@goodboyjs/cli 0.1.0

package/dist/commands/skill-version.js

@@ -0,0 +1,119 @@
+import { cp } from 'node:fs/promises';
+import { join, resolve, sep } from 'node:path';
+import ora from 'ora';
+import { getRegistryPath } from '../lib/registry.js';
+import { readRegistryEntry, writeRegistryEntry, resolveLatestVersion, resolveVersionPath, addVersionToEntry, } from '../lib/registry-entry.js';
+import { readManifest, writeManifest, validateManifest } from '../lib/manifest.js';
+import { SKILL_NAME_RE } from '../lib/validation.js';
+import { logger, sanitiseError } from '../lib/logger.js';
+const BUMP_LEVELS = ['patch', 'minor', 'major'];
+export function bumpVersion(version, level) {
+    const [major = 0, minor = 0, patch = 0] = version.split('.').map((n) => parseInt(n, 10));
+    switch (level) {
+        case 'patch': return `${major}.${minor}.${patch + 1}`;
+        case 'minor': return `${major}.${minor + 1}.0`;
+        case 'major': return `${major + 1}.0.0`;
+    }
+}
+function assertWithin(target, base, label) {
+    const resolvedTarget = resolve(target);
+    const resolvedBase = resolve(base);
+    if (!resolvedTarget.startsWith(resolvedBase + sep)) {
+        throw new Error(`Refused: ${label} escapes the expected directory`);
+    }
+}
+async function showVersionInfo(skillName) {
+    const registryPath = getRegistryPath();
+    const skillDir = join(registryPath, skillName);
+    assertWithin(skillDir, registryPath, 'skill path');
+    const entry = await readRegistryEntry(skillDir);
+    if (!entry) {
+        throw new Error(`Skill "${skillName}" not found in registry`);
+    }
+    const versions = Object.keys(entry.versions).sort((a, b) => {
+        const [aMaj = 0, aMin = 0, aPat = 0] = a.split('.').map(Number);
+        const [bMaj = 0, bMin = 0, bPat = 0] = b.split('.').map(Number);
+        return bMaj - aMaj || bMin - aMin || bPat - aPat;
+    });
+    logger.info(`Registry: ${registryPath}`);
+    logger.info('');
+    logger.info(`${skillName} versions:`);
+    logger.info('');
+    for (const version of versions) {
+        const v = entry.versions[version];
+        const tag = version === entry.latest ? ' (latest)' : '';
+        const yanked = v.yanked ? ' [yanked]' : '';
+        const added = new Date(v.addedAt).toLocaleDateString();
+        logger.info(`  ${version}${tag}${yanked}  —  added ${added}`);
+    }
+    logger.info('');
+    logger.info(`To create a new version: goodboy skill version ${skillName} --bump patch`);
+}
+async function createNewVersion(skillName, bump) {
+    if (!BUMP_LEVELS.includes(bump)) {
+        throw new Error(`Invalid bump level "${bump}": must be one of ${BUMP_LEVELS.join(', ')}`);
+    }
+    const level = bump;
+    const registryPath = getRegistryPath();
+    const skillDir = join(registryPath, skillName);
+    assertWithin(skillDir, registryPath, 'skill path');
+    const entry = await readRegistryEntry(skillDir);
+    if (!entry) {
+        throw new Error(`Skill "${skillName}" not found in registry`);
+    }
+    const currentLatest = resolveLatestVersion(entry);
+    if (!currentLatest) {
+        throw new Error('No installable version found (all versions are yanked)');
+    }
+    const newVersion = bumpVersion(currentLatest, level);
+    if (entry.versions[newVersion]) {
+        throw new Error(`Version ${newVersion} already exists in registry. ` +
+            `The registry uses immutable versions — existing versions cannot be replaced.`);
+    }
+    const sourceVersionDir = resolveVersionPath(entry, currentLatest, skillDir);
+    const newVersionDir = join(skillDir, 'versions', newVersion);
+    assertWithin(newVersionDir, skillDir, 'new version path');
+    const spinner = ora(`Creating ${skillName}@${newVersion}...`).start();
+    try {
+        await cp(sourceVersionDir, newVersionDir, { recursive: true });
+        const manifestPath = join(newVersionDir, 'manifest.json');
+        const rawManifest = await readManifest(manifestPath);
+        const manifest = validateManifest(rawManifest);
+        manifest.version = newVersion;
+        await writeManifest(manifestPath, manifest);
+        const updatedEntry = addVersionToEntry(entry, newVersion, join('versions', newVersion));
+        await writeRegistryEntry(skillDir, updatedEntry);
+        spinner.succeed();
+    }
+    catch (err) {
+        spinner.fail();
+        throw err;
+    }
+    logger.success(`Created ${skillName}@${newVersion} from ${currentLatest}`);
+    logger.info('');
+    logger.info(`Edit:    goodboy skill open ${skillName}`);
+    logger.info(`Install: goodboy upgrade ${skillName}`);
+}
+export function registerSkillVersion(program) {
+    program
+        .command('version <skill-name>')
+        .description('Show version info or create a new version of a registry skill')
+        .option('--bump <level>', 'Create a new version: patch | minor | major')
+        .action(async (skillName, options) => {
+        try {
+            if (!SKILL_NAME_RE.test(skillName)) {
+                throw new Error(`Invalid skill name "${skillName}": must match ^[a-z0-9-]+$`);
+            }
+            if (options.bump) {
+                await createNewVersion(skillName, options.bump);
+            }
+            else {
+                await showVersionInfo(skillName);
+            }
+        }
+        catch (err) {
+            logger.error(sanitiseError(err));
+            process.exit(1);
+        }
+    });
+}

