@floomhq/floom 1.0.64 → 2.0.1

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const VERSION: string;

package/dist/version.js

@@ -1,25 +1 @@
-import pkg from "../package.json" with { type: "json" };
-export const CLI_VERSION = pkg.version;
-function numericParts(value) {
-    const normalized = value.trim().replace(/^v/i, "");
-    const numeric = normalized.match(/^\d+(?:\.\d+)*/)?.[0] ?? "0";
-    return numeric.split(".").map((part) => Number.parseInt(part, 10));
-}
-export function compareSemverish(a, b) {
-    const left = numericParts(a);
-    const right = numericParts(b);
-    const max = Math.max(left.length, right.length);
-    for (let i = 0; i < max; i++) {
-        const l = left[i] ?? 0;
-        const r = right[i] ?? 0;
-        if (l > r)
-            return 1;
-        if (l < r)
-            return -1;
-    }
-    return 0;
-}
-export function formatVersionLabel(value) {
-    const trimmed = value.trim();
-    return trimmed.match(/^v/i) ? trimmed.replace(/^v/i, "v") : `v${trimmed}`;
-}
+export const VERSION = "2.0.1";

package/package.json

@@ -1,58 +1,50 @@
 {
   "name": "@floomhq/floom",
-  "version": "1.0.64",
-  "description": "Sync AI skills across agents and machines.",
+  "version": "2.0.1",
+  "description": "Floom CLI \u2014 one shared skill library, pulled into the AI agent you choose (Claude, Codex, Cursor, Gemini, OpenCode).",
   "license": "MIT",
-  "type": "module",
-  "bin": {
-    "floom": "bin/floom.js",
-    "floom-skills": "bin/floom.js"
+  "homepage": "https://floom.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/floomhq/skills-mvp.git"
   },
+  "types": "./dist/index.d.ts",
   "files": [
-    "bin",
-    "dist",
-    "README.md",
-    "LICENSE"
+    "dist"
   ],
-  "engines": {
-    "node": ">=20"
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "bin": {
+    "floom": "dist/index.js"
   },
   "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "typecheck": "tsc --noEmit",
-    "test": "npm run build && node --test test/*.mjs",
-    "pack:check": "npm pack --dry-run",
-    "prepack": "npm run build",
-    "prepublishOnly": "npm run build"
+    "build": "tsc -p tsconfig.typecheck.json --noEmit && node scripts/build-bundle.mjs",
+    "dev": "tsx watch src/index.ts",
+    "lint": "tsc -p tsconfig.typecheck.json --noEmit --pretty false",
+    "pack:check": "node scripts/verify-package.mjs",
+    "pack:smoke": "pnpm run build && node scripts/verify-package.mjs --install-smoke",
+    "prepack": "pnpm run build",
+    "prepublishOnly": "pnpm run build && pnpm run pack:check",
+    "start": "node dist/index.js",
+    "test": "tsx --tsconfig tsconfig.typecheck.json --test \"src/**/*.test.ts\"",
+    "typecheck": "tsc -p tsconfig.typecheck.json --noEmit"
   },
   "dependencies": {
-    "clipboardy": "4.0.0",
-    "open": "10.1.0",
-    "ora": "8.1.1",
-    "picocolors": "1.1.1",
-    "update-notifier": "7.3.1",
-    "yaml": "2.8.4"
+    "@modelcontextprotocol/sdk": "^1.12.2",
+    "chalk": "^5.3.0",
+    "commander": "^12.1.0",
+    "ora": "^8.1.0",
+    "prompts": "^2.4.2",
+    "tar": "^7.4.3",
+    "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@types/node": "22.10.5",
-    "@types/update-notifier": "6.0.8",
-    "typescript": "5.7.3"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/floomhq/floom.git",
-    "directory": "cli"
-  },
-  "keywords": [
-    "ai",
-    "skills",
-    "claude",
-    "markdown",
-    "cli",
-    "floom"
-  ]
+    "esbuild": "^0.27.7",
+    "@types/node": "^22.0.0",
+    "@types/prompts": "^2.4.9",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0"
+  }
 }

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Floom
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/README.md

