stagent 0.9.6 → 0.11.0

package/src/lib/agents/claude-agent.ts

@@ -15,7 +15,12 @@ import {
 import { getProfile } from "./profiles/registry";
 import { resolveProfileRuntimePayload, type ResolvedProfileRuntimePayload } from "./profiles/compatibility";
 import type { CanUseToolPolicy } from "./profiles/types";
-import { buildClaudeSdkEnv } from "./runtime/claude-sdk";
+import {
+  buildClaudeSdkEnv,
+  CLAUDE_SDK_ALLOWED_TOOLS,
+  CLAUDE_SDK_SETTING_SOURCES,
+} from "./runtime/claude-sdk";
+import { getFeaturesForModel } from "@/lib/chat/types";
 import { getActiveLearnedContext } from "./learned-context";
 import { getLaunchCwd, getWorkspaceContext } from "@/lib/environment/workspace-context";
 import { analyzeForLearnedPatterns } from "./pattern-extractor";
@@ -34,6 +39,97 @@ import {
   handleToolPermission,
   clearPermissionCache,
 } from "./tool-permissions";
+import {
+  classifyTaskFailureReason,
+  toRetryableRuntimeLaunchError,
+  type RuntimeLaunchProgress,
+} from "@/lib/agents/runtime/launch-failure";
+
+// ─── Stagent MCP injection helpers ──────────────────────────────────────
+//
+// Shared by executeClaudeTask and resumeClaudeTask so the two runtime entry
+// points cannot drift apart. The drift between chat engine injection and
+// claude-code runtime injection is what produced the P0 bug this feature
+// fixes — do not duplicate these patterns inline.
+
+/**
+ * Merge the in-process stagent MCP server into a profile/browser/external
+ * MCP server map. Stagent is spread LAST so no upstream source can shadow
+ * the `stagent` key with its own server.
+ *
+ * `@/lib/chat/stagent-tools` is loaded via dynamic `import()` to avoid a
+ * circular-dependency crash: that module transitively pulls in the chat
+ * tools registry, which imports the runtime registry (`runtime/catalog`,
+ * `runtime/index`), which statically references `claudeRuntimeAdapter` —
+ * the very module this file is defined in. A static import here would
+ * crash with "Cannot access 'claudeRuntimeAdapter' before initialization"
+ * at module-load time. The dynamic import defers the stagent-tools module
+ * until `executeClaudeTask` / `resumeClaudeTask` actually run, by which
+ * time every module in the graph has finished initializing.
+ */
+async function withStagentMcpServer(
+  profileServers: Record<string, unknown>,
+  browserServers: Record<string, unknown>,
+  externalServers: Record<string, unknown>,
+  projectId?: string | null,
+): Promise<Record<string, unknown>> {
+  const { createToolServer } = await import("@/lib/chat/stagent-tools");
+  const stagentServer = createToolServer(projectId).asMcpServer();
+  return {
+    ...profileServers,
+    ...browserServers,
+    ...externalServers,
+    stagent: stagentServer,
+  };
+}
+
+/**
+ * Prepend `mcp__stagent__*` to a profile's explicit allowedTools so the
+ * stagent tool registration survives the SDK preset filter. When the
+ * profile has no explicit allowlist and `includeSdkTools` is true, fall
+ * back to Phase 1a's CLAUDE_SDK_ALLOWED_TOOLS (Skill, Read/Grep/Glob,
+ * Edit/Write/Bash, TodoWrite) so task execution gets the same toolset as
+ * chat. Returns `undefined` only when the profile has no allowlist AND
+ * the caller does not want SDK tools added — letting the SDK fall
+ * through to claude_code preset defaults.
+ */
+function withStagentAllowedTools(
+  profileAllowedTools: string[] | undefined,
+  includeSdkTools: boolean,
+): string[] | undefined {
+  // An empty `allowedTools: []` is treated the same as `undefined` — an
+  // empty array is almost never the profile author's intent (they'd get
+  // only `mcp__stagent__*` and nothing else). Require at least one tool
+  // name for the "profile has explicit list" branch.
+  if (profileAllowedTools && profileAllowedTools.length > 0) {
+    // Profile has explicit list — respect it. Only prepend stagent.
+    return Array.from(new Set(["mcp__stagent__*", ...profileAllowedTools]));
+  }
+  if (includeSdkTools) {
+    // No profile allowlist but runtime has native skills — pass the
+    // Phase 1a tool set alongside mcp__stagent__* + browser/external
+    // (callers merge their own browser/external patterns into this list).
+    return ["mcp__stagent__*", ...CLAUDE_SDK_ALLOWED_TOOLS];
+  }
+  return undefined;
+}
+
+/**
+ * Write an explicit failure_reason to tasks at terminal-state transitions.
+ * Called from handleExecutionError and the execute/resume functions on known
+ * error classes. Prefer this over reverse-engineering reasons from text via
+ * detectFailureReason in scheduler.ts, which is fragile to SDK message changes.
+ */
+export async function writeTerminalFailureReason(
+  taskId: string,
+  error: unknown,
+): Promise<void> {
+  const reason = classifyTaskFailureReason(error);
+  await db
+    .update(tasks)
+    .set({ failureReason: reason, updatedAt: new Date() })
+    .where(eq(tasks.id, taskId));
+}
 
