fix(validate): catch unquoted YAML frontmatter that runtime drops (reworks #30)

[antongulin]

Reworks #30 (credit @mxl for the report, original implementation, and test scenarios — co-authored on the commit).

Why not merge #30 as-is

#30 added the yaml package, and bundling it broke the compiled dist (TypeError: __require is not a function in the package tests after rebuild). The reported bug — unquoted frontmatter values containing : pass validation but get dropped by the runtime's strict YAML parser — doesn't need a full YAML parser to catch.

What changed

• validateSkill now rejects top-level unquoted key: value frontmatter lines whose value contains : , reporting the key, line number, and a quoting hint.
• Quoted values, block scalars (|/> incl. chomping modifiers), continuation lines, and list items are unaffected.
• New validate.test.ts covering the scenarios from fix(validate): catch unquoted YAML frontmatter that runtime drops #30's test file (quoted-with-colon passes, unquoted-without-colon passes, bundled skill fixture passes, unquoted description/name/mid-value with : fail).
• No dependency changes. Rebuilt dist.

Verification

• npm run build clean
• npm test: 24/24 pass
• npm run test:ts: 50/50 pass

Closes #30.

🤖 Generated with Claude Code

[github-actions]

🏹 Robin

✅ Review done. I flagged 3 things worth a look.

Push fixes whenever you like, then comment /robin for another pass.

[github-actions]

🏹 Robin

Heads up: this is a point-in-time review. Push fixes freely, then comment /robin whenever you want another pass.

🔵 1 Low | 💡 2 Suggestions

Summary

The change adds validation to catch unquoted YAML frontmatter values containing ': ' (colon-space), which would cause the runtime to silently drop skills. The logic is sound: the check correctly excludes quoted values and block scalar markers, and the error message with a quote hint is helpful. Tests cover the main positive and negative cases well. A few minor test gaps and edge cases remain.

---

Robin — the Robin Hood of code review. Free for every PR.

[antongulin]

/robin

Fixed in a5b69ff:

• isQuotedValue length >= 2 guard
• block scalar with ': ' test
• single-quoted value with ': ' test

Verification: npm run build clean; npm test 24/24; npm run test:ts 52/52.

[github-actions]

🏹 Robin

✅ Review done. I flagged 3 things worth a look.

Push fixes whenever you like, then comment /robin for another pass.

[github-actions]

🏹 Robin

Heads up: this is a point-in-time review. Push fixes freely, then comment /robin whenever you want another pass.

🔵 2 Low | 💡 1 Suggestions

Summary

Well-implemented validation improvement that catches unquoted YAML frontmatter values containing colon-space, a common cause of silent skill rejection at runtime. The helper functions are clean, the block scalar marker regex is actually more complete than the previous hardcoded list (now handles |+ and >+), and test coverage is thorough across quoted, unquoted, single-quoted, block scalar, and multi-key scenarios. Only minor edge-case gaps exist.

---

Robin — the Robin Hood of code review. Free for every PR.

[antongulin]

/robin

Fixed in 3e39568:

• block scalar marker regex now accepts indentation/chomping indicators (|2-, >1+, etc.)

Verification: npm run build clean; npm test 24/24; npm run test:ts 52/52.

[github-actions]

🏹 Robin

✅ Review done. I flagged 3 things worth a look.

Push fixes whenever you like, then comment /robin for another pass.

[github-actions]

🏹 Robin

Heads up: this is a point-in-time review. Push fixes freely, then comment /robin whenever you want another pass.

⚠️ 1 Medium | 🔵 1 Low | 💡 1 Suggestions

Summary

The change adds validation to catch unquoted YAML frontmatter values containing ': ', which would cause the runtime YAML parser to misinterpret them as nested mappings and silently drop the skill. The approach is sound, the helper functions are well-scoped, and the test suite covers the key scenarios (quoted, single-quoted, block scalars, mid-value colons, and name-field cases). A few edge cases in the quoting and trimming logic could produce false negatives.

---

Robin — the Robin Hood of code review. Free for every PR.

[antongulin]

/robin

Fixed in 2e22bec:

• unquoted values ending with ':' now rejected (verified as YAML parse errors)
• tests for both trailing-colon variants

Verification: npm run build clean; npm test 24/24; npm run test:ts 54/54.

[github-actions]

🏹 Robin

✅ Review done. I flagged 2 things worth a look.

Push fixes whenever you like, then comment /robin for another pass.

[github-actions]

🏹 Robin

Heads up: this is a point-in-time review. Push fixes freely, then comment /robin whenever you want another pass.

🔵 1 Low | 💡 1 Suggestions

Summary

The change adds YAML frontmatter validation to catch unquoted values containing ': ' or ending with ':', which would cause the runtime to drop skills. The helper functions are well-crafted, the regex for block scalar markers is accurate, and test coverage is solid with good edge-case testing for quoted values, block scalars, and various colon placements. The main gap is that colon-tab sequences are not detected, which could allow some invalid YAML to pass validation.

---

Robin — the Robin Hood of code review. Free for every PR.

[antongulin]

/robin

Fixed in 7638c4d:

• colon-tab now treated as mapping separator (verified parse error)
• tightened trailing colon-space test assertions

Verification: npm run build clean; npm test 24/24; npm run test:ts 55/55.

[github-actions]

🏹 Robin

✅ Review done. I flagged 3 things worth a look.

Push fixes whenever you like, then comment /robin for another pass.

[github-actions]

🏹 Robin

Heads up: this is a point-in-time review. Push fixes freely, then comment /robin whenever you want another pass.

⚠️ 1 Medium | 🔵 1 Low | 💡 1 Suggestions

Summary

The change adds validation to catch unquoted YAML frontmatter values containing ': ' or ending with ':', which would cause the runtime to silently drop skills. The implementation is well-structured with good separation of concerns (isQuotedValue, isBlockScalarMarker) and comprehensive test coverage covering quoted strings, block scalars, colon-space, colon-tab, and trailing colon cases. The main issue is that error line numbers are relative to the frontmatter block rather than the actual file, which will confuse users debugging issues.

---

Robin — the Robin Hood of code review. Free for every PR.