@hncode/hncode 0.6.5 → 0.6.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hncode/hncode",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "description": "hncode — A cyan-blue TUI AI coding agent with zero runtime dependencies.",
   "type": "module",
   "main": "src/index.js",

package/src/skills.js

@@ -21,7 +21,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-
+import { httpsRequest } from './tools/fetch-url.js';
 export const SKILL_PREFIX = 'skill:';
 
 // The skills directory. Kept next to the other hncode state (~/.hncode/…), and
@@ -45,7 +45,16 @@ export function normalizeSkillName(name) {
 // or malformed block (then body === text and meta is empty).
 export function parseFrontMatter(text) {
   const src = String(text == null ? '' : text);
-  const m = /^\uFEFF?---\r?\n([\s\S]*?)\r?\n---[ \t]*\r?\n?/.exec(src);
+  // A DELIMITER THAT WAS ESCAPED IS STILL A DELIMITER.
+  //
+  // `---\nname: x` is what a skill looks like when something wrote the block with the newlines escaped: the
+  // first and last delimiters carry a literal backslash-n while the fields between them use real newlines. The
+  // block then matched nothing and the skill listed as "(no description)" — the file reads correctly in an
+  // editor, so there was nothing to see. Only the two delimiters are unescaped; a body that contains `\n` on
+  // purpose is untouched, because the replacement stops at the first field.
+  const norm = src.replace(/^\uFEFF?---\\n(?=[A-Za-z0-9_-])/, '---\n')
+    .replace(/\\n---(\\n|$)/, '\n---$1');
+  const m = /^\uFEFF?---\r?\n([\s\S]*?)\r?\n---[ \t]*\r?\n?/.exec(norm);
   if (!m) return { meta: {}, body: src };
   const meta = {};
   for (const line of m[1].split(/\r?\n/)) {
@@ -171,6 +180,105 @@ export function skillCompletions(prefix = '') {
 
