@newlandnpt/pep-cli 0.5.0 → 0.6.1

package/README.md

@@ -137,6 +137,44 @@ pep skills add group/sub/project -p    # move it into this project
 `pep skills list` prints each repository with the directory it lives in, which is what `-p` matches
 against.
 
+### Removing a repository
+
+```powershell
+pep skills remove group/sub/project
+```
+
+Deletes the skills that repository installed (in both the canonical directory and the linked one)
+and drops it from the list. It only removes what it installed itself — anything you put there by
+hand stays — and it needs no login, since nothing leaves the machine.
+
+### Two repositories, one skill name
+
+A skill's name is the folder name **inside** the repository, not the repository's own name. So two
+different repositories that each ship a `semi-integration/SKILL.md` both want
+`~/.agents/skills/semi-integration/`, and the second would silently overwrite the first.
+
+`add` refuses, and the error names the repository already there — it will not pick a winner for
+you. `update` never fails over it: the contested skill is left exactly as it is, everything else in
+that repository still refreshes, and the clash is reported every run until you `remove` one. That
+matters because a clash can appear **later**, when one repository adds a folder the other already
+has — you did nothing, and one upstream mistake must not stop every other repository from
+updating.
+
+```
+⚠ 3 repositories all install "semi-integration" here:
+    https://git.example.com/team-a/skill
+    https://git.example.com/team-b/skill-testing
+  They overwrite each other. `pep skills remove <repo>` keeps just one.
+```
+
+Installing them into **different** directories is fine — that is what `-p` is for.
+
+A contested skill stays frozen at whichever copy is on disk until you remove one of the claimants.
+That is deliberate: stable and loudly reported beats "whoever runs update last wins".
+
+`remove` leaves a shared skill's files on disk (which copy it is can no longer be told) and says
+so, rather than deleting what might be the other repository's content.
+
 ### Deleting a skill
 
 Delete a skill folder by hand and it **stays deleted**. `update` refreshes what is still on disk

