@cleocode/core 2026.3.45 → 2026.3.47

package/templates/skillsmp.json.example.md

@@ -0,0 +1,214 @@
+# SkillsMP Configuration Reference
+
+**File**: `~/.cleo/skillsmp.json` (global) or `./.cleo/skillsmp.json` (project)
+
+Configuration file for the SkillsMP (Skills Marketplace) integration in CLEO.
+
+---
+
+## Configuration Fields
+
+### Core Settings
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `$schema` | string | (see example) | JSON Schema reference for validation |
+| `endpoint` | string | `https://www.agentskills.in/api` | SkillsMP API endpoint URL |
+| `apiKey` | string | `""` | API key for authenticated requests (optional for public skills) |
+| `defaultInstallLocation` | enum | `"project"` | Default install location: `"project"` or `"global"` |
+| `timeout` | number | `30` | Request timeout in seconds |
+| `retries` | number | `3` | Number of retry attempts for failed requests |
+
+### Cache Settings
+
+Controls local caching of API responses to reduce network calls.
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `cache.enabled` | boolean | `true` | Enable response caching |
+| `cache.searchTtlMinutes` | number | `5` | Cache duration for search results (minutes) |
+| `cache.contentTtlMinutes` | number | `60` | Cache duration for skill content (minutes) |
+
+### Validation Settings
+
+Controls skill validation and verification during installation.
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `validation.checkSchemaVersion` | boolean | `true` | Verify skill schema version compatibility |
+| `validation.requireSignature` | boolean | `false` | Require cryptographic signature on skills |
+| `validation.allowedPublishers` | array | `[]` | Whitelist of trusted publishers (empty = allow all) |
+
+### Security Settings
+
+Sandbox and execution safety controls.
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `security.sandboxMode` | boolean | `true` | Run skill validation in sandbox |
+| `security.restrictedCommands` | array | (see example) | Blocked shell commands in skill content |
+| `security.maxFileSize` | number | `10485760` | Max skill file size in bytes (10MB default) |
+
+### Logging Settings
+
+Controls diagnostic output and audit trails.
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `logging.level` | enum | `"info"` | Log level: `"debug"`, `"info"`, `"warn"`, `"error"` |
+| `logging.logInstalls` | boolean | `true` | Log skill installation events |
+| `logging.logSearches` | boolean | `false` | Log search queries (verbose) |
+
+---
+
+## API Key Handling
+
+### Security Notes
+
+⚠️ **CRITICAL**: Never commit API keys to version control.
+
+**Recommended practices**:
+1. Use environment variable: `SKILLSMP_API_KEY`
+2. Store in global config: `~/.cleo/skillsmp.json`
+3. Add `.cleo/skillsmp.json` to `.gitignore`
+4. Use project config only for public/read-only access
+
+### Priority Order
+
+API key resolution order (first found wins):
+1. Environment variable: `$SKILLSMP_API_KEY`
+2. Project config: `./.cleo/skillsmp.json`
+3. Global config: `~/.cleo/skillsmp.json`
+4. No key (public access only)
+
+### Example: Environment Variable Setup
+
+```bash
+# Add to ~/.bashrc or ~/.zshrc
+export SKILLSMP_API_KEY="your-api-key-here"
+
+# Or set per-command
+SKILLSMP_API_KEY="key" cleo skill search "terraform"
+```
+
+---
+
+## Installation
+
+### Global Configuration (Recommended)
+
+```bash
+# Copy example to global location
+cp templates/skillsmp.json.example ~/.cleo/skillsmp.json
+
+# Edit with your API key
+nano ~/.cleo/skillsmp.json
+```
+
+### Project Configuration
+
+```bash
+# Copy example to project location
+cp templates/skillsmp.json.example ./.cleo/skillsmp.json
+
+# Add to .gitignore
+echo ".cleo/skillsmp.json" >> .gitignore
+```
+
+---
+
+## Validation
+
+Verify configuration syntax:
+
+```bash
+# Check if config is valid JSON
+jq empty ~/.cleo/skillsmp.json
+
+# Validate against schema (if ajv-cli installed)
+ajv validate -s schemas/skillsmp.schema.json -d ~/.cleo/skillsmp.json
+```
+
+---
+
+## Examples
+
+### Minimal Configuration (Public Access)
+
+```json
+{
+  "endpoint": "https://www.agentskills.in/api"
+}
+```
+
+### Development Configuration (Verbose Logging)
+
+```json
+{
+  "endpoint": "https://www.agentskills.in/api",
+  "cache": {
+    "enabled": false
+  },
+  "logging": {
+    "level": "debug",
+    "logSearches": true
+  }
+}
+```
+
+### Enterprise Configuration (Strict Security)
+
+```json
+{
+  "endpoint": "https://skills.enterprise.internal/api",
+  "apiKey": "${SKILLSMP_API_KEY}",
+  "defaultInstallLocation": "project",
+  "validation": {
+    "requireSignature": true,
+    "allowedPublishers": ["verified-publisher-1", "verified-publisher-2"]
+  },
+  "security": {
+    "sandboxMode": true,
+    "maxFileSize": 5242880
+  }
+}
+```
+
+---
+
+## Troubleshooting
+
+### Common Issues
+
+| Problem | Solution |
+|---------|----------|
+| `Connection timeout` | Increase `timeout` value or check network |
+| `API key invalid` | Verify key in config or environment variable |
+| `Skill validation failed` | Check `validation.checkSchemaVersion` or disable strict mode |
+| `Cache stale` | Lower TTL values or disable cache |
+
+### Debug Mode
+
+Enable verbose logging:
+
+```bash
+# Temporary debug
+cleo skill search "query" --debug
+
+# Persistent debug
+cleo config set skillsmp.logging.level debug
+```
+
+---
+
+## See Also
+
+- **Full Documentation**: `docs/commands/skill.md`
+- **Schema Definition**: `schemas/skillsmp.schema.json`
+- **CLI Reference**: `cleo skill --help`
+- **SkillsMP API Docs**: https://www.agentskills.in/docs
+
+---
+
+**Version**: 1.0.0
+**Last Updated**: 2026-01-27

