@klhapp/skillmux 1.11.2 → 1.13.0

package/src/commands/update.ts

@@ -1,277 +0,0 @@
-import { rmSync } from "node:fs";
-import { join } from "node:path";
-import { expandHome, loadConfig } from "../config";
-import {
-  assertHostAllowed,
-  cloneToTemp,
-  installIntoVault,
-  isLocalFileUrl,
-  remoteHeadCommit,
-  resolveCloneCommit,
-  resolveSkillDir,
-  validateSkillCandidate,
-} from "../install";
-import { emitSuccess } from "../output";
-import { hashSkillContent, readSkillOrigin, writeSkillOrigin } from "../provenance";
-import type { SkillOrigin } from "../provenance";
-import {
-  FAIL_ON_USAGE,
-  parseFailOn,
-  resolveMutatingFailOn,
-  scanExitCode,
-  type FailOnOption,
-  type ScanFinding,
-  type ScanSeverity,
-} from "../scan";
-import { SKILL_ID_PATTERN } from "../vault";
-import { confirmIfNeeded } from "./shared";
-import { checkOutdated } from "./outdated";
-import { isGlobalFlag } from "../global-flags";
-
-type UpdateKind = "update" | "up_to_date" | "skip_drift" | "skip_scan_failed" | "skip_read_error";
-
-interface UpdatePlanItem {
-  skillId: string;
-  oldCommit: string;
-  newCommit: string;
-  contentChanged: boolean;
-  kind: UpdateKind;
-  findings?: ScanFinding[];
-  reason?: string;
-  cloneDir: string | null;
-  fetchedDir: string | null;
-  origin: SkillOrigin;
-}
-
-async function resolveCandidateOrigins(
-  vaultPath: string,
-  skillId: string | undefined,
-  allowLocalSource: boolean,
-  allowedHosts: string[] | undefined,
-): Promise<{ skillId: string; origin: SkillOrigin }[]> {
-  if (skillId) {
-    // skillId (the CLI's positional <skill-id>) is joined straight into vaultPath
-    // below, and that join ultimately reaches installIntoVault's rmSync(recursive)
-    // + cpSync on the write path — a "../"-shaped value escapes the vault and lets
-    // `skillmux update` delete and overwrite an arbitrary directory on disk. Batch
-    // mode never hits this because checkOutdated only enumerates real vault entries
-    // (already SKILL_ID_PATTERN-filtered); the explicit single-skill path is the
-    // only one that takes this string directly from argv, so validate it here.
-    if (!SKILL_ID_PATTERN.test(skillId)) {
-      throw new Error(`invalid skill id "${skillId}": expected lowercase letters, digits, and hyphens only`);
-    }
-    let origin: SkillOrigin | null;
-    try {
-      origin = readSkillOrigin(join(vaultPath, skillId));
-    } catch (error) {
-      throw new Error(
-        `"${skillId}" has a corrupt .skillmux-origin sidecar: ${error instanceof Error ? error.message : String(error)}`,
-      );
-    }
-    if (!origin) {
-      throw new Error(`"${skillId}" has no origin recorded — was this skill installed via "skillmux install"?`);
-    }
-    if (!allowLocalSource && isLocalFileUrl(origin.source_url)) {
-      throw new Error(`"${skillId}" has a local (file://) source — pass --allow-local-source to update it`);
-    }
-    return [{ skillId, origin }];
-  }
-  const outdated = await checkOutdated(vaultPath, { allowLocalSource, allowedHosts });
-  return outdated
-    .filter((result) => result.status === "outdated")
-    .map((result) => ({ skillId: result.skill_id, origin: readSkillOrigin(join(vaultPath, result.skill_id))! }));
-}
-
-async function buildPlan(
-  vaultPath: string,
-  candidates: { skillId: string; origin: SkillOrigin }[],
-  failOn: ScanSeverity | undefined,
-  force: boolean,
-  allowedHosts: string[] | undefined,
-): Promise<UpdatePlanItem[]> {
-  const plan: UpdatePlanItem[] = [];
-  for (const { skillId, origin } of candidates) {
-    const skillDir = join(vaultPath, skillId);
-    let currentHash: string;
-    try {
-      currentHash = hashSkillContent(skillDir);
-    } catch (error) {
-      // A skill whose on-disk content can't be safely read (e.g. SKILL.md was
-      // swapped for a symlink after install — same threat model as AC7's drift
-      // check) is this skill's problem alone, matching checkOutdated's per-skill
-      // isolation: never let it abort the batch for every other candidate.
