@agenthippo-ai/agenthippo 0.1.0

package/out/base-prompts/skills/skill-installer/SKILL.md

@@ -0,0 +1,251 @@
+---
+name: skill-installer
+description: Guide for discovering and installing skills, agent packs, and MCP servers from the registry. Use when users ask to find, search, browse, or install skills, agent packs, MCPs, or agent configurations.
+---
+
+# Skill Installer
+
+Install skills, agent packs, and MCP servers using CLI commands.
+
+Use this invocation form for maximum compatibility in IDE sessions:
+
+```bash
+"${AGENTHIPPO_CLI_PATH:-agenthippo}" <command>
+```
+
+When running in Agent Hippo IDE, `AGENTHIPPO_CLI_PATH` may be injected automatically. Always keep the `:-agenthippo` fallback for portability.
+
+Before running store commands, perform a quick preflight:
+
+```bash
+"${AGENTHIPPO_CLI_PATH:-agenthippo}" --version
+```
+
+If preflight fails, tell the user to run **Agent Hippo: Setup AgentHippo CLI**.
+
+Use `--workspace "$AGENTHIPPO_WORKSPACE_ROOT"` and `--agent "${AGENTHIPPO_ACTIVE_AGENT:-default}"` when available.
+
+
+## Quick Reference
+
+```bash
+# Search
+agenthippo store search <query>
+agenthippo store search "pdf" --type skill
+agenthippo store list --type pack
+
+# Install (use folder-based paths: skills/, agent-packs/, mcp/)
+agenthippo store install skills/pdf-tools
+agenthippo store install agent-packs/code-reviewer@1.0.0
+agenthippo store install mcp/filesystem --agent default
+
+# Info
+agenthippo store info skills/pdf-tools --json
+```
+
+## Workflow
+
+1. **Search** for the artifact
+2. **Inspect** metadata (author, version, description)
+3. **Download & scan** for security issues
+4. **Report** findings to user
+5. **Install** if scan passes
+
+## Search
+
+```bash
+# Search all types
+agenthippo store search "document editing"
+
+# Filter by type
+agenthippo store search "code review" --type pack
+agenthippo store search "pdf" --type skill --limit 10
+
+# List all available
+agenthippo store list
+agenthippo store list --type skill
+
+# JSON output for parsing
+agenthippo store search "pdf" --json
+```
+
+**Output format:**
+```
+Found 3 result(s):
+
+  📦 skill/pdf-tools  v1.2.0 ✓
+     PDF editing, form filling, and text extraction
+     Installed to: default, code-reviewer
+
+  ☁️  skill/docx  v2.0.1
+     Word document creation and editing
+
+  ☁️  skill/canvas-design  v1.0.0
+     Canvas design skill
+
+Legend: 📦 Local  ☁️ Remote  ✓ Installed
+
+Install with:
+  agenthippo store install <type>/<slug>
+```
+
+**Icons:**
+- 📦 = Installed locally (in your library)
+- ☁️ = Available from remote store (not yet installed)
+- ✓ = Installed checkmark
+
+## Inspect
+
+```bash
+# Show details
+agenthippo store info skills/pdf-tools
+
+# JSON for parsing
+agenthippo store info agent-packs/code-reviewer --json
+```
+
+## Security Scan (MANDATORY)
+
+Before installing, scan downloaded files for dangerous patterns.
+
+### High Severity (Recommend BLOCK)
+
+| Pattern | Risk |
+|---------|------|
+| `eval(`, `new Function(` | Code injection |
+| `child_process.exec`, `os.system` | Shell injection |
+| `pickle.loads` | Arbitrary code execution |
+| Hardcoded API keys/tokens | Credential leak |
+| File writes outside workspace | System compromise |
+
+### Medium Severity (Warn User)
+
+| Pattern | Risk |
+|---------|------|
+| `innerHTML =`, `document.write` | XSS |
+| `subprocess` with `shell=True` | Injection risk |
+| Minified/obfuscated code | Hidden behavior |
+| Broad `allowed-tools` in frontmatter | Over-privileged |
+| Network calls to unknown hosts | Data exfiltration |
+
+
+### Report Format
+
+```
+⚠️ Security Scan: skill/example-tool
+
+HIGH: scripts/run.py:42 — eval() — code injection risk
+MED: SKILL.md — allowed-tools: Bash(*) — unrestricted shell
+
+Recommendation: BLOCK
+
+Proceed anyway? [y/N]
+```
+
+If **high severity** issues exist → recommend **BLOCK**.