package/dist/pep.cjs

@@ -1195,6 +1195,32 @@ function hashSkill(files) {
   }
   return hash.digest("hex").slice(0, 32);
 }
+async function removeSkills(name, store) {
+  const state = await store.read();
+  const pkg = state?.packages[name];
+  if (!state || !pkg) {
+    throw new Error(`Not added: ${name}. Run \`pep skills list\` to see what is.`);
+  }
+  const deleted = [];
+  const keptForOthers = [];
+  for (const skill of Object.keys(pkg.skills).sort()) {
+    const owner = Object.entries(state.packages).find(
+      ([other, one]) => other !== name && one.directory === pkg.directory && skill in one.skills
+    )?.[0];
+    if (owner !== void 0) {
+      keptForOthers.push({ skill, owner });
+      continue;
+    }
+    await (0, import_promises4.rm)((0, import_node_path4.join)(pkg.directory, skill), { recursive: true, force: true });
+    if (pkg.linkedInto !== void 0) {
+      await (0, import_promises4.rm)((0, import_node_path4.join)(pkg.linkedInto, skill), { recursive: true, force: true });
+    }
+    deleted.push(skill);
+  }
+  const { [name]: _dropped, ...rest } = state.packages;
+  await store.write({ version: 4, packages: rest });
+  return { name, deleted, keptForOthers, directory: pkg.directory };
+}
 function pickSkipped(previous, skipped) {
   return Object.fromEntries(
     skipped.map((skill) => [skill, previous?.skills[skill] ?? ""])
@@ -1223,11 +1249,18 @@ async function updateSkills(dependencies) {
   const state = await dependencies.stateStore.read();
   const previous = state?.packages[name];
   const sameTarget = previous?.directory === dependencies.directory && previous?.linkedInto === dependencies.linkInto;
+  const claimedElsewhere = (skill) => Object.entries(state?.packages ?? {}).find(
+    ([other, pkg]) => other !== name && pkg.directory === dependencies.directory && skill in pkg.skills
+  )?.[0];
   const gone = previous !== void 0 && sameTarget ? await missingSkills(previous.directory, Object.keys(previous.skills)) : /* @__PURE__ */ new Set();
   const nothingToRestore = !dependencies.restoreMissing || gone.size === 0;
+  const standing = Object.keys(previous?.skills ?? {}).flatMap((skill) => {
+    const owner = claimedElsewhere(skill);
+    return owner ? [{ skill, owner }] : [];
+  });
   if (commit !== void 0 && commit === previous?.commit && sameTarget && nothingToRestore) {
     await response.body?.cancel();
-    return { status: "unchanged", name, commit };
+    return { status: "unchanged", name, commit, conflicts: standing };
   }
   const gzipped = new Uint8Array(await response.arrayBuffer());
   const files = planSkillFiles(readTar((0, import_node_zlib.gunzipSync)(gzipped)));
@@ -1239,7 +1272,19 @@ async function updateSkills(dependencies) {
   }
   const inArchive = [...bySkill.keys()].sort();
   const skipped = dependencies.restoreMissing ? [] : inArchive.filter((skill) => gone.has(skill));
-  const skills = inArchive.filter((skill) => !skipped.includes(skill));
+  const candidates = inArchive.filter((skill) => !skipped.includes(skill));
+  const conflicts = [];
+  for (const skill of candidates) {
+    const owner = claimedElsewhere(skill);
+    if (owner === void 0) continue;
+    if (dependencies.restoreMissing) {
+      throw new Error(
+        `${owner} already installs a skill named "${skill}" in ${dependencies.directory}. Two repositories cannot both provide "${skill}" there \u2014 the second would silently overwrite the first. Install this one elsewhere (-p, or --dir <path>), or run \`pep skills remove ${owner}\` first.`
+      );
+    }
+    conflicts.push({ skill, owner });
+  }
+  const skills = candidates.filter((skill) => !conflicts.some((one) => one.skill === skill));
   const hashes = {};
   const updated = [];
   const unchanged = [];
@@ -1264,8 +1309,9 @@ async function updateSkills(dependencies) {
   for (const skill of skills) {
     await (0, import_promises4.rm)((0, import_node_path4.join)(dependencies.directory, skill), { recursive: true, force: true });
   }
+  const untouched = /* @__PURE__ */ new Set([...skipped, ...conflicts.map((one) => one.skill)]);
   for (const file of files) {
-    if (skipped.includes(file.skill)) continue;
+    if (untouched.has(file.skill)) continue;
     const target = (0, import_node_path4.join)(dependencies.directory, file.skill, ...file.path.split("/"));
     await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(target), { recursive: true });
     await (0, import_promises4.writeFile)(target, file.data);
@@ -1292,7 +1338,12 @@ async function updateSkills(dependencies) {
         ...dependencies.linkInto !== void 0 ? { linkedInto: dependencies.linkInto } : {},
         // 跳过的那些**原样留着上次的哈希** —— 账上仍然认它是这个包的（将来 add 能补回来，
         // 上游删掉时也还清得动），只是这次没去碰它。
-        skills: { ...pickSkipped(previous, skipped), ...hashes }
+        // 跳过的与让开的都**原样留着上次的哈希** —— 账上仍然认它是这个包的（将来 add
+        // 能补回来、`remove` 也还清得动），只是这次没去碰它。
+        skills: {
+          ...pickSkipped(previous, [...skipped, ...conflicts.map((one) => one.skill)]),
+          ...hashes
+        }
       }
     }
   });
@@ -1305,6 +1356,7 @@ async function updateSkills(dependencies) {
     fileCount: files.filter((one) => !skipped.includes(one.skill)).length,
     removed,
     skipped,
+    conflicts,
     directory: dependencies.directory,
     ...dependencies.linkInto !== void 0 ? { linkedInto: dependencies.linkInto } : {},
     ...copiedCount > 0 ? { copiedCount } : {},
@@ -1313,7 +1365,7 @@ async function updateSkills(dependencies) {
 }
 
 // src/cli.ts
-var VERSION = false ? "0.0.0-dev" : "0.5.0";
+var VERSION = false ? "0.0.0-dev" : "0.6.1";
 function usage() {
   return `PEP CLI ${VERSION}
 