 /** Typed representation of messages from the Agent SDK stream */
 interface AgentStreamMessage {
@@ -104,6 +200,14 @@ export async function finalizeTaskUsage(
     startedAt: state.startedAt,
     finishedAt: new Date(),
   });
+
+  await db
+    .update(tasks)
+    .set({
+      effectiveModelId: state.modelId ?? null,
+      updatedAt: new Date(),
+    })
+    .where(eq(tasks.id, state.taskId));
 }
 
 /**
@@ -116,7 +220,8 @@ async function processAgentStream(
   response: AsyncIterable<Record<string, unknown>>,
   abortController: AbortController,
   agentProfileId = "general",
-  usageState: TaskUsageState
+  usageState: TaskUsageState,
+  launchProgress?: RuntimeLaunchProgress
 ): Promise<void> {
   let sessionId: string | null = null;
   let receivedResult = false;
@@ -179,8 +284,14 @@ async function processAgentStream(
     // Handle assistant messages (tool use starts)
     if (message.type === "assistant" && message.message?.content) {
       turnCount++;
+      if (launchProgress) {
+        launchProgress.hasTurnStarted = true;
+      }
       for (const block of message.message.content) {
         if (block.type === "tool_use") {
+          if (launchProgress) {
+            launchProgress.hasToolUse = true;
+          }
           // Track screenshot tool_use IDs for result interception
           const toolBlock = block as { type: string; id?: string; name?: string; input?: unknown };
           if (typeof toolBlock.name === "string" && SCREENSHOT_TOOL_NAMES.has(toolBlock.name) && typeof toolBlock.id === "string") {
@@ -249,6 +360,9 @@ async function processAgentStream(
         return;
       }
       receivedResult = true;
+      if (launchProgress) {
+        launchProgress.hasResult = true;
+      }
       const resultText =
         typeof message.result === "string"
           ? message.result
@@ -314,11 +428,14 @@ async function processAgentStream(
       ? `Agent exhausted its turn limit (${turnCount} turns used) without producing a final result. The task may need fewer sub-queries or a higher maxTurns setting.`
       : "Agent stream ended without producing a result";
 
