@goodboyjs/cli 0.1.0

package/dist/lib/local-registry-adapter.d.ts

@@ -0,0 +1,18 @@
+import type { RegistryAdapter } from './registry-adapter.js';
+import type { RegistryEntry } from './registry-entry.js';
+import type { GoodBoyManifest } from '../types/index.js';
+/**
+ * Phase 1 implementation of RegistryAdapter.
+ * Resolves skills from a local git-based registry.
+ * Configured via GOODBOY_REGISTRY environment variable.
+ * Replace with RemoteRegistryAdapter in Phase 3.
+ */
+export declare class LocalRegistryAdapter implements RegistryAdapter {
+    resolveSkill(name: string): Promise<string>;
+    listInstalled(): Promise<GoodBoyManifest[]>;
+    listRegistry(): Promise<RegistryEntry[]>;
+    search(query: string): Promise<GoodBoyManifest[]>;
+    getRegistryLocation(): string;
+    getSkillsLocation(): string;
+    private matchesQuery;
+}

package/dist/lib/local-registry-adapter.js

@@ -0,0 +1,71 @@
+import { join } from 'node:path';
+import { getRegistryPath, getSkillsPath, resolveSkill, listInstalled, listRegistry, } from './registry.js';
+import { resolveLatestVersion, resolveVersionPath } from './registry-entry.js';
+import { readManifest, validateManifest } from './manifest.js';
+import { logger } from './logger.js';
+/**
+ * Phase 1 implementation of RegistryAdapter.
+ * Resolves skills from a local git-based registry.
+ * Configured via GOODBOY_REGISTRY environment variable.
+ * Replace with RemoteRegistryAdapter in Phase 3.
+ */
+export class LocalRegistryAdapter {
+    resolveSkill(name) {
+        return resolveSkill(name);
+    }
+    listInstalled() {
+        return listInstalled();
+    }
+    listRegistry() {
+        return listRegistry();
+    }
+    async search(query) {
+        let entries;
+        let registryPath;
+        try {
+            entries = await listRegistry();
+            registryPath = getRegistryPath();
+        }
+        catch {
+            return [];
+        }
+        if (entries.length === 0)
+            return [];
+        const queryLower = query.toLowerCase();
+        const results = [];
+        for (const entry of entries) {
+            const latestVersion = resolveLatestVersion(entry);
+            if (!latestVersion)
+                continue;
+            const skillDir = join(registryPath, entry.name);
+            const versionPath = resolveVersionPath(entry, latestVersion, skillDir);
+            const manifestPath = join(versionPath, 'manifest.json');
+            try {
+                const data = await readManifest(manifestPath);
+                const manifest = validateManifest(data);
+                if (this.matchesQuery(manifest, queryLower)) {
+                    results.push(manifest);
+                }
+            }
+            catch (err) {
+                logger.warn(`Skipping "${entry.name}": ${err instanceof Error ? err.message : 'invalid manifest'}`);
+            }
+        }
+        return results;
+    }
+    getRegistryLocation() {
+        return getRegistryPath();
+    }
+    getSkillsLocation() {
+        return getSkillsPath();
+    }
+    matchesQuery(skill, queryLower) {
+        return (skill.name.toLowerCase().includes(queryLower) ||
+            skill.description.toLowerCase().includes(queryLower) ||
+            (Array.isArray(skill.keywords) &&
+                skill.keywords.some((kw) => kw.toLowerCase().includes(queryLower))) ||
+            (Array.isArray(skill.tags) &&
+                skill.tags.some((t) => t.toLowerCase().includes(queryLower))) ||
+            (skill.category !== undefined && skill.category.toLowerCase().includes(queryLower)));
+    }
+}

package/dist/lib/logger.d.ts

@@ -0,0 +1,7 @@
+export declare const logger: {
+    info(msg: string): void;
+    success(msg: string): void;
+    warn(msg: string): void;
+    error(msg: string): void;
+};
+export declare function sanitiseError(error: unknown): string;

