vskill 0.1.33 → 0.1.35

package/dist/commands/add.test.js

@@ -73,8 +73,10 @@ vi.mock("../scanner/index.js", () => ({
 // Mock blocklist
 // ---------------------------------------------------------------------------
 const mockCheckBlocklist = vi.fn();
+const mockCheckInstallSafety = vi.fn();
 vi.mock("../blocklist/blocklist.js", () => ({
     checkBlocklist: (...args) => mockCheckBlocklist(...args),
+    checkInstallSafety: (...args) => mockCheckInstallSafety(...args),
 }));
 // ---------------------------------------------------------------------------
 // Mock security (platform security check)
@@ -204,7 +206,7 @@ beforeEach(() => {
 describe("addCommand with --plugin option (plugin directory support)", () => {
     beforeEach(() => {
         // Plugin path hits blocklist check first — return null (not blocked)
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
     });
     // TC-001: --plugin <name> flag selects sub-plugin from multi-plugin repo
     describe("TC-001: plugin flag selects sub-plugin directory", () => {
@@ -460,19 +462,23 @@ describe("addCommand blocklist check (GitHub path)", () => {
         globalThis.fetch = originalFetch;
     });
     it("blocks installation when skill is on the blocklist", async () => {
-        mockCheckBlocklist.mockResolvedValue({
-            skillName: "evil-repo",
-            threatType: "credential-theft",
-            severity: "critical",
-            reason: "Steals AWS credentials",
-            evidenceUrls: [],
-            discoveredAt: "2026-02-01T00:00:00Z",
+        mockCheckInstallSafety.mockResolvedValue({
+            blocked: true,
+            entry: {
+                skillName: "evil-repo",
+                threatType: "credential-theft",
+                severity: "critical",
+                reason: "Steals AWS credentials",
+                evidenceUrls: [],
+                discoveredAt: "2026-02-01T00:00:00Z",
+            },
+            rejected: false,
         });
         const mockExit = vi.spyOn(process, "exit").mockImplementation(() => {
             throw new Error("process.exit");
         });
         await expect(addCommand("owner/evil-repo", {})).rejects.toThrow("process.exit");
-        expect(mockCheckBlocklist).toHaveBeenCalledWith("evil-repo", undefined);
+        expect(mockCheckInstallSafety).toHaveBeenCalledWith("evil-repo");
         expect(mockExit).toHaveBeenCalledWith(1);
         // Tier 1 scan should NOT have been called (blocked before scan)
         expect(mockRunTier1Scan).not.toHaveBeenCalled();
@@ -484,7 +490,7 @@ describe("addCommand blocklist check (GitHub path)", () => {
         mockExit.mockRestore();
     });
     it("proceeds normally when skill is NOT on the blocklist", async () => {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
         mockEnsureLockfile.mockReturnValue({
@@ -495,11 +501,11 @@ describe("addCommand blocklist check (GitHub path)", () => {
             updatedAt: "2026-01-01T00:00:00.000Z",
         });
         await addCommand("owner/safe-repo", {});
-        expect(mockCheckBlocklist).toHaveBeenCalledWith("safe-repo", undefined);
+        expect(mockCheckInstallSafety).toHaveBeenCalledWith("safe-repo");
         expect(mockRunTier1Scan).toHaveBeenCalled();
     });
     it("uses --skill name for blocklist check when provided", async () => {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
         mockEnsureLockfile.mockReturnValue({
@@ -510,7 +516,7 @@ describe("addCommand blocklist check (GitHub path)", () => {
             updatedAt: "2026-01-01T00:00:00.000Z",
         });
         await addCommand("owner/repo", { skill: "my-skill" });
-        expect(mockCheckBlocklist).toHaveBeenCalledWith("my-skill", undefined);
+        expect(mockCheckInstallSafety).toHaveBeenCalledWith("my-skill");
     });
 });
 // ---------------------------------------------------------------------------
@@ -518,13 +524,17 @@ describe("addCommand blocklist check (GitHub path)", () => {
 // ---------------------------------------------------------------------------
