@autonomee/gohub 0.8.0

package/dist/cli/commands/publish.js

@@ -0,0 +1,85 @@
+import { stat } from 'node:fs/promises';
+import { basename, resolve } from 'node:path';
+import semver from 'semver';
+import { apiRequestForm } from '../../http.js';
+import { ApiRoutes, ApiV1PublishResponseSchema } from '../../schema/index.js';
+import { listTextFiles } from '../../skills.js';
+import { requireAuthToken } from '../authToken.js';
+import { getRegistry } from '../registry.js';
+import { sanitizeSlug, titleCase } from '../slug.js';
+import { createSpinner, fail, formatError } from '../ui.js';
+export async function cmdPublish(opts, folderArg, options) {
+    const folder = folderArg ? resolve(opts.workdir, folderArg) : null;
+    if (!folder)
+        fail('Path required');
+    const folderStat = await stat(folder).catch(() => null);
+    if (!folderStat || !folderStat.isDirectory())
+        fail('Path must be a folder');
+    const token = await requireAuthToken();
+    const registry = await getRegistry(opts, { cache: true });
+    const slug = options.slug ?? sanitizeSlug(basename(folder));
+    const displayName = options.name ?? titleCase(basename(folder));
+    const version = options.version;
+    const changelog = options.changelog ?? '';
+    const tagsValue = options.tags ?? 'latest';
+    const tags = tagsValue
+        .split(',')
+        .map((tag) => tag.trim())
+        .filter(Boolean);
+    const forkOfRaw = options.forkOf?.trim();
+    const forkOf = forkOfRaw ? parseForkOf(forkOfRaw) : undefined;
+    if (!slug)
+        fail('--slug required');
+    if (!displayName)
+        fail('--name required');
+    if (!version || !semver.valid(version))
+        fail('--version must be valid semver');
+    const spinner = createSpinner(`Preparing ${slug}@${version}`);
+    try {
+        const filesOnDisk = await listTextFiles(folder);
+        if (filesOnDisk.length === 0)
+            fail('No files found');
+        if (!filesOnDisk.some((file) => {
+            const lower = file.relPath.toLowerCase();
+            return lower === 'skill.md' || lower === 'skills.md';
+        })) {
+            fail('SKILL.md required');
+        }
+        const form = new FormData();
+        form.set('payload', JSON.stringify({
+            slug,
+            displayName,
+            version,
+            changelog,
+            acceptLicenseTerms: true,
+            tags,
+            ...(forkOf ? { forkOf } : {}),
+        }));
+        let index = 0;
+        for (const file of filesOnDisk) {
+            index += 1;
+            spinner.text = `Uploading ${file.relPath} (${index}/${filesOnDisk.length})`;
+            const blob = new Blob([Buffer.from(file.bytes)], { type: file.contentType ?? 'text/plain' });
+            form.append('files', blob, file.relPath);
+        }
+        spinner.text = `Publishing ${slug}@${version}`;
+        const result = await apiRequestForm(registry, { method: 'POST', path: ApiRoutes.skills, token, form }, ApiV1PublishResponseSchema);
+        spinner.succeed(`OK. Published ${slug}@${version} (${result.versionId})`);
+    }
+    catch (error) {
+        spinner.fail(formatError(error));
+        throw error;
+    }
+}
+function parseForkOf(value) {
+    const trimmed = value.trim();
+    const [slugRaw, versionRaw] = trimmed.split('@');
+    const slug = (slugRaw ?? '').trim().toLowerCase();
+    if (!slug)
+        fail('--fork-of must be <slug> or <slug@version>');
+    const version = (versionRaw ?? '').trim();
+    if (version && !semver.valid(version))
+        fail('--fork-of version must be valid semver');
+    return { slug, version: version || undefined };
+}
+//# sourceMappingURL=publish.js.map

package/dist/cli/commands/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../../src/cli/commands/publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEpD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAE3D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAgB,EAChB,SAAiB,EACjB,OAOC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,eAAe,CAAC,CAAA;IAClC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACvD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;QAAE,IAAI,CAAC,uBAAuB,CAAC,CAAA;IAE3E,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAA;IACtC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAEzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAA;IAC1C,MAAM,IAAI,GAAG,SAAS;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,OAAO,CAAC,CAAA;IAElB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;IACxC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAE7D,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAClC,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACzC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAE9E,MAAM,OAAO,GAAG,aAAa,CAAC,aAAa,IAAI,IAAI,OAAO,EAAE,CAAC,CAAA;IAC7D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;QAC/C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACpD,IACE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;YACxC,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,WAAW,CAAA;QACtD,CAAC,CAAC,EACF,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC3B,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAA;QAC3B,IAAI,CAAC,GAAG,CACN,SAAS,EACT,IAAI,CAAC,SAAS,CAAC;YACb,IAAI;YACJ,WAAW;YACX,OAAO;YACP,SAAS;YACT,kBAAkB,EAAE,IAAI;YACxB,IAAI;YACJ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CACH,CAAA;QAED,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,CAAA;YACV,OAAO,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,WAAW,CAAC,MAAM,GAAG,CAAA;YAC3E,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAA;YAC5F,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1C,CAAC;QAED,OAAO,CAAC,IAAI,GAAG,cAAc,IAAI,IAAI,OAAO,EAAE,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,QAAQ,EACR,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EACvD,0BAA0B,CAC3B,CAAA;QAED,OAAO,CAAC,OAAO,CAAC,iBAAiB,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,GAAG,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA;QAChC,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACjD,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,wCAAwC,CAAC,CAAA;IACrF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAA;AAChD,CAAC"}

package/dist/cli/commands/publish.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/commands/publish.test.js

@@ -0,0 +1,105 @@
+/* @vitest-environment node */
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+vi.mock('../authToken.js', () => ({
+    requireAuthToken: vi.fn(async () => 'tkn'),
+}));
+const mockGetRegistry = vi.fn(async (_opts, _params) => 'https://gohub.ai');
+vi.mock('../registry.js', () => ({
+    getRegistry: (opts, params) => mockGetRegistry(opts, params),
+}));
+const mockApiRequestForm = vi.fn();
+vi.mock('../../http.js', () => ({
+    apiRequestForm: (registry, args, schema) => mockApiRequestForm(registry, args, schema),
+}));
+const mockFail = vi.fn((message) => {
+    throw new Error(message);
+});
+const mockSpinner = { text: '', succeed: vi.fn(), fail: vi.fn() };
+vi.mock('../ui.js', () => ({
+    createSpinner: vi.fn(() => mockSpinner),
+    fail: (message) => mockFail(message),
+    formatError: (error) => (error instanceof Error ? error.message : String(error)),
+}));
+const { cmdPublish } = await import('./publish');
+async function makeTmpWorkdir() {
+    const root = await mkdtemp(join(tmpdir(), 'gohub-publish-'));
+    return root;
+}
+function makeOpts(workdir) {
+    return {
+        workdir,
+        dir: join(workdir, 'skills'),
+        site: 'https://gohub.ai',
+        registry: 'https://gohub.ai',
+        registrySource: 'default',
+    };
+}
+afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.clearAllMocks();
+});
+describe('cmdPublish', () => {
+    it('publishes SKILL.md from disk (mocked HTTP)', async () => {
+        const workdir = await makeTmpWorkdir();
+        try {
+            const folder = join(workdir, 'my-skill');
+            await mkdir(folder, { recursive: true });
+            const skillContent = '# Skill\n\nHello\n';
+            const notesContent = 'notes\n';
+            await writeFile(join(folder, 'SKILL.md'), skillContent, 'utf8');
+            await writeFile(join(folder, 'notes.md'), notesContent, 'utf8');
+            mockApiRequestForm.mockResolvedValueOnce({ ok: true, skillId: 'skill_1', versionId: 'ver_1' });
+            await cmdPublish(makeOpts(workdir), 'my-skill', {
+                slug: 'my-skill',
+                name: 'My Skill',
+                version: '1.0.0',
+                changelog: '',
+                tags: 'latest',
+            });
+            const publishCall = mockApiRequestForm.mock.calls.find((call) => {
+                const req = call[1];
+                return req?.path === '/api/v1/skills';
+            });
+            if (!publishCall)
+                throw new Error('Missing publish call');
+            const publishForm = publishCall[1].form;
+            const payloadEntry = publishForm.get('payload');
+            if (typeof payloadEntry !== 'string')
+                throw new Error('Missing publish payload');
+            const payload = JSON.parse(payloadEntry);
+            expect(payload.slug).toBe('my-skill');
+            expect(payload.displayName).toBe('My Skill');
+            expect(payload.version).toBe('1.0.0');