package/dist/commands/skill.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerSkillCommand(program: Command): void;

package/dist/commands/skill.js

@@ -0,0 +1,13 @@
+import { registerSkillCreate } from './skill-create.js';
+import { registerSkillVersion } from './skill-version.js';
+import { registerSkillOpen } from './skill-open.js';
+import { registerSkillDiff } from './skill-diff.js';
+import { registerSkillStatus } from './skill-status.js';
+export function registerSkillCommand(program) {
+    const skill = program.command('skill').description('Manage skill creation and scaffolding');
+    registerSkillCreate(skill);
+    registerSkillVersion(skill);
+    registerSkillOpen(skill);
+    registerSkillDiff(skill);
+    registerSkillStatus(skill);
+}

package/dist/commands/uninstall.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const uninstallCommand: Command;

package/dist/commands/uninstall.js

@@ -0,0 +1,53 @@
+import { Command } from 'commander';
+import { rmSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import ora from 'ora';
+import { logger, sanitiseError } from '../lib/logger.js';
+import { SKILL_NAME_RE } from '../lib/validation.js';
+import { removeSkillFromManifest, removeSkillFromLock, } from '../lib/goodboy-file.js';
+import { removeAgentSymlinks, AGENT_SKILL_DIRS } from '../lib/agents.js';
+import { removeFromStore, getGoodboyHome } from '../lib/store.js';
+function getProjectSkillsPath(cwd) {
+    return join(cwd, '.claude', 'skills');
+}
+async function uninstallSkill(name, options, cwd) {
+    if (!SKILL_NAME_RE.test(name)) {
+        throw new Error(`Invalid skill name: "${name}". Must match ^[a-z0-9-]+$.`);
+    }
+    const spinner = ora(`Uninstalling "${name}"…`).start();
+    if (options.global) {
+        await removeAgentSymlinks(name, Object.keys(AGENT_SKILL_DIRS));
+        removeFromStore(name);
+        const goodboyHome = getGoodboyHome();
+        await removeSkillFromManifest(goodboyHome, name);
+        await removeSkillFromLock(goodboyHome, name);
+    }
+    else {
+        const destPath = join(getProjectSkillsPath(cwd), name);
+        if (existsSync(destPath)) {
+            rmSync(destPath, { recursive: true, force: true });
+        }
+        else {
+            spinner.warn(`"${name}" is not installed in this project`);
+            return;
+        }
+        await removeSkillFromManifest(cwd, name);
+        await removeSkillFromLock(cwd, name);
+    }
+    spinner.succeed(`Uninstalled "${name}"`);
+}
+export const uninstallCommand = new Command('uninstall')
+    .alias('rm')
+    .description('Remove an installed skill')
+    .argument('<skill-name>', 'Skill to remove')
+    .option('-g, --global', 'Remove from global store and all agent symlinks')
+    .action(async (skillName, options) => {
+    const cwd = process.cwd();
+    try {
+        await uninstallSkill(skillName, options, cwd);
+    }
+    catch (err) {
+        logger.error(sanitiseError(err));
+        process.exit(1);
+    }
+});

