fix(#824): enforce exact skill link ownership

packages/mosaic/framework/tools/_scripts/mosaic-sync-skills

@@ -242,14 +242,10 @@ prune_stale_links_in_target() {
       continue
     fi
 
-    resolved="$(readlink -f "$link_path" 2>/dev/null || true)"
-    if [[ -z "$resolved" ]]; then
-      rm -f "$link_path"
-      echo "[mosaic-skills] Removed stale broken skill link: $link_path"
-      continue
-    fi
-
-    if [[ "$resolved" == "$MOSAIC_HOME/"* ]]; then
+    # -m resolves lexical dangling targets too. If resolution fails, ownership
+    # is unproven and the link must be preserved.
+    resolved="$(readlink -m "$link_path" 2>/dev/null || true)"
+    if [[ -n "$resolved" && "$resolved" == "$canonical_real/"* ]]; then
       rm -f "$link_path"
       echo "[mosaic-skills] Removed stale retired skill link: $link_path"
     fi

packages/mosaic/package.json

@@ -53,6 +53,7 @@
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
+    "@vitest/coverage-v8": "^2.0.0",
     "@types/react": "^18.3.0",
     "tsx": "^4.0.0",
     "typescript": "^5.8.0",

packages/mosaic/src/commands/skill.spec.ts

@@ -113,6 +113,62 @@ describe('Claude skill bridge', () => {
     );
   });
 
+  describe('CLI status output', () => {
+    let previousExitCode: number | string | null | undefined;
+
+    beforeEach(() => {
+      previousExitCode = process.exitCode;
+      process.exitCode = undefined;
+    });
+
+    afterEach(() => {
+      process.exitCode = previousExitCode;
+    });
+
+    async function run(...args: string[]): Promise<void> {
+      const program = new Command().exitOverride();
+      registerSkillCommand(program, paths);
+      await program.parseAsync(['node', 'mosaic', 'skill', ...args]);
+    }
+
+    it('reports register repair/idempotency and unregister idempotency statuses', async () => {
+      const log = vi.spyOn(console, 'log').mockImplementation(() => undefined);
+      createSkill('status-skill');
+
+      await run('register', 'status-skill');
+      await run('register', 'status-skill');
+      rmSync(join(paths.claudeSkillsDir, 'status-skill'));
+      symlinkSync(
+        join(paths.mosaicSkillsDir, 'retired'),
+        join(paths.claudeSkillsDir, 'status-skill'),
+      );
+      await run('register', 'status-skill');
+      await run('unregister', 'status-skill');
+      await run('unregister', 'status-skill');
+
+      expect(log.mock.calls.flat()).toEqual([
+        'status-skill: registered',
+        'status-skill: already registered',
+        'status-skill: repaired dangling registration',
+        'status-skill: unregistered',
+        'status-skill: already unregistered',
+      ]);
+      log.mockRestore();
+    });
+
+    it('reports empty and populated skill lists', async () => {
+      const log = vi.spyOn(console, 'log').mockImplementation(() => undefined);
+
+      await run('list');
+      createSkill('listed');
+      await run('list');
+
+      expect(log).toHaveBeenCalledWith('No Mosaic or Claude Code skills found.');
+      expect(log).toHaveBeenCalledWith(expect.stringMatching(/^unregistered\s+listed$/));
+      log.mockRestore();
+    });
+  });
+
   describe('registerSkill', () => {
     it('creates the exact canonical symlink and is idempotent', () => {
       createSkill('new-skill');

packages/mosaic/src/commands/skill.ts

@@ -88,6 +88,7 @@ export function validateSkillName(name: string): void {
   if (
     name.length === 0 ||
     name.startsWith('-') ||
+    name.endsWith('.') ||
     name.includes('..') ||
     name.includes('/') ||
     name.includes('\\') ||
@@ -230,6 +231,13 @@ export function unregisterSkill(
   const targetPath = resolveLinkTarget(linkPath);
   if (!isInsideSkillsRoot(targetPath, paths.mosaicSkillsDir)) throw foreignTargetError(linkPath);
 
+  const expectedTarget = resolve(directChild(paths.mosaicSkillsDir, name));
+  if (targetPath !== expectedTarget) {
+    throw new SkillBridgeError(
+      `Refusing to unregister misdirected Mosaic skill symlink at ${linkPath}; it points to ${targetPath}, not ${expectedTarget}.`,
+    );
+  }
+
   unlinkSync(linkPath);
   return { name, status: 'unregistered', linkPath };
 }

packages/mosaic/vitest.config.ts

@@ -5,5 +5,16 @@ export default defineConfig({
     globals: true,
     environment: 'node',
     testTimeout: 30_000,
+    coverage: {
+      provider: 'v8',
+      include: ['src/commands/skill.ts'],
+      reporter: ['text', 'json-summary'],
+      thresholds: {
+        statements: 85,
+        branches: 85,
+        functions: 85,
+        lines: 85,
+      },
+    },
   },
 });