+    const streamFailureReason = turnCount > 0 ? "turn_limit_exceeded" : "sdk_error";
+
     await db
       .update(tasks)
       .set({
         status: "failed",
         result: errorDetail,
+        failureReason: streamFailureReason,
         updatedAt: new Date(),
       })
       .where(eq(tasks.id, taskId));
@@ -417,6 +534,7 @@ export async function executeClaudeTask(taskId: string): Promise<void> {
   const [task] = await db.select().from(tasks).where(eq(tasks.id, taskId));
   if (!task) throw new Error(`Task ${taskId} not found`);
   const usageState = createTaskUsageState(task);
+  const launchProgress: RuntimeLaunchProgress = {};
 
   const abortController = new AbortController();
   const agentProfileId = task.agentProfile ?? "general";
@@ -432,13 +550,44 @@ export async function executeClaudeTask(taskId: string): Promise<void> {
     await prepareTaskOutputDirectory(taskId, { clearExisting: true });
     const ctx = await buildTaskQueryContext(task, agentProfileId);
 
-    // Merge browser + external MCP servers when enabled globally
+    // Per-schedule override: if the task carries its own maxTurns (set by
+    // fireSchedule from schedules.maxTurns), it takes precedence over the
+    // profile default. This is the runtime-enforced budget cap.
+    const effectiveMaxTurns = task.maxTurns ?? ctx.maxTurns;
+
+    // Merge browser + external MCP servers, then inject the in-process
+    // stagent server via the shared helper (see withStagentMcpServer above).
+    // The helper is async because it dynamically imports @/lib/chat/stagent-tools
+    // to break a module-load cycle with the runtime registry.
     const [browserServers, externalServers] = await Promise.all([
       getBrowserMcpServers(),
       getExternalMcpServers(),
     ]);
-    const profileMcpServers = ctx.payload?.mcpServers ?? {};
-    const mergedMcpServers = { ...profileMcpServers, ...browserServers, ...externalServers };
+    const mergedMcpServers = await withStagentMcpServer(
+      ctx.payload?.mcpServers ?? {},
+      browserServers,
+      externalServers,
+      task.projectId,
+    );
+    // Capability gate: only pass settingSources + CLAUDE_SDK tools when the
+    // runtime is claude-code (or a future runtime with hasNativeSkills).
+    // Anthropic-direct and OpenAI-direct task runtimes don't understand
+    // these SDK-specific options. Tasks do not carry a model field yet —
+    // an empty string falls through to the claude-code default in
+    // getFeaturesForModel, so the gate opens by default for the primary
+    // claude-code use case. Task 4's resume path follows the same pattern.
+    const runtimeFeatures = getFeaturesForModel("");
+    const includeSdkNativeTools = runtimeFeatures.hasNativeSkills;
+
+    // allowedTools merged via shared helper. When the profile has no explicit
+    // allowlist AND the runtime has native skills, we fall back to Phase 1a's
+    // CLAUDE_SDK_ALLOWED_TOOLS (Skill, Read/Grep/Glob, Edit/Write/Bash,
+    // TodoWrite) so task execution matches chat. Computed once so the
+    // conditional spread below does not invoke the helper twice.
+    const mergedAllowedTools = withStagentAllowedTools(
+      ctx.payload?.allowedTools,
+      includeSdkNativeTools,
+    );
 
     const authEnv = await getAuthEnv();
     const response = query({
@@ -452,11 +601,16 @@ export async function executeClaudeTask(taskId: string): Promise<void> {
         systemPrompt: ctx.systemInstructions
           ? { type: "preset" as const, preset: "claude_code" as const, append: ctx.systemInstructions }
           : { type: "preset" as const, preset: "claude_code" as const },
-        // F9: Bounded turn limit from profile or default
-        maxTurns: ctx.maxTurns,
+        // F9: Bounded turn limit from profile or default; per-schedule override wins
+        maxTurns: effectiveMaxTurns,
         // F4: Per-execution budget cap — use task-specific override if set
         maxBudgetUsd: task.maxBudgetUsd ?? DEFAULT_MAX_BUDGET_USD,
-        ...(ctx.payload?.allowedTools && { allowedTools: ctx.payload.allowedTools }),
+        ...(mergedAllowedTools && { allowedTools: mergedAllowedTools }),
+        // Phase 1a parity: load user + project settings (.claude/skills,
+        // CLAUDE.md, .claude/rules/*.md) when the runtime supports it.
+        ...(includeSdkNativeTools && {
+          settingSources: [...CLAUDE_SDK_SETTING_SOURCES],
+        }),
         ...(Object.keys(mergedMcpServers).length > 0 && {
           mcpServers: mergedMcpServers,
         }),
@@ -476,14 +630,24 @@ export async function executeClaudeTask(taskId: string): Promise<void> {
       response as AsyncIterable<Record<string, unknown>>,
       abortController,
       agentProfileId,
-      usageState
+      usageState,
+      launchProgress
     );
 