package/dist/commands/upgrade.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const upgradeCommand: Command;

package/dist/commands/upgrade.js

@@ -0,0 +1,103 @@
+import { Command } from 'commander';
+import { cpSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import ora from 'ora';
+import { createRegistryAdapter } from '../lib/registry-adapter.js';
+import { readManifest, validateManifest } from '../lib/manifest.js';
+import { scanForSymlinks } from '../lib/fs-security.js';
+import { logger, sanitiseError } from '../lib/logger.js';
+import { SKILL_NAME_RE } from '../lib/validation.js';
+import { readGoodBoyJson, getLockedVersion, addSkillToManifest, addSkillToLock, } from '../lib/goodboy-file.js';
+import { getStorePath, getGoodboyHome } from '../lib/store.js';
+function getProjectSkillsPath(cwd) {
+    return join(cwd, '.claude', 'skills');
+}
+async function upgradeSkill(name, options, cwd) {
+    if (!SKILL_NAME_RE.test(name)) {
+        throw new Error(`Invalid skill name: "${name}". Must match ^[a-z0-9-]+$.`);
+    }
+    const registry = createRegistryAdapter();
+    const spinner = ora(`Upgrading "${name}"…`).start();
+    let skillPath;
+    try {
+        skillPath = await registry.resolveSkill(name);
+    }
+    catch (err) {
+        spinner.fail(`Cannot locate skill "${name}" in registry`);
+        throw err;
+    }
+    let manifest;
+    try {
+        const data = await readManifest(join(skillPath, 'manifest.json'));
+        manifest = validateManifest(data);
+    }
+    catch (err) {
+        spinner.fail('Manifest validation failed');
+        throw err;
+    }
+    const lockDir = options.global ? getGoodboyHome() : cwd;
+    const lockedVersion = await getLockedVersion(lockDir, name);
+    if (lockedVersion !== null && lockedVersion === manifest.version) {
+        spinner.info(`"${name}" is already at the latest version (${manifest.version})`);
+        return;
+    }
+    try {
+        await scanForSymlinks(skillPath);
+    }
+    catch {
+        spinner.fail('Symlink check failed');
+        throw new Error('Skill rejected: symlink pointing outside skill directory detected');
+    }
+    const destPath = options.global
+        ? join(getStorePath(), name)
+        : join(getProjectSkillsPath(cwd), name);
+    if (!existsSync(destPath)) {
+        spinner.fail(`"${name}" is not installed`);
+        throw new Error(`Skill "${name}" is not installed. Run "goodboy install ${name}" first.`);
+    }
+    try {
+        cpSync(skillPath, destPath, { recursive: true, force: true });
+    }
+    catch (err) {
+        spinner.fail('Failed to copy skill files');
+        throw err;
+    }
+    await addSkillToManifest(lockDir, name, manifest.version);
+    await addSkillToLock(lockDir, name, manifest.version, destPath);
+    const from = lockedVersion !== null ? `${lockedVersion} → ` : '';
+    spinner.succeed(`Upgraded "${name}" (${from}${manifest.version})`);
+}
+async function upgradeAll(options, cwd) {
+    const dir = options.global ? getGoodboyHome() : cwd;
+    const goodboy = await readGoodBoyJson(dir);
+    if (!goodboy) {
+        throw new Error('No goodboy.json found in current directory.');
+    }
+    const skills = Object.keys(goodboy.skills);
+    if (skills.length === 0) {
+        logger.info('No skills listed in goodboy.json.');
+        return;
+    }
+    for (const name of skills) {
+        await upgradeSkill(name, options, cwd);
+    }
+}
+export const upgradeCommand = new Command('upgrade')
+    .description('Upgrade installed skills to the latest registry version')
+    .argument('[skill-name]', 'Skill to upgrade (omit to upgrade all from goodboy.json)')
+    .option('-g, --global', 'Upgrade in global store (~/.goodboy/skills/)')
+    .action(async (skillName, options) => {
+    const cwd = process.cwd();
+    try {
+        if (skillName !== undefined) {
+            await upgradeSkill(skillName, options, cwd);
+        }
+        else {
+            await upgradeAll(options, cwd);
+        }
+    }
+    catch (err) {
+        logger.error(sanitiseError(err));
+        process.exit(1);
+    }
+});