+If **medium only** → warn and ask for confirmation.
+
+## Install
+
+```bash
+# Install skill to current workspace
+agenthippo store install skills/pdf-tools
+
+# Install specific version
+agenthippo store install skills/pdf-tools@1.2.0
+
+# Install to specific agent
+agenthippo store install skills/pdf-tools --agent my-agent
+
+# Install agent pack (goes to user library)
+agenthippo store install agent-packs/code-reviewer
+
+# Install MCP server
+agenthippo store install mcp/filesystem
+
+# Force overwrite existing
+agenthippo store install skills/pdf-tools --force
+
+# Specify workspace
+agenthippo store install skills/pdf-tools --workspace /path/to/project
+```
+
+### Installation Paths
+
+| Type | Path |
+|------|------|
+| Skill | `<workspace>/.{{BRAND_FOLDER}}/agents/<agentId>/skills/<slug>/` |
+| Pack | `~/.{{BRAND_FOLDER}}/agents/<slug>/<version>/` |
+| MCP | `<workspace>/.{{BRAND_FOLDER}}/agents/<agentId>/mcp/<slug>/` |
+
+## Verify Installation
+
+After install, verify:
+
+1. **Files exist** at expected path
+2. **SKILL.md** (or `agent.yaml` for packs) is valid
+
+```bash
+# Verify pack
+agenthippo pack info <slug>
+agenthippo pack validate <slug>
+
+# List installed packs
+agenthippo pack list
+```
+
+## Custom Store
+
+To use a different store repository:
+
+```bash
+# Set custom store repo (default: agenthippoai/agenthippo-store)
+export AGENTHIPPO_STORE_REPO=myorg/my-store
+
+# Or set direct index URL
+export AGENTHIPPO_STORE_URL=https://myorg.github.io/my-store/store-index.json
+```
+
+## Private Repos
+
+For private store repositories, set a GitHub token:
+
+```bash
+# Any of these work:
+export GITHUB_TOKEN=ghp_...
+export GH_TOKEN=ghp_...
+export AGENTHIPPO_GITHUB_TOKEN=ghp_...
+
+# Then run commands as usual
+agenthippo store search "my internal skill"
+agenthippo store install skills/internal-tool
+```
+
+The CLI tries GitHub Pages first (public), then falls back to GitHub API with auth for private repos.
+
+## Fallback: Manual Download
+
+If CLI is unavailable, use curl:
+
+```bash
+# Download artifact tarball
+curl -L "https://api.github.com/repos/agenthippoai/agenthippo-store/tarball/skills/pdf-tools/v1.0.0" \
+  -H "Accept: application/vnd.github.v3+json" \
+  -o artifact.tar.gz
+
+# Extract
+tar -xzf artifact.tar.gz
+# Files are in: <extracted>/skills/pdf-tools/
+```
+
+## Local Library Paths
+
+Already-installed artifacts:
+
+- **Workspace skills:** `<workspace>/.{{BRAND_FOLDER}}/agents/<agentId>/skills/`
+- **User packs:** `~/.{{BRAND_FOLDER}}/agents/`
+- **Manifest:** `<workspace>/.{{BRAND_FOLDER}}/agentide.manifest.json`
+
+## Reference
+
+For programmatic API details, see [references/store-api.md](references/store-api.md).

package/out/base-prompts/skills/skill-installer/references/store-api.md

@@ -0,0 +1,219 @@
+# Store CLI Reference
+
+The `agenthippo store` command provides search and install capabilities.
+
+Prefer invoking the CLI with a portable fallback:
+
+```bash
+"${AGENTHIPPO_CLI_PATH:-agenthippo}" store <subcommand>
+```
+
+In Agent Hippo IDE sessions, these environment variables may be available:
+- `AGENTHIPPO_CLI_PATH` — absolute path to the resolved CLI binary
+- `AGENTHIPPO_WORKSPACE_ROOT` — workspace root path for `--workspace`
+- `AGENTHIPPO_ACTIVE_AGENT` — active agent id for `--agent`
+
+Preflight check:
+
+```bash
+"${AGENTHIPPO_CLI_PATH:-agenthippo}" --version
+```
+
+If unavailable, users can run **Agent Hippo: Setup AgentHippo CLI** from the command palette.
+
+Use these flags when available:
+
+```bash
+--workspace "$AGENTHIPPO_WORKSPACE_ROOT" --agent "${AGENTHIPPO_ACTIVE_AGENT:-default}"
+```
+
+Examples below continue to show `agenthippo ...` for readability.
