@genspark/cli 1.0.24 → 1.0.25

package/dist/commands/skills-pull.d.ts

@@ -0,0 +1,91 @@
+/**
+ * `gsk skills pull <ref> --out <dir>` — client-side writer for the backend
+ * `skills_pull` action.
+ *
+ * Why client-side: an HTTP/JSON tool can't materialise a file tree on the
+ * user's machine. The backend `skills_pull` action returns the skill's files
+ * as `{ path, content_base64 }` rows; this helper decodes them and writes the
+ * tree to disk — same split as `sb-git clone-url --execute` — plus a
+ * `.genspark-skill.json` provenance sidecar so the tree stays identifiable
+ * and refresh-able. Pull is an authoring/export flow (pull → edit → re-upload),
+ * not a runtime mount path.
+ */
+/** Skill-slug shape the backend enforces (single path component, no separators
+ * or `..`). Defined here — the lowest module in the skills-CLI import graph
+ * (skills-sync imports `safeJoin` from it) — and re-used by skills-sync so the
+ * client can't drift from the server's slug contract. */
+export declare const SLUG_RE: RegExp;
+/** One file row from the backend `skills_pull` response. */
+export interface SkillFile {
+    path: string;
+    size?: number;
+    content_base64: string;
+}
+/** Shape of the `data` field returned by the backend `skills_pull` action. */
+export interface SkillPullData {
+    slug: string;
+    ref?: string;
+    owner?: string;
+    publisher_type?: string;
+    name?: string;
+    commit?: string;
+    file_count?: number;
+    total_bytes?: number;
+    files: SkillFile[];
+}
+/**
+ * Provenance sidecar written next to the pulled files. This is what turns a
+ * pulled tree from an anonymous file dump into a managed artifact: it records
+ * WHICH skill (owner/slug) at WHICH commit landed here, so a later pull of the
+ * same skill can refresh the directory in place instead of being refused.
+ */
+export declare const SIDECAR_FILENAME = ".genspark-skill.json";
+export interface SkillSidecar {
+    ref?: string;
+    owner?: string;
+    slug?: string;
+    commit?: string;
+    publisher_type?: string;
+    pulled_at?: string;
+    file_count?: number;
+    content_hash?: string;
+}
+/** Parse the sidecar in `dest`, or null when absent/unreadable. */
+export declare function readSidecar(dest: string): SkillSidecar | null;
+/** Hash the tree currently on disk under `dir`, excluding the sidecar file. */
+export declare function hashTree(dir: string): string;
+/**
+ * Resolve the destination directory and decide whether this pull is a
+ * sidecar-matched in-place REFRESH. Default dest: the slug in the current
+ * directory; an explicit `--out` is honored (with `~` expansion).
+ *
+ * A non-empty existing directory is refused UNLESS its sidecar attests it
+ * holds a previous pull of the SAME skill (slug match, and owner match when
+ * both sides carry one) AND that pull is PRISTINE — the on-disk tree still
+ * hashes to what the sidecar recorded. A pristine match refreshes in place; an
+ * edited tree (or a same-skill dir with no recorded hash) is refused so a
+ * re-pull never silently destroys local edits (the pull → edit → re-upload
+ * authoring flow). A non-matching dir is refused so a pull never merges into an
+ * unrelated tree.
+ */
+export declare function resolvePullDest(slug: string, explicit: string | undefined, pulled?: {
+    slug: string;
+    owner?: string;
+}): {
+    dest: string;
+    refresh: boolean;
+};
+/**
+ * Resolve a server-provided relative file path against `dest`, rejecting any
+ * path that would escape the destination (absolute paths, `..` traversal).
+ * The backend already constrains paths to the skill subtree; this is
+ * defense-in-depth so a crafted response can't write outside `--out`.
+ */
+export declare function safeJoin(dest: string, relPath: string): string;
+/**
+ * Write a `skills_pull` response to disk. Returns 0 on success, non-zero on
+ * any failure (matches the exit-code contract the caller propagates via
+ * `process.exit`).