-      plan.push({
-        skillId,
-        oldCommit: origin.commit,
-        newCommit: origin.commit,
-        contentChanged: false,
-        kind: "skip_read_error",
-        reason: error instanceof Error ? error.message : String(error),
-        cloneDir: null,
-        fetchedDir: null,
-        origin,
-      });
-      continue;
-    }
-
-    // Drift is a purely local comparison — check it before fetching anything,
-    // so a drifted (and therefore skipped) skill never pays for a clone.
-    if (currentHash !== origin.content_hash && !force) {
-      plan.push({
-        skillId,
-        oldCommit: origin.commit,
-        newCommit: await remoteHeadCommit(origin.source_url),
-        contentChanged: false,
-        kind: "skip_drift",
-        cloneDir: null,
-        fetchedDir: null,
-        origin,
-      });
-      continue;
-    }
-
-    assertHostAllowed(origin.source_url, allowedHosts);
-    const cloneDir = await cloneToTemp(origin.source_url);
-    const resolved = resolveSkillDir(cloneDir, skillId, origin.skill_path);
-    const base = {
-      skillId,
-      oldCommit: origin.commit,
-      newCommit: resolveCloneCommit(cloneDir),
-      cloneDir,
-      fetchedDir: resolved.dir,
-      origin,
-    };
-
-    const { findings } = await validateSkillCandidate(skillId, resolved.dir);
-    if (scanExitCode(findings, failOn) !== 0) {
-      plan.push({ ...base, contentChanged: false, kind: "skip_scan_failed", findings });
-      continue;
-    }
-
-    const contentChanged = hashSkillContent(resolved.dir) !== currentHash;
-    plan.push({
-      ...base,
-      contentChanged,
-      kind: base.newCommit === origin.commit && !contentChanged ? "up_to_date" : "update",
-    });
-  }
-  return plan;
-}
-
-export function buildConfirmPrompt(toWrite: Pick<UpdatePlanItem, "skillId" | "origin">[]): string {
-  const lines = toWrite.map((item) => `  ${item.skillId} <- ${item.origin.source_url}`);
-  return `update:\n${lines.join("\n")}\n?`;
-}
-
-function statusFor(kind: UpdateKind, dryRun: boolean): string {
-  switch (kind) {
-    case "update":
-      return dryRun ? "would_update" : "updated";
-    case "skip_drift":
-      return dryRun ? "would_skip_drift" : "skipped_drift";
-    case "skip_scan_failed":
-      return dryRun ? "would_skip_scan_failed" : "skipped_scan_failed";
-    case "skip_read_error":
-      return "skipped_read_error";
-    default:
-      return "up_to_date";
-  }
-}
-
-function parseUpdateArgs(args: string[]): {
-  skillId?: string;
-  yes: boolean;
-  dryRun: boolean;
-  force: boolean;
-  failOn?: FailOnOption;
-  allowLocalSource: boolean;
-} {
-  let skillId: string | undefined;
-  let yes = false;
-  let dryRun = false;
-  let force = false;
-  let failOn: FailOnOption | undefined;
-  let allowLocalSource = false;
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === "--yes") yes = true;
-    else if (arg === "--dry-run") dryRun = true;
-    else if (arg === "--force") force = true;
-    else if (arg === "--allow-local-source") allowLocalSource = true;
-    else if (arg === "--fail-on") {
-      failOn = parseFailOn(args[++i]);
-    } else if (isGlobalFlag(arg, "--json")) {
-      // handled globally
-    } else if (arg?.startsWith("--")) {
-      throw new Error(`unknown update option: ${arg}`);
-    } else if (skillId !== undefined) {
-      throw new Error("skillmux update accepts at most one <skill-id> argument");
-    } else {
-      skillId = arg;
-    }
-  }
-  return { skillId, yes, dryRun, force, failOn, allowLocalSource };
-}
-
-export async function runUpdate(args: string[], options: { isJson: boolean }): Promise<void> {
-  const { skillId, yes, dryRun, force, failOn, allowLocalSource } = parseUpdateArgs(args);
-  const config = await loadConfig();
-  const vaultPath = expandHome(config.vault_path);
-
-  const candidates = await resolveCandidateOrigins(vaultPath, skillId, allowLocalSource, config.egress?.allowed_hosts);
-  // Same default as install: block on a high-severity finding unless the
-  // caller explicitly opts out with --fail-on none.