package/dist/lib/logger.js

@@ -0,0 +1,28 @@
+import chalk from 'chalk';
+import { homedir } from 'node:os';
+export const logger = {
+    info(msg) {
+        process.stdout.write(chalk.gray(msg) + '\n');
+    },
+    success(msg) {
+        process.stderr.write(chalk.green(`✓ ${msg}`) + '\n');
+    },
+    warn(msg) {
+        process.stderr.write(chalk.yellow(`⚠ ${msg}`) + '\n');
+    },
+    error(msg) {
+        process.stderr.write(chalk.red(`✗ ${msg}`) + '\n');
+    },
+};
+function redactHomePath(message) {
+    return message.replace(homedir(), '~');
+}
+export function sanitiseError(error) {
+    if (error instanceof Error) {
+        return redactHomePath(error.message);
+    }
+    if (typeof error === 'string') {
+        return redactHomePath(error);
+    }
+    return 'An unexpected error occurred';
+}

package/dist/lib/manifest.d.ts

@@ -0,0 +1,4 @@
+import type { GoodBoyManifest } from '../types/index.js';
+export declare function readManifest(filePath: string): Promise<unknown>;
+export declare function validateManifest(data: unknown): GoodBoyManifest;
+export declare function writeManifest(filePath: string, data: GoodBoyManifest): Promise<void>;

package/dist/lib/manifest.js

@@ -0,0 +1,86 @@
+import { createRequire } from 'node:module';
+import { statSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { Ajv } from 'ajv';
+import * as addFormatsPkg from 'ajv-formats';
+const addFormats = addFormatsPkg.default;
+const _require = createRequire(import.meta.url);
+const MAX_MANIFEST_BYTES = 512 * 1024; // 512 KB
+const MAX_NESTING_DEPTH = 10;
+let _validator = null;
+function getValidator() {
+    if (_validator)
+        return _validator;
+    const ajv = new Ajv({ strict: true, allErrors: true });
+    addFormats(ajv);
+    const schema = _require('@goodboyjs/schema/src/manifest.schema.json');
+    _validator = ajv.compile(schema);
+    return _validator;
+}
+// Heuristic nesting depth check: counts opening brackets/braces.
+// This is intentionally fast and runs before JSON.parse() to guard against
+// deeply nested payloads that could exhaust the stack. Brackets inside
+// string values inflate the count slightly but legitimate manifests are
+// well within the limit.
+function estimateNestingDepth(jsonString) {
+    let depth = 0;
+    let maxDepth = 0;
+    for (const ch of jsonString) {
+        if (ch === '{' || ch === '[') {
+            depth++;
+            if (depth > maxDepth)
+                maxDepth = depth;
+        }
+        else if (ch === '}' || ch === ']') {
+            depth--;
+        }
+    }
+    return maxDepth;
+}
+export async function readManifest(filePath) {
+    const resolved = resolve(filePath);
+    let size;
+    try {
+        size = statSync(resolved).size;
+    }
+    catch {
+        throw new Error(`manifest.json not found`);
+    }
+    if (size > MAX_MANIFEST_BYTES) {
+        throw new Error(`manifest.json exceeds the 512 KB size limit`);
+    }
+    let raw;
+    try {
+        raw = readFileSync(resolved, 'utf-8');
+    }
+    catch {
+        throw new Error(`Cannot read manifest.json: permission denied`);
+    }
+    if (estimateNestingDepth(raw) > MAX_NESTING_DEPTH) {
+        throw new Error(`Manifest structure is invalid: nesting depth exceeds maximum allowed (${MAX_NESTING_DEPTH})`);
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`manifest.json contains invalid JSON`);
+    }
+}
+export function validateManifest(data) {
+    const validate = getValidator();
+    if (!validate(data)) {
+        /* c8 ignore next 2 -- ajv always populates errors[] after a failed validate(); ?? fallbacks are unreachable */
+        const lines = (validate.errors ?? []).map((e) => `  ${e.instancePath || '(root)'}: ${e.message ?? 'validation failed'}`);
+        throw new Error(`Invalid manifest:\n${lines.join('\n')}`);
+    }
+    return data;
+}
+export async function writeManifest(filePath, data) {
+    const resolved = resolve(filePath);
+    try {
+        writeFileSync(resolved, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+    }
+    catch {
+        throw new Error(`Cannot write manifest.json: check directory permissions`);
+    }
+}