 // Build the text a skill contributes to the conversation. A short header keeps
 // the model from treating the body as the user's own words.
+// ---- installing from a GitHub repository ------------------------------------------------
+
+// A registry entry is `owner/repo`, optionally with a subdirectory: `owner/repo/skills`, or
+// `owner/repo@ref`. Skills are FOUND, not assumed: every `SKILL.md` below the given path is one,
+// because that is the layout the ecosystem uses — a folder per skill, each with its own file.
+//
+// The listing comes from the GitHub API, which needs no authentication for a public repository and
+// is rate limited per IP without a token. Fetching goes through the same transport as FetchURL so a
+// broken certificate chain on this network does not make the feature useless.
+const GH_API = 'https://api.github.com';
+
+/** Split `owner/repo[/sub][@ref]` into its parts, or null when the shape is wrong. */
+export function parseRepoSpec(spec) {
+  const text = String(spec == null ? '' : spec).trim().replace(/^https?:\/\/github\.com\//i, '');
+  if (!text) return null;
+  const at = text.lastIndexOf('@');
+  const ref = at > 0 ? text.slice(at + 1) : '';
+  const rest = at > 0 ? text.slice(0, at) : text;
+  const parts = rest.split('/').filter(Boolean);
+  if (parts.length < 2) return null;
+  const [owner, repo, ...sub] = parts;
+  return { owner, repo: repo.replace(/\.git$/i, ''), sub: sub.join('/'), ref: ref || '' };
+}
+
+async function ghJson(apiPath, insecure) {
+  const res = await httpsRequest(`${GH_API}${apiPath}`, undefined, insecure);
+  if (!res.ok) {
+    if (res.status === 404) return { error: `not found: ${apiPath}` };
+    if (res.status === 403) return { error: 'GitHub refused the request (rate limit without a token, or a private repository)' };
+    return { error: `GitHub returned ${res.status}` };
+  }
+  const buf = Buffer.from(await res.arrayBuffer());
+  try { return { data: JSON.parse(buf.toString('utf8')) }; } catch { return { error: 'GitHub returned something that is not JSON' }; }
+}
+
+/** Every `SKILL.md` at or below `path`, as { name, path }. */
+async function findSkillFiles(owner, repo, dirPath, ref, insecure, depth = 0) {
+  if (depth > 4) return [];
+  const q = ref ? `?ref=${encodeURIComponent(ref)}` : '';
+  const r = await ghJson(`/repos/${owner}/${repo}/contents/${dirPath}${q}`, insecure);
+  if (r.error) return { error: r.error };
+  const entries = Array.isArray(r.data) ? r.data : [];
+  const found = [];
+  for (const e of entries) {
+    if (e.type === 'file' && /^skill\.md$/i.test(e.name)) found.push({ name: e.name, path: e.path, url: e.download_url });
+  }
+  // A directory that holds a SKILL.md is a skill; do not descend into it looking for more, or a bundle of
+  // reference files beside one would be walked for nothing.
+  if (found.length) return found;
+  for (const e of entries) {
+    if (e.type !== 'dir') continue;
+    const sub = await findSkillFiles(owner, repo, e.path, ref, insecure, depth + 1);
+    if (sub && sub.error) continue;
+    found.push(...sub);
+  }
+  return found;
+}
+
+/**
+ * Install every skill in a GitHub repository (or a subdirectory of one).
+ *
+ * Returns { ok: true, installed: [{ name, path, replaced }], skipped: [name] } or { ok: false, error }.
+ * A name that is already present is REPLACED — the same rule `/import-skill` uses.
+ */
+export async function installSkillFromGitHub(specText, { insecure = true } = {}) {
+  const spec = parseRepoSpec(specText);
+  if (!spec) return { ok: false, error: `Expected owner/repo[/subdir], got "${specText}"` };
+  const { owner, repo, sub, ref } = spec;
+
+  const files = await findSkillFiles(owner, repo, sub, ref, insecure);
+  if (files && files.error) return { ok: false, error: files.error };
+  if (!files.length) {
+    return { ok: false, error: `no SKILL.md found in ${owner}/${repo}${sub ? '/' + sub : ''}` };
+  }
+
+  const dir = skillsDir();
+  const installed = [];
+  const skipped = [];
+  for (const f of files) {
+    // The DIRECTORY name is the skill name — `skills/ds-explain/SKILL.md` is `ds-explain`. The front matter
+    // may say something else, but the folder is what the repository is organised by and what the user expects
+    // to type after `/skill:`.
+    const folder = f.path.split('/').slice(-2)[0] || repo;
+    const res = await httpsRequest(f.url, undefined, insecure);
+    if (!res.ok) { skipped.push(folder); continue; }
+    const text = Buffer.from(await res.arrayBuffer()).toString('utf8');
+    const name = normalizeSkillName(folder);
+    if (!name || /[\\/]/.test(name)) { skipped.push(folder); continue; }
+    const dest = path.join(dir, `${name}.md`);
+    const replaced = fs.existsSync(dest);
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(dest, text, 'utf8');
+      installed.push({ name, path: dest, replaced });
+    } catch { skipped.push(folder); }
+  }
+  return { ok: installed.length > 0, installed, skipped, error: installed.length ? '' : 'nothing could be downloaded' };
+}
+
 export function skillPrompt(skill) {
   if (!skill || !skill.body) return '';
   return `[skill: ${skill.name}]\n\n${skill.body}`;