 describe("addCommand blocklist check (plugin path)", () => {
     it("blocks plugin installation when plugin is on the blocklist", async () => {
-        mockCheckBlocklist.mockResolvedValue({
-            skillName: "evil-plugin",
-            threatType: "prompt-injection",
-            severity: "critical",
-            reason: "Injects malicious prompts",
-            evidenceUrls: [],
-            discoveredAt: "2026-02-01T00:00:00Z",
+        mockCheckInstallSafety.mockResolvedValue({
+            blocked: true,
+            entry: {
+                skillName: "evil-plugin",
+                threatType: "prompt-injection",
+                severity: "critical",
+                reason: "Injects malicious prompts",
+                evidenceUrls: [],
+                discoveredAt: "2026-02-01T00:00:00Z",
+            },
+            rejected: false,
         });
         mockExistsSync.mockReturnValue(true);
         mockReadFileSync.mockImplementation((p) => {
@@ -543,12 +553,12 @@ describe("addCommand blocklist check (plugin path)", () => {
             throw new Error("process.exit");
         });
         await expect(addCommand("source", { plugin: "evil-plugin", pluginDir: "/tmp/test" })).rejects.toThrow("process.exit");
-        expect(mockCheckBlocklist).toHaveBeenCalledWith("evil-plugin");
+        expect(mockCheckInstallSafety).toHaveBeenCalledWith("evil-plugin");
         expect(mockRunTier1Scan).not.toHaveBeenCalled();
         mockExit.mockRestore();
     });
     it("proceeds with plugin installation when not blocklisted", async () => {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockExistsSync.mockReturnValue(true);
         mockReadFileSync.mockImplementation((p) => {
             if (p.includes("marketplace.json")) {
@@ -573,7 +583,7 @@ describe("addCommand blocklist check (plugin path)", () => {
             updatedAt: "2026-01-01T00:00:00.000Z",
         });
         await addCommand("source", { plugin: "safe-plugin", pluginDir: "/tmp/test" });
-        expect(mockCheckBlocklist).toHaveBeenCalledWith("safe-plugin");
+        expect(mockCheckInstallSafety).toHaveBeenCalledWith("safe-plugin");
         expect(mockRunTier1Scan).toHaveBeenCalled();
     });
 });
@@ -592,13 +602,17 @@ describe("addCommand --force with blocked skill", () => {
         globalThis.fetch = originalFetch;
     });
     it("shows warning box and continues when --force + blocked (GitHub path)", async () => {
-        mockCheckBlocklist.mockResolvedValue({
-            skillName: "evil-skill",
-            threatType: "credential-theft",
-            severity: "critical",
-            reason: "Base64-encoded AWS credential exfil",
-            evidenceUrls: [],
-            discoveredAt: "2026-02-01T00:00:00Z",
+        mockCheckInstallSafety.mockResolvedValue({
+            blocked: true,
+            entry: {
+                skillName: "evil-skill",
+                threatType: "credential-theft",
+                severity: "critical",
+                reason: "Base64-encoded AWS credential exfil",
+                evidenceUrls: [],
+                discoveredAt: "2026-02-01T00:00:00Z",
+            },
+            rejected: false,
         });
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
@@ -620,13 +634,17 @@ describe("addCommand --force with blocked skill", () => {
         expect(mockRunTier1Scan).toHaveBeenCalled();
     });
     it("shows warning box and continues when --force + blocked (plugin path)", async () => {
-        mockCheckBlocklist.mockResolvedValue({
-            skillName: "evil-plugin",
-            threatType: "prompt-injection",
-            severity: "critical",
-            reason: "Injects malicious prompts",
-            evidenceUrls: [],
-            discoveredAt: "2026-02-01T00:00:00Z",
+        mockCheckInstallSafety.mockResolvedValue({
+            blocked: true,
+            entry: {
+                skillName: "evil-plugin",
+                threatType: "prompt-injection",
+                severity: "critical",
+                reason: "Injects malicious prompts",