package/dist/lib/registry-adapter.d.ts

@@ -0,0 +1,56 @@
+import type { GoodBoyManifest } from '../types/index.js';
+import type { RegistryEntry } from './registry-entry.js';
+/**
+ * RegistryAdapter defines the contract between GoodBoy commands
+ * and any registry implementation.
+ *
+ * Phase 1: implemented by LocalRegistryAdapter (git-based)
+ * Phase 3: implemented by RemoteRegistryAdapter (@goodboyjs/registry-client)
+ *
+ * Commands must only import this interface — never a concrete adapter.
+ * This ensures the Phase 3 swap requires zero changes to command code.
+ */
+export interface RegistryAdapter {
+    /**
+     * Resolve a skill by name and return its filesystem path.
+     * Throws if the skill is not found or name is invalid.
+     */
+    resolveSkill(name: string): Promise<string>;
+    /**
+     * Return manifests for all installed skills.
+     * Skips silently any skill with a missing or invalid manifest.
+     */
+    listInstalled(): Promise<GoodBoyManifest[]>;
+    /**
+     * Search available skills by query string.
+     * Matches against name, description, and keywords.
+     * Case insensitive.
+     */
+    search(query: string): Promise<GoodBoyManifest[]>;
+    /**
+     * Return the resolved registry path or remote base URL.
+     * Used for display and diagnostic purposes only.
+     * May throw if GOODBOY_REGISTRY is set but invalid.
+     */
+    getRegistryLocation(): string;
+    /**
+     * Return the resolved skills installation path.
+     * Used for display and diagnostic purposes only.
+     */
+    getSkillsLocation(): string;
+    /**
+     * Return all entries in the local registry.
+     * Returns [] if the registry does not exist or cannot be read.
+     */
+    listRegistry(): Promise<RegistryEntry[]>;
+}
+/**
+ * Returns the appropriate RegistryAdapter for the current phase.
+ *
+ * Phase 1: always returns LocalRegistryAdapter.
+ * Phase 3: will inspect config or environment to decide between
+ * LocalRegistryAdapter and RemoteRegistryAdapter.
+ *
+ * Commands must use this factory — never instantiate adapters directly.
+ */
+export declare function createRegistryAdapter(): RegistryAdapter;

package/dist/lib/registry-adapter.js

@@ -0,0 +1,15 @@
+import { LocalRegistryAdapter } from './local-registry-adapter.js';
+/**
+ * Returns the appropriate RegistryAdapter for the current phase.
+ *
+ * Phase 1: always returns LocalRegistryAdapter.
+ * Phase 3: will inspect config or environment to decide between
+ * LocalRegistryAdapter and RemoteRegistryAdapter.
+ *
+ * Commands must use this factory — never instantiate adapters directly.
+ */
+export function createRegistryAdapter() {
+    // Phase 1: local registry only
+    // Phase 3: return RemoteRegistryAdapter when GOODBOY_REGISTRY_URL is set
+    return new LocalRegistryAdapter();
+}

package/dist/lib/registry-entry.d.ts

@@ -0,0 +1,16 @@
+export interface RegistryVersionEntry {
+    path: string;
+    addedAt: string;
+    yanked: boolean;
+}
+export interface RegistryEntry {
+    name: string;
+    latest: string;
+    versions: Record<string, RegistryVersionEntry>;
+}
+export declare function readRegistryEntry(skillDir: string): Promise<RegistryEntry | null>;
+export declare function writeRegistryEntry(skillDir: string, entry: RegistryEntry): Promise<void>;
+export declare function createRegistryEntry(skillName: string, version: string, versionPath: string): RegistryEntry;
+export declare function addVersionToEntry(entry: RegistryEntry, version: string, versionPath: string): RegistryEntry;
+export declare function resolveLatestVersion(entry: RegistryEntry): string | null;
+export declare function resolveVersionPath(entry: RegistryEntry, version: string, registrySkillDir: string): string;

