boost-skill-cli 1.0.306__tar.gz → 1.0.307__tar.gz

{boost_skill_cli-1.0.306/boost_skill_cli.egg-info → boost_skill_cli-1.0.307}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.306
+Version: 1.0.307
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.306 → boost_skill_cli-1.0.307}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.306'
-__version_tuple__ = version_tuple = (1, 0, 306)
+__version__ = version = '1.0.307'
+__version_tuple__ = version_tuple = (1, 0, 307)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.306 → boost_skill_cli-1.0.307}/boost_cli/commands/pkg.py

@@ -123,7 +123,33 @@ def _offer_mcp(res: store.InstallResult, no_mcp: bool = False) -> None:
     rows = res.mcp_servers
     if not rows or no_mcp or os.environ.get("BOOST_NO_MCP_OFFER"):
         return
-    from ..core import mcpdecl
+    from ..core import mcpdecl, scopes
+    # A project-scoped install already recorded these in the repo's .mcp.json
+    # (store.register_project_mcp), which is the committable, reviewable
+    # registration `--scope project` promises. Offering a `<host> mcp add` on
+    # top would register the same servers a second time, machine-wide — which
+    # is the bug this path had: the offer never looked at res.scope at all.
+    if res.scope == scopes.SCOPE_PROJECT:
+        # Report what was RECORDED, not what was declared. The two differ when
+        # the sidecar could not be written — a read-only checkout, a root-owned
+        # .mcp.json — and claiming success there would be the worse failure,
+        # because the skill really is installed and the servers really are not.
+        wanted = [r["name"] for r in mcpdecl.registrable(rows)]
+        if not wanted:
+            return
+        out.info("")
+        if res.mcp_recorded:
+            out.ok("recorded %s in %s"
+                   % (_plural(len(res.mcp_recorded), "MCP server"),
+                      mcpdecl.SIDECAR))
+            out.dim("  %s — commit it to share with the team"
+                    % ", ".join(res.mcp_recorded))
+        else:
+            out.warn("could not write %s — %s not registered"
+                     % (mcpdecl.SIDECAR, ", ".join(wanted)))
+            out.dim("  the skill is installed; fix the file's permissions and "
+                    "reinstall to record them")
+        return
     out.info("")
     out.warn("%s needs %s to work:" % (res.name, _plural(len(rows), "MCP server")))
     for row in rows:
@@ -142,22 +168,32 @@ def _offer_mcp(res: store.InstallResult, no_mcp: bool = False) -> None:
     targets = [h for h in mcphost.hosts() if shutil.which(mcphost.cli(h))] \
         or mcphost.hosts()
     where = " · ".join(mcphost.label(h) for h in targets)
-    if not out.confirm("register %s with %s now?"
+    # Name the scope. The prompt used to say only "register N servers with
+    # Claude Code now?", which is the one detail the answer turns on — this
+    # writes a registration every project on this machine will then launch.
+    if not out.confirm("register %s with %s, for every project on this machine?"
                        % (_plural(len(wirable), "server"), where), default=False):
         out.dim("  skipped — `%s mcp add …` when you're ready"
                 % mcphost.cli(targets[0]))
         return
     for row in wirable:
         for host in targets:
-            _register_mcp_server(row["name"], row["spec"], host=host)
+            _register_mcp_server(row["name"], row["spec"], host=host,
+                                 scope=res.scope)
 
 
-def _register_mcp_server(name: str, spec: dict, host: str = "claude") -> None:
-    """Run one `<host> mcp add` for a skill-declared server. Never raises."""
+def _register_mcp_server(name: str, spec: dict, host: str = "claude",
+                         scope: str = "user") -> None:
+    """Run one `<host> mcp add` for a skill-declared server. Never raises.
+
+    ``scope`` is threaded from the install rather than defaulted, because
+    ``register_argv``'s own default is ``"user"`` and silently taking it is how
+    a ``--scope project`` install ended up registering machine-wide.
+    """
     import subprocess
 
     from ..core import mcpdecl, mcphost
-    argv = mcpdecl.register_argv(name, spec, host=host)
+    argv = mcpdecl.register_argv(name, spec, host=host, scope=scope)
     if not shutil.which(mcphost.cli(host)):
         out.warn("`%s` CLI not found — run this yourself:" % mcphost.cli(host))
         out.info("  " + " ".join(argv))