@@ -1,90 +0,0 @@
-# @floomhq/floom
-
-Sync AI skills across agents and machines. Publish from your terminal, then add or sync skills with one command.
-
-```bash
-npm install -g @floomhq/floom
-floom init my-skill.md
-floom init my-skill
-floom login
-floom publish my-skill
-floom share my-skill --add teammate@example.com
-floom search review
-floom add awesome-skill --setup
-floom setup --target claude --dry-run
-floom daemon install --target all
-floom status
-floom list
-floom library list
-```
-
-Returns a shareable link like `https://floom.dev/s/ffas93ud`. Anyone with the URL can read the raw Markdown — drop it into any AI tool that accepts skills.
-
-The package is designed for `npx -y @floomhq/floom ...`. Global installs expose `floom`; `floom doctor` reports older local Floom runtime CLIs if they shadow the new command.
-
-## Commands
-
-- `npx -y @floomhq/floom login` — sign in with Google. New accounts are created on first login. Token stored at `~/.floom/config.json`.
-- `npx -y @floomhq/floom init [path]` — create a starter skill folder at `<path>/SKILL.md`. Passing an existing-style `file.md` path still creates that Markdown file.
-- `npx -y @floomhq/floom scan <path>` — check a skill file or package for high-confidence secrets, prompt-injection text, exfiltration instructions, and unsupported package layout before publishing.
-- `npx -y @floomhq/floom publish <path>` — upload a skill folder or Markdown file. Folder packages use `<slug>/SKILL.md` plus optional `references/`, `examples/`, `scripts/`, and `assets/`. Optional `--public` / `--private` / `--unlisted`, `--type knowledge|instruction|workflow|skill`, `--installs-as <target>`, and `--skill-version <label>`.
-- `npx -y @floomhq/floom share <slug>` — email-share one of your skills. Optional `--add <email>`, `--remove <email>`, and `--list`.
-- `npx -y @floomhq/floom list` — show your published skills. Optional `--json`.
-- `npx -y @floomhq/floom add <url-or-slug>` — fetch a skill into the selected agent skills root with supporting package files. Optional `--target claude|codex|cursor|opencode|kimi`, `--setup` to connect the agent, and `--force` to replace an existing local copy.
-- `npx -y @floomhq/floom info <url-or-slug>` — show skill metadata. Optional `--json`.
-- `npx -y @floomhq/floom search <query>` — search public skills and starter libraries. Optional `--library <slug>`, `--type knowledge|instruction|workflow|skill`, and `--json`.
-- `npx -y @floomhq/floom setup` — add Floom usage guidance to the selected harness instructions file. Optional `--target claude|codex|cursor|opencode|kimi`, `--dry-run`, `--yes`.
-- `npx -y @floomhq/floom connect` — alias for setup.
-- `npx -y @floomhq/floom mcp` — print MCP setup commands for supported agent CLIs.
-- `npx -y @floomhq/floom sync` — pull your published, saved, and subscribed library skills into one target. Optional `--target claude|codex|cursor|opencode|kimi`.
-- `npx -y @floomhq/floom watch` — run one target sync loop. Optional `--target claude|codex|cursor|opencode|kimi`, `--push`, `--no-yolo`, `--interval <seconds>`; minimum `10`.
-- `npx -y @floomhq/floom daemon install --target all` — install always-on sync for Claude, Codex, Cursor, OpenCode, and Kimi.
-- `npx -y @floomhq/floom daemon status --json` — show the latest daemon cycle and per-target result.
-- `npx -y @floomhq/floom status --json` — reconcile cloud, cache, native projection, and daemon counts.
-- `npx -y @floomhq/floom feedback --kind <kind> --message <text>` — send bounded agent feedback to Floom.
-- `npx -y @floomhq/floom audit skills --json` — report malformed, duplicate, and suspicious owned skills.
-- `npx -y @floomhq/floom library list` — list public starter libraries. Optional `--json`.
-- `npx -y @floomhq/floom library create <slug> --name <name>` — create a personal or starter library. Optional `--public` / `--private` / `--unlisted`.
-- `npx -y @floomhq/floom library add <library> <skill> [--folder <path>] [--tags a,b]` — add a skill to a library.
-- `npx -y @floomhq/floom library subscribe <slug>` — subscribe to a public or unlisted library so sync can pull it locally.
-- `npx -y @floomhq/floom move <slug> --folder <path>` — set your local folder override for a saved or library skill.
-- `npx -y @floomhq/floom delete <url-or-slug>` — delete one of your published skills. Optional `--yes`.
-- `npx -y @floomhq/floom doctor` — diagnose your Floom setup.
-- `npx -y @floomhq/floom whoami` — show the signed-in account.
-- `npx -y @floomhq/floom logout` — delete local credentials.
-
-## Skill format
-
-A skill package is a folder:
-
-```text
-my-skill/
-  SKILL.md
-  references/
-  examples/
-  scripts/
-  assets/
-```
-
-`SKILL.md` contains optional YAML frontmatter (`title`, `description`, `type`, `version`), then freeform Markdown. Supporting files are packaged only from `references/`, `examples/`, `scripts/`, and `assets/`.
-
-```markdown
----
-title: Write a LinkedIn post
-description: Yurii-level value density
-version: 0.1.0
----
-
-# Instructions
-- ...
-```
-
-## Configuration
-
-Override the API host with `FLOOM_API_URL` (defaults to `https://floom.dev`).
-
-`floom sync`, `floom watch`, and `floom daemon` handle published, saved, and subscribed library skills. Direct `floom sync --target <agent>` writes to that target's native skill root for compatibility. The always-on daemon writes pulled cloud packages into `~/.floom/skill-cache/<target>/` and keeps native harness roots as the user-editable projection/push surface.
-
-Sync manifests are target-scoped. Native projections are tracked under `~/.floom/native-sync-manifests/`; daemon cache roots keep their own `.floom-cli-sync-manifest.json`. The manifests record hashes for files Floom previously wrote. Sync writes missing files and applies cloud updates when the local file still matches the last Floom-tracked hash.
-Existing untracked files and locally edited tracked files are preserved as conflicts.
-Symlinks are never followed. To replace a local skill manually, run `floom add <url-or-slug> --force`.