+                evidenceUrls: [],
+                discoveredAt: "2026-02-01T00:00:00Z",
+            },
+            rejected: false,
         });
         mockExistsSync.mockReturnValue(true);
         mockReadFileSync.mockImplementation((p) => {
@@ -669,7 +687,7 @@ describe("addCommand platform security check (GitHub path)", () => {
             ok: true,
             text: async () => "# Safe Skill\nNormal content",
         });
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
     });
     afterEach(() => {
         globalThis.fetch = originalFetch;
@@ -775,7 +793,7 @@ describe("addCommand platform security check (GitHub path)", () => {
 describe("addCommand multi-skill discovery (GitHub path)", () => {
     const originalFetch = globalThis.fetch;
     beforeEach(() => {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockCheckPlatformSecurity.mockResolvedValue(null);
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
@@ -886,7 +904,7 @@ describe("addCommand multi-skill discovery (GitHub path)", () => {
 describe("addCommand source format routing", () => {
     const originalFetch = globalThis.fetch;
     beforeEach(() => {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockCheckPlatformSecurity.mockResolvedValue(null);
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
@@ -977,7 +995,7 @@ describe("addCommand source format routing", () => {
         // Reset fetch mock
         globalThis.fetch.mockClear();
         vi.clearAllMocks();
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockCheckPlatformSecurity.mockResolvedValue(null);
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
@@ -998,7 +1016,7 @@ describe("addCommand source format routing", () => {
 // ---------------------------------------------------------------------------
 describe("addCommand registry install (no slash in source)", () => {
     beforeEach(() => {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockEnsureLockfile.mockReturnValue({
@@ -1120,7 +1138,7 @@ describe("addCommand smart project root resolution", () => {
             ok: true,
             text: async () => "# Skill content",
         });
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
         mockEnsureLockfile.mockReturnValue({
@@ -1164,7 +1182,7 @@ describe("addCommand --agent filter", () => {
             ok: true,
             text: async () => "# Skill content",
         });
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockEnsureLockfile.mockReturnValue({
             version: 1,
@@ -1225,7 +1243,7 @@ describe("addCommand nested directory fix (TC-016)", () => {
             ok: true,
             text: async () => "# Skill content",
         });
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockEnsureLockfile.mockReturnValue({
             version: 1,
@@ -1294,7 +1312,7 @@ describe("addCommand with --repo flag (remote plugin install)", () => {
         ],
     });
     function setupHappyPath() {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
         mockFindProjectRoot.mockReturnValue("/project");
@@ -1381,7 +1399,7 @@ describe("addCommand with --repo flag (remote plugin install)", () => {
         exitSpy.mockRestore();
     });
     it("exits with error when plugin not found in marketplace", async () => {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         globalThis.fetch = vi.fn().mockImplementation(async (url) => {
             if (url.includes("marketplace.json")) {
                 return { ok: true, text: async () => marketplaceJson };
@@ -1418,7 +1436,7 @@ describe("addCommand native Claude Code plugin install", () => {
         plugins: [{ name: "sw-test", source: "./plugins/test", version: "1.0.0" }],
     });
     beforeEach(() => {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockEnsureLockfile.mockReturnValue({
             version: 1,
@@ -1508,7 +1526,7 @@ describe("addCommand with --repo --all flag (bulk install)", () => {
         ],
     });
     function setupAllHappyPath() {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
         mockFindProjectRoot.mockReturnValue("/project");
