@neta-art/neta-search-cli 0.2.20 → 0.2.26

package/README.md

@@ -10,6 +10,7 @@ npx -y @neta-art/neta-search-cli@latest skills add  <id>                 # insta
 npx -y @neta-art/neta-search-cli@latest skills list                      # what's in .agents/skills/, and which installed ones have updates
 npx -y @neta-art/neta-search-cli@latest skills update                    # update installed skills to their current release (or name some: handle, id or directory)
 npx -y @neta-art/neta-search-cli@latest skills init <name>               # scaffold your own skill
+npx -y @neta-art/neta-search-cli@latest skills submit <name>             # submit .agents/skills/<name>/ to the hub and wait for the result
 ```
 
 `<id>` is what `find` prints: a handle such as `neta-skills/holo-pack-opening` or `cohub/agent-browser`. Skills without a handle are listed as `cohub:<spaceId>/<name>`, which works everywhere a handle does. `update` and `remove` also accept the directory name under `.agents/skills/`.
@@ -22,6 +23,8 @@ Each `find --json` item carries a ready-to-run `use` command (`skills use <id> -
 
 Use `@latest` (or an exact version): with a range such as `@0.2`, npx keeps running whatever matching version it cached earlier and never checks for a newer one.
 
+`submit` works inside a Cohub sandbox only: it checks the directory locally (frontmatter, size, symlinks), sends this version to the hub under your name, and waits for the result: collected (with its digest) or why not. Submitting is not publishing: a version is offered to others only after it passes review. To keep a skill to yourself, add `share: false` to its frontmatter.
+
 Inside a Cohub sandbox the CLI picks up the sandbox identity automatically; elsewhere it runs anonymously.
 
 Single file, no runtime dependencies. Node.js 20+.

package/neta-search.mjs

@@ -4210,8 +4210,8 @@ var require_util = __commonJS({
             iterator = iterable[Symbol.asyncIterator]();
           },
           async pull(controller) {
-            const { done, value } = await iterator.next();
-            if (done) {
+            const { done: done2, value } = await iterator.next();
+            if (done2) {
               queueMicrotask(() => {
                 controller.close();
               });
@@ -7158,8 +7158,8 @@ var require_util2 = __commonJS({
       const bytes = [];
       let byteLength = 0;
       while (true) {
-        const { done, value: chunk } = await reader.read();
-        if (done) {
+        const { done: done2, value: chunk } = await reader.read();
+        if (done2) {
           return Buffer.concat(bytes, byteLength);
         }
         if (!isUint8Array(chunk)) {
@@ -7402,8 +7402,8 @@ var require_webidl = __commonJS({
           });
         }
         while (true) {
-          const { done, value } = method.next();
-          if (done) {
+          const { done: done2, value } = method.next();
+          if (done2) {
             break;
           }
           seq.push(converter(value));
@@ -8395,8 +8395,8 @@ Content-Type: ${value.type || "application/octet-stream"}\r
             iterator = action(object)[Symbol.asyncIterator]();
           },
           async pull(controller) {
-            const { value, done } = await iterator.next();
-            if (done) {
+            const { value, done: done2 } = await iterator.next();
+            if (done2) {
               queueMicrotask(() => {
                 controller.close();
               });
@@ -16793,11 +16793,11 @@ var require_fetch = __commonJS({
           let bytes;
           let isFailure;
           try {
-            const { done, value } = await fetchParams.controller.next();
+            const { done: done2, value } = await fetchParams.controller.next();
             if (isAborted(fetchParams)) {
               break;
             }
-            bytes = done ? void 0 : value;
+            bytes = done2 ? void 0 : value;
           } catch (err) {
             if (fetchParams.controller.ended && !timingInfo.encodedBodySize) {
               bytes = void 0;
@@ -17394,14 +17394,14 @@ var require_util4 = __commonJS({
       (async () => {
         while (!fr[kAborted]) {
           try {