package/bin/floom.js

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-import "../dist/cli.js";

package/dist/audit.js

@@ -1,236 +0,0 @@
-import ora from "ora";
-import { readFile } from "node:fs/promises";
-import { readConfig, resolveApiUrl } from "./config.js";
-import { getJson, postJson } from "./lib/api.js";
-import { FloomError } from "./errors.js";
-import { c, symbols } from "./ui.js";
-const FIXTURE_RE = /\b(?:cli lifecycle audit fixture|launch gate|temp skill|test fixture|audit fixture)\b/i;
-const ARCHIVE_CHUNK_SIZE = 1000;
-function contentHash(skill) {
-    return skill.content_sha256 ?? skill.content_hash ?? undefined;
-}
-function normalized(value) {
-    return (value ?? "").trim().replace(/\s+/g, " ").toLowerCase();
-}
-function riskFor(score, reasons) {
-    if (score >= 90 || reasons.includes("security_scan_failure"))
-        return "critical";
-    if (score >= 70)
-        return "high";
-    if (score >= 40)
-        return "medium";
-    return "low";
-}
-function scoreSkill(skill, duplicateGroup) {
-    const reasons = [];
-    let score = 0;
-    const title = normalized(skill.title);
-    const description = normalized(skill.description);
-    const body = skill.body_md ?? "";
-    const slug = skill.slug;
-    if (!title) {
-        score += 20;
-        reasons.push("blank_title");
-    }
-    if (!description) {
-        score += 15;
-        reasons.push("blank_description");
-    }
-    if (duplicateGroup) {
-        score += 35;
-        reasons.push("duplicate_content_hash");
-    }
-    if (FIXTURE_RE.test(`${skill.title ?? ""} ${skill.description ?? ""} ${slug}`)) {
-        score += 25;
-        reasons.push("launch_or_test_fixture");
-    }
-    if (title && title === normalized(slug)) {
-        score += 20;
-        reasons.push("slug_only_title");
-    }
-    if (body.trim().length > 0 && body.trim().length < 80) {
-        score += 35;
-        reasons.push("near_empty_body");
-    }
-    if (!/^---\s*\n/.test(body.trimStart())) {
-        score += 30;
-        reasons.push("missing_yaml_frontmatter");
-    }
-    if (/\b(?:api[_-]?key|secret|token)\b/i.test(body) && /\b(?:sk-|AIza|BEGIN PRIVATE KEY)\b/.test(body)) {
-        score += 50;
-        reasons.push("possible_secret");
-    }
-    if (score === 0)
-        return null;
-    const risk = riskFor(score, reasons);
-    const hash = contentHash(skill);
-    return {
-        slug,
-        title: skill.title?.trim() || "",
-        risk,
-        score,
-        reasons,
-        ...(hash ? { content_hash: hash } : {}),
-        ...(duplicateGroup ? { duplicate_group: duplicateGroup } : {}),
-        recommended_action: archiveRecommended(reasons) ? "archive" : "review",
-        safe: !reasons.includes("possible_secret"),
-    };
-}
-function archiveRecommended(reasons) {
-    if (reasons.includes("possible_secret"))
-        return true;
-    if (reasons.includes("launch_or_test_fixture"))
-        return true;
-    if (reasons.includes("blank_title") && reasons.includes("duplicate_content_hash"))
-        return true;
-    if (reasons.includes("near_empty_body") && reasons.includes("duplicate_content_hash"))
-        return true;
-    return false;
-}
-async function loadOwnedSkills() {
-    const cfg = await readConfig();
-    if (!cfg)
-        throw new FloomError("Not signed in.", "Run `npx -y @floomhq/floom login` first.");
-    const apiUrl = resolveApiUrl(cfg);
-    const skills = [];
-    let cursor;
-    const seenCursors = new Set();
-    for (let page = 0; page < 1000; page += 1) {
-        const url = new URL(`${apiUrl}/api/v1/me/skills`);
-        url.searchParams.set("limit", "100");
-        url.searchParams.set("scope", "owned");
-        if (cursor)
-            url.searchParams.set("cursor", cursor);
-        const mine = await getJson(url.toString(), "audit your skills", cfg.accessToken);
-        skills.push(...(mine.skills ?? []));
-        if (!mine.next_cursor)
-            break;
-        if (seenCursors.has(mine.next_cursor))
-            throw new FloomError("Invalid skills response.");
-        seenCursors.add(mine.next_cursor);
-        cursor = mine.next_cursor;
-    }
-    return skills;
-}
-function archiveSlugsFromPlan(raw) {
-    const value = raw && typeof raw === "object" ? raw : {};
-    const plan = value.archive_plan;
-    if (!Array.isArray(plan))
-        throw new FloomError("Invalid archive plan.", "Pass a JSON file from `floom audit skills --fix-plan`.");
-    const slugs = plan.map((item) => {
-        if (typeof item === "string")
-            return item;
-        if (item && typeof item === "object" && typeof item.slug === "string") {
-            return item.slug;
-        }
-        return "";
-    }).filter(Boolean);
-    if (slugs.length === 0)
-        throw new FloomError("Archive plan has no slugs.");
-    return [...new Set(slugs)];
-}
-async function applyArchivePlan(planPath, yes, json) {
-    const cfg = await readConfig();
-    if (!cfg)
-        throw new FloomError("Not signed in.", "Run `npx -y @floomhq/floom login` first.");
-    const raw = JSON.parse(await readFile(planPath, "utf8"));
-    const slugs = archiveSlugsFromPlan(raw);
-    const chunks = [];
-    for (let i = 0; i < slugs.length; i += ARCHIVE_CHUNK_SIZE)
-        chunks.push(slugs.slice(i, i + ARCHIVE_CHUNK_SIZE));
-    const responses = [];
-    for (const chunk of chunks) {
-        responses.push(await postJson(`${resolveApiUrl(cfg)}/api/v1/me/skills/archive`, yes ? "archive skills" : "preview skill archive", cfg.accessToken, { slugs: chunk, dry_run: !yes }));
-    }
-    const payload = {
-        dry_run: responses.every((response) => response.dry_run),
-        requested: responses.reduce((sum, response) => sum + response.requested, 0),
-        matched: responses.flatMap((response) => response.matched),
-        missing: responses.flatMap((response) => response.missing),
-        ...(yes ? { archived: responses.flatMap((response) => response.archived ?? []) } : {}),
-    };
-    if (json) {
-        process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
-        return;
-    }
-    const action = payload.dry_run ? "Archive preview" : "Archive applied";
-    process.stdout.write(`\n${symbols.ok}  ${action}: ${payload.matched.length}/${payload.requested} matched\n`);
-    if (payload.archived)
-        process.stdout.write(`   archived: ${payload.archived.length}\n`);
-    if (payload.missing.length > 0)
-        process.stdout.write(`   missing or not owned: ${payload.missing.join(", ")}\n`);
-    if (payload.dry_run)
-        process.stdout.write(`   ${c.dim("Re-run with --yes to archive matched skills.")}\n`);
-    process.stdout.write("\n");
-}