@@ -1623,7 +1641,7 @@ describe("addCommand project root consistency", () => {
             ok: true,
             text: async () => "# Skill content",
         });
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockCheckPlatformSecurity.mockResolvedValue(null);
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
@@ -1692,7 +1710,7 @@ describe("addCommand project root consistency", () => {
 describe("addCommand error handling in discovery flow", () => {
     const originalFetch = globalThis.fetch;
     beforeEach(() => {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockCheckPlatformSecurity.mockResolvedValue(null);
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
@@ -1739,7 +1757,7 @@ describe("addCommand error handling in discovery flow", () => {
 describe("addCommand flat name identifier guidance", () => {
     const originalFetch = globalThis.fetch;
     beforeEach(() => {
-        mockCheckBlocklist.mockResolvedValue(null);
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
         mockCheckPlatformSecurity.mockResolvedValue(null);
         mockRunTier1Scan.mockReturnValue(makeScanResult());
         mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
@@ -1790,8 +1808,124 @@ describe("addCommand flat name identifier guidance", () => {
         const logOutput = console.log.mock.calls
             .map((c) => String(c[0]))
             .join("\n");
-        // Should suggest the direct format
-        expect(logOutput).toContain("remotion-dev/skills");
+        // Should suggest the direct format including skill name
+        expect(logOutput).toContain("remotion-dev/skills/remotion-dev-skills-remotion");
+    });
+});
+// ---------------------------------------------------------------------------
+// Registry → GitHub fallback: auto-select matching skill (_targetSkill)
+// ---------------------------------------------------------------------------
+describe("addCommand registry fallback auto-selects matching skill", () => {
+    const originalFetch = globalThis.fetch;
+    beforeEach(() => {
+        mockCheckInstallSafety.mockResolvedValue({ blocked: false, rejected: false });
+        mockCheckPlatformSecurity.mockResolvedValue(null);
+        mockRunTier1Scan.mockReturnValue(makeScanResult());
+        mockDetectInstalledAgents.mockResolvedValue([makeAgent()]);
+        mockFindProjectRoot.mockReturnValue(process.cwd());
+        // Reset canonical installer (earlier test overrides with throwing impl)
+        mockInstallSymlink.mockReturnValue([]);
+        mockInstallCopy.mockReturnValue([]);
+        mockEnsureLockfile.mockReturnValue({
+            version: 1,
+            agents: [],
+            skills: {},
+            createdAt: "2026-01-01T00:00:00.000Z",
+            updatedAt: "2026-01-01T00:00:00.000Z",
+        });
+    });
+    afterEach(() => {
+        globalThis.fetch = originalFetch;
+    });
+    it("auto-selects matching skill from multi-skill repo (installs 1, not all)", async () => {
+        mockGetSkill.mockResolvedValue({
+            name: "excalidraw-diagram-generator",
+            author: "github",
+            content: undefined,
+            repoUrl: "https://github.com/github/awesome-copilot",
+            installs: 100,
+            updatedAt: "2026-02-20T00:00:00Z",
+        });
+        mockDiscoverSkills.mockResolvedValue([
+            { name: "code-review", path: "skills/code-review/SKILL.md", rawUrl: "https://raw.githubusercontent.com/github/awesome-copilot/main/skills/code-review/SKILL.md" },
+            { name: "excalidraw-diagram-generator", path: "skills/excalidraw-diagram-generator/SKILL.md", rawUrl: "https://raw.githubusercontent.com/github/awesome-copilot/main/skills/excalidraw-diagram-generator/SKILL.md" },
+            { name: "unit-test-writer", path: "skills/unit-test-writer/SKILL.md", rawUrl: "https://raw.githubusercontent.com/github/awesome-copilot/main/skills/unit-test-writer/SKILL.md" },
+        ]);
+        globalThis.fetch = vi.fn().mockResolvedValue({
+            ok: true,
+            text: async () => "# Excalidraw Diagram Generator",