{boost_skill_cli-1.0.306 → boost_skill_cli-1.0.307}/boost_cli/core/store.py

@@ -51,6 +51,10 @@ class InstallResult:
     # but never acted on: core stays non-interactive, so the command layer owns
     # the offer to register them — same split as `conflicts` and `score`.
     mcp_servers: List[dict] = field(default_factory=list)
+    # Names actually written to the project's .mcp.json — not what was
+    # declared. The two differ when the file could not be written, and the
+    # install report must show the former.
+    mcp_recorded: List[str] = field(default_factory=list)
 
 
 def skill_store_dir(name: str) -> Path:
@@ -266,6 +270,89 @@ def declared_mcp_servers(skill_dir) -> List[dict]:
     return mcpdecl.servers_for(meta, sidecar)
 
 
+def project_mcp_sidecar(base) -> Path:
+    """The repo's ``.mcp.json`` — where a project-scoped install records servers.
+
+    The committable file agents already read, which is the whole point of
+    project scope over shelling out to ``<host> mcp add``: a registration that
+    lives here is reviewable in a diff and arrives with a teammate's clone,
+    where one made through a host CLI exists only on the machine that ran it.
+    """
+    from . import mcpdecl
+    return Path(base) / mcpdecl.SIDECAR
+
+
+def _load_sidecar(path: Path) -> Optional[dict]:
+    """The sidecar document, or None if absent or unreadable.
+
+    Best-effort by design, exactly like :func:`declared_mcp_servers`: by the
+    time this runs the skill is already on disk, so a corrupt ``.mcp.json`` must
+    not turn a completed install into a traceback. ``merge_into`` treats a
+    non-dict as empty, so a damaged file is rebuilt rather than propagated.
+    """
+    import json
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+
+
+def _write_sidecar(path: Path, doc: dict) -> bool:
+    """Write the sidecar as indented JSON. False if it could not be written.
+
+    Best-effort on the way OUT as well as in. ``_load_sidecar`` already refuses
+    to turn a corrupt file into a traceback, but the write is the half that runs
+    *after* the skill is materialized, the lock is written and the journal is
+    logged — so an unwritable ``.mcp.json`` (read-only checkout, a root-owned
+    file, a full disk) would crash an install that had already succeeded. The
+    caller reports what was actually recorded rather than what was declared, so
+    a failure here is visible instead of silent.
+    """
+    import json
+    try:
+        path.write_text(json.dumps(doc, indent=2, sort_keys=True) + "\n",
+                        encoding="utf-8")
+        return True
+    except OSError:
+        return False
+
+
+def register_project_mcp(base, rows, skill: str) -> List[str]:
+    """Record ``skill``'s declared MCP servers in the repo. Returns names added.
+
+    Never overwrites a server already present — one the user configured by hand,
+    or one another skill declared first — and never creates the file for a skill
+    that declares nothing registrable, so a repo gains an ``.mcp.json`` only
+    when there is genuinely something in it.
+    """
+    from . import mcpdecl as _decl
+    if not _decl.registrable(rows):
+        return []
+    path = project_mcp_sidecar(base)
+    doc, added = _decl.merge_into(_load_sidecar(path), rows, skill)
+    if added and not _write_sidecar(path, doc):
+        return []          # nothing was recorded; do not claim otherwise
+    return added
+
+
+def unregister_project_mcp(base, skill: str) -> List[str]:
+    """Remove the servers boost recorded for ``skill``. Returns names removed.
+
+    Marker-keyed entries only, so a hand-configured server and another skill's
+    server both survive. Writes nothing when it owns nothing, which keeps an
+    uninstall from rewriting — and reformatting — a file it has no claim on.
+    """
+    from . import mcpdecl as _decl
+    path = project_mcp_sidecar(base)
+    existing = _load_sidecar(path)
+    if existing is None:
+        return []
+    doc, removed = _decl.strip_owned(existing, skill)
+    if removed and not _write_sidecar(path, doc):
+        return []
+    return removed
+
+
 def _enforce_capability_policy(name: str, skill_md: Path) -> None:
     """Raise if the skill's declared/detected capabilities are denied by policy.
 