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { createRequire } from 'node:module';
+import { initCommand } from './commands/init.js';
+import { registerSkillCommand } from './commands/skill.js';
+import { installCommand } from './commands/install.js';
+import { upgradeCommand } from './commands/upgrade.js';
+import { uninstallCommand } from './commands/uninstall.js';
+import { listCommand } from './commands/list.js';
+import { searchCommand } from './commands/search.js';
+import { addCommand } from './commands/add.js';
+import { registryCommand } from './commands/registry-cmd.js';
+const _require = createRequire(import.meta.url);
+const pkg = _require('../package.json');
+const program = new Command();
+program
+    .name('goodboy')
+    .description('Personal skill registry and dispatcher for Claude Code')
+    .version(pkg.version, '-v, --version', 'Print version number')
+    .addHelpText('after', '\nDocs: https://github.com/xpera-ch/goodboy');
+program.addCommand(initCommand);
+registerSkillCommand(program);
+program.addCommand(installCommand);
+program.addCommand(upgradeCommand);
+program.addCommand(uninstallCommand);
+program.addCommand(listCommand);
+program.addCommand(searchCommand);
+program.addCommand(addCommand);
+program.addCommand(registryCommand);
+program.parseAsync(process.argv).catch((err) => {
+    process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+});

package/dist/lib/agents.d.ts

@@ -0,0 +1,14 @@
+export declare const AGENT_SKILL_DIRS: Record<string, string>;
+export interface AgentLinkOptions {
+    agents: string[];
+    skillName: string;
+    storePath: string;
+}
+export declare function resolveAgentFlags(flags: {
+    claudeCode?: boolean;
+    codex?: boolean;
+    gemini?: boolean;
+    allAgents?: boolean;
+}): string[];
+export declare function createAgentSymlinks(options: AgentLinkOptions): Promise<void>;
+export declare function removeAgentSymlinks(skillName: string, agents: string[]): Promise<void>;