+            expect(payload.changelog).toBe('');
+            expect(payload.acceptLicenseTerms).toBe(true);
+            expect(payload.tags).toEqual(['latest']);
+            const files = publishForm.getAll('files');
+            expect(files.map((file) => String(file.name ?? '')).sort()).toEqual(['SKILL.md', 'notes.md']);
+        }
+        finally {
+            await rm(workdir, { recursive: true, force: true });
+        }
+    });
+    it('allows empty changelog when updating an existing skill', async () => {
+        const workdir = await makeTmpWorkdir();
+        try {
+            const folder = join(workdir, 'existing-skill');
+            await mkdir(folder, { recursive: true });
+            await writeFile(join(folder, 'SKILL.md'), '# Skill\n', 'utf8');
+            mockApiRequestForm.mockResolvedValueOnce({ ok: true, skillId: 'skill_1', versionId: 'ver_2' });
+            await cmdPublish(makeOpts(workdir), 'existing-skill', {
+                version: '1.0.1',
+                changelog: '',
+                tags: 'latest',
+            });
+            expect(mockApiRequestForm).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ path: '/api/v1/skills', method: 'POST' }), expect.anything());
+        }
+        finally {
+            await rm(workdir, { recursive: true, force: true });
+        }
+    });
+});
+//# sourceMappingURL=publish.test.js.map

package/dist/cli/commands/publish.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.test.js","sourceRoot":"","sources":["../../../src/cli/commands/publish.test.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAE9B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAG5D,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC;IAChC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC;CAC3C,CAAC,CAAC,CAAA;AAEH,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAc,EAAE,OAAiB,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAA;AAC9F,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,IAAa,EAAE,MAAgB,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC;CAChF,CAAC,CAAC,CAAA;AAEH,MAAM,kBAAkB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;AAClC,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9B,cAAc,EAAE,CAAC,QAAiB,EAAE,IAAa,EAAE,MAAgB,EAAE,EAAE,CACrE,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC;CAC7C,CAAC,CAAC,CAAA;AAEH,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,OAAe,EAAE,EAAE;IACzC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;AAC1B,CAAC,CAAC,CAAA;AACF,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;AACjE,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzB,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC;IACvC,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5C,WAAW,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;CAC1F,CAAC,CAAC,CAAA;AAEH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;AAEhD,KAAK,UAAU,cAAc;IAC3B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;IAC5D,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO;QACL,OAAO;QACP,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC5B,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,kBAAkB;QAC5B,cAAc,EAAE,SAAS;KAC1B,CAAA;AACH,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,gBAAgB,EAAE,CAAA;IACrB,EAAE,CAAC,aAAa,EAAE,CAAA;AACpB,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAA;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YACxC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACxC,MAAM,YAAY,GAAG,oBAAoB,CAAA;YACzC,MAAM,YAAY,GAAG,SAAS,CAAA;YAC9B,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;YAC/D,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;YAE/D,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;YAE9F,MAAM,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE;gBAC9C,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO;gBAChB,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;aACf,CAAC,CAAA;YAEF,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAkC,CAAA;gBACpD,OAAO,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAA;YACvC,CAAC,CAAC,CAAA;YACF,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YACzD,MAAM,WAAW,GAAI,WAAW,CAAC,CAAC,CAAyB,CAAC,IAAgB,CAAA;YAC5E,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAC/C,IAAI,OAAO,YAAY,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;YAChF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;YACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACrC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC7C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;YACxC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAoC,CAAA;YAC5E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;QAC/F,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAA;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;YAC9C,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACxC,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;YAE9D,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;YAE9F,MAAM,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE;gBACpD,OAAO,EAAE,OAAO;gBAChB,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;aACf,CAAC,CAAA;YAEF,MAAM,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAC7C,MAAM,CAAC,QAAQ,EAAE,EACjB,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACnE,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/cli/commands/skills.d.ts