+
+
+## Commands
+
+### search
+
+Search for artifacts in the store.
+
+```bash
+agenthippo store search <query> [options]
+```
+
+Options:
+- `--type <type>` — Filter: `pack`, `skill`, `mcp`
+- `--limit <n>` — Max results (default: 20)
+- `--json` — Output as JSON
+
+Examples:
+```bash
+agenthippo store search "pdf editing"
+agenthippo store search "code review" --type pack
+agenthippo store search "document" --limit 5 --json
+```
+
+### list
+
+List all available artifacts.
+
+```bash
+agenthippo store list [options]
+```
+
+Options:
+- `--type <type>` — Filter: `pack`, `skill`, `mcp`
+- `--json` — Output as JSON
+
+### install
+
+Install an artifact from the store.
+
+```bash
+agenthippo store install <type/slug[@version]> [options]
+```
+
+Options:
+- `--version <ver>` — Specific version (default: latest)
+- `--workspace <path>` — Target workspace (default: cwd)
+- `--agent <id>` — Target agent for skills/mcp (default: `default`)
+- `--force` — Overwrite existing installation
+- `--json` — Output as JSON
+
+Examples:
+```bash
+agenthippo store install skill/pdf-tools
+agenthippo store install pack/code-reviewer@1.0.0
+agenthippo store install mcp/filesystem --agent my-agent
+agenthippo store install skill/docx --force
+```
+
+### info
+
+Show artifact details.
+
+```bash
+agenthippo store info <type/slug> [options]
+```
+
+Options:
+- `--json` — Output as JSON (includes version list)
+
+## Artifact Reference Format
+
+```
+<type>/<slug>[@version]
+```
+
+Examples:
+- `skill/pdf-tools`
+- `pack/code-reviewer@1.0.0`
+- `mcp/filesystem`
+
+Type aliases:
+- `pack`, `packs`, `agent-packs` → pack
+- `skill`, `skills` → skill
+- `mcp` → mcp
+
+## JSON Output Schema
+
+### Search Result
+
+```json
+[
+  {
+    "id": "skill/pdf-tools",
+    "type": "skill",
+    "slug": "pdf-tools",
+    "displayName": "PDF Tools",
+    "description": "PDF editing and form filling",
+    "tags": ["pdf", "forms"],
+    "author": "agenthippo",
+    "latestVersion": "1.2.0"
+  }
+]
+```
+
+### Info Result
+
+```json
+{
+  "id": "skill/pdf-tools",
+  "type": "skill",
+  "slug": "pdf-tools",
+  "displayName": "PDF Tools",
+  "description": "PDF editing and form filling",
+  "tags": ["pdf", "forms"],
+  "author": "agenthippo",
+  "latestVersion": "1.2.0",
+  "versions": [
+    { "version": "1.2.0", "tagName": "skills/pdf-tools/v1.2.0", "isPrerelease": false },
+    { "version": "1.1.0", "tagName": "skills/pdf-tools/v1.1.0", "isPrerelease": false }
+  ]
+}
+```
+
+## Store Configuration
+
+The store connects to the default repository:
+- **Repo:** `agenthippoai/agenthippo-store`
+- **Index:** `https://agenthippoai.github.io/agenthippo-store/store-index.json`
+
+To use a custom store, set VS Code settings:
+- `agentide.storeRepo` — GitHub repo (e.g., `myorg/my-store`)
+- `agentide.store.indexUrl` — Custom index URL
+
+## Installation Paths
+
+| Type | Path |
+|------|------|
+| Skill | `<workspace>/.agent-hippo/agents/<agentId>/skills/<slug>/` |
+| Pack | `~/.agent-hippo/agents/<slug>/<version>/` |
+| MCP | `<workspace>/.agent-hippo/agents/<agentId>/mcp/<slug>/` |
+
+For packs, a `current.txt` file in the pack root points to the active version.