package/dist/lib/agents.js

@@ -0,0 +1,83 @@
+import { mkdir, lstat, symlink, unlink, readlink } from 'node:fs/promises';
+import { join, sep } from 'node:path';
+import { homedir } from 'node:os';
+import { logger } from './logger.js';
+export const AGENT_SKILL_DIRS = {
+    'claude-code': join(homedir(), '.claude', 'skills'),
+    'codex': join(homedir(), '.codex', 'skills'),
+    'gemini': join(homedir(), '.gemini', 'skills'),
+};
+const DEFAULT_AGENT = 'claude-code';
+export function resolveAgentFlags(flags) {
+    if (flags.allAgents)
+        return Object.keys(AGENT_SKILL_DIRS);
+    const resolved = [];
+    if (flags.claudeCode)
+        resolved.push('claude-code');
+    if (flags.codex)
+        resolved.push('codex');
+    if (flags.gemini)
+        resolved.push('gemini');
+    if (resolved.length === 0)
+        return [DEFAULT_AGENT];
+    /* c8 ignore next 5 */
+    for (const name of resolved) {
+        if (!(name in AGENT_SKILL_DIRS)) {
+            throw new Error(`Unknown agent: "${name}"`);
+        }
+    }
+    return resolved;
+}
+export async function createAgentSymlinks(options) {
+    const { agents, skillName, storePath } = options;
+    for (const agent of agents) {
+        if (!(agent in AGENT_SKILL_DIRS)) {
+            throw new Error(`Unknown agent: "${agent}"`);
+        }
+        const agentDir = AGENT_SKILL_DIRS[agent];
+        const symlinkTarget = join(agentDir, skillName);
+        // Traversal guard — validated skillName should already be safe, but belt-and-suspenders
+        /* c8 ignore next 3 */
+        if (!symlinkTarget.startsWith(agentDir + sep) && symlinkTarget !== agentDir) {
+            throw new Error(`Refused: symlink target escapes agent skills directory`);
+        }
+        await mkdir(agentDir, { recursive: true, mode: 0o700 });
+        const stat = await lstat(symlinkTarget).catch(() => null);
+        if (stat !== null) {
+            if (stat.isSymbolicLink()) {
+                const existing = await readlink(symlinkTarget);
+                if (existing === storePath) {
+                    logger.info(`${agent}: already linked correctly`);
+                    continue;
+                }
+                await unlink(symlinkTarget);
+            }
+            else {
+                throw new Error(`Cannot create symlink: ${symlinkTarget} exists as a real directory. ` +
+                    `Remove it manually before installing globally.`);
+            }
+        }
+        await symlink(storePath, symlinkTarget);
+        logger.success(`Linked to ${agent}: ${symlinkTarget}`);
+    }
+}
+export async function removeAgentSymlinks(skillName, agents) {
+    for (const agent of agents) {
+        if (!(agent in AGENT_SKILL_DIRS)) {
+            logger.warn(`Unknown agent "${agent}" — skipping`);
+            continue;
+        }
+        const agentDir = AGENT_SKILL_DIRS[agent];
+        const symlinkTarget = join(agentDir, skillName);
+        const stat = await lstat(symlinkTarget).catch(() => null);
+        if (stat === null)
+            continue;
+        if (stat.isSymbolicLink()) {
+            await unlink(symlinkTarget);
+            logger.info(`Removed ${agent} symlink: ${symlinkTarget}`);
+        }
+        else {
+            logger.warn(`${symlinkTarget} is a real directory — skipping (remove manually if needed)`);
+        }
+    }
+}

package/dist/lib/consent.d.ts

@@ -0,0 +1,3 @@
+import type { GoodBoyManifest } from '../types/index.js';
+export declare function summarizePermissions(manifest: GoodBoyManifest): string[];
+export declare function requestConsent(manifest: GoodBoyManifest): Promise<boolean>;