@@ -0,0 +1,26 @@
+import type { GlobalOpts } from '../types.js';
+export declare function cmdSearch(opts: GlobalOpts, query: string, limit?: number): Promise<void>;
+export declare function cmdInstall(opts: GlobalOpts, slug: string, versionFlag?: string, force?: boolean): Promise<void>;
+export declare function cmdUpdate(opts: GlobalOpts, slugArg: string | undefined, options: {
+    all?: boolean;
+    version?: string;
+    force?: boolean;
+}, inputAllowed: boolean): Promise<void>;
+export declare function cmdList(opts: GlobalOpts): Promise<void>;
+export declare function cmdUninstall(opts: GlobalOpts, slug: string, options: {
+    yes?: boolean;
+} | undefined, inputAllowed: boolean): Promise<void>;
+export declare function cmdExplore(opts: GlobalOpts, options?: {
+    limit?: number;
+    sort?: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function formatExploreLine(item: {
+    slug: string;
+    summary?: string | null;
+    updatedAt: number;
+    latestVersion?: {
+        version: string;
+    } | null;
+}): string;
+export declare function clampLimit(limit: number, fallback?: number): number;

package/dist/cli/commands/skills.js

@@ -0,0 +1,394 @@
+import { mkdir, rm, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import semver from 'semver';
+import { apiRequest, downloadZip, registryUrl } from '../../http.js';
+import { ApiRoutes, ApiV1SearchResponseSchema, ApiV1SkillListResponseSchema, ApiV1SkillResolveResponseSchema, ApiV1SkillResponseSchema, ApiV1SkillVersionResponseSchema, } from '../../schema/index.js';
+import { extractZipToDir, hashSkillFiles, listTextFiles, readLockfile, readSkillOrigin, writeLockfile, writeSkillOrigin, } from '../../skills.js';
+import { getRegistry } from '../registry.js';
+import { createSpinner, fail, formatError, isInteractive, promptConfirm } from '../ui.js';
+import { getOptionalAuthToken } from '../authToken.js';
+function normalizeSkillSlugOrFail(raw) {
+    const slug = raw.trim();
+    if (!slug)
+        fail('Slug required');
+    // Safety: never allow path traversal or nested paths to become filesystem operations.
+    if (slug.includes('/') || slug.includes('\\') || slug.includes('..')) {
+        fail(`Invalid slug: ${slug}`);
+    }
+    return slug;
+}
+function isSafeSkillSlug(slug) {
+    return Boolean(slug) && !slug.includes('/') && !slug.includes('\\') && !slug.includes('..');
+}
+export async function cmdSearch(opts, query, limit) {
+    if (!query)
+        fail('Query required');
+    const token = await getOptionalAuthToken();
+    const registry = await getRegistry(opts, { cache: true });
+    const spinner = createSpinner('Searching');
+    try {
+        const url = registryUrl(ApiRoutes.search, registry);
+        url.searchParams.set('q', query);
+        if (typeof limit === 'number' && Number.isFinite(limit)) {
+            url.searchParams.set('limit', String(limit));
+        }
+        const result = await apiRequest(registry, { method: 'GET', url: url.toString(), token }, ApiV1SearchResponseSchema);
+        spinner.stop();
+        for (const entry of result.results) {
+            const slug = entry.slug ?? 'unknown';
+            const name = entry.displayName ?? slug;
+            const version = entry.version ? ` v${entry.version}` : '';
+            console.log(`${slug}${version}  ${name}  (${entry.score.toFixed(3)})`);
+        }
+    }
+    catch (error) {
+        spinner.fail(formatError(error));
+        throw error;
+    }
+}
+export async function cmdInstall(opts, slug, versionFlag, force = false) {
+    const trimmed = normalizeSkillSlugOrFail(slug);
+    const token = await getOptionalAuthToken();
+    const registry = await getRegistry(opts, { cache: true });
+    await mkdir(opts.dir, { recursive: true });
+    const target = join(opts.dir, trimmed);
+    if (!force) {
+        const exists = await fileExists(target);
+        if (exists)
+            fail(`Already installed: ${target} (use --force)`);
+    }
+    const spinner = createSpinner(`Resolving ${trimmed}`);