package/dist/ui/injection-legacy.d.ts

@@ -1,26 +0,0 @@
-/**
- * Injection legacy utilities - validation keys and marker version extraction.
- *
- * Kept from the deleted injection-registry.ts for backward compatibility
- * with validation output and legacy marker migration. All active injection
- * logic is now delegated to @cleocode/caamp.
- *
- * @task T4677
- * @epic T4663
- */
-/**
- * Validation key names for JSON output.
- * Maps target filenames to JSON-safe key names used in validation results.
- */
-export declare const INJECTION_VALIDATION_KEYS: Readonly<Record<string, string>>;
-/**
- * Get the validation key for a target filename.
- */
-export declare function getValidationKey(target: string): string;
-/**
- * Extract the CLEO version from an injection marker string.
- * Returns null if no version is present (current format).
- * Returns the version string for legacy format.
- */
-export declare function extractMarkerVersion(markerLine: string): string | null;
-//# sourceMappingURL=injection-legacy.d.ts.map

package/dist/ui/injection-legacy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"injection-legacy.d.ts","sourceRoot":"","sources":["../../src/ui/injection-legacy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI7D,CAAC;AAEX;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAQD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAItE"}

package/src/ui/__tests__/injection-registry.test.d.ts

@@ -1,11 +0,0 @@
-/**
- * Tests for injection legacy utilities (injection-legacy.ts).
- *
- * These test the remaining utility functions kept from the deleted
- * injection-registry.ts for backward compatibility.
- *
- * @task T4677
- * @epic T4663
- */
-export {};
-//# sourceMappingURL=injection-registry.test.d.ts.map

package/src/ui/__tests__/injection-registry.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"injection-registry.test.d.ts","sourceRoot":"","sources":["injection-registry.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/src/ui/__tests__/injection-registry.test.js

@@ -1,46 +0,0 @@
-/**
- * Tests for injection legacy utilities (injection-legacy.ts).
- *
- * These test the remaining utility functions kept from the deleted
- * injection-registry.ts for backward compatibility.
- *
- * @task T4677
- * @epic T4663
- */
-import { describe, expect, it } from 'vitest';
-import { extractMarkerVersion, getValidationKey, INJECTION_VALIDATION_KEYS, } from '../injection-legacy.js';
-describe('getValidationKey', () => {
-    it('should return correct keys for known targets', () => {
-        expect(getValidationKey('CLAUDE.md')).toBe('claude_md');
-        expect(getValidationKey('AGENTS.md')).toBe('agents_md');
-        expect(getValidationKey('GEMINI.md')).toBe('gemini_md');
-    });
-    it('should generate a key for unknown targets', () => {
-        expect(getValidationKey('CODEX.md')).toBe('codex_md');
-        expect(getValidationKey('README.md')).toBe('readme_md');
-    });
-});
-describe('INJECTION_VALIDATION_KEYS', () => {
-    it('should have entries for the 3 known targets', () => {
-        expect(INJECTION_VALIDATION_KEYS['CLAUDE.md']).toBe('claude_md');
-        expect(INJECTION_VALIDATION_KEYS['AGENTS.md']).toBe('agents_md');
-        expect(INJECTION_VALIDATION_KEYS['GEMINI.md']).toBe('gemini_md');
-    });
-});
-describe('extractMarkerVersion', () => {
-    it('should return null for current format (no version)', () => {
-        expect(extractMarkerVersion('<!-- CLEO:START -->')).toBeNull();
-    });
-    it('should extract version from legacy format', () => {
-        expect(extractMarkerVersion('<!-- CLEO:START v0.58.6 -->')).toBe('0.58.6');
-    });
-    it('should return null for non-matching strings', () => {
-        expect(extractMarkerVersion('not a marker')).toBeNull();
-        expect(extractMarkerVersion('')).toBeNull();
-    });
-    it('should handle various version formats', () => {
-        expect(extractMarkerVersion('CLEO:START v1.0.0 -->')).toBe('1.0.0');
-        expect(extractMarkerVersion('CLEO:START v10.20.30 -->')).toBe('10.20.30');
-    });
-});
-//# sourceMappingURL=injection-registry.test.js.map

