@floomhq/floom 1.0.25 → 1.0.27

package/dist/doctor.js

@@ -4,10 +4,11 @@ import { delimiter } from "node:path";
 import { join } from "node:path";
 import { stat, readFile, access, readdir, constants, realpath } from "node:fs/promises";
 import { promisify } from "node:util";
-import { needsRefresh, readConfig, readRawConfig, CONFIG_PATH, resolveApiUrl } from "./config.js";
+import { readConfig, CONFIG_PATH, resolveApiUrl } from "./config.js";
 import { floomFetch } from "./lib/api.js";
 import { c, symbols } from "./ui.js";
 import { CLI_VERSION, compareSemverish, formatVersionLabel } from "./version.js";
+import { targetSkillsDir } from "./targets.js";
 const execFile = promisify(execFileCb);
 function statusBadge(s) {
     if (s === "ok")
@@ -17,23 +18,12 @@ function statusBadge(s) {
     return c.red(symbols.fail);
 }
 async function checkAuth() {
-    const raw = await readRawConfig();
-    if (!raw) {
-        return {
-            name: "Auth",
-            status: "ok",
-            detail: "Receiver mode ready. Sign in only when publishing or listing your own skills.",
-        };
-    }
-    const expired = raw.expiresAt <= Math.floor(Date.now() / 1000);
-    const expiresSoon = needsRefresh(raw);
     const cfg = await readConfig();
     if (!cfg) {
         return {
             name: "Auth",
-            status: "fail",
-            detail: expired ? "Token expired and refresh failed." : "Token refresh failed.",
-            hint: "Run `npx -y @floomhq/floom logout && npx -y @floomhq/floom login` to sign in again.",
+            status: "ok",
+            detail: "Receiver mode ready. Sign in only when publishing or listing your own skills.",
         };
     }
     const apiUrl = resolveApiUrl(cfg);
@@ -59,11 +49,10 @@ async function checkAuth() {
             };
         }
         const data = (await res.json());
-        const suffix = expiresSoon ? " (token refreshed)" : "";
         return {
             name: "Auth",
             status: "ok",
-            detail: data.email ? `Signed in as ${data.email}${suffix}` : `Signed in${suffix}`,
+            detail: data.email ? `Signed in as ${data.email}` : "Signed in",
         };
     }
     catch (err) {
@@ -81,6 +70,9 @@ async function checkMcp() {
         { name: "Claude Code", path: join(homedir(), ".claude.json") },
         { name: "Claude Code (settings)", path: join(homedir(), ".claude", "settings.json") },
         { name: "Codex", path: join(homedir(), ".codex", "config.toml") },
+        { name: "Cursor", path: join(homedir(), ".cursor", "mcp.json") },
+        { name: "OpenCode", path: join(homedir(), ".config", "opencode", "opencode.json") },
+        { name: "Kimi", path: join(homedir(), ".kimi", "mcp.json") },
         { name: "Gemini", path: join(homedir(), ".gemini", "settings.json") },
     ];
     const found = [];
@@ -113,13 +105,6 @@ async function checkMcp() {
         detail: `Registered with: ${found.map((f) => f.name).join(", ")}`,
     };
 }
-function targetSkillsDir(target) {
-    if (target === "codex") {
-        const codexHome = process.env.CODEX_HOME ?? join(homedir(), ".codex");
-        return process.env.CODEX_SKILLS_DIR ?? join(codexHome, "skills");
-    }
-    return process.env.CLAUDE_SKILLS_DIR ?? join(homedir(), ".claude", "skills");
-}
 async function checkTargetDir(target) {
     const dir = targetSkillsDir(target);
     try {
@@ -347,6 +332,7 @@ async function readExecutableVersion(path) {
 }
 export async function doctor(opts = {}) {
     const target = opts.target ?? "claude";
+    process.stdout.write(`\n${c.bold("floom doctor")} ${c.dim(`(${formatVersionLabel(CLI_VERSION)}, target: ${target})`)}\n\n`);
     const checks = await Promise.all([
         checkCliCommand(),
         checkAuth(),
@@ -355,22 +341,6 @@ export async function doctor(opts = {}) {
         checkLastSync(target),
         checkVersion(),
     ]);
-    const anyFail = checks.some((check) => check.status === "fail");
-    const anyWarn = checks.some((check) => check.status === "warn");
-    if (opts.json) {
-        process.stdout.write(`${JSON.stringify({
-            ok: !anyFail,
-            status: anyFail ? "fail" : anyWarn ? "warn" : "ok",
-            version: CLI_VERSION,
-            target,
-            checks,
-            configPath: CONFIG_PATH,
-        })}\n`);
-        if (anyFail)
-            process.exit(1);
-        return;
-    }
-    process.stdout.write(`\n${c.bold("floom doctor")} ${c.dim(`(${formatVersionLabel(CLI_VERSION)}, target: ${target})`)}\n\n`);
     // Compute column widths for clean table output.
     const nameW = Math.max(...checks.map((c) => c.name.length), 6);
     for (const check of checks) {
@@ -380,6 +350,8 @@ export async function doctor(opts = {}) {
             process.stdout.write(`     ${c.dim("→ " + check.hint)}\n`);
         }
     }
+    const anyFail = checks.some((c) => c.status === "fail");
+    const anyWarn = checks.some((c) => c.status === "warn");
     process.stdout.write("\n");
     if (anyFail) {
         process.stdout.write(`  ${c.red("✗ Some checks failed.")} See hints above.\n\n`);