+ */
+export declare function writeSkillFiles(data: SkillPullData, explicitDest: string | undefined): number;
+//# sourceMappingURL=skills-pull.d.ts.map

package/dist/commands/skills-pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-pull.d.ts","sourceRoot":"","sources":["../../src/commands/skills-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH;;;yDAGyD;AACzD,eAAO,MAAM,OAAO,QAAqC,CAAA;AAEzD,4DAA4D;AAC5D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,SAAS,EAAE,CAAA;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,yBAAyB,CAAA;AAEtD,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IAInB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAW7D;AAqCD,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAe5C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAgCpC;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAiB9D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,EACnB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAmHR"}

package/dist/commands/skills-pull.js

@@ -0,0 +1,275 @@
+/**
+ * `gsk skills pull <ref> --out <dir>` — client-side writer for the backend
+ * `skills_pull` action.
+ *
+ * Why client-side: an HTTP/JSON tool can't materialise a file tree on the
+ * user's machine. The backend `skills_pull` action returns the skill's files
+ * as `{ path, content_base64 }` rows; this helper decodes them and writes the
+ * tree to disk — same split as `sb-git clone-url --execute` — plus a
+ * `.genspark-skill.json` provenance sidecar so the tree stays identifiable
+ * and refresh-able. Pull is an authoring/export flow (pull → edit → re-upload),
+ * not a runtime mount path.
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { info, error as logError } from '../logger.js';
+/** Skill-slug shape the backend enforces (single path component, no separators
+ * or `..`). Defined here — the lowest module in the skills-CLI import graph
+ * (skills-sync imports `safeJoin` from it) — and re-used by skills-sync so the
+ * client can't drift from the server's slug contract. */
+export const SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/**
+ * Provenance sidecar written next to the pulled files. This is what turns a
+ * pulled tree from an anonymous file dump into a managed artifact: it records
+ * WHICH skill (owner/slug) at WHICH commit landed here, so a later pull of the
+ * same skill can refresh the directory in place instead of being refused.
+ */
+export const SIDECAR_FILENAME = '.genspark-skill.json';
+/** Parse the sidecar in `dest`, or null when absent/unreadable. */
+export function readSidecar(dest) {
+    try {
+        const raw = fs.readFileSync(path.join(dest, SIDECAR_FILENAME), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // absent or corrupt → treated as "no sidecar" (caller refuses the dir)
+    }
+    return null;
+}
+/**
+ * Content hash of a set of skill files, canonicalized so the write-time hash
+ * (over the payload) and the re-pull-time hash (over the on-disk tree) are
+ * directly comparable: POSIX-separator relative paths, sorted, each contributes
+ * `path\0<bytes>\0`. The sidecar itself is never part of the hash.
+ */
+function hashFiles(entries) {
+    const hash = crypto.createHash('sha256');
+    // Canonicalize the key BEFORE sorting so the write-time hash (payload paths)
+    // and the re-pull hash (on-disk paths) agree regardless of platform:
+    //   - separator: on-disk paths join with the OS separator (`\` on Windows);
+    //     payload paths are `/`. Sorting on the raw separator orders the two
+    //     differently (`/` and `\` are different code points), so a pristine
+    //     Windows tree would never match its own recorded hash.
+    //   - Unicode form: a normalizing filesystem (legacy HFS+, some SMB mounts)
+    //     returns filenames in NFD while the backend emits NFC, so the same name
+    //     hashes differently on write vs re-pull → a pristine tree read as edited.
+    // Normalize both (POSIX separators + NFC) and sort AND hash on that key.
+    const normalized = entries
+        .map(e => ({
+        key: e.relPath.split(path.sep).join('/').normalize('NFC'),
+        bytes: e.bytes,
+    }))
+        .sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+    for (const { key, bytes } of normalized) {
+        hash.update(key);
+        hash.update('\0');
+        hash.update(bytes);
+        hash.update('\0');
+    }
+    return hash.digest('hex');
+}
+/** Hash the tree currently on disk under `dir`, excluding the sidecar file. */
+export function hashTree(dir) {
+    const entries = [];
+    const walk = (abs, rel) => {
+        for (const name of fs.readdirSync(abs)) {
+            const childAbs = path.join(abs, name);
+            const childRel = rel ? path.join(rel, name) : name;
+            if (fs.statSync(childAbs).isDirectory()) {
+                walk(childAbs, childRel);
+            }
+            else if (!(rel === '' && name === SIDECAR_FILENAME)) {
+                entries.push({ relPath: childRel, bytes: fs.readFileSync(childAbs) });
+            }
+        }
+    };
+    walk(dir, '');
+    return hashFiles(entries);
+}
+/**
+ * Resolve the destination directory and decide whether this pull is a
+ * sidecar-matched in-place REFRESH. Default dest: the slug in the current
+ * directory; an explicit `--out` is honored (with `~` expansion).