package/src/tools/activate-skill.js

@@ -0,0 +1,76 @@
+/**
+ * The ActivateSkill tool: the model loads a skill by name.
+ *
+ * A skill is a stored procedure — a body of instructions for one kind of job (review a diff, debug a failure,
+ * design a UI). Until now the only way to run one was for the USER to type `/skill:<name>`, which means the model
+ * could not use a skill at all: it had no idea the directory existed.
+ *
+ * The system prompt now lists the names and descriptions, and this tool is the other half — the way to act on
+ * that list. It returns the BODY, which the model then follows in its own turn.
+ *
+ * WHY A TOOL AND NOT A SLASH COMMAND: a slash command is handled by the TUI before the model sees anything. This
+ * has to be callable mid-turn, in the middle of a multi-step job, when the model realises the remaining work is
+ * "review this" and a skill was written for exactly that.
+ */
+import { listSkills, readSkill, normalizeSkillName } from '../skills.js';
+
+export const spec = {
+  name: 'ActivateSkill',
+  description: [
+    'Load a skill — a stored procedure for a particular kind of work — and return its instructions.',
+    '',
+    'The available skills are listed in the system prompt under "# Skills", with a one-line description each.',
+    'Call this when one of them fits the job in front of you, then follow the returned instructions.',
+    '',
+    'The body is the skill\'s full text. It is NOT a summary: read it and do what it says.',
+    'Use `list` to see everything installed, including anything added since the prompt was built.',
+  ].join('\n'),
+  parameters: {
+    type: 'object',
+    properties: {
+      names: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'One or more skill names to load, as listed under "# Skills".',
+      },
+      list: {
+        type: 'boolean',
+        description: 'Return the installed skills with their descriptions instead of loading one.',
+      },
+    },
+  },
+  async execute(args) {
+    if (args && args.list) {
+      const all = listSkills();
+      if (!all.length) return 'No skills are installed. The user can add one with /import-skill.';
+      return all.map((s) => `- ${s.name}${s.description ? `: ${s.description}` : ''}`).join('\n');
+    }
+
+    const raw = args && args.names;
+    const wanted = (Array.isArray(raw) ? raw : (raw ? [raw] : []))
+      .map((n) => normalizeSkillName(n))
+      .filter(Boolean);
+    if (!wanted.length) {
+      const all = listSkills();
+      const names = all.map((s) => s.name).join(', ');
+      return `Error: name a skill to activate. Installed: ${names || '(none)'}`;
+    }
+
+    const out = [];
+    const missing = [];
+    for (const name of wanted) {
+      const skill = readSkill(name);
+      if (!skill) { missing.push(name); continue; }
+      // The header names the skill so a transcript with two of them stays readable; the body is verbatim.
+      out.push(`[skill: ${skill.name}]\n\n${skill.body}`);
+    }
+
+    if (!out.length) {
+      const all = listSkills();
+      return `Error: no skill named ${missing.join(', ')}. Installed: ${all.map((s) => s.name).join(', ') || '(none)'}`;
+    }
+    // A partial miss is worth saying: silently loading one of two would leave the job half-instructed.
+    if (missing.length) out.push(`(not installed: ${missing.join(', ')})`);
+    return out.join('\n\n---\n\n');
+  },
+};

package/src/tools/fetch-url.js

@@ -76,7 +76,7 @@ const RETRY_AFTER_MS = 1500;
  * `node:https` instead. It is the SAME request — same headers, same redirects, same body cap — just built
  * by hand so `rejectUnauthorized: false` can be passed.
  */
-async function fetchWithRetry(url, signal, insecure = false) {
+export async function fetchWithRetry(url, signal, insecure = false) {
   if (insecure) return httpsRequest(url, signal, true);
   const first = await fetch(url, { signal, redirect: 'follow', headers: HEADERS });
   if (first.status !== 429) return first;
@@ -93,7 +93,7 @@ async function fetchWithRetry(url, signal, insecure = false) {
  * buffered up to MAX_BYTES and handed back as an object with `.ok`, `.status`, `.headers.get()` and
  * `.arrayBuffer()`, so the rest of `execute` does not know which transport ran.
  */
-function httpsRequest(url, signal, insecure) {
+export function httpsRequest(url, signal, insecure) {
   return new Promise((resolve, reject) => {
     let u;
     try { u = new URL(url); } catch (e) { reject(e); return; }

package/src/tools/index.js

@@ -23,6 +23,7 @@ import { spec as notebookSpec } from './notebook.js';
 import { spec as diagnosticsSpec } from './diagnostics.js';
 import * as memoryMod from './memory.js';
 import * as goalMod from './goal.js';
+import * as activateSkillMod from './activate-skill.js';
 import { pluginTools, pluginToolGeneration } from '../plugin.js';
 