package/src/ui/__tests__/injection-registry.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"injection-registry.test.js","sourceRoot":"","sources":["injection-registry.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAEhC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,oBAAoB,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/src/ui/__tests__/injection-registry.test.ts

@@ -1,57 +0,0 @@
-/**
- * Tests for injection legacy utilities (injection-legacy.ts).
- *
- * These test the remaining utility functions kept from the deleted
- * injection-registry.ts for backward compatibility.
- *
- * @task T4677
- * @epic T4663
- */
-
-import { describe, expect, it } from 'vitest';
-import {
-  extractMarkerVersion,
-  getValidationKey,
-  INJECTION_VALIDATION_KEYS,
-} from '../injection-legacy.js';
-
-describe('getValidationKey', () => {
-  it('should return correct keys for known targets', () => {
-    expect(getValidationKey('CLAUDE.md')).toBe('claude_md');
-    expect(getValidationKey('AGENTS.md')).toBe('agents_md');
-    expect(getValidationKey('GEMINI.md')).toBe('gemini_md');
-  });
-
-  it('should generate a key for unknown targets', () => {
-    expect(getValidationKey('CODEX.md')).toBe('codex_md');
-    expect(getValidationKey('README.md')).toBe('readme_md');
-  });
-});
-
-describe('INJECTION_VALIDATION_KEYS', () => {
-  it('should have entries for the 3 known targets', () => {
-    expect(INJECTION_VALIDATION_KEYS['CLAUDE.md']).toBe('claude_md');
-    expect(INJECTION_VALIDATION_KEYS['AGENTS.md']).toBe('agents_md');
-    expect(INJECTION_VALIDATION_KEYS['GEMINI.md']).toBe('gemini_md');
-  });
-});
-
-describe('extractMarkerVersion', () => {
-  it('should return null for current format (no version)', () => {
-    expect(extractMarkerVersion('<!-- CLEO:START -->')).toBeNull();
-  });
-
-  it('should extract version from legacy format', () => {
-    expect(extractMarkerVersion('<!-- CLEO:START v0.58.6 -->')).toBe('0.58.6');
-  });
-
-  it('should return null for non-matching strings', () => {
-    expect(extractMarkerVersion('not a marker')).toBeNull();
-    expect(extractMarkerVersion('')).toBeNull();
-  });
-
-  it('should handle various version formats', () => {
-    expect(extractMarkerVersion('CLEO:START v1.0.0 -->')).toBe('1.0.0');
-    expect(extractMarkerVersion('CLEO:START v10.20.30 -->')).toBe('10.20.30');
-  });
-});

package/src/ui/injection-legacy.ts

@@ -1,44 +0,0 @@
-/**
- * Injection legacy utilities - validation keys and marker version extraction.
- *
- * Kept from the deleted injection-registry.ts for backward compatibility
- * with validation output and legacy marker migration. All active injection
- * logic is now delegated to @cleocode/caamp.
- *
- * @task T4677
- * @epic T4663
- */
-
-/**
- * Validation key names for JSON output.
- * Maps target filenames to JSON-safe key names used in validation results.
- */
-export const INJECTION_VALIDATION_KEYS: Readonly<Record<string, string>> = {
-  'CLAUDE.md': 'claude_md',
-  'AGENTS.md': 'agents_md',
-  'GEMINI.md': 'gemini_md',
-} as const;
-
-/**
- * Get the validation key for a target filename.
- */
-export function getValidationKey(target: string): string {
-  return INJECTION_VALIDATION_KEYS[target] ?? target.toLowerCase().replace(/[^a-z0-9]/g, '_');
-}
-
-/**
- * Version pattern for injection markers.
- * Matches: "CLEO:START -->" (current) or "CLEO:START v0.58.6 -->" (legacy)
- */
-const INJECTION_VERSION_PATTERN = /CLEO:START( v(\d+\.\d+\.\d+))? -->/;
-
-/**
- * Extract the CLEO version from an injection marker string.
- * Returns null if no version is present (current format).
- * Returns the version string for legacy format.
- */
-export function extractMarkerVersion(markerLine: string): string | null {
-  const match = markerLine.match(INJECTION_VERSION_PATTERN);
-  if (!match) return null;
-  return match[2] ?? null;
-}