-    // Fire-and-forget pattern extraction for self-improvement
-    analyzeForLearnedPatterns(taskId, agentProfileId).catch((err) => {
+    try {
+      await analyzeForLearnedPatterns(taskId, agentProfileId);
+    } catch (err) {
       console.error("[self-improvement] pattern extraction failed:", err);
-    });
+    }
   } catch (error: unknown) {
+    const retryableLaunchError = toRetryableRuntimeLaunchError({
+      runtimeId: "claude-code",
+      error,
+      progress: launchProgress,
+    });
+    if (retryableLaunchError) {
+      throw retryableLaunchError;
+    }
     await handleExecutionError(
       taskId,
       task.title,
@@ -545,13 +709,37 @@ export async function resumeClaudeTask(taskId: string): Promise<void> {
     await prepareTaskOutputDirectory(taskId);
     const ctx = await buildTaskQueryContext(task, profileId);
 
-    // Merge browser + external MCP servers when enabled globally
+    // Per-schedule override: if the task carries its own maxTurns (set by
+    // fireSchedule from schedules.maxTurns), it takes precedence over the
+    // profile default. This is the runtime-enforced budget cap.
+    const effectiveMaxTurns = task.maxTurns ?? ctx.maxTurns;
+
+    // Merge browser + external MCP servers, then inject the in-process
+    // stagent server via the shared helper (see withStagentMcpServer).
+    // Async for the same cycle-breaking reason as executeClaudeTask above.
     const [browserServers, externalServers] = await Promise.all([
       getBrowserMcpServers(),
       getExternalMcpServers(),
     ]);
-    const profileMcpServers = ctx.payload?.mcpServers ?? {};
-    const mergedMcpServers = { ...profileMcpServers, ...browserServers, ...externalServers };
+    const mergedMcpServers = await withStagentMcpServer(
+      ctx.payload?.mcpServers ?? {},
+      browserServers,
+      externalServers,
+      task.projectId,
+    );
+    // Capability gate: same logic as executeClaudeTask. Resumed tasks must
+    // get the same SDK options as their original run so skills that were
+    // visible on first execution remain visible after a resume. `task.model`
+    // does not exist on the tasks schema — pass "" which resolves to the
+    // claude-code default (hasNativeSkills: true) for every current task
+    // flow. See features/task-runtime-skill-parity.md Task 4.
+    const runtimeFeatures = getFeaturesForModel("");
+    const includeSdkNativeTools = runtimeFeatures.hasNativeSkills;
+
+    const mergedAllowedTools = withStagentAllowedTools(
+      ctx.payload?.allowedTools,
+      includeSdkNativeTools,
+    );
 
