From ec7a2e3eaecc8cbad02501f9021ff3b8ead6df32 Mon Sep 17 00:00:00 2001
From: YeonGyu-Kim <code.yeon.gyu@gmail.com>
Date: Fri, 27 Mar 2026 16:59:04 +0900
Subject: [PATCH] fix(#2857): prevent npm scoped package paths from being
 resolved as skill paths

resolveSkillPathReferences: add looksLikeFilePath() guard that requires
a file extension or trailing slash before resolving @scope/package
references. npm packages like @mycom/my_mcp_tools@beta were incorrectly
being rewritten to absolute paths in skill templates.

2 new tests.
---
 src/shared/skill-path-resolver.test.ts | 24 ++++++++++++++++++++++++
 src/shared/skill-path-resolver.ts      | 12 +++++++++++-
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/src/shared/skill-path-resolver.test.ts b/src/shared/skill-path-resolver.test.ts
index e0e3b8541..da29ee863 100644
--- a/src/shared/skill-path-resolver.test.ts
+++ b/src/shared/skill-path-resolver.test.ts
@@ -90,6 +90,30 @@ describe("resolveSkillPathReferences", () => {
 		expect(result).toBe("No path references here")
 	})
 
+	it("does not resolve npm scoped packages in commands", () => {
+		//#given
+		const content = "npx --package=@mycom/my_mcp_tools@beta cli my_cmd_tool XXX"
+		const basePath = "C:/Users/Admin/.config/opencode/skills/my_skills"
+
+		//#when
+		const result = resolveSkillPathReferences(content, basePath)
+
+		//#then
+		expect(result).toBe("npx --package=@mycom/my_mcp_tools@beta cli my_cmd_tool XXX")
+	})
+
+	it("does not resolve npm scoped packages without version suffix", () => {
+		//#given
+		const content = "npm install @angular/core @types/node"
+		const basePath = "/skills/frontend"
+
+		//#when
+		const result = resolveSkillPathReferences(content, basePath)
+
+		//#then
+		expect(result).toBe("npm install @angular/core @types/node")
+	})
+
 	it("handles basePath with trailing slash", () => {
 		//#given
 		const content = "@scripts/search.py"
diff --git a/src/shared/skill-path-resolver.ts b/src/shared/skill-path-resolver.ts
index 0ac8465ec..72b8f93a5 100644
--- a/src/shared/skill-path-resolver.ts
+++ b/src/shared/skill-path-resolver.ts
@@ -1,10 +1,17 @@
 import { join } from "path"
 
+function looksLikeFilePath(path: string): boolean {
+	if (path.endsWith("/")) return true
+	const lastSegment = path.split("/").pop() ?? ""
+	return /\.[a-zA-Z0-9]+$/.test(lastSegment)
+}
+
 /**
  * Resolves @path references in skill content to absolute paths.
  *
  * Matches @references that contain at least one slash (e.g., @scripts/search.py, @data/)
  * to avoid false positives with decorators (@param), JSDoc tags (@ts-ignore), etc.
+ * Also skips npm scoped packages (@scope/package) by requiring a file extension or trailing slash.
  *
  * Email addresses are excluded since they have alphanumeric characters before @.
  */
@@ -12,6 +19,9 @@ export function resolveSkillPathReferences(content: string, basePath: string): s
 	const normalizedBase = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath
 	return content.replace(
 		/(?<![a-zA-Z0-9])@([a-zA-Z0-9_-]+\/[a-zA-Z0-9_.\-\/]*)/g,
-		(_, relativePath: string) => join(normalizedBase, relativePath)
+		(match, relativePath: string) => {
+			if (!looksLikeFilePath(relativePath)) return match
+			return join(normalizedBase, relativePath)
+		}
 	)
 }