+        });
+        await addCommand("excalidraw-diagram-generator", {});
+        // Should only install 1 skill, not all 3
+        expect(mockRunTier1Scan).toHaveBeenCalledTimes(1);
+        const lockArg = mockWriteLockfile.mock.calls[0][0];
+        expect(Object.keys(lockArg.skills)).toHaveLength(1);
+        expect(lockArg.skills).toHaveProperty("excalidraw-diagram-generator");
+        expect(lockArg.skills).not.toHaveProperty("code-review");
+        expect(lockArg.skills).not.toHaveProperty("unit-test-writer");
+    });
+    it("falls through to install all when registry name does not match any discovered skill", async () => {
+        mockGetSkill.mockResolvedValue({
+            name: "remotion-dev-skills-remotion",
+            author: "remotion-dev",
+            content: undefined,
+            repoUrl: "https://github.com/remotion-dev/skills",
+            installs: 0,
+            updatedAt: "2026-02-20T00:00:00Z",
+        });
+        // Registry name "remotion-dev-skills-remotion" does NOT match dir names
+        mockDiscoverSkills.mockResolvedValue([
+            { name: "remotion", path: "skills/remotion/SKILL.md", rawUrl: "https://raw.githubusercontent.com/remotion-dev/skills/main/skills/remotion/SKILL.md" },
+            { name: "video-editor", path: "skills/video-editor/SKILL.md", rawUrl: "https://raw.githubusercontent.com/remotion-dev/skills/main/skills/video-editor/SKILL.md" },
+        ]);
+        globalThis.fetch = vi.fn().mockResolvedValue({
+            ok: true,
+            text: async () => "# Skill content",
+        });
+        // Non-TTY → installs all discovered skills (no prompt)
+        await addCommand("remotion-dev-skills-remotion", {});
+        // Both skills should be installed (no auto-filter match)
+        expect(mockRunTier1Scan).toHaveBeenCalledTimes(2);
+        const lockArg = mockWriteLockfile.mock.calls[0][0];
+        expect(Object.keys(lockArg.skills)).toHaveLength(2);
+    });
+    it("tip message suggests 3-part owner/repo/skill format", async () => {
+        mockGetSkill.mockResolvedValue({
+            name: "excalidraw-diagram-generator",
+            author: "github",
+            content: undefined,
+            repoUrl: "https://github.com/github/awesome-copilot",
+            installs: 0,
+            updatedAt: "2026-02-20T00:00:00Z",
+        });
+        mockDiscoverSkills.mockResolvedValue([
+            { name: "excalidraw-diagram-generator", path: "skills/excalidraw-diagram-generator/SKILL.md", rawUrl: "https://raw.githubusercontent.com/github/awesome-copilot/main/skills/excalidraw-diagram-generator/SKILL.md" },
+        ]);
+        globalThis.fetch = vi.fn().mockResolvedValue({
+            ok: true,
+            text: async () => "# Skill content",
+        });
+        await addCommand("excalidraw-diagram-generator", {});
+        const logOutput = console.log.mock.calls
+            .map((c) => String(c[0]))
+            .join("\n");
+        expect(logOutput).toContain("github/awesome-copilot/excalidraw-diagram-generator");
+    });
+    it("does not auto-filter when _targetSkill is not set (direct owner/repo)", async () => {
+        mockDiscoverSkills.mockResolvedValue([
+            { name: "skill-a", path: "skills/skill-a/SKILL.md", rawUrl: "https://raw.githubusercontent.com/owner/repo/main/skills/skill-a/SKILL.md" },
+            { name: "skill-b", path: "skills/skill-b/SKILL.md", rawUrl: "https://raw.githubusercontent.com/owner/repo/main/skills/skill-b/SKILL.md" },
+        ]);
+        globalThis.fetch = vi.fn().mockResolvedValue({
+            ok: true,
+            text: async () => "# Skill content",
+        });
+        // Direct install without registry — no _targetSkill
+        await addCommand("owner/repo", {});
+        // Both skills should be installed
+        expect(mockRunTier1Scan).toHaveBeenCalledTimes(2);
+        const lockArg = mockWriteLockfile.mock.calls[0][0];
+        expect(Object.keys(lockArg.skills)).toHaveLength(2);
     });
 });
 //# sourceMappingURL=add.test.js.map