     const authEnv = await getAuthEnv();
     const response = query({
@@ -566,11 +754,15 @@ export async function resumeClaudeTask(taskId: string): Promise<void> {
         systemPrompt: ctx.systemInstructions
           ? { type: "preset" as const, preset: "claude_code" as const, append: ctx.systemInstructions }
           : { type: "preset" as const, preset: "claude_code" as const },
-        // F9: Bounded turn limit from profile or default
-        maxTurns: ctx.maxTurns,
+        // F9: Bounded turn limit from profile or default; per-schedule override wins
+        maxTurns: effectiveMaxTurns,
         // F4: Per-execution budget cap — use task-specific override if set
         maxBudgetUsd: task.maxBudgetUsd ?? DEFAULT_MAX_BUDGET_USD,
-        ...(ctx.payload?.allowedTools && { allowedTools: ctx.payload.allowedTools }),
+        ...(mergedAllowedTools && { allowedTools: mergedAllowedTools }),
+        // Phase 1a parity: match executeClaudeTask — see Task 3 rationale.
+        ...(includeSdkNativeTools && {
+          settingSources: [...CLAUDE_SDK_SETTING_SOURCES],
+        }),
         ...(Object.keys(mergedMcpServers).length > 0 && {
           mcpServers: mergedMcpServers,
         }),
@@ -593,10 +785,11 @@ export async function resumeClaudeTask(taskId: string): Promise<void> {
       usageState
     );
 
-    // Fire-and-forget pattern extraction for self-improvement
-    analyzeForLearnedPatterns(taskId, profileId).catch((err) => {
+    try {
+      await analyzeForLearnedPatterns(taskId, profileId);
+    } catch (err) {
       console.error("[self-improvement] pattern extraction failed:", err);
-    });
+    }
   } catch (error: unknown) {
     const errorMessage =
       error instanceof Error ? error.message : String(error);
@@ -612,6 +805,7 @@ export async function resumeClaudeTask(taskId: string): Promise<void> {
           status: "failed",
           result: "Session expired — re-queue for fresh start",
           sessionId: null,
+          failureReason: "auth_failed",
           updatedAt: new Date(),
         })
         .where(eq(tasks.id, taskId));
@@ -667,11 +861,13 @@ async function handleExecutionError(
     return;
   }
 
+  const failureReason = classifyTaskFailureReason(error);
   await db
     .update(tasks)
     .set({
       status: "failed",
       result: errorMessage,
+      failureReason,
       updatedAt: new Date(),
     })
     .where(eq(tasks.id, taskId));

package/src/lib/agents/execution-manager.ts

@@ -1,6 +1,3 @@
-import { licenseManager } from "@/lib/license/manager";
-import { createTierLimitNotification } from "@/lib/license/notifications";
-
 interface RunningExecution {
   abortController: AbortController;
   sessionId: string | null;
@@ -17,42 +14,10 @@ export function getExecution(taskId: string): RunningExecution | undefined {
   return executions.get(taskId);
 }
 
-/**
- * Register a running execution. Checks the parallel workflow limit
- * for the current tier before allowing the execution to proceed.
- *
- * @throws {ParallelLimitError} if the concurrent execution limit is reached
- */
 export function setExecution(taskId: string, execution: RunningExecution): void {
-  const limit = licenseManager.getLimit("parallelWorkflows");
-  const currentCount = executions.size;
-
-  if (Number.isFinite(limit) && currentCount >= limit) {
-    const tier = licenseManager.getTier();
-    // Fire-and-forget notification
-    createTierLimitNotification("parallelWorkflows", currentCount, limit, taskId).catch(() => {});
-    throw new ParallelLimitError(currentCount, limit, tier);
-  }
-
   executions.set(taskId, execution);
 }
 
-export class ParallelLimitError extends Error {
-  public readonly current: number;
-  public readonly limit: number;
-  public readonly tier: string;
-
-  constructor(current: number, limit: number, tier: string) {
-    super(
-      `Parallel workflow limit reached (${current}/${limit}) on ${tier} tier. Wait for a running task to complete or upgrade.`
-    );
-    this.name = "ParallelLimitError";
-    this.current = current;
-    this.limit = limit;
-    this.tier = tier;
-  }
-}
-
 export function removeExecution(taskId: string): void {
   executions.delete(taskId);
 }