@@ -501,6 +588,12 @@ def _install_project_skill(entry: dict, force: bool = False,
     res.upgraded = existing is not None
     res.scope = scopes.SCOPE_PROJECT
     res.score, _ = util.score_skill(first)
+    res.mcp_servers = declared_mcp_servers(first)
+    # Project scope registers into the repo's own .mcp.json rather than leaving
+    # it to the command layer's `<host> mcp add` offer, which is user-scoped and
+    # would put a machine-wide registration behind a --scope project install.
+    # Recorded here so it lands with the skill and reverses with it.
+    res.mcp_recorded = register_project_mcp(resolved_base, res.mcp_servers, name)
     return res
 
 
@@ -525,8 +618,14 @@ def uninstall_project(name: str, base=None) -> dict:
         if m.get("agent"):
             removed.append(m["agent"])
     projectlock.remove_skill(resolved_base, name)
+    # Reverse exactly what the install recorded. Marker-keyed entries only, so a
+    # server the user configured by hand — or one another skill still needs —
+    # survives. Without this a skill tried once keeps launching its server for
+    # every project that clones the repo.
+    unregistered = unregister_project_mcp(resolved_base, name)
     journal.log("uninstall", name, scope=scopes.SCOPE_PROJECT)
     return {"name": name, "unlinked": removed, "entry": entry,
+            "mcp_unregistered": unregistered,
             "scope": scopes.SCOPE_PROJECT, "base": str(resolved_base)}
 
 

{boost_skill_cli-1.0.306 → boost_skill_cli-1.0.307/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.306
+Version: 1.0.307
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.306 → boost_skill_cli-1.0.307}/boost_skill_cli.egg-info/SOURCES.txt

@@ -520,6 +520,7 @@ tests/unit/test_pkg_secrets.py
 tests/unit/test_platform_pins.py
 tests/unit/test_policy.py
 tests/unit/test_post_deploy_smoke.py
+tests/unit/test_project_mcp_sidecar.py
 tests/unit/test_projectlock.py
 tests/unit/test_provenance.py
 tests/unit/test_rag.py

{boost_skill_cli-1.0.306 → boost_skill_cli-1.0.307}/docs/roadmap/items/mcp-servers-ignore-install-scope.md

@@ -2,15 +2,15 @@
 id: mcp-servers-ignore-install-scope
 board: code
 section: dx
-status: planned
+status: shipped
 category: Bug · MCP
 complexity: M
 impact: High
 wow: 4
 note: --scope project installs the skill into the repo and its MCP server machine-wide
 order: 14
-owner:
-pr:
+owner: loop/mcp-scope-fix
+pr: 351
 title: A project-scoped install registers its MCP servers <em>machine-wide</em>
 ---
 <code>boost install &lt;skill&gt; --scope project</code> (or <code>--here</code>) is a promise about
@@ -66,5 +66,31 @@ the scope it was registered at, which is another reason to record it rather than
 names no scope. It should say which file or scope is about to change, because that is the decision
 being made.
 
+<b>Shipped, all four.</b> Scope now flows: <code>_offer_mcp</code> reads <code>res.scope</code> and
+threads it through <code>_register_mcp_server</code> into <code>register_argv</code>, so a
+user-scope install passes its scope explicitly rather than silently inheriting the
+<code>scope="user"</code> default that caused this. A project-scope install does not shell out at
+all &mdash; it records into the repo's <code>.mcp.json</code>, which is the committable, reviewable
+registration <code>--scope project</code> promises, and it arrives with a teammate's clone where a
+host-CLI registration exists only on the machine that ran it. Uninstall reverses exactly those
+entries. And the prompt names the scope: it now asks to register "for every project on this
+machine", which is the detail the answer turns on.
+
+Wiring was most of it &mdash; <b>both halves of the document logic already existed and had no
+callers</b>. <code>merge_into</code> and <code>strip_owned</code> were written, tested and unused;
+the new code is the file I/O around them, which lives in <code>core/store.py</code> because
+<code>core/mcpdecl.py</code> is deliberately I/O-free (the same split <code>core/mcphost.py</code>
+keeps).
+
+The properties worth stating, because each is a way to destroy someone else's work: a server the
+user configured by hand is never overwritten on install and never removed on uninstall; another
+skill's server survives both; unrelated keys in the document survive both; an uninstall that owns
+nothing does not rewrite &mdash; and so does not reformat &mdash; a file it has no claim on; and a
+corrupt or absent <code>.mcp.json</code> is never fatal, because by then the skill is already on
+disk. A skill declaring nothing registrable creates no file at all.
+
+Verified by disabling the wiring and confirming the end-to-end tests fail without it, rather than
+trusting that a passing test proves anything.
+
 Related: [[mcp-aware-skills]] (which added the declaration format),
 [[mcp-install-skips-the-injection-scan]] and [[mcp-register-names-server-before-env]].

