assert.equal(result.action, "created");
+    assert.deepEqual(
+      [...result.added].sort(),
+      [".agents/skills/", ".claude/skills/"],
+    );
+  });
+
+  it("is a no-op for global-only targets", () => {
+    const result = ensureManagedRootIgnores(["claudeGlobal", "agentsGlobal", "windsurfGlobal"]);
+    assert.equal(result.action, "skipped");
+    assert.deepEqual(result.added, []);
+    assert.throws(() => readFileSync(join(tempDir, ".gitignore")));
+  });
+
+  it("is a no-op for an empty or missing target list", () => {
+    assert.equal(ensureManagedRootIgnores([]).action, "skipped");
+    assert.equal(ensureManagedRootIgnores(undefined).action, "skipped");
+  });
+
+  it("every managed-root entry is in the artifact registry's expected set", async () => {
+    // Cross-consistency: the uninstall remover strips the whole marked
+    // section, but GITIGNORE_REQUIRED_ENTRIES is the documented
+    // expected-set contract — a managed-root entry the registry does
+    // not know about is drift (#885 / #2361).
+    const { GITIGNORE_REQUIRED_ENTRIES } = await import(
+      "../../lib/artifact-registry.mjs"
+    );
+    for (const entry of Object.values(MANAGED_ROOT_ENTRIES)) {
+      assert.ok(
+        GITIGNORE_REQUIRED_ENTRIES.includes(entry),
+        `${entry} missing from GITIGNORE_REQUIRED_ENTRIES`,
+      );
+    }
+  });
+
+  it("covers every project-scope managed root exactly once in MANAGED_ROOT_ENTRIES", () => {
+    assert.deepEqual(Object.keys(MANAGED_ROOT_ENTRIES).sort(), [
+      "agentsProject",
+      "claudeProject",
+    ]);
+  });
+});

package/src/test/lib/sync.test.mjs

@@ -2700,3 +2700,352 @@ describe("runSync — a poisoned skill is quarantined, not fatal (#2413 audit)",
     );
   });
 });
+
+// ── Foreign-content detection + declaration probe (#2361) ──────────────
+
+describe("runSync — governance warnings (#2361)", () => {
+  beforeEach(setupServer);
+  afterEach(teardownServer);
+
+  /** Seed a non-CLI-managed skill dir in the project's claude root. */
+  function seedForeign(name) {
+    const dir = join(process.cwd(), ".claude", "skills", name);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "SKILL.md"), `---\nname: ${name}\n---\n`);
+  }
+
+  it("warns per foreign dir on a 200 sync and counts it in the summary as unmanaged", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    const stderr = createCaptureStream();
+    seedForeign("hand-rolled");
+    server.setLibraryResponse({
+      skills: [makeSkill("pdf-helper")],
+      removals: [],
+      syncedAt: "2025-06-01T00:00:00Z",
+    });
+
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      io: { stderr },
+    });
+
+    assert.equal(result.unmanaged, 1);
+    assert.match(stderr.text(), /is not from your library/);
+    assert.match(stderr.text(), /skillrepo push/);
+    assert.match(stderr.text(), /\.claude\/skills\/hand-rolled\//);
+    // The skill delivered THIS sync is managed — never warned about.
+    assert.ok(!stderr.text().includes("pdf-helper"));
+  });
+
+  it("a freshly-synced library with no foreign dirs warns nothing (unmanaged: 0)", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    const stderr = createCaptureStream();
+    server.setLibraryResponse({
+      skills: [makeSkill("pdf-helper")],
+      removals: [],
+      syncedAt: "2025-06-01T00:00:00Z",
+    });
+
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      io: { stderr },
+    });
+
+    assert.equal(result.unmanaged, 0);
+    assert.ok(!stderr.text().includes("not from your library"));
+  });
+
+  it("detection runs on the 304 short-circuit too", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("pdf-helper")],
+      removals: [],
+      syncedAt: "2025-06-01T00:00:00Z",
+    });
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+
+    // Foreign content appears AFTER the first sync; the second sync
+    // 304s (etag matches, placements complete) and must still warn.