-            const { done, value } = await chunkPromise;
+            const { done: done2, value } = await chunkPromise;
             if (isFirstChunk && !fr[kAborted]) {
               queueMicrotask(() => {
                 fireAProgressEvent("loadstart", fr);
               });
             }
             isFirstChunk = false;
-            if (!done && types.isUint8Array(value)) {
+            if (!done2 && types.isUint8Array(value)) {
               bytes.push(value);
               if ((fr[kLastProgressEventFired] === void 0 || Date.now() - fr[kLastProgressEventFired] >= 50) && !fr[kAborted]) {
                 fr[kLastProgressEventFired] = Date.now();
@@ -17410,7 +17410,7 @@ var require_util4 = __commonJS({
                 });
               }
               chunkPromise = reader.read();
-            } else if (done) {
+            } else if (done2) {
               queueMicrotask(() => {
                 fr[kState] = "done";
                 try {
@@ -25148,16 +25148,16 @@ function transformConnectPostToGetRequest(request3, message, useBase64) {
 // cli/node_modules/@connectrpc/connect/dist/esm/protocol/run-call.js
 function runUnaryCall(opt) {
   const next = applyInterceptors(opt.next, opt.interceptors);
-  const [signal, abort, done] = setupSignal(opt);
+  const [signal, abort, done2] = setupSignal(opt);
   const req = Object.assign(Object.assign({}, opt.req), { message: normalize(opt.req.method.I, opt.req.message), signal });
   return next(req).then((res) => {
-    done();
+    done2();
     return res;
   }, abort);
 }
 function runStreamingCall(opt) {
   const next = applyInterceptors(opt.next, opt.interceptors);
-  const [signal, abort, done] = setupSignal(opt);
+  const [signal, abort, done2] = setupSignal(opt);
   const req = Object.assign(Object.assign({}, opt.req), { message: normalizeIterable(opt.req.method.I, opt.req.message), signal });
   let doneCalled = false;
   signal.addEventListener("abort", function() {
@@ -25179,7 +25179,7 @@ function runStreamingCall(opt) {
             return it.next().then((r) => {
               if (r.done == true) {
                 doneCalled = true;
-                done();
+                done2();
               }
               return r;
             }, abort);
@@ -25201,7 +25201,7 @@ function setupSignal(opt) {
       cleanup();
       return Promise.reject(e);
     },
-    function done() {
+    function done2() {
       cleanup();
       controller.abort();
     }
@@ -26957,9 +26957,12 @@ function eventContext(env, extra = {}) {
   return ctx;
 }
 async function reportSkillEvent(env, event, skillId, digest, skillName, extra = {}) {
-  if (env.anonymous) return false;
+  return await reportSkillEventDetail(env, event, skillId, digest, skillName, extra) !== "unreachable";
+}
+async function reportSkillEventDetail(env, event, skillId, digest, skillName, extra = {}) {
+  if (env.anonymous) return "unreachable";
   try {
-    await feedbackClient(env).reportSkillEvents({
+    const res = await feedbackClient(env).reportSkillEvents({
       events: [
         {
           event,
@@ -26973,10 +26976,10 @@ async function reportSkillEvent(env, event, skillId, digest, skillName, extra =
         }
       ]
     });
-    return true;
+    return res.accepted > 0 ? "accepted" : "dropped";
   } catch (e) {
     console.error(`Note: failed to report the ${event} event (this does not affect the ${event}): ${e instanceof Error ? e.message : e}`);
-    return false;
+    return "unreachable";
   }
 }
 
@@ -27084,15 +27087,18 @@ var TIMEOUT_MS = 6e4;
 var MAX_TRIES = 4;
 var ArchiveNotFound = class extends Error {
 };
-async function fetchArchive(env, id) {
-  const url = `${env.apiBase}${ARCHIVE_PATH}?id=${encodeURIComponent(id)}`;
+var DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+async function fetchArchive(env, id, pin) {
+  let url = `${env.apiBase}${ARCHIVE_PATH}?id=${encodeURIComponent(id)}`;
+  if (pin) url += `&digest=${encodeURIComponent(pin)}`;
   const res = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(TIMEOUT_MS) });
-  if (res.status === 404) throw new ArchiveNotFound(`${id} does not exist or has no released version`);