+ *
+ * A non-empty existing directory is refused UNLESS its sidecar attests it
+ * holds a previous pull of the SAME skill (slug match, and owner match when
+ * both sides carry one) AND that pull is PRISTINE — the on-disk tree still
+ * hashes to what the sidecar recorded. A pristine match refreshes in place; an
+ * edited tree (or a same-skill dir with no recorded hash) is refused so a
+ * re-pull never silently destroys local edits (the pull → edit → re-upload
+ * authoring flow). A non-matching dir is refused so a pull never merges into an
+ * unrelated tree.
+ */
+export function resolvePullDest(slug, explicit, pulled) {
+    const dest = explicit
+        ? path.resolve(explicit.replace(/^~(?=\/|$)/, os.homedir()))
+        : path.resolve(process.cwd(), slug);
+    if (fs.existsSync(dest) && fs.readdirSync(dest).length > 0) {
+        const sidecar = readSidecar(dest);
+        const sameSkill = sidecar != null &&
+            sidecar.slug === (pulled?.slug ?? slug) &&
+            (!sidecar.owner || !pulled?.owner || sidecar.owner === pulled.owner);
+        if (!sameSkill) {
+            throw new Error(`Refusing to write into ${dest}: directory exists and is not empty ` +
+                `(no ${SIDECAR_FILENAME} matching this skill). ` +
+                `Remove it or pass --out <new-path>.`);
+        }
+        // Same skill, but only refresh a PRISTINE tree. An edited tree (or one
+        // written before content hashing) must not be silently wiped.
+        const pristine = typeof sidecar.content_hash === 'string' &&
+            sidecar.content_hash === hashTree(dest);
+        if (!pristine) {
+            throw new Error(`Refusing to overwrite ${dest}: it holds local changes since the last ` +
+                `pull of this skill (or was pulled before edit-detection). Save your ` +
+                `edits, remove the directory, or pass --out <new-path>.`);
+        }
+        return { dest, refresh: true };
+    }
+    return { dest, refresh: false };
+}
+/**
+ * Resolve a server-provided relative file path against `dest`, rejecting any
+ * path that would escape the destination (absolute paths, `..` traversal).
+ * The backend already constrains paths to the skill subtree; this is
+ * defense-in-depth so a crafted response can't write outside `--out`.
+ */
+export function safeJoin(dest, relPath) {
+    // Backend emits POSIX git-tree paths, so a backslash or Windows
+    // drive/UNC prefix can only be a crafted payload — reject before
+    // path.normalize (whose semantics differ per platform) sees it.
+    if (relPath.includes('\\') || /^[a-zA-Z]:/.test(relPath)) {
+        throw new Error(`Unsafe file path in skill payload: ${relPath}`);
+    }
+    const normalized = path.normalize(relPath);
+    if (path.isAbsolute(normalized) || normalized.split(path.sep)[0] === '..') {
+        throw new Error(`Unsafe file path in skill payload: ${relPath}`);
+    }
+    const target = path.resolve(dest, normalized);
+    const destWithSep = dest.endsWith(path.sep) ? dest : dest + path.sep;
+    if (target !== dest && !target.startsWith(destWithSep)) {
+        throw new Error(`Unsafe file path in skill payload: ${relPath}`);
+    }
+    return target;
+}
+/**
+ * Write a `skills_pull` response to disk. Returns 0 on success, non-zero on
+ * any failure (matches the exit-code contract the caller propagates via
+ * `process.exit`).