package/dist/errors.js

@@ -20,7 +20,7 @@ export function friendlyHttp(status, action) {
         return new FloomError(`You don't have permission to ${action}.`);
     }
     if (status === 404) {
-        if (/fetch|inspect|add|install|show|get|search|list|info|load/i.test(action)) {
+        if (/fetch|inspect|add|install|show|get|search|list|info/i.test(action)) {
             return new FloomError("Skill not found.", "Check the link or slug, then try again.");
         }
         return new FloomError("Skill not found.", "Run `npx -y @floomhq/floom publish <path>` to create a new one.");

package/dist/install.js

@@ -1,6 +1,5 @@
 import { constants } from "node:fs";
-import { lstat, mkdir, open, readdir, rmdir, unlink } from "node:fs/promises";
-import { homedir } from "node:os";
+import { lstat, mkdir, open } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import ora from "ora";
 import { readConfig, resolveApiUrl } from "./config.js";
@@ -9,6 +8,7 @@ import { c, symbols } from "./ui.js";
 import { FloomError } from "./errors.js";
 import { normalizeRemotePackageFiles, packageHash, sha256Bytes } from "./package.js";
 import { manifestKey, markSynced, readSyncManifest, withSyncLock, writeSyncManifest } from "./sync-manifest.js";
+import { targetLabel, targetSkillsDir, targetSkillsDirEnv } from "./targets.js";
 const SLUG_RE = /^[A-Za-z0-9_-]{1,128}$/;
 const FD_PATH_ROOT = "/proc/self/fd";
 function slugFromInput(input) {
@@ -22,13 +22,6 @@ function slugFromInput(input) {
         return trimmed.replace(/\.(md|json)$/i, "");
     }
 }
-function skillsDir(target) {
-    if (target === "codex") {
-        const codexHome = process.env.CODEX_HOME ?? join(homedir(), ".codex");
-        return process.env.CODEX_SKILLS_DIR ?? join(codexHome, "skills");
-    }
-    return process.env.CLAUDE_SKILLS_DIR ?? join(homedir(), ".claude", "skills");
-}
 function skillPath(root, slug) {
     return join(root, slug, "SKILL.md");
 }
@@ -36,7 +29,7 @@ function legacySkillPath(root, slug) {
     return join(root, `${slug}.md`);
 }
 function skillsDirHint(target) {
-    return target === "codex" ? "CODEX_SKILLS_DIR" : "CLAUDE_SKILLS_DIR";
+    return targetSkillsDirEnv(target);
 }
 function setupCommand(target) {
     return `npx -y @floomhq/floom setup --target ${target} --yes`;
@@ -66,14 +59,12 @@ async function readLocalFile(path) {
         throw err;
     }
 }
-async function localPackageState(root, slug, target, files) {
+async function localPackageHash(root, slug, target, files) {
     const main = await readLocalFile(target);
     if (main === null) {
         const legacy = await readLocalFile(legacySkillPath(root, slug));
-        if (legacy !== null && legacy.length === 0)
-            return null;
-        if (legacy !== null)
-            return { hash: packageHash(legacy.toString("utf8"), []), source: "legacy" };
+        if (legacy !== null && files.length === 0)
+            return packageHash(legacy.toString("utf8"), []);
         return null;
     }
     const localFiles = [];
@@ -83,7 +74,7 @@ async function localPackageState(root, slug, target, files) {
             return null;
         localFiles.push({ path: file.path, bytes, sha256: file.sha256 });
     }
-    return { hash: packageHash(main.toString("utf8"), localFiles), source: "native" };
+    return packageHash(main.toString("utf8"), localFiles);
 }
 async function markInstallSynced(root, slug, files) {
     const manifest = await readSyncManifest();
@@ -121,33 +112,6 @@ async function writeInstallFile(root, target, body) {
         await parent.close();
     }
 }
-async function removeLegacySkillFile(root, slug) {
-    try {
-        await unlink(legacySkillPath(root, slug));
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ENOENT")
-            return;
-        if (code === "EISDIR" || code === "ELOOP" || code === "EPERM")
-            return;
-        throw err;
-    }
-}
-async function removeEmptyNativeSkillDir(root, slug) {
-    try {
-        const dir = dirname(skillPath(root, slug));
-        const entries = await readdir(dir);
-        if (entries.length === 0)
-            await rmdir(dir);
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ENOENT" || code === "ENOTEMPTY" || code === "EEXIST")
-            return;
-        throw err;
-    }
-}
 async function overwriteInstallFile(root, target, body) {
     const parent = await openSafeParentDirectory(root, target);
     const handle = await open(childCreatePath(parent, dirname(target), basename(target)), constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 0o600);
@@ -225,14 +189,14 @@ async function assertSafeDirectory(path) {
 }
 export async function install(slugInput, opts = {}) {
     const targetAgent = opts.target ?? "claude";
-    const root = skillsDir(targetAgent);
+    const root = targetSkillsDir(targetAgent);
     const slug = slugFromInput(slugInput);
     if (!SLUG_RE.test(slug)) {
         throw new FloomError(`Invalid skill slug: ${slugInput}`);