 
@@ -57,6 +58,7 @@ const builtinTools = [
   diagnosticsSpec,
   memoryMod.spec,
   goalMod.spec,
+  activateSkillMod.spec,
   ...TEAM_TOOL_SPECS,
 ];
 

package/src/tui.js

@@ -103,7 +103,7 @@ import { renderTaskOutputViewer, handleViewerKey, makeViewerState } from './task
 import { renderSwarmProgress } from './swarm-progress.js';
 import { sortedTasks, getTask, settleTask, STATUS_LABEL, backgroundTaskCard } from './agent-task.js';
 import { localVersion } from './version.js';
-import { listSkills, readSkill, importSkill, deleteSkill, skillPrompt, skillCompletions, normalizeSkillName, SKILL_PREFIX, skillsDir } from './skills.js';
+import { listSkills, readSkill, importSkill, installSkillFromGitHub, deleteSkill, skillPrompt, skillCompletions, normalizeSkillName, SKILL_PREFIX, skillsDir } from './skills.js';
 import { loadHooks, describeHooks, runShellHooks, HOOK_EVENTS } from './hooks.js';
 import { beginTurn, rewind as rewindFiles, describeRewind, listCheckpoints, restoreCheckpoint, describeCheckpoints, checkpointDelta } from './file-history.js';
 import { trimToolResults } from './tool-result.js';
@@ -258,7 +258,7 @@ export const COMMANDS = [
   { name: 'reload-config', desc: 'Reload config.toml settings only', priority: 60 },
   { name: 'plugins', desc: 'Open the plugin manager (installed + available in the repo)', priority: 60, argumentHint: '[install <name> | remove <name> | reload]' },
   { name: 'skills', desc: 'Open the skill manager (installed + available in the repo)', priority: 60, argumentHint: '[install <name> | remove <name>]' },
-  { name: 'import-skill', desc: 'Import a Markdown file as a skill (a duplicate name is overwritten)', priority: 60, argumentHint: '<file.md> [name]' },
+  { name: 'import-skill', desc: 'Add a skill from a Markdown file, or install every skill in a GitHub repository (owner/repo)', cooldown: false },
   { name: 'hooks', desc: 'Show configured shell hooks, or test one', priority: 60, argumentHint: '[list | test <event>]' },
   { name: 'git', desc: 'Show repository status (branch, changes, remote)', priority: 62 },
   { name: 'commit', desc: 'Stage and commit with a message (or let the agent draft one)', priority: 62, argumentHint: '[message]' },
@@ -10545,7 +10545,7 @@ export async function dispatch(cmdRaw, arg, state, cfg, session, h, submit, stdo
         ...panel,
         'Skills',
         `  /${SKILL_PREFIX}<name>     run an installed skill (Tab completes the name)`,
-        '  /import-skill <file.md>  add or overwrite a skill from a Markdown file',
+    '  /import-skill <file.md | owner/repo>  add a skill from a file, or install a repository of them',
         '  /skills                  open the skill manager (Tab switches tabs)',
         '  /skills install <name>   download one from the repo, without the panel',
         '  /skills remove <name>    delete the local copy',
@@ -12519,12 +12519,30 @@ export async function dispatch(cmdRaw, arg, state, cfg, session, h, submit, stdo
       return;
     }
     case 'import-skill': {
-      // Usage: /import-skill <file.md> [name]
+      // Usage: /import-skill <file.md | owner/repo[/sub]> [name]
       const parts = raw.split(/\s+/).filter(Boolean);
-      const file = parts[0];
+      const source = parts[0];
       const nameArg = parts[1];
-      if (!file) { appErr('Usage: /import-skill <file.md> [name]'); return; }
-      const res = importSkill(file, nameArg);
+      if (!source) { appErr('Usage: /import-skill <file.md | owner/repo[/subdir]> [name]'); return; }
+    
+      // A repository spec has no extension and carries a slash — a local Markdown path always ends in .md, and a
+      // path that does not is not something this command ever accepted.
+      const looksLikeRepo = !/\.md$/i.test(source) && /^[\w.-]+\/[\w.-]+/.test(source);
+      if (looksLikeRepo) {
+        say(`Installing skills from ${source}…`);
+        renderFrame();
+        void installSkillFromGitHub(source).then((res) => {