package/dist/lib/registry-entry.js

@@ -0,0 +1,74 @@
+/**
+ * Internal module — registry-entry.json read/write and version resolution.
+ * @internal
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const ENTRY_FILE = 'registry-entry.json';
+export async function readRegistryEntry(skillDir) {
+    const entryPath = join(skillDir, ENTRY_FILE);
+    try {
+        const raw = await readFile(entryPath, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+export async function writeRegistryEntry(skillDir, entry) {
+    const entryPath = join(skillDir, ENTRY_FILE);
+    await writeFile(entryPath, JSON.stringify(entry, null, 2) + '\n', 'utf-8');
+}
+export function createRegistryEntry(skillName, version, versionPath) {
+    return {
+        name: skillName,
+        latest: version,
+        versions: {
+            [version]: {
+                path: versionPath,
+                addedAt: new Date().toISOString(),
+                yanked: false,
+            },
+        },
+    };
+}
+export function addVersionToEntry(entry, version, versionPath) {
+    return {
+        ...entry,
+        latest: version,
+        versions: {
+            ...entry.versions,
+            [version]: {
+                path: versionPath,
+                addedAt: new Date().toISOString(),
+                yanked: false,
+            },
+        },
+    };
+}
+export function resolveLatestVersion(entry) {
+    const versions = Object.keys(entry.versions).sort((a, b) => {
+        const [aMaj = 0, aMin = 0, aPat = 0] = a.split('.').map(Number);
+        const [bMaj = 0, bMin = 0, bPat = 0] = b.split('.').map(Number);
+        /* c8 ignore next — equal versions are unreachable (Record keys are unique) */
+        return (bMaj - aMaj) || (bMin - aMin) || (bPat - aPat);
+    });
+    for (const ver of versions) {
+        if (!entry.versions[ver].yanked)
+            return ver;
+    }
+    return null;
+}
+export function resolveVersionPath(entry, version, registrySkillDir) {
+    const versionEntry = entry.versions[version];
+    if (!versionEntry) {
+        throw new Error(`Version "${version}" not found in registry entry for "${entry.name}"`);
+    }
+    const { path: vp } = versionEntry;
+    if (vp.startsWith('https://') || vp.startsWith('http://')) {
+        return vp;
+    }
+    return join(registrySkillDir, vp);
+}

package/dist/lib/registry.d.ts

@@ -0,0 +1,8 @@
+import type { RegistryEntry } from './registry-entry.js';
+import type { GoodBoyManifest } from '../types/index.js';
+export declare function getRegistryPath(): string;
+export declare function getSkillsPath(): string;
+export declare function ensureRegistryExists(): void;
+export declare function resolveSkill(name: string, version?: string): Promise<string>;
+export declare function listRegistry(): Promise<RegistryEntry[]>;
+export declare function listInstalled(): Promise<GoodBoyManifest[]>;