+ */
+export function writeSkillFiles(data, explicitDest) {
+    if (!data || !Array.isArray(data.files) || data.files.length === 0) {
+        logError('skills pull: response contained no files.');
+        return 1;
+    }
+    if (typeof data.slug !== 'string' || !data.slug.trim()) {
+        logError('skills pull: response is missing a skill slug.');
+        return 1;
+    }
+    // The slug computes the default destination dir, so validate its shape the
+    // same way the backend does (single path component, no separators / `..`).
+    // safeJoin only guards the per-file paths; an unsanitised slug would let a
+    // crafted response escape the destination root before the per-file check.
+    if (!SLUG_RE.test(data.slug)) {
+        logError(`skills pull: response has an unsafe skill slug: ${data.slug}`);
+        return 1;
+    }
+    // The provenance sidecar owns the root SIDECAR_FILENAME. If the skill itself
+    // ships a root-level file by that name, writing the sidecar would clobber it
+    // and the pristine check (which excludes the root sidecar) would silently
+    // drop it — so refuse rather than corrupt the skill. A same-named file in a
+    // SUBDIR is fine (only the root sidecar is reserved).
+    if (data.files.some(f => f.path === SIDECAR_FILENAME)) {
+        logError(`skills pull: skill ships a reserved root file ${SIDECAR_FILENAME}; ` +
+            `cannot materialize it without clobbering the provenance sidecar.`);
+        return 1;
+    }
+    let dest;
+    let refresh;
+    try {
+        ;
+        ({ dest, refresh } = resolvePullDest(data.slug, explicitDest, {
+            slug: data.slug,
+            owner: data.owner,
+        }));
+    }
+    catch (e) {
+        logError(e.message);
+        return 1;
+    }
+    const destExisted = fs.existsSync(dest);
+    // A sidecar-matched refresh REPLACES the previous pull: clear the directory
+    // first so files deleted upstream don't linger as stale strays. The old
+    // content is by definition a previous served snapshot of this same skill
+    // (that is what the sidecar attests), so wiping it loses nothing local.
+    if (refresh) {
+        try {
+            for (const entry of fs.readdirSync(dest)) {
+                fs.rmSync(path.join(dest, entry), { recursive: true, force: true });
+            }
+        }
+        catch (e) {
+            logError(`skills pull: failed to clear ${dest} for refresh: ${e.message}`);
+            return 1;
+        }
+    }
+    // Roll back partial writes on failure so a mid-loop error (a crafted
+    // traversal/NUL path, disk-full) never leaves a half-written tree that then
+    // permanently fails the next retry on resolvePullDest's non-empty-dir guard.
+    try {
+        const written = [];
+        for (const file of data.files) {
+            if (!file.path)
+                continue; // skip a degenerate empty path (would resolve to dest itself)
+            const target = safeJoin(dest, file.path);
+            const bytes = Buffer.from(file.content_base64, 'base64');
+            fs.mkdirSync(path.dirname(target), { recursive: true });
+            fs.writeFileSync(target, bytes);
+            written.push({ relPath: file.path, bytes });
+        }
+        // Sidecar last, after every file landed — a crash mid-write must never
+        // leave a sidecar attesting a complete pull over a partial tree. The
+        // content_hash pins this exact tree so a later re-pull can tell a pristine
+        // directory (safe to refresh) from one the user has edited.
+        const sidecar = {
+            ref: data.ref ?? (data.owner ? `${data.owner}/${data.slug}` : data.slug),
+            owner: data.owner,
+            slug: data.slug,
+            commit: data.commit,
+            publisher_type: data.publisher_type,
+            pulled_at: new Date().toISOString(),
+            file_count: data.files.length,
+            content_hash: hashFiles(written),
+        };
+        fs.writeFileSync(path.join(dest, SIDECAR_FILENAME), JSON.stringify(sidecar, null, 2) + '\n');
+    }
+    catch (e) {
+        try {
+            if (!destExisted) {
+                fs.rmSync(dest, { recursive: true, force: true }); // we created it → remove fully
+            }
+            else {
+                // dest pre-existed as either EMPTY (guard-proven) or a refresh we
+                // already cleared — every entry now under it is ours. Clear it back to
+                // empty (leaving empty subdirs would trip the non-empty-dir guard and
+                // brick every retry). A failed refresh thus ends EMPTY, not restored —
+                // inherent to refresh-in-place; the next pull rebuilds it.