+          if (!res.ok) { appErr(`Install failed: ${res.error}`); renderFrame(); return; }
+          const names = res.installed.map((s) => s.name);
+          app(`Installed ${names.length} skill(s): ${names.join(', ')}`);
+          if (res.skipped.length) notice(`Skipped: ${res.skipped.join(', ')}`, 'error');
+          say(`Activate one with /skill:<name>, or type /skills to list them.`);
+          renderFrame();
+        }).catch((e) => { appErr(`Install failed: ${(e && e.message) || e}`); renderFrame(); });
+        return;
+      }
+    
+      const res = importSkill(source, nameArg);
       if (!res.ok) { appErr(res.error); return; }
       app(`${res.replaced ? 'Skill overwritten' : 'Skill imported'}: ${res.name} → ${res.path}`);
       say(`Activate it with /${SKILL_PREFIX}${res.name}`);
@@ -12938,12 +12956,15 @@ export async function dispatch(cmdRaw, arg, state, cfg, session, h, submit, stdo
         // and the model saw it as a detached system note rather than as their words.
         const extra = String(raw || '').trim();
         const prompt = skillPrompt(sk) + (extra ? `\n\n${extra}` : '');
-        // The row is a SKILL ACTIVATION card, not a user bubble and not the literal
-        // `/skill:foo` text (which read as the user having typed a command). The body
-        // rides a system message so it never renders as the user's own speech — the
-        // distinction kimi draws, and the reason this row exists at all.
+        // THE CARD says which skill ran; the USER MESSAGE is what the person typed, if anything.
+        //
+        // The args used to travel twice: once as `bubbleText`, which drew a bubble identical to the composer below the
+        // card, and once appended to the hidden body. Passing them as the prompt is what makes them the user's words —
+        // and when there are none, nothing is drawn but the card.
         addChat({ role: 'skill', text: name, args: extra, _conv: true });
-        await sendPrompt('/' + SKILL_PREFIX + name, { skillBody: prompt, bubbleText: extra });
+        // `submit` drops an empty prompt, so an activation with no args needs something to send. The body itself
+        // is what does the work; this line is only what makes the turn happen.
+        await sendPrompt(extra || `Run the ${name} skill.`, { skillBody: prompt });
         return;
       }
       // Check if this is a plugin-registered command.
@@ -13857,6 +13878,29 @@ async function runTurn(deps, text, opts = {}, viewArg) {
     if (memory) {
       sysText += '\n\n' + memory;
     }
+
+    // THE SKILLS ON DISK, BY NAME AND DESCRIPTION.
+    //
+    // Without this the model has no way to know a skill exists: the directory is invisible to it, so a skill that
+    // fits the task went unused unless the user remembered the name. Names and descriptions only — the bodies are
+    // read from disk when activated, and putting every body in every request would defeat the point of a skill.
+    //
+    // Read per turn, like the memory notes above, so installing one takes effect on the next message.
+    const availableSkills = listSkills().filter((s) => s.name);
+    if (availableSkills.length) {
+      const listed = availableSkills
+        .map((s) => `- ${s.name}${s.description ? `: ${s.description}` : ''}`)
+        .join('\n');
+      sysText += '\n\n' + [
+        '# Skills',
+        '',
+        'Reusable procedures installed for this machine. Each is invoked by name and then supplies its own',
+        'instructions. Use the ActivateSkill tool when one fits the work in front of you; the user can also call',
+        'them directly with /skill:<name>.',
+        '',
+        listed,
+      ].join('\n');
+    }
     // OUTPUT STYLE (/output-style): a form-of-reply instruction read from a file,
     // re-read per turn like the notes above so editing the file takes effect on the
     // next request. Placed AFTER the preferences and memory but BEFORE AGENTS.md: