@holt-os/holt 0.11.0 → 0.12.0

package/README.md

@@ -213,11 +213,13 @@ holt skill list                        list installed skills
 holt skill show <name>                 print a skill
 holt skill create <name> [--global]    scaffold a new skill
 holt skill search <query>              find skills in the registry
-holt skill add <src|name> [--global]   install from a git URL, path, or registry name
+holt skill add <src|name> [--global]   install from a git URL, git-url#subdir, path, or registry name
 holt skill publish [<name>]            prepare a skill for the registry (prints a PR entry)
 holt skill remove <name>               delete a skill
 ```
 
+A source may carry a `#<subdir>` suffix (split on the first `#`) that points at one skill folder inside a repo or path: `holt skill add https://github.com/holt-os/registry#skills/pm-prd`. The subdir is a path, relative to the source root, that contains a `SKILL.md`. This lets a single repo hold many skills (one monorepo), which is exactly how the community registry is laid out. The subdir is validated to stay inside the source (absolute paths and `..` traversal are refused), since a registry entry is remote-controlled. Without a `#`, behaviour is unchanged: Holt looks for a `SKILL.md` at the source root or in exactly one immediate subfolder.
+
 In chat, run one with `/skill <name> [your input]`. Available skills are also listed to the brain each turn, so it knows what it can be asked to follow.
 
 ### Built-in skills
@@ -256,7 +258,7 @@ The index is a JSON document:
 }
 ```
 
-`source` is anything `holt skill add` already accepts: a git URL (its `SKILL.md` may sit in one subfolder) or a local path. `tags` is optional. Only `name` and `source` are required per entry; malformed rows are skipped rather than failing the whole index.
+`source` is anything `holt skill add` already accepts: a git URL (its `SKILL.md` may sit in one subfolder), a local path, or either of those with a `#<subdir>` suffix pointing at one skill folder inside the repo. That last form lets one repo hold many skills, so the community registry can be a single monorepo (e.g. `"source": "https://github.com/holt-os/registry#skills/pm-prd"`). `tags` is optional. Only `name` and `source` are required per entry; malformed rows are skipped rather than failing the whole index.
 
 - **Find:** `holt skill search <query>` fetches the index and lists skills whose name, description, or tags match (case-insensitive substring, name matches first). An empty query lists everything. It prints name, author, description, and source.
 - **Install by name:** `holt skill add <name>` resolves the name in the registry to its `source`, then installs through the exact same clone/copy path as `holt skill add <url|path>`. A git URL or an existing local path is still installed directly, unchanged.

package/dist/cli.js

@@ -3702,7 +3702,7 @@ import {
   cpSync,
   mkdtempSync
 } from "fs";
-import { join as join12, resolve as resolve3 } from "path";
+import { join as join12, resolve as resolve3, sep, isAbsolute as isAbsolute3 } from "path";
 import { tmpdir } from "os";
 import { spawnSync as spawnSync2 } from "child_process";
 
@@ -3866,7 +3866,7 @@ function usage() {
     "  holt skill show <name>              print a skill",
     "  holt skill create <name> [--global] scaffold a new skill",
     "  holt skill search <query>           find skills in the registry",
-    "  holt skill add <src|name> [--global] install from a git URL, path, or registry name",
+    "  holt skill add <src|name> [--global] install from a git URL, git-url#subdir, path, or registry name",
     "  holt skill publish [<name>]         prepare a skill for the registry (prints a PR entry)",
     "  holt skill remove <name>            delete a skill",
     "",
@@ -3902,6 +3902,20 @@ var SKILL_TEMPLATE = (name) => [
 function isGitUrl(s) {
   return s.includes("://") || s.endsWith(".git") || s.startsWith("git@");
 }
+function splitSubpath(source) {
+  const i = source.indexOf("#");
+  if (i === -1) return { base: source, subpath: "" };
+  return { base: source.slice(0, i), subpath: source.slice(i + 1) };
+}
+function resolveSubpathDir(fetched, subpath) {
+  if (isAbsolute3(subpath)) return null;
+  const segments = subpath.split(/[\\/]/);
+  if (segments.some((s) => s === "..")) return null;
+  const target = resolve3(fetched, subpath);
+  const root = resolve3(fetched);
+  if (target !== root && !target.startsWith(root + sep)) return null;
+  return target;
+}
 function findSkillDir(root) {
   if (existsSync12(join12(root, "SKILL.md"))) return root;
   let subs = [];
@@ -3986,14 +4000,15 @@ function cmdCreate(name, global) {
   console.log(c.dim('  Edit it, then run it in chat with "/skill ' + clean + '".\n'));
 }
 function installFromSource(source, scope) {
+  const { base, subpath } = splitSubpath(source);
   let fetched = "";
   let tempDir = "";
   try {
-    if (isGitUrl(source)) {
+    if (isGitUrl(base)) {
       tempDir = mkdtempSync(join12(tmpdir(), "holt-skill-"));
       console.log(c.dim(`
-  Cloning ${source} ...`));
-      const res = spawnSync2("git", ["clone", "--depth", "1", source, tempDir], { stdio: "ignore" });
+  Cloning ${base} ...`));
+      const res = spawnSync2("git", ["clone", "--depth", "1", base, tempDir], { stdio: "ignore" });
       if (res.status !== 0) {
         console.error(c.red("  Clone failed. Check the URL and that git is installed.\n"));
         process.exitCode = 1;
@@ -4001,7 +4016,7 @@ function installFromSource(source, scope) {
       }
       fetched = tempDir;
     } else {
-      fetched = resolve3(source);
+      fetched = resolve3(base);
       if (!existsSync12(fetched)) {
         console.error(c.red(`
   No such path: ${fetched}
@@ -4010,9 +4025,31 @@ function installFromSource(source, scope) {
         return false;
       }
     }
-    const skillDir = findSkillDir(fetched);
+    let searchRoot = fetched;
+    if (subpath) {
+      const target = resolveSubpathDir(fetched, subpath);
+      if (!target) {
+        console.error(c.red(`
+  Refusing unsafe subpath "${subpath}": it must stay inside the source (no absolute or "..").
+`));
+        process.exitCode = 1;
+        return false;
+      }
+      if (!existsSync12(target) || !statSync5(target).isDirectory()) {
+        console.error(c.red(`
+  Subpath "${subpath}" does not exist in the source.
+`));
+        process.exitCode = 1;
+        return false;
+      }
+      searchRoot = target;
+    }
+    const skillDir = findSkillDir(searchRoot);
     if (!skillDir) {
-      console.error(c.red("\n  Could not find a SKILL.md at the source root or in a single subfolder.\n"));
+      const where = subpath ? `subpath "${subpath}"` : "the source root or in a single subfolder";
+      console.error(c.red(`
+  Could not find a SKILL.md at ${where}.
+`));
       process.exitCode = 1;
       return false;
     }
@@ -4056,11 +4093,12 @@ function installFromSource(source, scope) {
 }
 async function cmdAdd(source, global, refresh) {
   if (!source) {
-    console.log(c.dim("\n  Usage: holt skill add <git-url|path|name> [--global]\n"));
+    console.log(c.dim("\n  Usage: holt skill add <git-url|git-url#subdir|path|name> [--global]\n"));
     return;
   }
   const scope = global ? "global" : "workspace";
-  if (isGitUrl(source) || existsSync12(resolve3(source))) {
+  const { base } = splitSubpath(source);
+  if (isGitUrl(base) || existsSync12(resolve3(base))) {
     installFromSource(source, scope);
     return;
   }
@@ -5061,7 +5099,7 @@ function renderGraphHtml(graph2, meta) {
 
 // src/ingest.ts
 import { readdirSync as readdirSync4, readFileSync as readFileSync14, statSync as statSync6 } from "fs";
-import { join as join13, relative, sep, extname, dirname as dirname3, basename as basename2 } from "path";
+import { join as join13, relative, sep as sep2, extname, dirname as dirname3, basename as basename2 } from "path";
 var CODE_EXT = /* @__PURE__ */ new Set([
   "js",
   "jsx",
@@ -5112,7 +5150,7 @@ var MAX_FILES = 2e3;
 var MAX_FILE_BYTES = 400 * 1024;
 var MAX_TOTAL_BYTES = 64 * 1024 * 1024;
 function toPosix(p) {
-  return sep === "/" ? p : p.split(sep).join("/");
+  return sep2 === "/" ? p : p.split(sep2).join("/");
 }
 function ingestFolder(root, want = { code: true, docs: true }) {
   const files = [];
@@ -5815,7 +5853,7 @@ function holtTools() {
 }
 
 // src/version.ts
-var VERSION = "0.11.0";
+var VERSION = "0.12.0";
 
 // src/commands/mcp.ts
 function printSetup() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holt-os/holt",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "An open-source personal agent OS: any LLM, private memory you can see and walk.",
   "type": "module",
   "license": "MIT",