+  if (res.status === 404) throw new ArchiveNotFound(pin ? `version ${pin} of ${id} is not available` : `${id} does not exist or has no released version`);
   const location = res.headers.get("location");
   if (res.status < 300 || res.status >= 400 || !location) throw new Error(`failed to download ${id}: HTTP ${res.status}`);
   const digest = res.headers.get("x-skill-digest") ?? "";
   const name = res.headers.get("x-skill-name") ?? id.split("/").pop();
   if (!digest) throw new Error(`failed to download ${id}: the server did not return a version (x-skill-digest)`);
+  if (pin && digest !== pin) throw new Error(`failed to download ${id}: asked for version ${pin}, the server offered ${digest}`);
   const body = await download(new URL(location, url).toString(), id);
   const files = untarGz(body);
   const got = digestOf(new Map(files.map((f) => [f.path, f.data])));
@@ -27116,12 +27122,19 @@ async function archiveHead(env, id) {
 async function download(url, id) {
   for (let attempt = 1; ; attempt++) {
     const res = await fetch(url, { signal: AbortSignal.timeout(TIMEOUT_MS) });
-    if (res.status === 202 && attempt < MAX_TRIES) {
-      const body = await res.json().catch(() => ({}));
-      await new Promise((r) => setTimeout(r, Math.min(Math.max(body.retryAfterMs ?? 2e3, 250), 5e3)));
+    if ((res.status === 202 || res.status === 503) && attempt < MAX_TRIES) {
+      let wait = 2e3;
+      if (res.status === 202) {
+        const body = await res.json().catch(() => ({}));
+        wait = body.retryAfterMs ?? wait;
+      } else {
+        const sec = Number(res.headers.get("retry-after"));
+        if (Number.isFinite(sec) && sec > 0) wait = sec * 1e3;
+      }
+      await new Promise((r) => setTimeout(r, Math.min(Math.max(wait, 250), 5e3)));
       continue;
     }
-    if (!res.ok) throw new Error(`failed to download ${id}: registry returned HTTP ${res.status}`);
+    if (!res.ok) throw new Error(`failed to download ${id}: HTTP ${res.status}`);
     return Buffer.from(await res.arrayBuffer());
   }
 }
@@ -27247,7 +27260,12 @@ function writeSkill(target, files, source) {
   const trash = join2(dirname(target), `.trash-${target.split("/").pop()}-${process.pid}`);
   const hadOld = existsSync(target);
   if (hadOld) renameSync(target, trash);
-  renameSync(staging, target);
+  try {
+    renameSync(staging, target);
+  } catch (e) {
+    rmSync(staging, { recursive: true, force: true });
+    throw e;
+  }
   if (hadOld) rmSync(trash, { recursive: true, force: true });
 }
 var POINTER_RE = /^\s*neta-skill-id:\s*["']?(cohub:[^"'\s]+)["']?\s*$/m;
@@ -27277,14 +27295,15 @@ function sharedOptOut(dir) {
   }
 }
 function shareNotice(id, dir, draft, reported) {
+  const name = id.split("/").pop();
   if (draft) {
-    console.error(`Note: skills in the drafts directory are not shared. Move it to ${SKILLS_DIR}/ and others will be able to find and install it.`);
+    console.error(`Note: drafts are not sent to the hub. When it is ready, run neta-search skills add ${name} to move it to ${SKILLS_DIR}/, then neta-search skills submit ${name}.`);
   } else if (sharedOptOut(dir)) {
-    console.error(`Note: ${id} sets share: false, so it is not shared with others.`);
+    console.error(`Note: ${id} sets share: false, so it is not sent to the hub.`);
   } else if (!reported) {
-    console.error(`Note: could not reach the server this time, so ${id} is not shared yet; it will retry on the next use.`);
+    console.error(`Note: could not reach the server this time, so this version of ${id} was not sent to the hub; it will retry on the next use.`);
   } else {
-    console.error(`Note: the version you just used will be shared with others under your name once the server verifies it: ${id}. To opt out, add share: false to the SKILL.md frontmatter.`);
+    console.error(`Note: this version of ${id} was sent to the hub under your name. Others can use it only after it passes review; neta-search skills submit ${name} shows whether it was collected. To keep it to yourself, add share: false to the SKILL.md frontmatter.`);
   }
 }
 
@@ -27392,6 +27411,22 @@ async function cmdUse(idOrName, opts) {
   let notice = null;
   let found = null;