-function duplicateGroups(skills) {
-    const byHash = new Map();
-    for (const skill of skills) {
-        const hash = contentHash(skill);
-        if (!hash)
-            continue;
-        const group = byHash.get(hash) ?? [];
-        group.push(skill);
-        byHash.set(hash, group);
-    }
-    const out = new Map();
-    let i = 1;
-    for (const [hash, group] of byHash.entries()) {
-        if (group.length < 2)
-            continue;
-        const id = `dup_${i}`;
-        i += 1;
-        for (const skill of group)
-            out.set(`${hash}\0${skill.slug}`, id);
-    }
-    return out;
-}
-function summarize(skills, findings) {
-    return {
-        total: skills.length,
-        findings: findings.length,
-        critical: findings.filter((f) => f.risk === "critical").length,
-        high: findings.filter((f) => f.risk === "high").length,
-        medium: findings.filter((f) => f.risk === "medium").length,
-        low: findings.filter((f) => f.risk === "low").length,
-        blank_titles: skills.filter((s) => !normalized(s.title)).length,
-        blank_descriptions: skills.filter((s) => !normalized(s.description)).length,
-        duplicate_hash_groups: new Set(findings.map((f) => f.duplicate_group).filter(Boolean)).size,
-    };
-}
-export async function auditSkills(opts) {
-    if (opts.archivePlan) {
-        await applyArchivePlan(opts.archivePlan, opts.yes, opts.json);
-        return;
-    }
-    const spinner = opts.json || opts.fixPlan ? null : ora({ text: c.dim("Auditing skills..."), color: "yellow" }).start();
-    let skills;
-    try {
-        skills = await loadOwnedSkills();
-    }
-    finally {
-        spinner?.stop();
-    }
-    const duplicates = duplicateGroups(skills);
-    const findings = skills
-        .map((skill) => scoreSkill(skill, contentHash(skill) ? duplicates.get(`${contentHash(skill)}\0${skill.slug}`) : undefined))
-        .filter((finding) => finding !== null)
-        .sort((a, b) => b.score - a.score || a.slug.localeCompare(b.slug));
-    const summary = summarize(skills, findings);
-    const archivePlan = findings
-        .filter((finding) => finding.recommended_action === "archive")
-        .map((finding) => ({ slug: finding.slug, reasons: finding.reasons, score: finding.score }));
-    if (opts.json || opts.fixPlan) {
-        process.stdout.write(`${JSON.stringify({ summary, findings, ...(opts.fixPlan ? { archive_plan: archivePlan } : {}) }, null, 2)}\n`);
-        return;
-    }
-    process.stdout.write(`\n${symbols.dot}  ${c.bold("Skill audit")} ${c.dim(`(${summary.total} owned skills)`)}\n\n`);
-    process.stdout.write(`   findings: ${summary.findings}  critical: ${summary.critical}  high: ${summary.high}  medium: ${summary.medium}  low: ${summary.low}\n`);
-    process.stdout.write(`   blank titles: ${summary.blank_titles}  blank descriptions: ${summary.blank_descriptions}  duplicate groups: ${summary.duplicate_hash_groups}\n\n`);
-    for (const finding of findings.slice(0, 25)) {
-        process.stdout.write(`   ${c.cyan(finding.slug.padEnd(14))} ${finding.risk.padEnd(8)} ${String(finding.score).padStart(3)}  ${finding.reasons.join(", ")}\n`);
-    }
-    if (findings.length > 25)
-        process.stdout.write(`   ${c.dim(`... ${findings.length - 25} more. Run with --json for full output.`)}\n`);
-    process.stdout.write("\n");
-}