fix: keep legacy cleanup project-local

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: marcelsafin

src/specify_cli/extensions/__init__.py

@@ -1290,15 +1290,10 @@ def _unregister_extension_skills(
         Called during extension removal to clean up skill files that
         were created by ``_register_extension_skills()``.
 
-        When *skills_dir* is omitted, this is a genuinely unscoped removal
-        (e.g. full extension removal): ``registered_skills`` is a single
-        flat list covering mirrors created under *every* agent this
-        extension was ever activated under, not just the currently active
-        one, so we always scan all known agent skills directories rather
-        than narrowing to whichever agent happens to be active right now.
-        Each candidate directory is verified against the SKILL.md
-        ``metadata.source`` field before removal to avoid accidentally
-        deleting user-created skills with the same name.
+        When *skills_dir* is omitted, project-local agent skill directories
+        are scanned. Home-scoped outputs require explicit agent provenance:
+        the legacy flat registry and ``metadata.source`` marker do not
+        identify which project created a global skill.
 
         Args:
             skill_names: List of skill names to remove.
@@ -1391,6 +1386,10 @@ def _unregister_extension_skills(
                 skills_candidate,
                 trusted_root,
             ) in self._extension_skill_candidate_dirs().items():
+                # ponytail: flat provenance cannot safely own global output;
+                # include home paths once registry entries identify project/agent.
+                if trusted_root != Path(os.path.abspath(self.project_root)):
+                    continue
                 if not skills_candidate.is_dir():
                     continue
                 # Reject the candidate directory itself (any path

src/specify_cli/presets/__init__.py

@@ -2523,7 +2523,7 @@ def _infer_legacy_skill_provenance(
         Copilot — permanently orphaning Copilot's override on later
         removal.
 
-        Every *configured* integration's skills directory is probed (via
+        Every project-local configured integration's skills directory is probed (via
         the same safe, symlink-validated helpers used for
         restore/removal), not only agents whose registrar config is
         statically ``/SKILL.md``-only: a command-backed agent (e.g.
@@ -2569,6 +2569,12 @@ def _infer_legacy_skill_provenance(
             skills_dir = self._safe_skills_dir_for_agent(agent_name)
             if skills_dir is None:
                 continue
+            # ponytail: legacy markers lack project ownership for global
+            # outputs; include home paths once provenance records the project.
+            if not Path(os.path.abspath(skills_dir)).is_relative_to(
+                Path(os.path.abspath(self.project_root))
+            ):
+                continue
             dir_to_agents.setdefault(skills_dir, []).append(agent_name)
 
         marker = f"preset:{pack_id}"

tests/test_extension_skills.py

@@ -2023,10 +2023,10 @@ def test_remove_while_second_agent_still_in_skills_mode_cleans_up_first_agent_mi
             "directory (#2948)"
         )
 
-    def test_unscoped_cleanup_removes_hermes_home_skill(
+    def test_unscoped_cleanup_preserves_unqualified_hermes_home_skill(
         self, project_dir, temp_dir, monkeypatch
     ):
-        """Fallback cleanup must include configured home-relative outputs."""
+        """Flat registry provenance cannot own another project's home output."""
         home = temp_dir / "home"
         monkeypatch.setattr(Path, "home", lambda: home)
         skill_name = "speckit-hermes-cleanup-hello"
@@ -2046,7 +2046,7 @@ def test_unscoped_cleanup_removes_hermes_home_skill(
             [skill_name], "hermes-cleanup"
         )
 
-        assert not skill_dir.exists()
+        assert skill_dir.exists()
 
     def test_unregister_agent_artifacts_stays_scoped_when_agent_dir_absent(
         self, project_dir, temp_dir

tests/test_presets.py

@@ -6438,6 +6438,30 @@ def test_infer_legacy_skill_provenance_skips_invalid_utf8(
             ["speckit-specify"], "some-pack", "claude"
         ) == {"claude": ["speckit-specify"]}
 
+    def test_infer_legacy_skill_provenance_excludes_home_outputs(
+        self, project_dir, temp_dir, monkeypatch
+    ):
+        home = temp_dir / "home"
+        monkeypatch.setattr(Path, "home", lambda: home)
+        skill_dir = home / ".hermes" / "skills" / "speckit-specify"
+        skill_dir.mkdir(parents=True)
+        (skill_dir / "SKILL.md").write_text(
+            "---\n"
+            "metadata:\n"
+            "  source: preset:some-pack\n"
+            "---\n\n"
+            "Other project\n",
+            encoding="utf-8",
+        )
+
+        manager = PresetManager(project_dir)
+        inferred = manager._infer_legacy_skill_provenance(
+            ["speckit-specify"], "some-pack", "claude"
+        )
+
+        assert inferred == {"claude": ["speckit-specify"]}
+        assert skill_dir.exists()
+
     def test_remove_infers_legacy_flat_list_provenance_without_prior_rescaffold(
         self, project_dir, temp_dir
     ):