package/dist/lib/registry.js

@@ -0,0 +1,114 @@
+/**
+ * Internal module — do not import directly from command files.
+ * Use RegistryAdapter via createRegistryAdapter() instead.
+ * @internal
+ */
+import { existsSync, mkdirSync, readdirSync } from 'node:fs';
+import { join, resolve, isAbsolute, sep } from 'node:path';
+import { homedir } from 'node:os';
+import { readManifest, validateManifest } from './manifest.js';
+import { readRegistryEntry, resolveLatestVersion, resolveVersionPath, } from './registry-entry.js';
+import { logger } from './logger.js';
+import { SKILL_NAME_RE } from './validation.js';
+export function getRegistryPath() {
+    const env = process.env['GOODBOY_REGISTRY'];
+    if (env !== undefined && env.length > 0) {
+        // Reject traversal sequences before any filesystem call
+        if (env.includes('..')) {
+            throw new Error(`GOODBOY_REGISTRY must not contain path traversal sequences`);
+        }
+        if (!isAbsolute(env)) {
+            throw new Error(`GOODBOY_REGISTRY must be an absolute path`);
+        }
+        if (!existsSync(env)) {
+            logger.warn(`GOODBOY_REGISTRY path does not exist: "${env}". Falling back to default.`);
+            return join(homedir(), '.goodboy', 'registry');
+        }
+        return resolve(env);
+    }
+    return join(homedir(), '.goodboy', 'registry');
+}
+export function getSkillsPath() {
+    return join(homedir(), '.goodboy', 'skills');
+}
+export function ensureRegistryExists() {
+    const registryPath = getRegistryPath();
+    if (!existsSync(registryPath)) {
+        mkdirSync(registryPath, { recursive: true, mode: 0o700 });
+    }
+}
+export async function resolveSkill(name, version) {
+    // Normalize to detect URL-encoded traversal (e.g. ..%2F) and null bytes
+    // before any filesystem operation.
+    const nullStripped = name.replace(/\0/g, '');
+    let decoded;
+    try {
+        decoded = decodeURIComponent(nullStripped);
+    }
+    catch {
+        decoded = nullStripped;
+    }
+    const normalized = decoded.trim();
+    if (normalized !== name) {
+        throw new Error(`Skill name contains invalid characters`);
+    }
+    if (!SKILL_NAME_RE.test(name)) {
+        throw new Error(`Invalid skill name "${name}": must match ^[a-z0-9-]+$`);
+    }
+    const registryPath = getRegistryPath();
+    const skillDir = resolve(join(registryPath, name));
+    // Traversal guard: resolved path must be directly inside the registry dir.
+    const expectedPrefix = registryPath + sep;
+    /* c8 ignore next 3 — defense-in-depth: SKILL_NAME_RE blocks all traversal chars, this is unreachable through the public API */
+    if (!skillDir.startsWith(expectedPrefix) || !resolve(skillDir).startsWith(expectedPrefix)) {
+        throw new Error(`Refused: resolved skill path escapes the registry directory`);
+    }
+    const entry = await readRegistryEntry(skillDir);
+    if (!entry) {
+        throw new Error(`Skill "${name}" not found in registry`);
+    }
+    const resolvedVersion = version ?? resolveLatestVersion(entry);
+    if (!resolvedVersion) {
+        throw new Error(`Skill "${name}" has no available versions`);
+    }
+    return resolveVersionPath(entry, resolvedVersion, skillDir);
+}
+export async function listRegistry() {
+    const registryPath = getRegistryPath();
+    if (!existsSync(registryPath))
+        return [];
+    const dirEntries = readdirSync(registryPath, { withFileTypes: true });
+    const results = [];
+    for (const dirEntry of dirEntries) {
+        if (!dirEntry.isDirectory())
+            continue;
+        const skillDir = join(registryPath, dirEntry.name);
+        const entry = await readRegistryEntry(skillDir);
+        if (entry)
+            results.push(entry);
+    }
+    return results;
+}
+export async function listInstalled() {
+    const skillsPath = getSkillsPath();
+    if (!existsSync(skillsPath)) {
+        // 0o700: skills are user-private, no group/world read
+        mkdirSync(skillsPath, { recursive: true, mode: 0o700 });
+        return [];
+    }
+    const entries = readdirSync(skillsPath, { withFileTypes: true });
+    const manifests = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const manifestPath = join(skillsPath, entry.name, 'manifest.json');
+        try {
+            const data = await readManifest(manifestPath);
+            manifests.push(validateManifest(data));
+        }
+        catch (err) {
+            logger.warn(`Skipping "${entry.name}": ${err instanceof Error ? err.message : 'invalid manifest'}`);
+        }
+    }
+    return manifests;
+}

package/dist/lib/skill-validator.d.ts

@@ -0,0 +1,11 @@
+export type ValidationSeverity = 'error' | 'warning';
+export interface ValidationIssue {
+    severity: ValidationSeverity;
+    message: string;
+}
+export interface ValidationResult {
+    valid: boolean;
+    issues: ValidationIssue[];
+}
+export declare function validateSkillDirectory(skillPath: string): Promise<ValidationResult>;
+export declare function formatValidationResult(result: ValidationResult, skillName: string): void;