{boost_skill_cli-1.0.306 → boost_skill_cli-1.0.307}/docs/roadmap.html

@@ -3284,7 +3284,7 @@ suite only runs if a human remembers to run it locally, so a CLI change that bre
       </article>
 
       <article class="cap rcard" id="mcp-servers-ignore-install-scope">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Bug · MCP</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Bug · MCP</span></div>
         <h3>A project-scoped install registers its MCP servers <em>machine-wide</em></h3>
         <p><code>boost install &lt;skill&gt; --scope project</code> (or <code>--here</code>) is a promise about
 blast radius: the skill lands inside this repo, committable, affecting nobody else's machine. The
@@ -3339,6 +3339,32 @@ the scope it was registered at, which is another reason to record it rather than
 names no scope. It should say which file or scope is about to change, because that is the decision
 being made.
 
+<b>Shipped, all four.</b> Scope now flows: <code>_offer_mcp</code> reads <code>res.scope</code> and
+threads it through <code>_register_mcp_server</code> into <code>register_argv</code>, so a
+user-scope install passes its scope explicitly rather than silently inheriting the
+<code>scope="user"</code> default that caused this. A project-scope install does not shell out at
+all &mdash; it records into the repo's <code>.mcp.json</code>, which is the committable, reviewable
+registration <code>--scope project</code> promises, and it arrives with a teammate's clone where a
+host-CLI registration exists only on the machine that ran it. Uninstall reverses exactly those
+entries. And the prompt names the scope: it now asks to register "for every project on this
+machine", which is the detail the answer turns on.
+
+Wiring was most of it &mdash; <b>both halves of the document logic already existed and had no
+callers</b>. <code>merge_into</code> and <code>strip_owned</code> were written, tested and unused;
+the new code is the file I/O around them, which lives in <code>core/store.py</code> because
+<code>core/mcpdecl.py</code> is deliberately I/O-free (the same split <code>core/mcphost.py</code>
+keeps).
+
+The properties worth stating, because each is a way to destroy someone else's work: a server the
+user configured by hand is never overwritten on install and never removed on uninstall; another
+skill's server survives both; unrelated keys in the document survive both; an uninstall that owns
+nothing does not rewrite &mdash; and so does not reformat &mdash; a file it has no claim on; and a
+corrupt or absent <code>.mcp.json</code> is never fatal, because by then the skill is already on
+disk. A skill declaring nothing registrable creates no file at all.
+
+Verified by disabling the wiring and confirming the end-to-end tests fail without it, rather than
+trusting that a passing test proves anything.
+
 Related: [[mcp-aware-skills]] (which added the declaration format),
 [[mcp-install-skips-the-injection-scan]] and [[mcp-register-names-server-before-env]].</p>
         <div class="meta">

{boost_skill_cli-1.0.306 → boost_skill_cli-1.0.307}/tests/functional/test_workspace_scope.py