   let fetchId = parsed && !mine ? idOrName : null;
+  const pin = opts.digest?.trim().toLowerCase();
+  if (opts.digest !== void 0) {
+    if (!pin || !DIGEST_RE.test(pin)) {
+      console.error(`--digest must look like sha256:<64 hex characters>, got "${opts.digest}".`);
+      return 1;
+    }
+    if (!parsed) {
+      console.error(
+        resolved.unreachable ? `Cannot reach the server (${env.apiBase}), so handle "${input}" could not be resolved. Try again later.` : `--digest needs a handle or an id (cohub:<space>/<name>); "${input}" is neither.`
+      );
+      return 1;
+    }
+    const r = await pinnedFromCacheOrDownload(env, idOrName, pin);
+    if (!r) return 1;
+    return emit(env, r.found, r.handle ?? handle, name, { via, entry, viaPointer: false, notice: null, json: opts.json, pinned: true });
+  }
   const installed = join4(SKILLS_DIR, name);
   const draft = join4(DRAFTS_DIR, name);
   if (skillDirExists(installed)) {
@@ -27446,16 +27481,21 @@ async function cmdUse(idOrName, opts) {
     console.error(`Skill "${idOrName}" is not available locally. Run neta-search skills find "${name}" to get its id.`);
     return 1;
   }
+  return emit(env, found, handle, name, { via, entry, viaPointer, notice, json: opts.json, pinned: false });
+}
+async function emit(env, found, handle, name, o) {
+  const { via, entry, viaPointer, notice } = o;
   const useId = randomUUID();
   const extra = { use_id: useId, where: found.where };
   if (via) extra["via"] = via;
   if (entry) extra["entry"] = entry;
+  if (o.pinned) extra["pinned"] = "true";
   const digest = found.where === "mod" ? "" : found.digest ?? skillDirDigest(found.path);
   const reported = found.reportId ? await reportSkillEvent(env, "use", found.reportId, digest, name, extra) : false;
   const skillMd = readFileSync4(join4(found.path, "SKILL.md"), "utf8");
   const dir = resolve(found.path);
   const shown = handle ?? found.reportId ?? name;
-  if (opts.json) {
+  if (o.json) {
     console.log(
       JSON.stringify({
         skill: found.reportId ?? name,
@@ -27513,6 +27553,18 @@ function findInMounts(spaceId, name) {
   }
   return hits[0] ?? null;
 }
+function pinnedDir(spaceId, name, digest) {
+  return join4(FETCH_ROOT, spaceId, `${name}@${digest.slice("sha256:".length, "sha256:".length + 12)}`);
+}
+async function pinnedFromCacheOrDownload(env, fetchId, pin) {
+  const p = parseId(fetchId);
+  const dir = pinnedDir(p.spaceId, p.name, pin);
+  const have = skillDirExists(dir) ? readSource(dir) : null;
+  if (have && have.id === fetchId && have.digest === pin) {
+    return { found: { path: dir, where: "cache", reportId: have.id, digest: have.digest }, handle: have.handle };
+  }
+  return download2(env, fetchId, pin, dir);
+}
 async function fromCacheOrDownload(env, fetchId) {
   const p = parseId(fetchId);
   const cacheDir = join4(FETCH_ROOT, p.spaceId, p.name);
@@ -27536,16 +27588,34 @@ async function fromCacheOrDownload(env, fetchId) {
     if (head.handle && head.handle !== have.handle) writeSource(cacheDir, { ...have, handle: head.handle });
     return { found: { path: cacheDir, where: "cache", reportId: have.id, digest: have.digest }, handle: head.handle ?? have.handle };
   }
+  return download2(env, fetchId);
+}
+function sameVersion(dir, want) {
+  if (!skillDirExists(dir)) return false;
+  const have = readSource(dir);
+  return !!have && have.id === want.id && have.digest === want.digest;
+}
+async function download2(env, fetchId, pin, target) {
   try {
-    const a = await fetchArchive(env, fetchId);
+    const a = await fetchArchive(env, fetchId, pin);
     const skillMd = a.files.find((f) => f.path === "SKILL.md");
     if (skillMd && pointerTargetOf(skillMd.data.toString("utf8")) !== null) {
       console.error(`${fetchId} downloaded as another pointer; stopping here (pointers are followed only one level, to avoid loops).`);
       return null;
     }
     const q = parseId(a.id);
-    const path = join4(FETCH_ROOT, q.spaceId, q.name);
-    writeSkill(path, a.files, { id: a.id, digest: a.digest, handle: a.handle });
+    const path = target ?? join4(FETCH_ROOT, q.spaceId, q.name);