+                for (const entry of fs.readdirSync(dest)) {
+                    fs.rmSync(path.join(dest, entry), { recursive: true, force: true });
+                }
+            }
+        }
+        catch {
+            // best-effort cleanup; the original write error below is what matters
+        }
+        logError(`skills pull: failed to write files: ${e.message}`);
+        return 1;
+    }
+    info(`${refresh ? 'Refreshed' : 'Pulled'} ${data.files.length} file(s) for ${data.slug} → ${dest}`);
+    return 0;
+}
+//# sourceMappingURL=skills-pull.js.map

package/dist/commands/skills-pull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-pull.js","sourceRoot":"","sources":["../../src/commands/skills-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,EAAE,MAAM,cAAc,CAAA;AAEtD;;;yDAGyD;AACzD,MAAM,CAAC,MAAM,OAAO,GAAG,kCAAkC,CAAA;AAsBzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAA;AAgBtD,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAA;QACtE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAsB,CAAA;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,OAA0D;IAE1D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IACxC,6EAA6E;IAC7E,qEAAqE;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,4DAA4D;IAC5D,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,UAAU,GAAG,OAAO;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACT,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;QACzD,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,OAAO,GAAyC,EAAE,CAAA;IACxD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAC9C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAClD,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAC1B,CAAC;iBAAM,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACb,OAAO,SAAS,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,QAA4B,EAC5B,MAAyC;IAEzC,MAAM,IAAI,GAAG,QAAQ;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,SAAS,GACb,OAAO,IAAI,IAAI;YACf,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;YACvC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,sCAAsC;gBAClE,OAAO,gBAAgB,yBAAyB;gBAChD,qCAAqC,CACxC,CAAA;QACH,CAAC;QACD,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;YACxC,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,0CAA0C;gBACrE,sEAAsE;gBACtE,wDAAwD,CAC3D,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAe;IACpD,gEAAgE;IAChE,iEAAiE;IACjE,gEAAgE;IAChE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAA;IACpE,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAmB,EACnB,YAAgC;IAEhC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,QAAQ,CAAC,2CAA2C,CAAC,CAAA;QACrD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,gDAAgD,CAAC,CAAA;QAC1D,OAAO,CAAC,CAAA;IACV,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,mDAAmD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACxE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,sDAAsD;IACtD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;QACtD,QAAQ,CACN,iDAAiD,gBAAgB,IAAI;YACnE,kEAAkE,CACrE,CAAA;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,IAAY,CAAA;IAChB,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE;YAC7D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,CAAA;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAE,CAAW,CAAC,OAAO,CAAC,CAAA;QAC9B,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CACN,gCAAgC,IAAI,iBAAkB,CAAW,CAAC,OAAO,EAAE,CAC5E,CAAA;YACD,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,CAAC;QACH,MAAM,OAAO,GAAyC,EAAE,CAAA;QACxD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,SAAQ,CAAC,8DAA8D;YACvF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;YACxD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACvD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,OAAO,GAAiB;YAC5B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACxE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YAC7B,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC;SACjC,CAAA;QACD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EACjC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CACxC,CAAA;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA,CAAC,+BAA+B;YACnF,CAAC;iBAAM,CAAC;gBACN,kEAAkE;gBAClE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,2DAA2D;gBAC3D,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACrE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;QACD,QAAQ,CAAC,uCAAwC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACvE,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,CACF,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,gBAAgB,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE,CAC9F,CAAA;IACD,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/commands/skills-save.d.ts

@@ -0,0 +1,39 @@
+/**
+ * `gsk skills save [path]` — client-side directory collector for the backend
+ * `skills_save` action.
+ *
+ * Why client-side: `skills_save` takes `files: [{path, content_base64}]` in
+ * its request body (the inverse of `skills_pull`'s response shape) — an
+ * HTTP/JSON tool has no way to walk a local directory itself, so the CLI
+ * reads the tree and ships the encoded bytes. This is the sentinel-protocol
+ * successor referenced in `gsk_tool_adaptor.py`'s `_action_save`: SAS used to
+ * drop a `.save_to_self` file for the sandbox host to notice and zip
+ * out-of-band; here the CLI does the same walk itself, synchronously, before
+ * the request goes out.