@@ -265,3 +265,66 @@ def test_doctor_reports_intact_project_skills(boost, tapped, repo):
     boost("install", "brainstorming", "--local")
     res = boost("doctor")
     assert "project skill" in res.out and "intact" in res.out
+
+
+# ── declared MCP servers stay in the repo ────────────────────────────────
+
+def _declare_mcp(tapped, skill: str, server: str = "gh"):
+    """Give a skill in the tap clone an .mcp.json sidecar declaring a server."""
+    from boost_cli.core import catalog, mcpdecl
+    matches = catalog.find(skill)
+    assert matches, skill
+    src = store.source_dir_for(matches[0])
+    (src / mcpdecl.SIDECAR).write_text(json.dumps(
+        {mcpdecl.SERVERS_KEY: {server: {"command": "npx", "args": ["-y", server]}}}),
+        encoding="utf-8")
+
+
+def test_a_local_install_records_mcp_servers_in_the_repo(boost, tapped, repo):
+    """THE BUG: --local promised repo-scoped and registered machine-wide.
+
+    A project install must leave its declared servers in the repo's own
+    .mcp.json — committable, reviewable, and arriving with a teammate's clone —
+    rather than in this machine's user-scope host config.
+    """
+    from boost_cli.core import mcpdecl
+    _declare_mcp(tapped, "brainstorming")
+    boost("install", "brainstorming", "--local")
+    sidecar = repo / mcpdecl.SIDECAR
+    assert sidecar.is_file(), "no .mcp.json written into the repo"
+    servers = json.loads(sidecar.read_text())[mcpdecl.SERVERS_KEY]
+    assert "gh" in servers
+    assert servers["gh"][mcpdecl.MARKER_KEY] == "brainstorming", \
+        "the entry must name the skill that asked for it, so uninstall can reverse it"
+
+
+def test_uninstalling_locally_removes_the_servers_it_added(boost, tapped, repo):
+    from boost_cli.core import mcpdecl
+    _declare_mcp(tapped, "brainstorming")
+    boost("install", "brainstorming", "--local")
+    boost("uninstall", "brainstorming", "--local")
+    servers = json.loads((repo / mcpdecl.SIDECAR).read_text())[mcpdecl.SERVERS_KEY]
+    assert "gh" not in servers, \
+        "a skill removed from the repo must stop launching its server"
+
+
+def test_uninstall_leaves_a_hand_written_server_alone(boost, tapped, repo):
+    from boost_cli.core import mcpdecl
+    (repo / mcpdecl.SIDECAR).write_text(json.dumps(
+        {mcpdecl.SERVERS_KEY: {"mine": {"command": "my-own-thing"}}}),
+        encoding="utf-8")
+    _declare_mcp(tapped, "brainstorming")
+    boost("install", "brainstorming", "--local")
+    boost("uninstall", "brainstorming", "--local")
+    servers = json.loads((repo / mcpdecl.SIDECAR).read_text())[mcpdecl.SERVERS_KEY]
+    assert servers["mine"] == {"command": "my-own-thing"}, \
+        "boost must only reverse what boost wrote"
+
+
+def test_a_user_install_writes_no_sidecar_into_the_repo(boost, tapped, repo):
+    # The complement: user scope must not start scattering .mcp.json files into
+    # whatever directory the install happened to run from.
+    from boost_cli.core import mcpdecl
+    _declare_mcp(tapped, "brainstorming")
+    boost("install", "brainstorming")
+    assert not (repo / mcpdecl.SIDECAR).exists()