     }
     const cfg = await readConfig();
     const apiUrl = resolveApiUrl(cfg);
-    const spinner = opts.json ? null : ora({ text: c.dim(`Adding ${slug}...`), color: "yellow" }).start();
+    const spinner = ora({ text: c.dim(`Adding ${slug}...`), color: "yellow" }).start();
     let detail;
     try {
         detail = await getJson(`${apiUrl}/api/v1/skills/${encodeURIComponent(slug)}`, "fetch skill", cfg?.accessToken);
@@ -241,7 +205,7 @@ export async function install(slugInput, opts = {}) {
         }
     }
     catch (err) {
-        spinner?.stop();
+        spinner.stop();
         throw err;
     }
     const target = skillPath(root, slug);
@@ -267,29 +231,21 @@ export async function install(slugInput, opts = {}) {
             }
             throw err;
         }
-        const existing = await localPackageState(root, slug, target, remotePackageFiles);
+        await ensureSafeParentDirectory(root, target);
+        const existing = await localPackageHash(root, slug, target, remotePackageFiles);
         const conflictingTarget = await preflightInstallPackage(root, installFiles, opts.force ? { force: true } : {});
         if (conflictingTarget) {
             throw new FloomError("Local skill already exists with different content.", `Run \`npx -y @floomhq/floom add <link> --force\` to replace it, or move the local file first: ${relative(root, conflictingTarget).split(sep).join("/")}`);
         }
-        if (existing?.hash === remoteHash && existing.source === "native") {
-            await removeLegacySkillFile(root, slug);
+        if (existing === remoteHash) {
             action = "unchanged";
         }
-        else if (existing !== null && (opts.force || (existing.source === "legacy" && existing.hash === remoteHash))) {
+        else if (opts.force) {
             try {
-                if (existing.source === "legacy")
-                    await writeInstallFile(root, target, detail.body_md);
-                else
-                    await overwriteInstallFile(root, target, detail.body_md);
+                await overwriteInstallFile(root, target, detail.body_md);
                 for (const file of remotePackageFiles) {
-                    const fileTarget = join(dirname(target), file.path);
-                    if (existing.source === "legacy")
-                        await writeInstallFile(root, fileTarget, file.bytes);
-                    else
-                        await overwriteInstallFile(root, fileTarget, file.bytes);
+                    await overwriteInstallFile(root, join(dirname(target), file.path), file.bytes);
                 }
-                await removeLegacySkillFile(root, slug);
             }
             catch (err) {
                 const code = err.code;
@@ -297,7 +253,7 @@ export async function install(slugInput, opts = {}) {
                     throw new FloomError("Local path is a symbolic link.", "Move or delete the local path, then run `npx -y @floomhq/floom add` again.");
                 throw err;
             }
-            action = existing.source === "legacy" ? "installed" : "updated";
+            action = "updated";
         }
         else if (existing !== null) {
             throw new FloomError("Local skill already exists with different content.", "Run `npx -y @floomhq/floom add <link> --force` to replace it, or move the local file first.");
@@ -308,7 +264,6 @@ export async function install(slugInput, opts = {}) {
                 for (const file of remotePackageFiles) {
                     await writeInstallFile(root, join(dirname(target), file.path), file.bytes);
                 }
-                await removeLegacySkillFile(root, slug);
             }
             catch (err) {
                 const code = err.code;
@@ -332,17 +287,7 @@ export async function install(slugInput, opts = {}) {
             manifestWarning = err instanceof Error ? err.message : String(err);
         }
     });
-    spinner?.stop();
-    if (opts.json) {
-        process.stdout.write(`${JSON.stringify({
-            slug,
-            action,
-            target: targetAgent,
-            path: target,
-            setup: Boolean(opts.setup),
-        })}\n`);
-        return;
-    }
+    spinner.stop();
     process.stdout.write(`\n${symbols.ok}  [floom] ${action} ${c.bold(slug)}\n`);
     process.stdout.write(`   ${c.dim(dirname(target))}\n\n`);
     if (manifestWarning) {
@@ -350,7 +295,7 @@ export async function install(slugInput, opts = {}) {
     }
     process.stdout.write(`   ${c.bold("Next")}\n`);
     if (opts.setup) {
-        process.stdout.write(`   ${c.dim("1.")} Floom is connecting ${targetAgent === "claude" ? "Claude Code" : "Codex"} now.\n`);
+        process.stdout.write(`   ${c.dim("1.")} Floom is connecting ${targetLabel(targetAgent)} now.\n`);
         process.stdout.write(`   ${c.dim("2.")} Tell your agent to use ${c.bold(slug)} when it matches the task.\n\n`);
     }
     else {