+    try {
+        // Fetch skill metadata including moderation status
+        const skillMeta = await apiRequest(registry, { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(trimmed)}`, token }, ApiV1SkillResponseSchema);
+        // Check moderation status before proceeding
+        if (skillMeta.moderation?.isMalwareBlocked) {
+            spinner.fail(`Blocked: ${trimmed} is flagged as malicious`);
+            fail('This skill has been flagged as malware and cannot be installed.');
+        }
+        if (skillMeta.moderation?.isSuspicious && !force) {
+            spinner.stop();
+            console.log(`\n⚠️  Warning: "${trimmed}" is flagged as suspicious by VirusTotal Code Insight.\n` +
+                '   This skill may contain risky patterns (crypto keys, external APIs, eval, etc.)\n' +
+                '   Review the skill code before use.\n');
+            if (isInteractive()) {
+                const confirm = await promptConfirm('Install anyway?');
+                if (!confirm)
+                    fail('Installation cancelled');
+                spinner.start(`Resolving ${trimmed}`);
+            }
+            else {
+                fail('Use --force to install suspicious skills in non-interactive mode');
+            }
+        }
+        const resolvedVersion = versionFlag ?? skillMeta.latestVersion?.version ?? null;
+        if (!resolvedVersion)
+            fail('Could not resolve latest version');
+        if (versionFlag) {
+            await apiRequest(registry, {
+                method: 'GET',
+                path: `${ApiRoutes.skills}/${encodeURIComponent(trimmed)}/versions/${encodeURIComponent(resolvedVersion)}`,
+                token,
+            }, ApiV1SkillVersionResponseSchema);
+        }
+        if (force) {
+            await rm(target, { recursive: true, force: true });
+        }
+        spinner.text = `Downloading ${trimmed}@${resolvedVersion}`;
+        const zip = await downloadZip(registry, { slug: trimmed, version: resolvedVersion, token });
+        await extractZipToDir(zip, target);
+        await writeSkillOrigin(target, {
+            version: 1,
+            registry,
+            slug: trimmed,
+            installedVersion: resolvedVersion,
+            installedAt: Date.now(),
+        });
+        const lock = await readLockfile(opts.workdir);
+        lock.skills[trimmed] = {
+            version: resolvedVersion,
+            installedAt: Date.now(),
+        };
+        await writeLockfile(opts.workdir, lock);
+        spinner.succeed(`OK. Installed ${trimmed} -> ${target}`);
+    }
+    catch (error) {
+        spinner.fail(formatError(error));
+        throw error;
+    }
+}
+export async function cmdUpdate(opts, slugArg, options, inputAllowed) {
+    const slug = slugArg ? normalizeSkillSlugOrFail(slugArg) : undefined;
+    const all = Boolean(options.all);
+    if (!slug && !all)
+        fail('Provide <slug> or --all');
+    if (slug && all)
+        fail('Use either <slug> or --all');
+    if (options.version && !slug)
+        fail('--version requires a single <slug>');
+    if (options.version && !semver.valid(options.version))
+        fail('--version must be valid semver');
+    const allowPrompt = isInteractive() && inputAllowed;
+    const token = await getOptionalAuthToken();
+    const registry = await getRegistry(opts, { cache: true });
+    const lock = await readLockfile(opts.workdir);
+    const slugs = slug ? [slug] : Object.keys(lock.skills).filter(isSafeSkillSlug);
+    if (slugs.length === 0) {
+        console.log('No installed skills.');
+        return;
+    }
+    for (const entry of slugs) {
+        const spinner = createSpinner(`Checking ${entry}`);
+        try {
+            const target = join(opts.dir, entry);
+            const exists = await fileExists(target);
+            // Always fetch skill metadata to check moderation status
+            const skillMeta = await apiRequest(registry, { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(entry)}`, token }, ApiV1SkillResponseSchema);
+            // Check moderation status before proceeding
+            if (skillMeta.moderation?.isMalwareBlocked) {
+                spinner.fail(`${entry}: blocked as malicious`);
+                console.log('   This skill has been flagged as malware and cannot be updated.');
+                continue;
+            }
+            if (skillMeta.moderation?.isSuspicious && !options.force) {
+                spinner.stop();
+                console.log(`\n⚠️  Warning: "${entry}" is flagged as suspicious by VirusTotal Code Insight.\n` +
+                    '   This skill may contain risky patterns (crypto keys, external APIs, eval, etc.)\n');