+    const record = { id: a.id, digest: a.digest, handle: a.handle };
+    if (target) {
+      if (sameVersion(path, record)) return { found: { path, where: "fetched", reportId: a.id, digest: a.digest }, handle: a.handle };
+      try {
+        writeSkill(path, a.files, record);
+      } catch (e) {
+        if (!sameVersion(path, record)) throw e;
+      }
+      return { found: { path, where: "fetched", reportId: a.id, digest: a.digest }, handle: a.handle };
+    }
+    writeSkill(path, a.files, record);
     return { found: { path, where: "fetched", reportId: a.id, digest: a.digest }, handle: a.handle };
   } catch (e) {
     console.error(e instanceof ArchiveNotFound ? `${e.message}.` : String(e instanceof Error ? e.message : e));
@@ -27578,9 +27648,10 @@ async function cmdInit(name, opts) {
   console.log(`
 Next steps:`);
   console.log(`  1. Edit SKILL.md. Make the description say when to use this skill; agents decide by it, and search matches on it.`);
-  console.log(`  2. Try it: neta-search skills use ${slug} (drafts work directly and are not shared)`);
-  console.log(`  3. When it is ready: neta-search skills add ${slug} moves it to .agents/skills/; versions you use from there are shared with others`);
-  console.log(`     (under your name; to opt out, add share: false to the frontmatter)`);
+  console.log(`  2. Try it: neta-search skills use ${slug} (drafts work directly and are not sent to the hub)`);
+  console.log(`  3. When it is ready: neta-search skills add ${slug} moves it to .agents/skills/`);
+  console.log(`  4. Submit it: neta-search skills submit ${slug} sends this version to the hub and tells you whether it was collected.`);
+  console.log(`     Others can use it only after it passes review. To keep it to yourself, add share: false to the frontmatter.`);
   return 0;
 }
 function template(slug) {
@@ -27589,7 +27660,7 @@ name: ${slug}
 description: One sentence on when to use this skill (what a user would search for). Search matches on this field.
 metadata:
   neta-scope: universal  # character|world|image|video|audio|text|universal
-  # neta-tags: []        # optional: your own tags (the server adds coarse tags too)
+  # neta-tags: []        # optional: your own tags
 # disable-model-invocation: true  # optional: hide from the agent's skill list; only runs when named explicitly or via use
 ---
 
@@ -27605,15 +27676,197 @@ metadata:
 `;
 }
 
-// cli/src/skills/manage.ts
-import { existsSync as existsSync5, readdirSync as readdirSync3, rmSync as rmSync2 } from "node:fs";
+// cli/src/skills/submit.ts
+import { existsSync as existsSync5, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "node:fs";
 import { join as join6 } from "node:path";
+var SUBMISSION_PATH = "/v1/skills/submission";
+var MAX_FILES = 1e3;
+var MAX_FILE_BYTES = 20 << 20;
+var MAX_TOTAL_BYTES = 100 << 20;
+function precheck(dir) {
+  const problems = [];
+  const md = join6(dir, "SKILL.md");
+  if (!existsSync5(md)) return ["there is no SKILL.md"];
+  const raw = readFileSync5(md, "utf8");
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
+  if (!fm) problems.push("SKILL.md has no frontmatter (it must start with --- and have name / description)");
+  else if (!/^description\s*:\s*\S/m.test(fm[1])) problems.push("the frontmatter has no description (agents decide when to use a skill by it)");
+  if (sharedOptOut(dir)) problems.push("SKILL.md sets share: false; remove it to submit");
+  const links = [];
+  const walk = (rel) => {
+    for (const ent of readdirSync3(join6(dir, rel), { withFileTypes: true })) {
+      const childRel = rel ? `${rel}/${ent.name}` : ent.name;
+      const st = lstatSync2(join6(dir, childRel));
+      if (st.isSymbolicLink()) links.push(childRel);
+      else if (st.isDirectory() && !skipSegment(ent.name, true)) walk(childRel);
+    }
+  };
+  walk("");
+  if (links.length) problems.push(`symbolic links are not accepted: ${links.slice(0, 5).join(", ")}${links.length > 5 ? ` (+${links.length - 5} more)` : ""}`);
+  const files = readSkillFiles(dir);
+  if (files.size > MAX_FILES) problems.push(`too many files: ${files.size} (at most ${MAX_FILES})`);
+  let total = 0;
+  for (const [p, b] of files) {
+    total += b.length;