-  const effectiveFailOn = resolveMutatingFailOn(failOn);
-  const plan = await buildPlan(vaultPath, candidates, effectiveFailOn, force, config.egress?.allowed_hosts);
-  try {
-    const toWrite = plan.filter((item) => item.kind === "update");
-
-    if (!dryRun && toWrite.length > 0) {
-      const proceed = await confirmIfNeeded({
-        confirmed: yes,
-        isJson: options.isJson,
-        prompt: buildConfirmPrompt(toWrite),
-        nonInteractiveError: "skillmux update requires --yes when run non-interactively",
-      });
-      if (!proceed) return;
-
-      for (const item of toWrite) {
-        // toWrite is filtered to kind === "update", which is only ever set after
-        // a successful clone above, so fetchedDir is always populated here.
-        const targetDir = installIntoVault(vaultPath, item.skillId, item.fetchedDir as string, true);
-        writeSkillOrigin(targetDir, {
-          source_url: item.origin.source_url,
-          skill_path: item.origin.skill_path,
-          commit: item.newCommit,
-          installed_at: new Date().toISOString(),
-          content_hash: hashSkillContent(targetDir),
-        });
-      }
-    }
-
-    const skills = plan.map((item) => ({
-      skill_id: item.skillId,
-      source_url: item.origin.source_url,
-      old_commit: item.oldCommit,
-      new_commit: item.newCommit,
-      content_changed: item.contentChanged,
-      status: statusFor(item.kind, dryRun),
-      ...(item.findings ? { findings: item.findings } : {}),
-      ...(item.reason ? { reason: item.reason } : {}),
-    }));
-
-    emitSuccess({ isJson: options.isJson }, { dry_run: dryRun, skills }, () => {
-      if (skills.length === 0) {
-        console.log("update: nothing to do");
-        return;
-      }
-      for (const s of skills) {
-        console.log(`[${s.status}] ${s.skill_id}`);
-      }
-    });
-  } finally {
-    for (const item of plan) {
-      if (item.cloneDir) rmSync(item.cloneDir, { recursive: true, force: true });
-    }
-  }
-}

package/src/completions.ts

@@ -1,196 +0,0 @@
-import { MANAGED_PINS_AGENT_IDS, SUPPORTED_AGENT_IDS } from "./init-agents";
-
-export type ShellType = "bash" | "zsh" | "fish";
-
-const TOP_LEVEL_COMMANDS: { name: string; description: string }[] = [
-  { name: "context", description: "Manage connection contexts" },
-  { name: "config", description: "Manage configuration" },
-  { name: "serve", description: "Start MCP server" },
-  { name: "index", description: "Rebuild local search index" },
-  { name: "sync", description: "Synchronize vault skills" },
-  { name: "init", description: "Configure this machine and its agents" },
-  { name: "project", description: "Configure project-scoped skills" },
-  { name: "target", description: "Manage advanced skill-delivery targets" },
-  { name: "core", description: "Pin/unpin skills into [core]" },
-  { name: "report", description: "Generate usage stats" },
-  { name: "scan", description: "Audit skills for issues" },
-  { name: "install", description: "Install skills into vault" },
-  { name: "eval", description: "Evaluate search accuracy" },
-  { name: "doctor", description: "Check runtime health" },
-  { name: "skill", description: "Show which root resolves a skill_id" },
-  { name: "local-vault", description: "Manage local_vault_paths discoverability markers" },
-  { name: "models", description: "Manage local models" },
-  { name: "completions", description: "Generate shell completions" },
-];
-
-export function generateCompletions(shell: ShellType): string {
-  if (shell === "bash") {