+ */
+export interface CollectedFiles {
+    files: Array<{
+        path: string;
+        content_base64: string;
+    }>;
+    totalBytes: number;
+    sidecarOwner?: string;
+}
+/**
+ * Walk `dir` and collect every real file into a `skills_save` payload.
+ *
+ * - Symlinks are never followed (skipped outright) — a save must not escape
+ *   `dir` or loop on a cyclic link.
+ * - At the root only, dotfiles are excluded except `.gitignore` (ordinary
+ *   authoring content) and the pull provenance sidecar `.genspark-skill.json`
+ *   (metadata, not a skill file). Dotfiles in subdirectories are kept as-is.
+ * - Requires a root `SKILL.md`: the server rejects a save without one
+ *   anyway (frontmatter validation), so failing fast here saves a round trip.
+ * - Throws once the running byte total exceeds `maxBytes`.
+ *
+ * Returns the sidecar's recorded `owner` (if any) so the caller can warn the
+ * user before saving into someone else's pulled skill forks it into their
+ * own catalog.
+ */
+export declare function collectSkillDir(dir: string, maxBytes?: number): CollectedFiles;
+//# sourceMappingURL=skills-save.d.ts.map

package/dist/commands/skills-save.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-save.d.ts","sourceRoot":"","sources":["../../src/commands/skills-save.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAA0B,GACnC,cAAc,CA2DhB"}

package/dist/commands/skills-save.js

@@ -0,0 +1,93 @@
+/**
+ * `gsk skills save [path]` — client-side directory collector for the backend
+ * `skills_save` action.
+ *
+ * Why client-side: `skills_save` takes `files: [{path, content_base64}]` in
+ * its request body (the inverse of `skills_pull`'s response shape) — an
+ * HTTP/JSON tool has no way to walk a local directory itself, so the CLI
+ * reads the tree and ships the encoded bytes. This is the sentinel-protocol
+ * successor referenced in `gsk_tool_adaptor.py`'s `_action_save`: SAS used to
+ * drop a `.save_to_self` file for the sandbox host to notice and zip
+ * out-of-band; here the CLI does the same walk itself, synchronously, before
+ * the request goes out.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { readSidecar, SIDECAR_FILENAME } from './skills-pull.js';
+/** Mirrors the backend's `_MAX_SAVE_BYTES` (gsk_tool_adaptor.py) so a save
+ * that would be rejected server-side fails locally without a round trip. */
+const DEFAULT_MAX_BYTES = 25 * 1024 * 1024;
+/**
+ * Walk `dir` and collect every real file into a `skills_save` payload.
+ *
+ * - Symlinks are never followed (skipped outright) — a save must not escape
+ *   `dir` or loop on a cyclic link.
+ * - At the root only, dotfiles are excluded except `.gitignore` (ordinary
+ *   authoring content) and the pull provenance sidecar `.genspark-skill.json`
+ *   (metadata, not a skill file). Dotfiles in subdirectories are kept as-is.
+ * - Requires a root `SKILL.md`: the server rejects a save without one
+ *   anyway (frontmatter validation), so failing fast here saves a round trip.
+ * - Throws once the running byte total exceeds `maxBytes`.
+ *
+ * Returns the sidecar's recorded `owner` (if any) so the caller can warn the
+ * user before saving into someone else's pulled skill forks it into their
+ * own catalog.
+ */
+export function collectSkillDir(dir, maxBytes = DEFAULT_MAX_BYTES) {
+    const skillMdPath = path.join(dir, 'SKILL.md');
+    if (!fs.existsSync(skillMdPath) || !fs.statSync(skillMdPath).isFile()) {
+        throw new Error(`${dir} has no SKILL.md at its root — not a skill directory`);
+    }
+    const files = [];
+    let totalBytes = 0;
+    const walk = (abs, rel) => {
+        const isRoot = rel === '';
+        for (const dirent of fs.readdirSync(abs, { withFileTypes: true })) {
+            if (dirent.isSymbolicLink())
+                continue;
+            if (isRoot &&
+                (dirent.name === SIDECAR_FILENAME ||
+                    (dirent.name.startsWith('.') && dirent.name !== '.gitignore'))) {
+                continue;
+            }
+            const childAbs = path.join(abs, dirent.name);
+            const childRel = rel ? path.join(rel, dirent.name) : dirent.name;
+            if (dirent.isDirectory()) {
+                // Never walk or ship dependency / VCS trees, at ANY depth — they are
+                // never part of a skill, can be enormous (blowing the byte cap on
+                // junk), and `.git` would leak history. Root `.git` is already caught
+                // by the dotfile filter above; this also covers nested ones and
+                // `node_modules` (not a dotfile, so otherwise walked).