boost_skill_cli-1.0.307/tests/unit/test_project_mcp_sidecar.py

@@ -0,0 +1,187 @@
+"""Unit tests: a project-scoped install records its MCP servers in the repo.
+
+``boost install <skill> --scope project`` is a promise about blast radius: the
+skill lands inside this repo, committable, affecting nobody else's machine. Its
+declared MCP servers did not keep that promise — they were registered at *user*
+scope, globally, whatever scope the skill was installed at, because
+``_offer_mcp`` never read ``res.scope`` and ``_register_mcp_server`` took no
+scope at all.
+
+The document logic for doing it properly already existed and had no callers:
+``mcpdecl.merge_into`` merges declared servers into an ``.mcp.json`` — the
+committable file agents already read — stamping each entry with a marker naming
+the skill that asked for it, and ``mcpdecl.strip_owned`` reverses exactly those.
+Both are pure. These tests cover the file I/O that wires them up, which lives in
+``store`` because ``mcpdecl`` is deliberately I/O-free.
+
+The properties that matter are all about *not* destroying someone else's work:
+a hand-configured server, another skill's server, and any unrelated key in the
+document must survive both an install and an uninstall.
+"""
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from boost_cli.core import mcpdecl, store
+
+pytestmark = pytest.mark.usefixtures("sandbox")
+
+
+def _rows(*names):
+    """Registrable declaration rows, the shape `declared_mcp_servers` returns."""
+    return [{"name": n, "spec": {"command": "npx", "args": ["-y", n]}}
+            for n in names]
+
+
+def _read(base):
+    return json.loads((base / mcpdecl.SIDECAR).read_text(encoding="utf-8"))
+
+
+def _servers(base):
+    return _read(base).get(mcpdecl.SERVERS_KEY, {})
+
+
+class TestRegister:
+    def test_writes_a_sidecar_naming_the_skill(self, tmp_path):
+        added = store.register_project_mcp(tmp_path, _rows("gh"), "my-skill")
+        assert added == ["gh"]
+        entry = _servers(tmp_path)["gh"]
+        assert entry["command"] == "npx"
+        assert entry[mcpdecl.MARKER_KEY] == "my-skill"
+
+    def test_the_file_is_json_a_human_can_review(self, tmp_path):
+        # The whole point of project scope over `mcp add` is that it lands in a
+        # file you can read in a diff and commit.
+        store.register_project_mcp(tmp_path, _rows("gh"), "sk")
+        text = (tmp_path / mcpdecl.SIDECAR).read_text(encoding="utf-8")
+        assert text.endswith("\n")
+        assert "\n  " in text, "should be indented, not one line"
+
+    def test_an_existing_hand_written_server_is_never_overwritten(self, tmp_path):
+        (tmp_path / mcpdecl.SIDECAR).write_text(json.dumps(
+            {mcpdecl.SERVERS_KEY: {"gh": {"command": "mine"}}}), encoding="utf-8")
+        added = store.register_project_mcp(tmp_path, _rows("gh"), "sk")
+        assert added == []
+        assert _servers(tmp_path)["gh"] == {"command": "mine"}, \
+            "a server the user configured by hand must survive untouched"
+
+    def test_unrelated_keys_survive(self, tmp_path):
+        (tmp_path / mcpdecl.SIDECAR).write_text(
+            json.dumps({"inputs": [1, 2], mcpdecl.SERVERS_KEY: {}}),
+            encoding="utf-8")
+        store.register_project_mcp(tmp_path, _rows("gh"), "sk")
+        assert _read(tmp_path)["inputs"] == [1, 2]
+
+    def test_a_corrupt_sidecar_does_not_lose_the_install(self, tmp_path):
+        # Best-effort, like declared_mcp_servers: the skill is already on disk
+        # by this point, so an unreadable sidecar must not raise.
+        (tmp_path / mcpdecl.SIDECAR).write_text("{not json", encoding="utf-8")
+        added = store.register_project_mcp(tmp_path, _rows("gh"), "sk")
+        assert added == ["gh"]
+        assert "gh" in _servers(tmp_path)
+
+    def test_no_rows_writes_nothing(self, tmp_path):
+        assert store.register_project_mcp(tmp_path, [], "sk") == []
+        assert not (tmp_path / mcpdecl.SIDECAR).exists(), \
+            "a skill with no servers must not create an empty sidecar"
+
+    def test_a_name_only_declaration_is_not_invented(self, tmp_path):
+        # `registrable` filters these out: boost will not invent a command line.
+        assert store.register_project_mcp(
+            tmp_path, [{"name": "gh", "spec": {}}], "sk") == []
+        assert not (tmp_path / mcpdecl.SIDECAR).exists()
+
+    def test_two_skills_each_keep_their_own_marker(self, tmp_path):
+        store.register_project_mcp(tmp_path, _rows("a"), "one")