+                if (allowPrompt) {
+                    const confirm = await promptConfirm('Update anyway?');
+                    if (!confirm) {
+                        console.log(`${entry}: skipped`);
+                        continue;
+                    }
+                    spinner.start(`Checking ${entry}`);
+                }
+                else {
+                    console.log(`${entry}: skipped (use --force to update suspicious skills)`);
+                    continue;
+                }
+            }
+            let localFingerprint = null;
+            if (exists) {
+                const filesOnDisk = await listTextFiles(target);
+                if (filesOnDisk.length > 0) {
+                    const hashed = hashSkillFiles(filesOnDisk);
+                    localFingerprint = hashed.fingerprint;
+                }
+            }
+            let resolveResult;
+            if (localFingerprint) {
+                resolveResult = await resolveSkillVersion(registry, entry, localFingerprint, token);
+            }
+            else {
+                resolveResult = { match: null, latestVersion: skillMeta.latestVersion ?? null };
+            }
+            const latest = resolveResult.latestVersion?.version ?? null;
+            const matched = resolveResult.match?.version ?? null;
+            if (matched && lock.skills[entry]?.version !== matched) {
+                lock.skills[entry] = {
+                    version: matched,
+                    installedAt: lock.skills[entry]?.installedAt ?? Date.now(),
+                };
+            }
+            if (!latest) {
+                spinner.fail(`${entry}: not found`);
+                continue;
+            }
+            if (!matched && localFingerprint && !options.force) {
+                spinner.stop();
+                if (!allowPrompt) {
+                    console.log(`${entry}: local changes (no match). Use --force to overwrite.`);
+                    continue;
+                }
+                const confirm = await promptConfirm(`${entry}: local changes (no match). Overwrite with ${options.version ?? latest}?`);
+                if (!confirm) {
+                    console.log(`${entry}: skipped`);
+                    continue;
+                }
+                spinner.start(`Updating ${entry} -> ${options.version ?? latest}`);
+            }
+            const targetVersion = options.version ?? latest;
+            if (options.version) {
+                if (matched && matched === targetVersion) {
+                    spinner.succeed(`${entry}: already at ${matched}`);
+                    continue;
+                }
+            }
+            else if (matched && semver.valid(matched) && semver.gte(matched, targetVersion)) {
+                spinner.succeed(`${entry}: up to date (${matched})`);
+                continue;
+            }
+            if (spinner.isSpinning) {
+                spinner.text = `Updating ${entry} -> ${targetVersion}`;
+            }
+            else {
+                spinner.start(`Updating ${entry} -> ${targetVersion}`);
+            }
+            await rm(target, { recursive: true, force: true });
+            const zip = await downloadZip(registry, { slug: entry, version: targetVersion, token });
+            await extractZipToDir(zip, target);
+            const existingOrigin = await readSkillOrigin(target);
+            await writeSkillOrigin(target, {
+                version: 1,
+                registry: existingOrigin?.registry ?? registry,
+                slug: existingOrigin?.slug ?? entry,
+                installedVersion: targetVersion,
+                installedAt: existingOrigin?.installedAt ?? Date.now(),
+            });
+            lock.skills[entry] = { version: targetVersion, installedAt: Date.now() };
+            spinner.succeed(`${entry}: updated -> ${targetVersion}`);
+        }
+        catch (error) {
+            spinner.fail(formatError(error));
+            throw error;
+        }
+    }
+    await writeLockfile(opts.workdir, lock);
+}
+export async function cmdList(opts) {
+    const lock = await readLockfile(opts.workdir);
+    const entries = Object.entries(lock.skills);
+    if (entries.length === 0) {
+        console.log('No installed skills.');
+        return;
+    }
+    for (const [slug, entry] of entries) {
+        console.log(`${slug}  ${entry.version ?? 'latest'}`);
+    }
+}
+export async function cmdUninstall(opts, slug, options = {}, inputAllowed) {
+    const trimmed = normalizeSkillSlugOrFail(slug);
+    const lock = await readLockfile(opts.workdir);
+    if (!lock.skills[trimmed]) {