+    if (b.length > MAX_FILE_BYTES) problems.push(`${p} is ${mb(b.length)} (at most ${mb(MAX_FILE_BYTES)} per file)`);
+  }
+  if (total > MAX_TOTAL_BYTES) problems.push(`the skill is ${mb(total)} in total (at most ${mb(MAX_TOTAL_BYTES)})`);
+  return problems;
+}
+var mb = (n) => `${(n / (1 << 20)).toFixed(1)} MB`;
+function blockLabel(reason) {
+  const head = reason.split(":")[0];
+  switch (head) {
+    case "draft":
+      return "it is in the drafts directory";
+    case "opt_out":
+      return "SKILL.md sets share: false";
+    case "pointer":
+      return "SKILL.md is a hub pointer, not a skill";
+    case "frontmatter":
+      return `the frontmatter is incomplete (${reason.slice(head.length + 1).trim()})`;
+    case "secret":
+      return `a file looks like it contains a secret (${reason.slice(head.length + 1).trim()}); remove it and submit again`;
+    default:
+      return reason;
+  }
+}
+async function fetchStatus(env, id, digest) {
+  const url = `${env.apiBase}${SUBMISSION_PATH}?id=${encodeURIComponent(id)}&digest=${encodeURIComponent(digest)}`;
+  const res = await fetch(url, { signal: AbortSignal.timeout(1e4) });
+  if (!res.ok) return { http: res.status };
+  return await res.json();
+}
+async function cmdSubmit(name, opts) {
+  const env = detectEnv();
+  if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(name)) {
+    console.error(`Skill names are kebab-case directory names under ${SKILLS_DIR}/ (e.g. brawl-creator), got "${name}".`);
+    return 2;
+  }
+  if (env.anonymous) {
+    console.error("submit only works inside a Cohub sandbox: it submits a skill from the space you are in.");
+    return 2;
+  }
+  const dir = join6(SKILLS_DIR, name);
+  if (!existsSync5(join6(dir, "SKILL.md"))) {
+    if (existsSync5(join6(DRAFTS_DIR, name, "SKILL.md"))) {
+      console.error(`${name} is still a draft (${DRAFTS_DIR}/${name}/). Drafts are not submitted; run neta-search skills add ${name} to move it to ${SKILLS_DIR}/ first.`);
+    } else {
+      console.error(`There is no skill at ${dir}/ (it needs a SKILL.md).`);
+    }
+    return 1;
+  }
+  const src = readSource(dir);
+  if (src) {
+    console.error(`${dir}/ was installed from ${src.handle ?? src.id}; only skills written in this space can be submitted.`);
+    return 1;
+  }
+  if (pointerTarget(dir)) {
+    console.error(`${dir}/SKILL.md is a hub pointer, not a skill; there is nothing to submit.`);
+    return 1;
+  }
+  const problems = precheck(dir);
+  if (problems.length) {
+    console.error(`Not submitted: ${dir}/ has problems the hub would reject:`);
+    for (const p of problems) console.error(`  - ${p}`);
+    return 1;
+  }
+  const files = readSkillFiles(dir);
+  const digest = digestOf(files);
+  const id = ownId(env, name);
+  const total = [...files.values()].reduce((a, b) => a + b.length, 0);
+  if (!opts.json) console.error(`Checked: ${files.size} files, ${mb(total)}. Submitting ${digest} ...`);
+  const sent = await reportSkillEventDetail(env, "use", id, digest, name, { via: "submit", where: "local" });
+  if (sent === "unreachable") {
+    console.error("Not submitted: could not reach the server. Try again in a moment.");
+    return 1;
+  }
+  if (sent === "dropped") {
+    console.error("Not submitted: the server received the request but did not record it (it may be over its daily limit or having trouble). Try again later.");
+    return 1;
+  }
+  const deadline = Date.now() + (opts.wait ?? 60) * 1e3;
+  const poll = opts.pollMs ?? 2e3;
+  let s;
+  let unknown = 0;
+  let toldWaiting = false;
+  for (; ; ) {
+    try {
+      s = await fetchStatus(env, id, digest);
+    } catch {
+      s = { http: 0 };
+    }
+    if ("http" in s) {
+      if (s.http === 404 || s.http === 403) {
+        return done(opts, { id, digest, state: "no_result" }, `Submitted ${digest}, but this server cannot report the result (older server, or not reachable from here). Whether it was collected is unknown.`, 4);
+      }
+    } else if (s.state === "unknown") {
+      if (++unknown >= 3) {
+        return done(
+          opts,
+          { id, digest, state: s.state },