package/dist/lib/consent.js

@@ -0,0 +1,48 @@
+import { confirm } from '@inquirer/prompts';
+import { logger } from './logger.js';
+// Exhaustiveness enforced at compile time: if the schema's permissions enum grows,
+// adding the missing key here becomes required to compile. The runtime guard in
+// summarizePermissions() is the backstop for when types are stale (schema changed
+// but generate:types was not re-run).
+const PERMISSION_LABELS = {
+    read_files: 'Read files on disk',
+    write_files: 'Write files on disk',
+    network: 'Access the network',
+    shell: 'Run shell commands',
+    env: 'Read environment variables',
+};
+// Fixed output order matches schema enum declaration order, independent of object key order.
+const PERMISSION_ORDER = [
+    'read_files', 'write_files', 'network', 'shell', 'env',
+];
+export function summarizePermissions(manifest) {
+    const perms = manifest.permissions ?? [];
+    // Runtime backstop against schema/type drift: if the schema gains a new permission
+    // value but generate:types has not been re-run, Ajv will accept the new value while
+    // PERMISSION_LABELS has no entry for it. Throw rather than silently omit it from
+    // the consent display — a missing permission in the prompt is worse than a crash.
+    for (const p of perms) {
+        if (PERMISSION_LABELS[p] === undefined) {
+            throw new Error(`Unknown permission value in manifest: "${p}". ` +
+                `This likely means the schema was updated without regenerating types — run npm run generate:types.`);
+        }
+    }
+    return PERMISSION_ORDER
+        .filter((p) => perms.includes(p))
+        .map((p) => PERMISSION_LABELS[p]);
+}
+export async function requestConsent(manifest) {
+    const lines = summarizePermissions(manifest);
+    if (lines.length === 0)
+        return true;
+    logger.info('');
+    logger.info(`Skill "${manifest.name}" requests the following permissions:`);
+    for (const line of lines) {
+        logger.info(`  • ${line}`);
+    }
+    logger.info('');
+    return confirm({
+        message: `Allow "${manifest.name}" to install with these permissions?`,
+        default: false,
+    });
+}

package/dist/lib/fs-security.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Recursively scan `dirPath` for symlinks that point outside `dirPath`.
+ * Symlinks whose resolved target starts with `dirPath + sep` are permitted
+ * (internal cross-references within the skill). All other symlinks abort
+ * with a security error so a malicious skill cannot use them to escape the
+ * skill sandbox during copy.
+ */
+export declare function scanForSymlinks(dirPath: string): Promise<void>;

package/dist/lib/fs-security.js

@@ -0,0 +1,27 @@
+import { readdir, readlink } from 'node:fs/promises';
+import { join, resolve, sep } from 'node:path';
+/**
+ * Recursively scan `dirPath` for symlinks that point outside `dirPath`.
+ * Symlinks whose resolved target starts with `dirPath + sep` are permitted
+ * (internal cross-references within the skill). All other symlinks abort
+ * with a security error so a malicious skill cannot use them to escape the
+ * skill sandbox during copy.
+ */
+export async function scanForSymlinks(dirPath) {
+    const entries = await readdir(dirPath, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = join(dirPath, entry.name);
+        if (entry.isSymbolicLink()) {
+            const linkTarget = await readlink(fullPath);
+            const resolvedTarget = resolve(dirPath, linkTarget);
+            if (!resolvedTarget.startsWith(dirPath + sep) && resolvedTarget !== dirPath) {
+                throw new Error(`Security: skill contains a symlink pointing outside its directory: ` +
+                    `${fullPath} → ${resolvedTarget}. Installation aborted.`);
+            }
+            // Symlink points inside the skill directory — permitted
+        }
+        else if (entry.isDirectory()) {
+            await scanForSymlinks(fullPath);
+        }
+    }
+}