+        store.register_project_mcp(tmp_path, _rows("b"), "two")
+        servers = _servers(tmp_path)
+        assert servers["a"][mcpdecl.MARKER_KEY] == "one"
+        assert servers["b"][mcpdecl.MARKER_KEY] == "two"
+
+
+class TestUnregister:
+    def test_removes_only_this_skills_servers(self, tmp_path):
+        store.register_project_mcp(tmp_path, _rows("a"), "one")
+        store.register_project_mcp(tmp_path, _rows("b"), "two")
+        removed = store.unregister_project_mcp(tmp_path, "one")
+        assert removed == ["a"]
+        assert list(_servers(tmp_path)) == ["b"], \
+            "another skill's server must survive this uninstall"
+
+    def test_a_hand_written_server_survives_uninstall(self, tmp_path):
+        (tmp_path / mcpdecl.SIDECAR).write_text(json.dumps(
+            {mcpdecl.SERVERS_KEY: {"mine": {"command": "x"}}}), encoding="utf-8")
+        store.register_project_mcp(tmp_path, _rows("gh"), "sk")
+        store.unregister_project_mcp(tmp_path, "sk")
+        assert list(_servers(tmp_path)) == ["mine"]
+
+    def test_unrelated_keys_survive_uninstall(self, tmp_path):
+        (tmp_path / mcpdecl.SIDECAR).write_text(
+            json.dumps({"inputs": [7], mcpdecl.SERVERS_KEY: {}}),
+            encoding="utf-8")
+        store.register_project_mcp(tmp_path, _rows("gh"), "sk")
+        store.unregister_project_mcp(tmp_path, "sk")
+        assert _read(tmp_path)["inputs"] == [7]
+
+    def test_no_sidecar_is_not_an_error(self, tmp_path):
+        assert store.unregister_project_mcp(tmp_path, "sk") == []
+
+    def test_a_corrupt_sidecar_is_not_an_error(self, tmp_path):
+        (tmp_path / mcpdecl.SIDECAR).write_text("{not json", encoding="utf-8")
+        assert store.unregister_project_mcp(tmp_path, "sk") == []
+
+    def test_nothing_owned_leaves_the_file_untouched(self, tmp_path):
+        original = json.dumps({mcpdecl.SERVERS_KEY: {"mine": {"command": "x"}}})
+        (tmp_path / mcpdecl.SIDECAR).write_text(original, encoding="utf-8")
+        assert store.unregister_project_mcp(tmp_path, "sk") == []
+        assert (tmp_path / mcpdecl.SIDECAR).read_text(encoding="utf-8") == original, \
+            "removing nothing must not rewrite the file"
+
+    def test_register_then_unregister_round_trips(self, tmp_path):
+        store.register_project_mcp(tmp_path, _rows("a", "b"), "sk")
+        assert sorted(_servers(tmp_path)) == ["a", "b"]
+        assert store.unregister_project_mcp(tmp_path, "sk") == ["a", "b"]
+        assert _servers(tmp_path) == {}
+
+
+class TestAnUnwritableSidecarNeverCrashesAnInstall:
+    """The write is the half that runs AFTER the install is already committed.
+
+    By the time `register_project_mcp` is called the skill is materialized, the
+    project lock is written and the journal is logged. An unwritable
+    `.mcp.json` — read-only checkout, root-owned file, full disk — must not
+    turn that completed install into a traceback, which is the same contract
+    `_load_sidecar` already keeps for a corrupt file on the way in.
+    """
+
+    @staticmethod
+    def _unwritable(monkeypatch):
+        def boom(*_a, **_k):
+            raise OSError(13, "Permission denied")
+        monkeypatch.setattr(store.Path, "write_text", boom)
+
+    def test_register_reports_nothing_recorded_instead_of_raising(
+            self, tmp_path, monkeypatch):
+        self._unwritable(monkeypatch)
+        assert store.register_project_mcp(tmp_path, _rows("gh"), "sk") == []
+
+    def test_unregister_reports_nothing_removed_instead_of_raising(
+            self, tmp_path, monkeypatch):
+        (tmp_path / mcpdecl.SIDECAR).write_text(json.dumps(
+            {mcpdecl.SERVERS_KEY: {"gh": {"command": "npx",
+                                          mcpdecl.MARKER_KEY: "sk"}}}),
+            encoding="utf-8")
+        self._unwritable(monkeypatch)
+        assert store.unregister_project_mcp(tmp_path, "sk") == []
+
+    def test_a_failed_write_is_not_reported_as_success(self, tmp_path,
+                                                       monkeypatch):
+        # The return value is what the install report prints, so it must not
+        # name servers that were never written.
+        self._unwritable(monkeypatch)
+        recorded = store.register_project_mcp(tmp_path, _rows("a", "b"), "sk")
+        assert recorded == [], \
+            "claiming a server was recorded when the file could not be " \
+            "written is worse than the failure itself"