+          `Not collected: when the server read ${dir}/ it was no longer this version (was it edited right after submitting?). Finish editing, then run neta-search skills submit ${name} again.`,
+          1
+        );
+      }
+    } else if (s.state !== "queued") {
+      return finish(opts, id, digest, name, s);
+    } else if (!toldWaiting && !opts.json) {
+      console.error(`Waiting for the server to collect it${s.reason ? ` (last attempt failed: ${s.reason}; it retries)` : ""} ...`);
+      toldWaiting = true;
+    }
+    if (Date.now() + poll > deadline) {
+      return done(
+        opts,
+        { id, digest, state: "queued" },
+        `Still waiting after ${opts.wait ?? 60}s: the server has not collected ${digest} yet. Run the same command again later; resubmitting the same version is safe.`,
+        3
+      );
+    }
+    await new Promise((r) => setTimeout(r, poll));
+  }
+}
+function finish(opts, id, digest, name, s) {
+  const base = { id, digest, state: s.state, handle: s.handle || void 0, gated: s.gated, released: s.released, reason: s.reason || void 0, duplicate_of: s.duplicate_of || void 0 };
+  switch (s.state) {
+    case "rejected":
+      return done(opts, base, `Not collected: ${s.reason ?? "the server rejected the directory"}. Fix it and submit again.`, 1);
+    case "blocked":
+      return done(opts, base, `Not collected: ${blockLabel(s.reason ?? "")}.`, 1);
+    case "superseded":
+      return done(opts, base, `A newer version of ${name} was submitted meanwhile; that one is being collected instead of ${digest}.`, 1);
+    default: {
+      const lines = [`Collected: ${s.handle || id} ${digest}`];
+      if (s.duplicate_of) {
+        lines.push(`Its content is identical to ${s.duplicate_of}, so the hub treats it as a copy of that skill; it will not be listed on its own.`);
+      } else if (s.released) {
+        lines.push("This version is already live.");
+      } else if (s.gated) {
+        lines.push("It is waiting for review: it goes live once the gate writes back pass for this version (publishing runs every 30 minutes). Until then the current live version, if any, stays.");
+      } else if (s.trusted) {
+        lines.push("It goes live at the next publish (every 30 minutes).");
+      } else {
+        lines.push("Skills from personal spaces are not offered to other people yet (that needs the review gate, which is not open yet). You can keep using it here.");
+      }
+      return done(opts, base, lines.join("\n"), 0);
+    }
+  }
+}
+function done(opts, json, text, code) {
+  if (opts.json) console.log(JSON.stringify(json));
+  else (code === 0 ? console.log : console.error)(text);
+  return code;
+}
+
+// cli/src/skills/manage.ts
+import { existsSync as existsSync6, readdirSync as readdirSync4, rmSync as rmSync2 } from "node:fs";
+import { join as join7 } from "node:path";
 function scanLocal(dir) {
-  if (!existsSync5(dir)) return [];
+  if (!existsSync6(dir)) return [];
   const out = [];
-  for (const e of readdirSync3(dir, { withFileTypes: true })) {
+  for (const e of readdirSync4(dir, { withFileTypes: true })) {
     if (!e.isDirectory() || e.name.startsWith(".")) continue;
-    const path = join6(dir, e.name);
+    const path = join7(dir, e.name);
     if (!skillDirExists(path)) continue;
     const src = readSource(path);
     if (src) {
@@ -27746,7 +27999,7 @@ async function cmdRemove(names, opts) {
   const local = scanLocal(opts.dir);
   const results = [];
   for (const n of names) {
-    const found = (await findLocal(env, local, n)).filter((s) => existsSync5(s.path));
+    const found = (await findLocal(env, local, n)).filter((s) => existsSync6(s.path));
     if (found.length === 0) results.push({ name: n, result: "not_found" });
     for (const s of found) {
       if (s.kind === "own" && !opts.force) {
@@ -27761,8 +28014,8 @@ async function cmdRemove(names, opts) {
   if (opts.json) console.log(JSON.stringify({ results }));
   else
     for (const r of results) {
-      if (r.result === "removed") console.log(`Removed ${join6(opts.dir, r.name)}`);
-      else if (r.result === "not_found") console.error(`${join6(opts.dir, r.name)} does not exist`);
+      if (r.result === "removed") console.log(`Removed ${join7(opts.dir, r.name)}`);