+    seedForeign("rogue");
+    const stderr = createCaptureStream();
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      io: { stderr },
+    });
+
+    assert.equal(result.notModified, true);
+    assert.equal(result.unmanaged, 1);
+    assert.match(stderr.text(), /\.claude\/skills\/rogue\//);
+  });
+
+  it("the throttled early-exit does no detection (zero-work contract)", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    server.setEtag('"v1"');
+    server.setLibraryResponse({
+      skills: [makeSkill("pdf-helper")],
+      removals: [],
+      syncedAt: "2025-06-01T00:00:00Z",
+    });
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"] });
+
+    seedForeign("rogue");
+    const stderr = createCaptureStream();
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      throttle: true,
+      minSyncIntervalMs: 60 * 60 * 1000,
+      io: { stderr },
+    });
+
+    assert.equal(result.throttled, true);
+    assert.equal(result.unmanaged, undefined);
+    assert.ok(!stderr.text().includes("not from your library"));
+  });
+
+  it("a skillrepo.json outside a git work tree does not warn", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    const stderr = createCaptureStream();
+    // Sandbox project dir is NOT a git repo — the probe has no ignore
+    // signal, so the declaration warning must not fire.
+    writeFileSync(join(process.cwd(), "skillrepo.json"), "{}\n");
+    server.setLibraryResponse({
+      skills: [],
+      removals: [],
+      syncedAt: "2025-06-01T00:00:00Z",
+    });
+
+    await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      io: { stderr },
+    });
+
+    assert.ok(!stderr.text().includes("skillrepo.json is gitignored"));
+  });
+
+  it("warns when skillrepo.json exists but is gitignored (real git repo)", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    const { execFileSync } = await import("node:child_process");
+    execFileSync("git", ["init", "-q"], { cwd: process.cwd(), stdio: "ignore" });
+    writeFileSync(join(process.cwd(), "skillrepo.json"), "{}\n");
+    writeFileSync(join(process.cwd(), ".gitignore"), "skillrepo.json\n");
+
+    const stderr = createCaptureStream();
+    server.setLibraryResponse({
+      skills: [],
+      removals: [],
+      syncedAt: "2025-06-01T00:00:00Z",
+    });
+
+    await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      io: { stderr },
+    });
+
+    assert.match(stderr.text(), /skillrepo\.json is gitignored/);
+  });
+});
+
+describe("runSync — warn-on-new gating (#2361 owner directive)", () => {
+  beforeEach(setupServer);
+  afterEach(teardownServer);
+
+  function seedForeign(name) {
+    const dir = join(process.cwd(), ".claude", "skills", name);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "SKILL.md"), `---\nname: ${name}\n---\n`);
+  }
+
+  async function syncOnce(stderr) {
+    return runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      io: { stderr },
+    });
+  }
+
+  it("repeats nothing: second sync with unchanged findings warns zero lines but still counts", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    seedForeign("hand-rolled");
+    server.setLibraryResponse({ skills: [], removals: [], syncedAt: "x" });
+
+    const first = createCaptureStream();
+    const r1 = await syncOnce(first);
+    assert.equal(r1.unmanaged, 1);
+    assert.match(first.text(), /hand-rolled/);
+
+    const second = createCaptureStream();
+    const r2 = await syncOnce(second);
+    assert.equal(r2.unmanaged, 1, "count stays total, not just new");
+    assert.ok(
+      !second.text().includes("hand-rolled"),
+      "unchanged finding must not re-warn",
+    );
+  });
+
+  it("warns only the NEW dir when one is added later", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    seedForeign("old-one");
+    server.setLibraryResponse({ skills: [], removals: [], syncedAt: "x" });
+    await syncOnce(createCaptureStream());
+
+    seedForeign("new-one");
+    const stderr = createCaptureStream();
+    const r = await syncOnce(stderr);
+    assert.equal(r.unmanaged, 2);
+    assert.match(stderr.text(), /new-one/);
+    assert.ok(!stderr.text().includes("old-one"));
+  });
+
+  it("a removed dir that reappears warns again", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    seedForeign("phoenix");
+    server.setLibraryResponse({ skills: [], removals: [], syncedAt: "x" });
+    await syncOnce(createCaptureStream());
+
+    rmSync(join(process.cwd(), ".claude", "skills", "phoenix"), {
+      recursive: true,
+      force: true,
+    });
+    await syncOnce(createCaptureStream());
+
+    seedForeign("phoenix");
+    const stderr = createCaptureStream();
+    await syncOnce(stderr);
+    assert.match(stderr.text(), /phoenix/);
+  });
+
+  it("hook-mode syncs neither warn nor consume the finding (interactive sync still warns)", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    seedForeign("hand-rolled");
+    server.setLibraryResponse({ skills: [], removals: [], syncedAt: "x" });
+
+    // Hook sync (throttle: true caller) with a fresh window: scans and
+    // counts but must not warn or mark seen.