-    const opts = [...TOP_LEVEL_COMMANDS.map((c) => c.name), "--context", "--server", "--json", "--allow-insecure", "--verbose", "--dry-run", "--help"].join(" ");
-    return `# bash completion for skillmux
-_skillmux_completions() {
-    local cur prev opts
-    COMPREPLY=()
-    cur="\${COMP_WORDS[COMP_CWORD]}"
-    prev="\${COMP_WORDS[COMP_CWORD-1]}"
-    opts="${opts}"
-
-    if [ "$COMP_CWORD" -eq 1 ]; then
-        COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
-        return 0
-    fi
-
-    case "$prev" in
-        context)
-            COMPREPLY=( $(compgen -W "add list current use remove" -- "$cur") )
-            ;;
-        config)
-            COMPREPLY=( $(compgen -W "init show get validate diff set status" -- "$cur") )
-            ;;
-        completions)
-            COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") )
-            ;;
-        core)
-            COMPREPLY=( $(compgen -W "pin unpin" -- "$cur") )
-            ;;
-        skill)
-            COMPREPLY=( $(compgen -W "which" -- "$cur") )
-            ;;
-        project)
-            COMPREPLY=( $(compgen -W "init list show add-path remove-path pin unpin attach detach" -- "$cur") )
-            ;;
-        target)
-            COMPREPLY=( $(compgen -W "list show add remove" -- "$cur") )
-            ;;
-        local-vault)
-            COMPREPLY=( $(compgen -W "init" -- "$cur") )
-            ;;
-        eval)
-            COMPREPLY=( $(compgen -W "promote" -- "$cur") )
-            ;;
-        --agent)
-            if [ "\${COMP_WORDS[1]}" = "project" ]; then
-                COMPREPLY=( $(compgen -W "${MANAGED_PINS_AGENT_IDS.join(" ")}" -- "$cur") )
-            else
-                COMPREPLY=( $(compgen -W "${SUPPORTED_AGENT_IDS.join(" ")}" -- "$cur") )
-            fi
-            ;;
-    esac
-    if [ "\${COMP_WORDS[1]}" = "init" ] && [ "\${#COMPREPLY[@]}" -eq 0 ]; then
-        COMPREPLY=( $(compgen -W "--agent --vault --core --migrate-full-vault --show-mcp-setup --register-mcp --no-instructions --no-sync --interactive --yes --dry-run --json" -- "$cur") )
-    fi
-    if [ "\${COMP_WORDS[1]}" = "project" ] && [ "\${COMP_WORDS[2]}" = "init" ]; then
-        COMPREPLY=( $(compgen -W "--name --skill --agent --target --register-mcp --no-sync --interactive --yes --dry-run --json" -- "$cur") )
-    fi
-    if [ "\${COMP_WORDS[1]}" = "eval" ] && [ "\${COMP_WORDS[2]}" = "promote" ]; then
-        COMPREPLY=( $(compgen -W "--since --out --dry-run --yes --json" -- "$cur") )
-    fi
-}
-complete -F _skillmux_completions skillmux
-`;
-  }
-
-  if (shell === "zsh") {
-    const commands = TOP_LEVEL_COMMANDS.map((c) => `        '${c.name}:${c.description}'`).join("\n");
-    return `#compdef skillmux
-_skillmux() {
-    local -a commands
-    commands=(
-${commands}
-    )
-    if (( CURRENT == 2 )); then
-        _describe -t commands 'skillmux command' commands
-    elif [[ "$words[2]" == "init" ]]; then
-        _arguments \\
-          '*--agent[select an agent]:agent:(${SUPPORTED_AGENT_IDS.join(" ")})' \\
-          '--vault[vault directory]:directory:_directories' \\
-          '*--core[seed a core skill]:skill id:' \\
-          '--migrate-full-vault[convert a full-vault symlink to managed pins]' \\
-          '--show-mcp-setup[also print the MCP registration snippet]' \\
-          '--register-mcp[register skillmux via the agent own CLI]' \\
-          '--no-instructions[skip managed instruction files]' \\
-          '--no-sync[save setup without synchronizing targets]' \\
-          '--interactive[force guided setup]' \\
-          '--yes[apply without prompts]' \\
-          '--dry-run[print the plan without writing]' \\