+        fail(`Not installed: ${trimmed}`);
+    }
+    const allowPrompt = isInteractive() && inputAllowed;
+    if (!options.yes) {
+        if (!allowPrompt)
+            fail('Pass --yes (no input)');
+        const confirm = await promptConfirm(`Uninstall ${trimmed}?`);
+        if (!confirm) {
+            console.log('Cancelled.');
+            return;
+        }
+    }
+    const spinner = createSpinner(`Uninstalling ${trimmed}`);
+    try {
+        const target = join(opts.dir, trimmed);
+        await rm(target, { recursive: true, force: true });
+        delete lock.skills[trimmed];
+        await writeLockfile(opts.workdir, lock);
+        spinner.succeed(`Uninstalled ${trimmed}`);
+    }
+    catch (error) {
+        spinner.fail(formatError(error));
+        throw error;
+    }
+}
+export async function cmdExplore(opts, options = {}) {
+    const token = await getOptionalAuthToken();
+    const registry = await getRegistry(opts, { cache: true });
+    const spinner = createSpinner('Fetching latest skills');
+    try {
+        const url = registryUrl(ApiRoutes.skills, registry);
+        const boundedLimit = clampLimit(options.limit ?? 25);
+        const { apiSort } = resolveExploreSort(options.sort);
+        url.searchParams.set('limit', String(boundedLimit));
+        if (apiSort !== 'updated')
+            url.searchParams.set('sort', apiSort);
+        const result = await apiRequest(registry, { method: 'GET', url: url.toString(), token }, ApiV1SkillListResponseSchema);
+        spinner.stop();
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        if (result.items.length === 0) {
+            console.log('No skills found.');
+            return;
+        }
+        for (const item of result.items) {
+            console.log(formatExploreLine(item));
+        }
+    }
+    catch (error) {
+        spinner.fail(formatError(error));
+        throw error;
+    }
+}
+export function formatExploreLine(item) {
+    const version = item.latestVersion?.version ?? '?';
+    const age = formatRelativeTime(item.updatedAt);
+    const summary = item.summary ? `  ${truncate(item.summary, 50)}` : '';
+    return `${item.slug}  v${version}  ${age}${summary}`;
+}
+export function clampLimit(limit, fallback = 25) {
+    if (!Number.isFinite(limit))
+        return fallback;
+    return Math.min(Math.max(1, limit), 200);
+}
+function formatRelativeTime(timestamp) {
+    const now = Date.now();
+    const diff = now - timestamp;
+    const seconds = Math.floor(diff / 1000);
+    const minutes = Math.floor(seconds / 60);
+    const hours = Math.floor(minutes / 60);
+    const days = Math.floor(hours / 24);
+    if (days > 30) {
+        const months = Math.floor(days / 30);
+        return `${months}mo ago`;
+    }
+    if (days > 0)
+        return `${days}d ago`;
+    if (hours > 0)
+        return `${hours}h ago`;
+    if (minutes > 0)
+        return `${minutes}m ago`;
+    return 'just now';
+}
+function truncate(str, maxLen) {
+    if (str.length <= maxLen)
+        return str;
+    return `${str.slice(0, maxLen - 1)}…`;
+}
+function resolveExploreSort(raw) {
+    const normalized = raw?.trim().toLowerCase();
+    if (!normalized || normalized === 'newest' || normalized === 'updated') {
+        return { sort: 'newest', apiSort: 'updated' };
+    }
+    if (normalized === 'downloads' || normalized === 'download') {
+        return { sort: 'downloads', apiSort: 'downloads' };
+    }
+    if (normalized === 'rating' || normalized === 'stars' || normalized === 'star') {
+        return { sort: 'rating', apiSort: 'stars' };
+    }
+    if (normalized === 'installs' ||
+        normalized === 'install' ||
+        normalized === 'installscurrent' ||
+        normalized === 'installs-current' ||
+        normalized === 'current') {
+        return { sort: 'installs', apiSort: 'installsCurrent' };
+    }
+    if (normalized === 'installsalltime' || normalized === 'installs-all-time') {
+        return { sort: 'installsAllTime', apiSort: 'installsAllTime' };
+    }
+    if (normalized === 'trending') {
+        return { sort: 'trending', apiSort: 'trending' };
+    }
+    fail(`Invalid sort "${raw}". Use newest, downloads, rating, installs, installsAllTime, or trending.`);
+}
+async function resolveSkillVersion(registry, slug, hash, token) {
+    const url = registryUrl(ApiRoutes.resolve, registry);
+    url.searchParams.set('slug', slug);
+    url.searchParams.set('hash', hash);
+    return apiRequest(registry, { method: 'GET', url: url.toString(), token }, ApiV1SkillResolveResponseSchema);
+}
+async function fileExists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=skills.js.map