package/dist/lib/skill-validator.js

@@ -0,0 +1,122 @@
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { readManifest, validateManifest } from './manifest.js';
+import { logger } from './logger.js';
+function parseFrontmatter(content) {
+    const lines = content.split('\n');
+    if (lines[0]?.trim() !== '---') {
+        return { hasDelimiters: false, hasClosingDelimiter: false, body: content };
+    }
+    const closeIdx = lines.findIndex((l, i) => i > 0 && l.trim() === '---');
+    if (closeIdx === -1) {
+        return { hasDelimiters: true, hasClosingDelimiter: false, body: '' };
+    }
+    const frontmatterLines = lines.slice(1, closeIdx);
+    const body = lines.slice(closeIdx + 1).join('\n').trim();
+    const result = {};
+    for (const line of frontmatterLines) {
+        const colonIdx = line.indexOf(':');
+        if (colonIdx === -1)
+            continue;
+        const key = line.slice(0, colonIdx).trim();
+        const value = line.slice(colonIdx + 1).trim().replace(/^["']|["']$/g, '');
+        if (key === 'name')
+            result.name = value;
+        if (key === 'description')
+            result.description = value;
+    }
+    return { ...result, hasDelimiters: true, hasClosingDelimiter: true, body };
+}
+export async function validateSkillDirectory(skillPath) {
+    const issues = [];
+    // --- manifest.json checks ---
+    const manifestPath = join(skillPath, 'manifest.json');
+    let manifest = null;
+    if (!existsSync(manifestPath)) {
+        issues.push({ severity: 'error', message: 'manifest.json not found' });
+    }
+    else {
+        try {
+            const raw = await readManifest(manifestPath);
+            try {
+                manifest = validateManifest(raw);
+            }
+            catch (err) {
+                /* c8 ignore next */
+                const msg = err instanceof Error ? err.message : String(err);
+                issues.push({ severity: 'error', message: `manifest.json fails schema validation: ${msg}` });
+            }
+        }
+        catch (err) {
+            /* c8 ignore next */
+            const msg = err instanceof Error ? err.message : String(err);
+            issues.push({ severity: 'error', message: `manifest.json is not valid JSON: ${msg}` });
+        }
+    }
+    // manifest field warnings (only if manifest was valid)
+    if (manifest) {
+        if (manifest.description.length < 20) {
+            issues.push({ severity: 'warning', message: 'manifest description is very short (< 20 characters)' });
+        }
+        if (!manifest.keywords || manifest.keywords.length === 0) {
+            issues.push({ severity: 'warning', message: 'manifest has no keywords' });
+        }
+        if (!manifest.category) {
+            issues.push({ severity: 'warning', message: 'manifest has no category' });
+        }
+        if (!manifest.tags || manifest.tags.length === 0) {
+            issues.push({ severity: 'warning', message: 'manifest has no tags' });
+        }
+    }
+    // --- SKILL.md checks ---
+    const skillMdPath = join(skillPath, 'SKILL.md');
+    if (!existsSync(skillMdPath)) {
+        issues.push({ severity: 'error', message: 'SKILL.md not found' });
+    }
+    else {
+        const content = await readFile(skillMdPath, 'utf-8');
+        const fm = parseFrontmatter(content);
+        if (!fm.hasDelimiters) {
+            issues.push({ severity: 'error', message: 'SKILL.md has no frontmatter (missing opening --- delimiter)' });
+        }
+        else if (!fm.hasClosingDelimiter) {
+            issues.push({ severity: 'error', message: 'SKILL.md frontmatter is not closed (missing closing --- delimiter)' });
+        }
+        else {
+            if (!fm.name) {
+                issues.push({ severity: 'error', message: 'SKILL.md frontmatter is missing the name field' });
+            }
+            if (!fm.description) {
+                issues.push({ severity: 'error', message: 'SKILL.md frontmatter is missing the description field' });
+            }
+            if (manifest && fm.name && fm.name !== manifest.name) {
+                issues.push({
+                    severity: 'error',
+                    message: `SKILL.md frontmatter name "${fm.name}" does not match manifest.json name "${manifest.name}"`,
+                });
+            }
+            if (fm.body.length < 50) {
+                issues.push({ severity: 'warning', message: 'SKILL.md body is empty or very short (< 50 characters)' });
+            }
+        }
+    }
+    const valid = issues.every((i) => i.severity !== 'error');
+    return { valid, issues };
+}
+export function formatValidationResult(result, skillName) {
+    const errors = result.issues.filter((i) => i.severity === 'error');
+    const warnings = result.issues.filter((i) => i.severity === 'warning');
+    if (errors.length > 0) {
+        logger.error(`Validation errors for "${skillName}":`);
+        for (const issue of errors) {
+            logger.error(`  • ${issue.message}`);
+        }
+    }
+    if (warnings.length > 0) {
+        logger.warn(`Validation warnings for "${skillName}":`);
+        for (const issue of warnings) {
+            logger.warn(`  • ${issue.message}`);
+        }
+    }
+}

package/dist/lib/store.d.ts

@@ -0,0 +1,13 @@
+export declare function getGoodboyHome(): string;
+export declare function getStorePath(): string;
+export declare function ensureStoreExists(): void;
+/**
+ * Copy a skill from `sourcePath` into the store.
+ * Returns the absolute path of the installed store entry.
+ */
+export declare function installToStore(skillName: string, sourcePath: string): Promise<string>;
+/**
+ * Remove a skill from the store.
+ * No-op if the skill is not present.
+ */
+export declare function removeFromStore(skillName: string): void;