+      else if (r.result === "not_found") console.error(`${join7(opts.dir, r.name)} does not exist`);
       else console.error(`${r.name} is a skill you wrote yourself (no install source), so it was not removed. Add --force if you really want to delete it.`);
     }
   return failed > 0 ? 1 : 0;
@@ -27771,16 +28024,20 @@ async function cmdRemove(names, opts) {
 // cli/src/cli.ts
 var program2 = new Command();
 program2.name("neta-search").description("neta-search: search the Cohub skill ecosystem").version(cliVersion());
-var skills = program2.command("skills").description("skills: find / add / use / list / update / remove / init");
+var skills = program2.command("skills").description("skills: find / add / use / list / update / remove / init / submit");
 skills.command("find").description("search the ecosystem for skills").argument("<query>", "what you want to do (natural language or keywords)").option("-n, --limit <n>", "max results", "20").option("--json", "compact JSON output (for agents)").action(async (query, opts) => {
   await run(cmdFind(query, { limit: Number(opts.limit) || 20, json: opts.json }));
 });
 skills.command("add").description("install a skill: an id or handle from find downloads its current release; a name from your drafts moves it into .agents/skills/").argument("<id-or-name>", "skill id or handle from find (e.g. neta-skills/holo-pack-opening), or the name of one of your drafts").option("--dir <dir>", "install directory", ".agents/skills").option("--json", "compact JSON output (for agents)").action(async (idOrName, opts) => {
   await run(cmdAdd(idOrName, opts));
 });
-skills.command("use").description("use a skill without installing it: prints the full SKILL.md and the skill directory (local copy, mounted mod, cache, or download)").argument("<id-or-name>", "skill id, handle (e.g. neta-skills/holo-pack-opening), or local skill name").option("--json", "compact JSON output (for agents)").option("--via <channel>", "where this use came from, recorded in usage stats (site / board-menu / picker / find)").option("--entry <id>", "entry id (picker / menu entry), recorded in usage stats").action(async (idOrName, opts) => {
+skills.command("use").description("use a skill without installing it: prints the full SKILL.md and the skill directory (local copy, mounted mod, cache, or download)").argument("<id-or-name>", "skill id, handle (e.g. neta-skills/holo-pack-opening), or local skill name").option("--json", "compact JSON output (for agents)").option("--via <channel>", "where this use came from, recorded in usage stats (site / board-menu / skill-picker / find)").option("--entry <id>", "entry id (picker / menu entry), recorded in usage stats").addOption(new Option("--digest <sha256>", "use exactly this version (sha256:<hex>); needs a handle or id").hideHelp()).action(async (idOrName, opts) => {
   await run(cmdUse(idOrName, opts));
 });
+skills.command("submit").description("submit the current version of one of your skills (.agents/skills/<name>/ in this space) to the hub and wait for the result; it goes live for others only after review").argument("<name>", "skill directory name under .agents/skills/").option("--wait <seconds>", "how long to wait for the server's result", "60").option("--json", "compact JSON output (for agents)").action(async (name, opts) => {
+  const wait = Number(opts.wait);
+  await run(cmdSubmit(name, { json: !!opts.json, wait: Number.isFinite(wait) && wait >= 0 ? wait : 60 }));
+});
 skills.command("list").alias("ls").description("list local skills (installed / pointer / your own) and check installed ones for updates").option("--dir <dir>", "skills directory", ".agents/skills").option("--offline", "do not check for updates online").option("--json", "compact JSON output (for agents)").action(async (opts) => {
   await run(cmdList({ dir: opts.dir, offline: !!opts.offline, json: !!opts.json }));
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/neta-search-cli",
-  "version": "0.2.20",
+  "version": "0.2.26",
   "description": "neta-search CLI — find, try and install skills from the Cohub / Neta skill registry",
   "type": "module",
   "bin": {