-          '--json[emit a JSON envelope]'
-    elif [[ "$words[2]" == "project" && "$words[3]" == "init" ]]; then
-        _arguments \\
-          '1:project directory:_directories' \\
-          '--name[project group name]:group:' \\
-          '*--skill[project skill]:skill id:' \\
-          '*--agent[select an agent]:agent:(${MANAGED_PINS_AGENT_IDS.join(" ")})' \\
-          '*--target[select an advanced target]:target:' \\
-          '--register-mcp[register a project-scoped MCP server for claude-code]' \\
-          '--no-sync[save setup without synchronizing targets]' \\
-          '--interactive[force guided setup]' \\
-          '--yes[apply without prompts]' \\
-          '--dry-run[print the plan without writing]' \\
-          '--json[emit a JSON envelope]'
-    elif [[ "$words[2]" == "project" && CURRENT == 3 ]]; then
-        _values 'project command' init list show add-path remove-path pin unpin attach detach
-    elif [[ "$words[2]" == "eval" && "$words[3]" == "promote" ]]; then
-        _arguments \
-          '--since[time window]:window:' \
-          '--out[output file]:file:_files' \
-          '--dry-run[print the plan without writing]' \
-          '--yes[apply without prompts]' \
-          '--json[emit a JSON envelope]'
-    elif [[ "$words[2]" == "eval" && CURRENT == 3 ]]; then
-        _values 'eval command' promote
-    elif [[ "$words[2]" == "target" && CURRENT == 3 ]]; then
-        _values 'target command' list show add remove rehome migrate
-    elif [[ "$words[2]" == "skill" && CURRENT == 3 ]]; then
-        _values 'skill command' which
-    elif [[ "$words[2]" == "core" && CURRENT == 3 ]]; then
-        _values 'core command' pin unpin
-    elif [[ "$words[2]" == "local-vault" && CURRENT == 3 ]]; then
-        _values 'local-vault command' init
-    fi
-}
-_skillmux "$@"
-`;
-  }
-
-  if (shell === "fish") {
-    const topLevel = TOP_LEVEL_COMMANDS.map(
-      (c) => `complete -c skillmux -n "__fish_use_subcommand" -a ${c.name} -d "${c.description}"`,
-    ).join("\n");
-    return `# fish completion for skillmux
-complete -c skillmux -f
-${topLevel}
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l agent -x -a "${SUPPORTED_AGENT_IDS.join(" ")}" -d "Select an agent"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l vault -r -d "Vault directory"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l core -x -d "Seed a core skill"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l migrate-full-vault -d "Convert a full-vault symlink"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l show-mcp-setup -d "Also print the MCP registration snippet"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l register-mcp -d "Register skillmux via the agent's own CLI"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l no-instructions -d "Skip managed instruction files"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l no-sync -d "Save without synchronizing"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l interactive -d "Force guided setup"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l yes -d "Apply without prompts"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l dry-run -d "Print the plan without writing"
-complete -c skillmux -n "__fish_seen_subcommand_from init" -l json -d "Emit a JSON envelope"
-complete -c skillmux -n "__fish_seen_subcommand_from project" -a "init list show add-path remove-path pin unpin attach detach" -d "Manage projects"
-complete -c skillmux -n "__fish_seen_subcommand_from project" -l name -x -d "Project group name"
-complete -c skillmux -n "__fish_seen_subcommand_from project" -l skill -x -d "Project skill"