+    const hookErr = createCaptureStream();
+    const hookRun = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      throttle: true,
+      minSyncIntervalMs: 0,
+      io: { stderr: hookErr },
+    });
+    assert.equal(hookRun.unmanaged, 1, "hook sync still counts");
+    assert.ok(!hookErr.text().includes("hand-rolled"), "hook sync must not warn");
+
+    // The interactive sync afterwards is the FIRST to warn.
+    const stderr = createCaptureStream();
+    await syncOnce(stderr);
+    assert.match(stderr.text(), /hand-rolled/, "hook sync must not consume the warning");
+  });
+
+  it("gitignored-declaration warning fires once, then stays quiet while the state holds", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    const { execFileSync } = await import("node:child_process");
+    execFileSync("git", ["init", "-q"], { cwd: process.cwd(), stdio: "ignore" });
+    writeFileSync(join(process.cwd(), "skillrepo.json"), "{}\n");
+    writeFileSync(join(process.cwd(), ".gitignore"), "skillrepo.json\n");
+    server.setLibraryResponse({ skills: [], removals: [], syncedAt: "x" });
+
+    const first = createCaptureStream();
+    await syncOnce(first);
+    assert.match(first.text(), /skillrepo\.json is gitignored/);
+    assert.match(first.text(), /Remove it from \.gitignore and commit it/);
+
+    const second = createCaptureStream();
+    await syncOnce(second);
+    assert.ok(!second.text().includes("skillrepo.json is gitignored"));
+
+    // Un-ignoring clears the state; re-ignoring warns again.
+    writeFileSync(join(process.cwd(), ".gitignore"), "\n");
+    await syncOnce(createCaptureStream());
+    writeFileSync(join(process.cwd(), ".gitignore"), "skillrepo.json\n");
+    const fourth = createCaptureStream();
+    await syncOnce(fourth);
+    assert.match(fourth.text(), /skillrepo\.json is gitignored/);
+  });
+});
+
+
+describe("runSync — governance state robustness (#2361 prod-readiness)", () => {
+  beforeEach(setupServer);
+  afterEach(teardownServer);
+
+  it("two repos sharing one HOME warn independently for same-named dirs", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    server.setLibraryResponse({ skills: [], removals: [], syncedAt: "x" });
+
+    const repoA = join(sandbox, "project"); // the default cwd from setupServer
+    const repoB = join(sandbox, "project-b");
+    mkdirSync(repoB, { recursive: true });
+
+    function seedIn(repoDir) {
+      const dir = join(repoDir, ".claude", "skills", "shared-name");
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(join(dir, "SKILL.md"), "---\nname: shared-name\n---\n");
+    }
+
+    seedIn(repoA);
+    const errA = createCaptureStream();
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"], io: { stderr: errA } });
+    assert.match(errA.text(), /shared-name/, "repo A warns");
+
+    // Same machine-global HOME, different repo: the same NAME must
+    // still warn — seen-state keys are absolute roots, so isolation
+    // holds through the REAL path derivation, not just unit inputs.
+    process.chdir(repoB);
+    seedIn(repoB);
+    const errB = createCaptureStream();
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"], io: { stderr: errB } });
+    assert.match(errB.text(), /shared-name/, "repo B warns independently");
+
+    // And repo A stays quiet on its next sync (its own state intact).