package/src/lib/agents/handoff/bus.ts

@@ -125,8 +125,8 @@ export async function processHandoffs(): Promise<void> {
 
     // Fire-and-forget task execution
     try {
-      const { executeTaskWithRuntime } = await import("@/lib/agents/runtime");
-      executeTaskWithRuntime(taskId).catch((err) => {
+      const { startTaskExecution } = await import("@/lib/agents/task-dispatch");
+      startTaskExecution(taskId).catch((err) => {
         console.error(`[handoff] task execution failed for message ${msg.id}:`, err);
       });
     } catch (err) {

package/src/lib/agents/learned-context.ts

@@ -5,9 +5,6 @@ import type { LearnedContextRow } from "@/lib/db/schema";
 import { runMetaCompletion } from "./runtime/claude";
 import { getSettingSync } from "@/lib/settings/helpers";
 import { SETTINGS_KEYS } from "@/lib/constants/settings";
-import { checkLimit } from "@/lib/license/limit-check";
-import { getContextVersionCount } from "@/lib/license/limit-queries";
-import { createTierLimitNotification } from "@/lib/license/notifications";
 
 const DEFAULT_CONTEXT_CHAR_LIMIT = 8_000;
 const SUMMARIZATION_RATIO = 0.75;
@@ -95,15 +92,6 @@ export async function proposeContextAddition(
   additions: string,
   options?: { silent?: boolean }
 ): Promise<string> {
-  // Tier limit check — context version cap per profile
-  const versionCount = getContextVersionCount(profileId);
-  const limitResult = checkLimit("contextVersions", versionCount);
-  if (!limitResult.allowed) {
-    createTierLimitNotification("contextVersions", versionCount, limitResult.limit, taskId).catch(() => {});
-    throw new Error(
-      `Context version limit reached (${versionCount}/${limitResult.limit}). Upgrade to unlock more capacity.`
-    );
-  }
 
   const version = getNextVersion(profileId);
   const notificationId = options?.silent ? null : crypto.randomUUID();

package/src/lib/agents/learning-session.ts

@@ -181,6 +181,7 @@ export async function batchApproveProposals(
     await import("./learned-context");
 
   let approved = 0;
+  const touchedProfileIds = new Set<string>();
   for (const rowId of proposalRowIds) {
     const [row] = db
       .select()
@@ -229,16 +230,28 @@ export async function batchApproveProposals(
     }
 
     approved++;
-
-    const sizeInfo = checkContextSize(row.profileId);
-    if (sizeInfo.needsSummarization) {
-      await summarizeContext(row.profileId);
-    }
+    touchedProfileIds.add(row.profileId);
   }
 
   // Mark the batch notification as responded
   await markBatchNotificationResponded(proposalRowIds, "approved");
 
+  const profilesNeedingSummarization = [...touchedProfileIds].filter(
+    (profileId) => checkContextSize(profileId).needsSummarization
+  );
+  void Promise.allSettled(
+    profilesNeedingSummarization.map(async (profileId) => {
+      try {
+        await summarizeContext(profileId);
+      } catch (error) {
+        console.error(
+          "[learning-session] Failed to summarize approved context batch:",
+          error
+        );
+      }
+    })
+  );
+
   return approved;
 }
 