package/dist/login.js

@@ -1,6 +1,5 @@
 import { createServer } from "node:http";
 import { createServer as createNetServer } from "node:net";
-import { randomBytes } from "node:crypto";
 import open from "open";
 import ora from "ora";
 import { getApiUrl, writeConfig } from "./config.js";
@@ -8,19 +7,18 @@ import { c, header, symbols } from "./ui.js";
 import { FloomError, friendlyHttp, friendlyNetwork } from "./errors.js";
 const DEFAULT_PORT = 7456;
 const TIMEOUT_MS = 5 * 60 * 1000;
-export async function login(provider = "google") {
+export async function login() {
     const apiUrl = getApiUrl();
     const port = await pickPort();
-    const providerLabel = provider === "github" ? "GitHub" : "Google";
     process.stdout.write(header());
-    process.stdout.write(`${symbols.arrow}  Opening browser to sign in with ${providerLabel}...\n\n`);
+    process.stdout.write(`${symbols.arrow}  Opening browser to sign in with Google...\n\n`);
     const spinner = ora({
         text: c.dim("Waiting for sign-in to complete..."),
         color: "yellow",
     }).start();
     let tokens;
     try {
-        tokens = await waitForCallback(port, provider);
+        tokens = await waitForCallback(port);
     }
     catch (err) {
         spinner.stop();
@@ -91,10 +89,9 @@ function reserveEphemeralPort() {
         });
     });
 }
-function waitForCallback(port, provider) {
+function waitForCallback(port) {
     return new Promise((resolve, reject) => {
         const apiUrl = getApiUrl();
-        const state = randomBytes(32).toString("base64url");
         let settled = false;
         const server = createServer((req, res) => {
             // CORS preflight from the browser bridge page.
@@ -125,15 +122,6 @@ function waitForCallback(port, provider) {
                             res.end(localCallbackPage("Missing tokens from OAuth response."));
                             return;
                         }
-                        if (data.state !== state) {
-                            res.writeHead(400, {
-                                "access-control-allow-origin": origin,
-                                "access-control-allow-private-network": "true",
-                                "content-type": "text/html; charset=utf-8",
-                            });
-                            res.end(localCallbackPage("Invalid sign-in state."));
-                            return;
-                        }
                         res.writeHead(200, {
                             "access-control-allow-origin": origin,
                             "access-control-allow-private-network": "true",
@@ -151,11 +139,6 @@ function waitForCallback(port, provider) {
                 });
                 return;
             }
-            if (req.method === "GET" && req.url?.startsWith("/cli-callback")) {
-                res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-                res.end(localCallbackBridgePage());
-                return;
-            }
             res.writeHead(404, { "content-type": "text/plain" });
             res.end("Not found");
         });
@@ -178,12 +161,11 @@ function waitForCallback(port, provider) {
             reject(new FloomError(`Local auth server failed on port ${port}.`, `Is port ${port} already in use? (${err.message})`));
         });
         server.listen(port, "127.0.0.1", () => {
-            const target = `${apiUrl}/auth/cli?port=${port}&provider=${provider}&state=${encodeURIComponent(state)}`;
-            process.stdout.write(c.dim("If the browser does not open, copy this URL:") +
-                `\n${c.cyan(target)}\n\n`);
+            const target = `${apiUrl}/auth/cli?port=${port}`;
             open(target).catch((e) => {
                 const msg = e instanceof Error ? e.message : String(e);
-                process.stdout.write(c.yellow(`Could not auto-open browser (${msg}).\n`));
+                process.stdout.write(c.yellow(`Could not auto-open browser (${msg}).\n`) +
+                    c.dim(`Open this URL manually: ${target}\n`));
             });
         });
     });
@@ -193,7 +175,7 @@ function parseCallbackBody(body, contentType) {
     if (type.includes("application/x-www-form-urlencoded")) {
         const params = new URLSearchParams(body);
         const parsed = {};
-        for (const key of ["access_token", "refresh_token", "expires_in", "token_type", "state"]) {
+        for (const key of ["access_token", "refresh_token", "expires_in", "token_type"]) {
             const value = params.get(key);
             if (value)
                 parsed[key] = value;
@@ -202,47 +184,6 @@ function parseCallbackBody(body, contentType) {
     }
     return JSON.parse(body);
 }
-function localCallbackBridgePage() {
-    return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Floom CLI sign-in</title>
-</head>
-<body>
-  <p>Completing Floom CLI sign-in...</p>
-  <script>
-    (async function () {
-      try {
-        var params = new URLSearchParams(window.location.hash.slice(1));
-        if (!params.get("access_token") || !params.get("refresh_token")) {
-          document.body.textContent = "OAuth response missing tokens.";
-          return;
-        }
-        var body = new URLSearchParams();
-        ["access_token", "refresh_token", "expires_in", "token_type", "state"].forEach(function (key) {
-          var value = params.get(key);
-          if (value) body.set(key, value);
-        });
-        window.history.replaceState(null, "", window.location.pathname);
-        var res = await fetch("/cli-callback", {
-          method: "POST",
-          headers: { "content-type": "application/x-www-form-urlencoded" },
-          body: body.toString()
-        });
-        var html = await res.text();
-        document.open();
-        document.write(html);
-        document.close();
-      } catch (e) {
-        document.body.textContent = "Could not complete Floom CLI sign-in. Return to your terminal and run floom login again.";
-      }
-    })();
-  </script>
-</body>
-</html>`;
-}
 function localCallbackPage(message) {
     const safeMessage = escapeHtml(message);
     return `<!doctype html>