+                if (dirent.name === 'node_modules' || dirent.name === '.git')
+                    continue;
+                walk(childAbs, childRel);
+                continue;
+            }
+            if (!dirent.isFile())
+                continue;
+            // Cap-check on the stat size BEFORE reading: an over-cap file yields a
+            // clean cap error without ballooning memory or tripping Node's
+            // ERR_FS_FILE_TOO_LARGE on a huge readFileSync.
+            const size = fs.statSync(childAbs).size;
+            if (totalBytes + size > maxBytes) {
+                throw new Error(`skill directory exceeds the ${maxBytes} byte cap`);
+            }
+            const bytes = fs.readFileSync(childAbs);
+            totalBytes += bytes.length;
+            files.push({
+                path: childRel.split(path.sep).join('/'),
+                content_base64: bytes.toString('base64'),
+            });
+        }
+    };
+    walk(dir, '');
+    if (files.length === 0) {
+        throw new Error(`${dir} contains no files to save`);
+    }
+    return {
+        files,
+        totalBytes,
+        sidecarOwner: readSidecar(dir)?.owner,
+    };
+}
+//# sourceMappingURL=skills-save.js.map

package/dist/commands/skills-save.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-save.js","sourceRoot":"","sources":["../../src/commands/skills-save.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEhE;4EAC4E;AAC5E,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAQ1C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,WAAmB,iBAAiB;IAEpC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,sDAAsD,CAAC,CAAA;IAC/E,CAAC;IAED,MAAM,KAAK,GAAoD,EAAE,CAAA;IACjE,IAAI,UAAU,GAAG,CAAC,CAAA;IAElB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAC9C,MAAM,MAAM,GAAG,GAAG,KAAK,EAAE,CAAA;QACzB,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,MAAM,CAAC,cAAc,EAAE;gBAAE,SAAQ;YACrC,IACE,MAAM;gBACN,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB;oBAC/B,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,EAChE,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;YAChE,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,qEAAqE;gBACrE,kEAAkE;gBAClE,sEAAsE;gBACtE,gEAAgE;gBAChE,uDAAuD;gBACvD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;oBAAE,SAAQ;gBACtE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;gBACxB,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;gBAAE,SAAQ;YAC9B,uEAAuE;YACvE,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAA;YACvC,IAAI,UAAU,GAAG,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,WAAW,CAAC,CAAA;YACrE,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;YACvC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAA;YAC1B,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACzC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAEb,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,4BAA4B,CAAC,CAAA;IACrD,CAAC;IAED,OAAO;QACL,KAAK;QACL,UAAU;QACV,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK;KACtC,CAAA;AACH,CAAC"}

package/dist/commands/skills-sync.d.ts

@@ -0,0 +1,92 @@
+/**
+ * `gsk skills sync` — client-side materializer for the backend `skills_sync`
+ * action.
+ *
+ * Why client-side: `skills_sync` returns a digest-diffed bundle (base64 file
+ * bytes for changed skills, a removal list, per-slug errors); this module
+ * applies one such response to disk. Deliberately NOT parity with
+ * `setup.sh` (which unconditionally `rm -rf`s then `ln -sfn`s over the mount
+ * path — the synced skill always wins): here a pre-existing REAL directory
+ * under `mountDir` (an inline-tar builtin, or user content) is never
+ * clobbered by a same-named synced skill; the real dir wins and the slug is
+ * reported failed instead. Chosen because this materializer runs on a
+ * user's laptop, not a disposable sandbox — never `rm -rf`ing directories we
+ * didn't create is worth a failed sync entry. Index.ts (Task 6) drives the
+ * poll-until-`complete` loop and owns `--check`; this module only ever
+ * applies (never diffs) a response.