+    process.chdir(repoA);
+    const errA2 = createCaptureStream();
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"], io: { stderr: errA2 } });
+    assert.ok(!errA2.text().includes("shared-name"), "repo A does not re-warn");
+  });
+
+  it("a corrupt .governance-seen mid-sync degrades to warn-everything, never fails the sync", async () => {
+    const { createCaptureStream } = await import("../helpers/capture-stream.mjs");
+    const { globalGovernanceSeenPath } = await import("../../lib/paths.mjs");
+    server.setLibraryResponse({ skills: [], removals: [], syncedAt: "x" });
+
+    const dir = join(process.cwd(), ".claude", "skills", "survivor");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "SKILL.md"), "---\nname: survivor\n---\n");
+
+    await runSync({ serverUrl, apiKey: VALID_KEY, vendors: ["claudeCode"], io: { stderr: createCaptureStream() } });
+
+    // Corrupt the state file (truncated write, disk fault, hand edit).
+    writeFileSync(globalGovernanceSeenPath(), "{ this is not json");
+
+    const stderr = createCaptureStream();
+    const result = await runSync({
+      serverUrl,
+      apiKey: VALID_KEY,
+      vendors: ["claudeCode"],
+      io: { stderr },
+    });
+    // Sync succeeds; corrupt state reads as empty → the finding warns
+    // again (loud-but-safe) and the file is rewritten valid.
+    assert.equal(result.unmanaged, 1);
+    assert.match(stderr.text(), /survivor/);
+    const healed = JSON.parse(readFileSync(globalGovernanceSeenPath(), "utf-8"));
+    assert.equal(healed.schemaVersion, 1);
+  });
+});

package/src/test/mergers/uninstall-gitignore.test.mjs

@@ -207,3 +207,68 @@ describe("removeGitignore", () => {
     assert.match(after, /\n\n\ndist\/|\n\ndist\//);
   });
 });
+
+// ── Legacy sync-time section removal (#2361) ───────────────────────────
+
+describe("removeGitignore — legacy sync-time section", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  const LEGACY_HEADER = "# SkillRepo (CLI-managed library skills)";
+
+  it("removes a leftover legacy section when no marked section exists", () => {
+    writeFileSync(
+      ".gitignore",
+      `node_modules/\n\n${LEGACY_HEADER}\n.agents/skills/\n`,
+      "utf-8",
+    );
+    const result = removeGitignore();
+    assert.equal(result.action, "removed");
+    assert.equal(result.removed, 2);
+    const content = readFileSync(".gitignore", "utf-8");
+    assert.ok(!content.includes(LEGACY_HEADER));
+    assert.ok(!content.includes(".agents/skills/"));
+    assert.ok(content.includes("node_modules/"));
+  });
+
+  it("removes both the marked section and a legacy section in one pass", () => {
+    writeFileSync(
+      ".gitignore",
+      "user-stuff/\n\n# SkillRepo CLI (added by `skillrepo init`)\n.env.local\n.claude/skills/\n\n" +
+        `${LEGACY_HEADER}\n.agents/skills/\n`,
+      "utf-8",
+    );
+    const result = removeGitignore();
+    assert.equal(result.action, "removed");
+    // 3 marked-section lines (header + 2 entries) + 2 legacy lines.
+    assert.equal(result.removed, 5);
+    const content = readFileSync(".gitignore", "utf-8");
+    assert.ok(!content.includes("SkillRepo"));
+    assert.ok(content.includes("user-stuff/"));
+  });
+
+  it("leaves user content under the legacy header untouched", () => {
+    writeFileSync(
+      ".gitignore",
+      `${LEGACY_HEADER}\nmy-own-line/\n.agents/skills/\n`,
+      "utf-8",
+    );
+    const result = removeGitignore();
+    assert.equal(result.action, "removed");
+    // Only the header itself — the directly-following line is NOT
+    // `.agents/skills/`, so nothing else is attributable.
+    assert.equal(result.removed, 1);
+    const content = readFileSync(".gitignore", "utf-8");
+    assert.ok(content.includes("my-own-line/"));
+    assert.ok(content.includes(".agents/skills/"));
+  });
+
+  it("dry-run reports the legacy section without writing", () => {
+    const original = `${LEGACY_HEADER}\n.agents/skills/\n`;
+    writeFileSync(".gitignore", original, "utf-8");
+    const result = removeGitignore({ dryRun: true });
+    assert.equal(result.action, "would-remove");
+    assert.equal(result.removed, 2);
+    assert.equal(readFileSync(".gitignore", "utf-8"), original);
+  });
+});