package/dist/mcp.js

@@ -2,15 +2,18 @@ import { c } from "./ui.js";
 export function printMcpSetup() {
     const snippet = `## Floom
 - Use Floom skills from the local Floom skills folder when they match the task.
-- To install a shared skill, run \`npx -y @floomhq/floom add <slug-or-url> --target claude\` or \`npx -y @floomhq/floom add <slug-or-url> --target codex\`.
+- To install a shared skill, run \`npx -y @floomhq/floom add <slug-or-url> --target <claude|codex|cursor|opencode|kimi>\`.
 - To find reusable behavior, run \`npx -y @floomhq/floom search <query>\`.
-- MCP sync is optional; use it while the Floom MCP server is configured and running.`;
+- MCP sync uses the skills directory configured for that agent; set \`FLOOM_SKILLS_DIR\` or the agent-specific env var when registering the server.`;
     process.stdout.write(`\n${c.bold("Floom MCP setup")}\n\n`);
     process.stdout.write(`${c.dim("Pick your tool:")}\n\n`);
     process.stdout.write(`  ${c.bold("Claude Code")}\n`);
     process.stdout.write(`  ${c.cyan("claude mcp add floom -- npx -y @floomhq/floom-mcp-sync")}\n\n`);
     process.stdout.write(`  ${c.bold("Codex CLI")}\n`);
     process.stdout.write(`  ${c.cyan("codex mcp add floom -- npx -y @floomhq/floom-mcp-sync")}\n\n`);
+    process.stdout.write(`  ${c.bold("Cursor / OpenCode / Kimi")}\n`);
+    process.stdout.write(`  ${c.cyan("Run the agent's MCP registration flow with FLOOM_SKILLS_DIR set to its skills root.")}\n`);
+    process.stdout.write(`  ${c.dim("Examples: ~/.cursor/skills-cursor, ~/.config/opencode/skills, ~/.kimi/skills")}\n\n`);
     process.stdout.write(`${c.dim("Full guide:")} ${c.cyan("https://floom.dev/docs/mcp")}\n\n`);
     process.stdout.write(`${c.dim("Recommended agent instruction snippet:")}\n\n`);
     process.stdout.write(`${snippet}\n\n`);