+ */
+/** One file row from a `skills_sync` `update` entry. */
+export interface SyncSkillFile {
+    path: string;
+    content_base64: string;
+}
+/** One per-slug entry in a `skills_sync` response. */
+export interface SyncSkillEntry {
+    slug: string;
+    sha?: string;
+    action: 'update' | 'unchanged' | 'removed' | 'error';
+    files?: SyncSkillFile[];
+    total_bytes?: number;
+    code?: string;
+}
+/** Shape of the `data` field returned by the backend `skills_sync` action. */
+export interface SyncResponseData {
+    synced?: boolean;
+    complete: boolean;
+    skills: SyncSkillEntry[];
+}
+export interface SyncOptions {
+    storeDir?: string;
+    mountDir?: string;
+}
+export interface ApplySyncResult {
+    state: Record<string, string>;
+    applied: string[];
+    removed: string[];
+    failed: string[];
+}
+/**
+ * Folds the per-batch results of the multi-batch sync loop into single deduped
+ * totals. A slug can recur across batches — a server `error` row carries no
+ * recordable sha, so the server re-emits it in EVERY batch — and concatenating
+ * per-batch arrays would multi-count it, making the summary counts and the
+ * exit-4 gate wrong. Each category is a Set (dedup by slug); a slug's outcome
+ * in a later batch supersedes an earlier one. It also aggregates the echoed
+ * skill rows so `-o json` reflects every batch, not just the final one.
+ *
+ * Generic over the echoed-row type so the CLI can pass its own row shape
+ * without a cast (only `slug` is required here).
+ */
+export declare class SyncAggregator<Row extends {
+    slug: string;
+}> {
+    private readonly _applied;
+    private readonly _removed;
+    private readonly _failed;
+    private readonly _rows;
+    /** Fold one batch's apply result and its echoed skill rows into the totals. */
+    add(result: ApplySyncResult, rows: readonly Row[]): void;
+    private categorize;
+    get appliedCount(): number;
+    get removedCount(): number;
+    get failedCount(): number;
+    /** Aggregated echoed rows (deduped by slug, last-wins). */
+    get skills(): Row[];
+}
+export declare const STATE_FILENAME = "skills-sync-state.json";
+export declare function defaultStoreDir(): string;
+export declare function defaultMountDir(): string;
+/** Load the persisted `{slug: sha}` digest map. Both unparseable JSON AND a
+ * valid-JSON-but-wrong-shape file self-heal to `{}` — a dirty state file
+ * forces a full re-diff on the next sync rather than risk skipping a change
+ * against a state we can't trust. The shape check matters because the server
+ * verb rejects the WHOLE sync (`bad state digest map`) on a single bad key,
+ * so without validating here a corrupt map would wedge every sync forever;
+ * resetting to `{}` lets it recover on the next run. */
+export declare function loadState(storeDir: string): Record<string, string>;
+/**
+ * Apply one `skills_sync` response to disk. Never called in `--check` mode
+ * (Task 6's caller diffs against `loadState` output itself for that path).
+ */
+export declare function applySyncResponse(data: SyncResponseData, opts?: SyncOptions): ApplySyncResult;
+//# sourceMappingURL=skills-sync.d.ts.map

package/dist/commands/skills-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-sync.d.ts","sourceRoot":"","sources":["../../src/commands/skills-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAA;IACpD,KAAK,CAAC,EAAE,aAAa,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,cAAc,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc,CAAC,GAAG,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAE/C,+EAA+E;IAC/E,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,GAAG,IAAI;IAOxD,OAAO,CAAC,UAAU;IAOlB,IAAI,YAAY,IAAI,MAAM,CAEzB;IACD,IAAI,YAAY,IAAI,MAAM,CAEzB;IACD,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,2DAA2D;IAC3D,IAAI,MAAM,IAAI,GAAG,EAAE,CAElB;CACF;AAED,eAAO,MAAM,cAAc,2BAA2B,CAAA;AAMtD,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;;wDAMwD;AACxD,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAelE;AAkJD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,WAAgB,GACrB,eAAe,CAiGjB"}