package/src/lib/agents/profiles/__tests__/list-fused-profiles.test.ts

@@ -0,0 +1,110 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { listFusedProfiles } from "@/lib/agents/profiles/list-fused-profiles";
+
+describe("listFusedProfiles", () => {
+  let projectDir: string;
+  let userSkillsDir: string;
+
+  beforeEach(() => {
+    projectDir = mkdtempSync(join(tmpdir(), "stagent-skills-"));
+    userSkillsDir = mkdtempSync(join(tmpdir(), "stagent-user-skills-"));
+    mkdirSync(join(projectDir, ".claude", "skills"), { recursive: true });
+  });
+
+  afterEach(() => {
+    rmSync(projectDir, { recursive: true, force: true });
+    rmSync(userSkillsDir, { recursive: true, force: true });
+  });
+
+  function writeSkill(baseDir: string, name: string, frontmatter: string) {
+    mkdirSync(join(baseDir, name), { recursive: true });
+    writeFileSync(
+      join(baseDir, name, "SKILL.md"),
+      `---\n${frontmatter}\n---\n\nbody for ${name}\n`
+    );
+  }
+
+  it("returns registry profiles when no filesystem skills exist", async () => {
+    const result = await listFusedProfiles(projectDir, userSkillsDir);
+    // Should contain at least one registry profile (builtin)
+    expect(result.length).toBeGreaterThan(0);
+    expect(result.every((p) => typeof p.id === "string")).toBe(true);
+  });
+
+  it("surfaces a project .claude/skills/<name> entry", async () => {
+    writeSkill(
+      join(projectDir, ".claude", "skills"),
+      "my-project-skill",
+      `name: my-project-skill\ndescription: Test project skill`
+    );
+    const result = await listFusedProfiles(projectDir, userSkillsDir);
+    expect(result.some((p) => p.id === "my-project-skill")).toBe(true);
+    const skill = result.find((p) => p.id === "my-project-skill")!;
+    expect(skill.name).toBe("my-project-skill");
+    expect(skill.description).toBe("Test project skill");
+    expect(skill.origin).toBe("filesystem-project");
+  });
+
+  it("sets projectDir to the project root (not the skills subdirectory) on filesystem-project entries", async () => {
+    writeSkill(
+      join(projectDir, ".claude", "skills"),
+      "my-scoped-skill",
+      `name: my-scoped-skill\ndescription: Scoped`
+    );
+    const result = await listFusedProfiles(projectDir, userSkillsDir);
+    const skill = result.find((p) => p.id === "my-scoped-skill")!;
+    expect(skill.projectDir).toBe(projectDir);
+    // Negative: must not be the .claude/skills subdirectory
+    expect(skill.projectDir).not.toContain(".claude/skills");
+  });
+
+  it("surfaces a user ~/.claude/skills/<name> entry", async () => {
+    writeSkill(
+      userSkillsDir,
+      "my-user-skill",
+      `name: my-user-skill\ndescription: Test user skill`
+    );
+    const result = await listFusedProfiles(projectDir, userSkillsDir);
+    expect(result.some((p) => p.id === "my-user-skill")).toBe(true);
+    expect(
+      result.find((p) => p.id === "my-user-skill")!.origin
+    ).toBe("filesystem-user");
+  });
+
+  it("dedupes by id — registry profile wins over filesystem skill with same id", async () => {
+    // "general" is a known builtin registry profile id; write a filesystem
+    // skill with the same id to force a collision.
+    writeSkill(
+      join(projectDir, ".claude", "skills"),
+      "general",
+      `name: general\ndescription: This should be overridden by registry`
+    );
+    const result = await listFusedProfiles(projectDir, userSkillsDir);
+    const entries = result.filter((p) => p.id === "general");
+    expect(entries).toHaveLength(1);
+    // Registry description should win (not the filesystem-overridden one)
+    expect(entries[0].description).not.toBe("This should be overridden by registry");
+  });
+
+  it("logs and skips a malformed SKILL.md (no name field in frontmatter)", async () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    writeSkill(
+      join(projectDir, ".claude", "skills"),
+      "broken-skill",
+      `description: Missing name field — broken`
+    );
+    const result = await listFusedProfiles(projectDir, userSkillsDir);
+    expect(result.some((p) => p.id === "broken-skill")).toBe(false);
+    expect(warnSpy).toHaveBeenCalled();
+    warnSpy.mockRestore();
+  });
+
+  it("returns an empty-safe result when projectDir does not exist", async () => {
+    const result = await listFusedProfiles("/nonexistent/path", userSkillsDir);
+    // Should still return registry + user skills, no throw
+    expect(Array.isArray(result)).toBe(true);
+  });
+});