-complete -c skillmux -n "__fish_seen_subcommand_from project" -l agent -x -a "${MANAGED_PINS_AGENT_IDS.join(" ")}" -d "Select an agent"
-complete -c skillmux -n "__fish_seen_subcommand_from project" -l target -x -d "Select an advanced delivery target"
-complete -c skillmux -n "__fish_seen_subcommand_from project" -l register-mcp -d "Register a project-scoped MCP server for claude-code"
-complete -c skillmux -n "__fish_seen_subcommand_from project" -l no-sync -d "Save without synchronizing"
-complete -c skillmux -n "__fish_seen_subcommand_from project" -l interactive -d "Force guided setup"
-complete -c skillmux -n "__fish_seen_subcommand_from project" -l yes -d "Apply without prompts"
-complete -c skillmux -n "__fish_seen_subcommand_from eval" -a "promote" -d "Promote correlated fetches into eval cases"
-complete -c skillmux -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from promote" -l since -x -d "Time window"
-complete -c skillmux -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from promote" -l out -r -d "Output file"
-complete -c skillmux -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from promote" -l dry-run -d "Print the plan without writing"
-complete -c skillmux -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from promote" -l yes -d "Apply without prompts"
-complete -c skillmux -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from promote" -l json -d "Emit a JSON envelope"
-complete -c skillmux -n "__fish_seen_subcommand_from target" -a "list show add remove rehome migrate" -d "Manage targets"
-complete -c skillmux -n "__fish_seen_subcommand_from core" -a "pin unpin" -d "Manage [core] pins"
-complete -c skillmux -n "__fish_seen_subcommand_from skill" -a "which" -d "Show which root resolves a skill_id"
-complete -c skillmux -n "__fish_seen_subcommand_from local-vault" -a "init" -d "Initialize a local_vault_paths marker"
-`;
-  }
-
-  throw new Error(`Unsupported shell: ${shell}`);
-}

package/src/concurrency-limiter.ts

@@ -1,61 +0,0 @@
-export class ConcurrencyLimiter {
-  private inFlight = 0;
-
-  constructor(private readonly max: number) {}
-
-  tryAcquire(): boolean {
-    if (this.inFlight >= this.max) return false;
-    this.inFlight++;
-    return true;
-  }
-
-  release(): void {
-    this.inFlight = Math.max(0, this.inFlight - 1);
-  }
-}
-
-/**
- * Wraps a response body so `release` fires when the stream actually finishes
- * (fully drained or cancelled by a client disconnect) instead of as soon as
- * the Response object is constructed. For a buffered body this happens almost
- * immediately; for an open SSE stream it defers release until the connection
- * really closes, so a concurrency limiter reflects true connection lifetime.
- */
-export function releaseOnStreamClose(
-  body: ReadableStream<Uint8Array> | null,
-  release: () => void,
-): ReadableStream<Uint8Array> | null {
-  if (!body) {
-    release();
-    return null;
-  }
-
-  const reader = body.getReader();
-  let released = false;
-  const releaseOnce = () => {
-    if (released) return;
-    released = true;
-    release();
-  };
-
-  return new ReadableStream<Uint8Array>({
-    async pull(controller) {
-      try {
-        const { done, value } = await reader.read();
-        if (done) {
-          controller.close();
-          releaseOnce();
-          return;
-        }
-        controller.enqueue(value);
-      } catch (error) {
-        controller.error(error);
-        releaseOnce();
-      }
-    },
-    cancel(reason) {
-      releaseOnce();
-      return reader.cancel(reason);
-    },
-  });
-}