+
+## Exit Codes
+
+- `0` — Success
+- `1` — Error (invalid args, not found, network error)
+
+## Environment Variables
+
+### Store Configuration
+
+- `AGENTHIPPO_STORE_REPO` — GitHub repo (e.g., `myorg/my-store`). Default: `agenthippoai/agenthippo-store`
+- `AGENTHIPPO_STORE_URL` — Direct index URL (overrides repo-based URL)
+
+### Authentication
+
+- `GITHUB_TOKEN` — GitHub personal access token for private repos
+- `GH_TOKEN` — Alternative token variable (GitHub CLI compatible)
+- `AGENTHIPPO_GITHUB_TOKEN` — Agent Hippo specific token
+
+### Debug
+
+- `VERBOSE=1` — Enable verbose logging to stderr
+
+## Custom Store
+
+To use a different store repository:
+
+```bash
+# Point to your org's store
+export AGENTHIPPO_STORE_REPO=myorg/my-private-store
+
+# Or use a direct URL
+export AGENTHIPPO_STORE_URL=https://mycdn.example.com/store-index.json
+```
+
+## Private Repo Support
+
+For private store repositories:
+
+1. Create a GitHub Personal Access Token with `repo` scope
+2. Export it: `export GITHUB_TOKEN=ghp_...`
+3. Run CLI commands as usual
+
+The CLI automatically:
+1. Tries GitHub Pages first (public repos, fast CDN)
+2. Falls back to GitHub API with auth if Pages returns 403/404

package/out/base-prompts/skills/spotlight-dashboard/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: spotlight-dashboard
+description: Customize the Spotlight dashboard to visualize charts, interactive js, HTML widgets, or general presentation of images, reports. Use this skill when you need to wire scripts/views or adjust dashboard rendering behavior.
+---
+
+# Spotlight Dashboard
+
+Wire scripts/views and keep dashboard artifacts discoverable.
+
+## Scope Constraint (Shipped Agents)
+Assume only `.agent-hippo/` paths are visible. Do not rely on extension source files.
+
+## View Config Discovery (config-first)
+1. Inspect `.agent-hippo/analytics/panel/views*.yaml`.
+2. Use `views-team.yaml` for Agent Team `activeViewId` only; eligible views are discovered via the `team` or `fleet` tag in each `view.yaml` (`scope` sets install location).
+3. Use `views.yaml` for Spotlight panel policy (`layout`, `refreshOnNavigate`, scripts list).
+4. If only one exists, use it.
+
+## Shared Spotlight Execution Contract (Required)
+1. Ensure script exists in `.agent-hippo/analytics/views/<view-id>/scripts`.
+2. Register script in relevant `panel/views*.yaml` view entry.
+3. Set `activeViewId` to target view by default (unless user says otherwise).
+4. Ensure artifacts are written under target view `charts/reports/exports`.
+5. Verify files exist before reporting success.
+
+## Quick Integration Checklist
+- Script path exists.
+- Target view entry exists in `views*.yaml`.
+- Script is listed under target view `scripts`.
+- `activeViewId` points to intended view.
+- Chart/report/export files exist under target view directories.
+
+## Create or update `view.yaml` (required for store publish)
+
+Every custom view under `.agent-hippo/analytics/views/<view-id>/` must have a `view.yaml` with store metadata. When creating or updating a view, **always** set `version`, `description`, and `tags`
+```yaml
+version: 1.0.0          # publish semver (required before sharing to store)
+id: <view-id>
+name: <Display Name>
+description: <One-line summary for the AgentHippo store>
+author: <your-name-or-org>
+tags:
+  - spotlight
+  - <domain-keyword>
+scope: global           # or workspace
+scripts:
+  - <widget>.js
+system: false
+```
+
+| Field | Notes |
+|-------|--------|
+| `version` | Publish semver (e.g. `1.0.0`); bump on each store release. Do not use a separate `semver` field. |
+| `description` | One-line summary for the AgentHippo store — **required** |
+| `tags` | 2–5 keywords (`spotlight` plus domain terms) — **required** for discoverability |
+| `id`, `name`, `author` | Identity and display; set `author` when known |
+
+- Toolbar **Publish** uses a **full bundle** (scripts + charts/exports + manifest). Use the panel menu **Share scripts only to store** when you only want widget scripts.
+- CLI: `agenthippo store publish view/<view-id> --bundle full` (reads `version` from `view.yaml`).
+
+## Failure-Handling Matrix (Required)
+- `views.yaml` missing → create minimal `views.yaml` with global/workspace + target view.
+- target view missing in config → append view entry (preserve existing views).
+- target view folders missing → create `scripts/charts/reports/exports/assets/images`.
+- refresh shows no artifacts → verify generated file extensions and locations.
+
+## Dashboard Architecture (summary)
+Spotlight discovers artifacts from:
+- `${AGENTIDE_CHART_DIR}` (`png`, `svg`, `jpg`, `jpeg`, `html`)
+- `${AGENTIDE_REPORT_DIR}` (`md`)
+- `${AGENTIDE_EXPORT_DIR}` (`csv`, `json`)
+
+Default persisted state:
+- `.agent-hippo/analytics/panel-state/default.json`
+
+## Advanced (only when modifying panel runtime)
+Message protocol via `panelApi` (`runtime-bridge.js`):
+- Webview → Extension: `requestArtifacts`, `requestSummary`, `requestFilters`, `requestPanelState`, `savePanelState`, `requestArtifactContent`, `openChatWithPrompt`, `refreshCharts`, `copySessionId`, `updateFilters`
+- Extension → Webview: `artifactsUpdated`, `artifactContent`, `summaryCards`, `panelStateLoaded`, `disabledChartsUpdated`, `filtersUpdated`, `refreshStarted`, `refreshFinished`, `dataStale`
+
+## Guardrails
+- Prefer configuration-level edits over runtime source edits.
+- Keep dashboard integrations lightweight and deterministic.

package/out/base-prompts/skills/spotlight-insights/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: spotlight-insights
+description: Orchestrates Spotlight analytics end-to-end by combining query, visualization, optimization, and reporting workflows. Use when the user asks for a complete analysis package with metrics, charts, reports, exports, and recommendations.
+---
+
+# Spotlight Insights
+
+Coordinator skill for end-to-end Spotlight deliverables.
+
+## Scope Constraint (Shipped Agents)
+Assume only `.agent-hippo/` paths are visible. Do not rely on extension source code.
+
+## Use This Skill When
+- User asks for a complete analytics package (numbers + visuals + report)
+- Task spans multiple Spotlight skills
+- User wants actionable recommendations with supporting evidence
+
+## Inputs To Confirm
+- Objective: cost, latency, reliability, regression, incident, or mixed
+- Scope: global or workspace
+- Filters: `agent_id`, `project_id`, time window
+- Deliverables: chart, report, export, post-mortem, or bundle
+- Data mode: trace-only vs includes external data
+- Audience depth: operator brief vs executive summary
+
+## Paths
+Prefer env vars:
+- `AGENTIDE_SCRIPT_DIR`
+- `AGENTIDE_CHART_DIR`
+- `AGENTIDE_REPORT_DIR`
+- `AGENTIDE_EXPORT_DIR`
+
+If missing, use `.agent-hippo/analytics/views/<view-id>/{scripts,charts,reports,exports}`.
+
+## Shared Spotlight Execution Contract (Required)
+1. Create/update reusable scripts under target view `scripts/`.
+2. Register scripts in `.agent-hippo/analytics/panel/views*.yaml`.
+3. Set `activeViewId` to target view by default (unless user says otherwise).
+4. Run scripts with deterministic outputs.
+5. Verify artifacts exist before reporting success.
+6. Return script + artifact paths in final response.
+7. For external data: include source citations + method note.
+
+## Orchestration Workflow
+1. **Query baseline (`spotlight-query`)**
+   - Run baseline/outlier queries for trace-mode objectives.
+   - Capture concrete metrics/IDs (session/request/version).
+2. **Generate visuals (`spotlight-visualize`)**
+   - Produce deterministic chart artifacts.
+   - Follow shared execution contract.
+3. **Generate report/export (`spotlight-report`)**
+   - Produce markdown plus optional CSV/JSON outputs.
+4. **Optimization pass (`spotlight-optimize`, when requested)**
+   - Convert findings into prioritized actions with expected impact.
+5. **Assemble final package**
+   - Return concise summary + evidence + paths + next steps.
+
+## Failure-Handling Matrix (Required)
+- Query unavailable but external-data request is valid → continue with external-data mode and label limitations.
+- `views*.yaml` missing → create minimal config then proceed.
+- Script ran but artifact missing → fail step, diagnose path/write issues, rerun.
+- External source flaky → retry + fallback transport + warning; produce partial outputs when possible.
+
+## Required Quality Checks
+- Every claim is backed by query output or cited external data.
+- Every artifact path is verified on disk.
+- Scripts are re-runnable.
+- Recommendations include impact and rationale.
+
+## Delivery Template
+```markdown
+## Spotlight Insights: <scope>
+
+### What was generated
+- Charts: ...
+- Report: ...
+- Exports: ...
+
+### Key findings
+1. ...
+2. ...
+
+### Recommended actions
+- [ ] P0 ...
+- [ ] P1 ...
+
+### Artifact paths
+- Script: ...
+- Chart: ...
+- Report: ...
+- Export: ...
+
+### Data sources / method
+- Sources: ...
+- Method: ...
+```
+
+## Guardrails
+- Do not skip validation before chart/report generation.
+- Do not mix scopes without explicit labels.
+- Keep outputs operator-focused and concise.