package/dist/lib/goodboy-file.d.ts

@@ -0,0 +1,24 @@
+export interface GoodBoyJson {
+    schema: '1.0.0';
+    registry?: string;
+    skills: Record<string, string>;
+}
+export interface GoodBoyLockEntry {
+    version: string;
+    resolved: string;
+    integrity?: string;
+}
+export interface GoodBoyLock {
+    schema: '1.0.0';
+    generated: string;
+    skills: Record<string, GoodBoyLockEntry>;
+}
+export declare function readGoodBoyJson(dir: string): Promise<GoodBoyJson | null>;
+export declare function writeGoodBoyJson(dir: string, data: GoodBoyJson): Promise<void>;
+export declare function readGoodBoyLock(dir: string): Promise<GoodBoyLock | null>;
+export declare function writeGoodBoyLock(dir: string, data: GoodBoyLock): Promise<void>;
+export declare function addSkillToManifest(dir: string, skillName: string, version: string): Promise<void>;
+export declare function addSkillToLock(dir: string, skillName: string, version: string, resolvedPath: string): Promise<void>;
+export declare function removeSkillFromManifest(dir: string, skillName: string): Promise<void>;
+export declare function removeSkillFromLock(dir: string, skillName: string): Promise<void>;
+export declare function getLockedVersion(dir: string, skillName: string): Promise<string | null>;

package/dist/lib/goodboy-file.js

@@ -0,0 +1,99 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { join, resolve, isAbsolute } from 'node:path';
+const GOODBOY_JSON = 'goodboy.json';
+const GOODBOY_LOCK = 'goodboy.lock';
+function safeDir(dir) {
+    const resolved = resolve(dir);
+    /* c8 ignore next 3 */
+    if (!isAbsolute(resolved)) {
+        throw new Error(`Invalid directory path: "${dir}"`);
+    }
+    return resolved;
+}
+export async function readGoodBoyJson(dir) {
+    const filePath = join(safeDir(dir), GOODBOY_JSON);
+    try {
+        const raw = await readFile(filePath, 'utf-8');
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new Error(`goodboy.json contains invalid JSON`);
+        }
+        const data = parsed;
+        if (data['schema'] !== '1.0.0') {
+            throw new Error(`goodboy.json has unsupported schema version: "${String(data['schema'])}"`);
+        }
+        return data;
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+export async function writeGoodBoyJson(dir, data) {
+    const filePath = join(safeDir(dir), GOODBOY_JSON);
+    await writeFile(filePath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+}
+export async function readGoodBoyLock(dir) {
+    const filePath = join(safeDir(dir), GOODBOY_LOCK);
+    try {
+        const raw = await readFile(filePath, 'utf-8');
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new Error(`goodboy.lock contains invalid JSON`);
+        }
+        return parsed;
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+export async function writeGoodBoyLock(dir, data) {
+    const filePath = join(safeDir(dir), GOODBOY_LOCK);
+    const updated = { ...data, generated: new Date().toISOString() };
+    await writeFile(filePath, JSON.stringify(updated, null, 2) + '\n', 'utf-8');
+}
+export async function addSkillToManifest(dir, skillName, version) {
+    const existing = await readGoodBoyJson(dir);
+    const manifest = existing ?? { schema: '1.0.0', skills: {} };
+    manifest.skills[skillName] = `^${version}`;
+    await writeGoodBoyJson(dir, manifest);
+}
+export async function addSkillToLock(dir, skillName, version, resolvedPath) {
+    const existing = await readGoodBoyLock(dir);
+    const lock = existing ?? {
+        schema: '1.0.0',
+        generated: new Date().toISOString(),
+        skills: {},
+    };
+    lock.skills[skillName] = { version, resolved: resolvedPath };
+    await writeGoodBoyLock(dir, lock);
+}
+export async function removeSkillFromManifest(dir, skillName) {
+    const existing = await readGoodBoyJson(dir);
+    if (!existing)
+        return;
+    delete existing.skills[skillName];
+    await writeGoodBoyJson(dir, existing);
+}
+export async function removeSkillFromLock(dir, skillName) {
+    const existing = await readGoodBoyLock(dir);
+    if (!existing)
+        return;
+    delete existing.skills[skillName];
+    await writeGoodBoyLock(dir, existing);
+}
+export async function getLockedVersion(dir, skillName) {
+    const lock = await readGoodBoyLock(dir);
+    if (!lock)
+        return null;
+    return lock.skills[skillName]?.version ?? null;
+}