@@ -1325,6 +1377,7 @@ Usage:
   pep skills list
   pep skills add <repo-url | group/project[@ref]> [-p | --dir <path>]
   pep skills update [<repo>...] [-p | --dir <path>]
+  pep skills remove <repo>
   pep docs list [--docs-url <url>]
   pep docs get <path> [--docs-url <url>]
   pep nexus setup
@@ -1369,6 +1422,16 @@ it already lives and never moves anything. On update, -p and --dir instead NARRO
 repositories installed there: \`pep skills update -p\` refreshes only this project's, and reports
 nothing to do when the project has none. To move a repository, add it again with the new flag \u2014
 add is where the location is decided, and the copy in the old location is then removed.
+\`pep skills remove <repo>\` deletes the skills that repository installed and drops it from the
+list. It only removes what it installed itself, and it needs no login. A skill that another
+repository also installs is left on disk (which copy it is can no longer be told) and reported.
+
+Two repositories cannot both provide a skill with the SAME NAME in one directory \u2014 the skill name
+is the folder name inside the repository, so they would overwrite each other. add refuses, naming
+the repository already there. update never fails over it: it leaves that one skill untouched,
+refreshes everything else, and reports it every run until you remove one. Installing them into
+different directories (-p, or --dir) is fine.
+
 Delete a skill folder by hand and update LEAVES IT DELETED \u2014 it refreshes what is still there and
 reports the ones it left alone. Run \`pep skills add <repo>\` to put them back; add is the command
 that installs. Either way update only touches skills it wrote itself; anything you put there by
@@ -1389,8 +1452,15 @@ The password is shown by PEP once and never stored, so a second run reports 409
 handing it out again.`;
 }
 function reportUpdate(result) {
+  const conflicts = () => {
+    for (const { skill, owner } of result.conflicts) {
+      console.error(`  \u26A0 "${skill}" is also installed here by ${owner} \u2014 they overwrite`);
+      console.error(`    each other. \`pep skills remove\` one of them to settle it.`);
+    }
+  };
   if (result.status === "unchanged") {
     console.log(`${result.name}: already at ${result.commit}. Nothing to do.`);
+    conflicts();
     return;
   }
   console.log(
@@ -1403,6 +1473,7 @@ function reportUpdate(result) {
     console.log(`  deleted locally, left alone: ${result.skipped.join(" ")}`);
     console.log(`  (\`pep skills add ${result.name}\` puts them back)`);
   }
+  conflicts();
   console.log(`  ${result.fileCount} file(s) in ${result.directory}`);
   if (result.linkedInto !== void 0) {
     console.log(
@@ -1459,17 +1530,22 @@ async function loginConfig(args, store = fileConfigStore()) {
   };
 }
 function parseSkillsArgs(command, args, cwd) {
-  const explicitDirectory = command === "list" ? void 0 : option(args, "--dir");
-  const project = command === "list" ? false : flag(args, "--project", "-p");
+  const local = command === "list" || command === "remove";
+  const explicitDirectory = local ? void 0 : option(args, "--dir");
+  const project = local ? false : flag(args, "--project", "-p");
   if (explicitDirectory !== void 0 && project) {
     throw new Error("--dir and --project/-p cannot be used together: they name different places.");
   }
   const unknownOption = args.find((one) => one.startsWith("-"));
   if (unknownOption) throw new Error(`Unknown option: ${unknownOption}`);
-  const requested = command === "add" ? args.shift() : void 0;
+  const takesOne = command === "add" || command === "remove";
+  const requested = takesOne ? args.shift() : void 0;
   if (command === "add" && !requested) {
     throw new Error("pep skills add needs a repository: a full https URL, or <group>/<project>.");
   }
+  if (command === "remove" && !requested) {
+    throw new Error("pep skills remove needs a repository. Run `pep skills list` to see them.");
+  }
   const named = command === "update" ? [...args] : [];
   if (command !== "update" && args.length > 0) {
     throw new Error(`Unexpected argument: ${args[0]}`);
@@ -1569,16 +1645,15 @@ ${usage()}`);
     return;
   }
   if (group === "skills") {
-    if (command !== "update" && command !== "add" && command !== "list") {
+    if (command !== "update" && command !== "add" && command !== "list" && command !== "remove") {
       throw new Error(`Unknown skills command.
 
 ${usage()}`);
     }
     const { requested, named, chosenTarget } = parseSkillsArgs(command, args);
-    const authorization = await auth.currentAuthorization();
-    const remote = { issuer: authorization.issuer, accessToken: authorization.accessToken };
+    const stateStore = fileSkillsStateStore();
     if (command === "list") {
-      const listed = await fileSkillsStateStore().read();
+      const listed = await stateStore.read();
       const packages = Object.entries(listed?.packages ?? {}).sort(
         ([a], [b]) => a.localeCompare(b)
       );
@@ -1587,10 +1662,36 @@ ${usage()}`);
         return;
       }
       for (const [source, pkg] of packages) console.log(`${source}	${pkg.directory}`);
+      const byPlace = /* @__PURE__ */ new Map();
+      for (const [source, pkg] of packages) {
+        for (const skill of Object.keys(pkg.skills)) {
+          const key = `${pkg.directory}\0${skill}`;
+          byPlace.set(key, [...byPlace.get(key) ?? [], source]);
+        }
+      }
+      for (const [key, owners] of byPlace) {
+        if (owners.length < 2) continue;
+        const skill = key.split("\0")[1];
+        console.error(`
+\u26A0 ${owners.length} repositories all install "${skill}" here:`);
+        for (const one of owners) console.error(`    ${one}`);
+        console.error("  They overwrite each other. `pep skills remove <repo>` keeps just one.");
+      }
       console.error("\n`pep skills update` refreshes all of them, each where it lives.");
       return;
     }
-    const stateStore = fileSkillsStateStore();
+    if (command === "remove") {
+      const result = await removeSkills(requested, stateStore);
+      console.log(
+        result.deleted.length > 0 ? `${result.name}: removed ${result.deleted.join(" ")} from ${result.directory}` : `${result.name}: nothing on disk to delete; dropped it from the list`
+      );
+      for (const { skill, owner } of result.keptForOthers) {
+        console.error(`  kept "${skill}" \u2014 ${owner} also installs it here`);
+      }
+      return;
+    }
+    const authorization = await auth.currentAuthorization();
+    const remote = { issuer: authorization.issuer, accessToken: authorization.accessToken };
     const state = await stateStore.read();
     const installed = Object.keys(state?.packages ?? {}).sort();
     const run2 = async (source, target, restoreMissing = false) => reportUpdate(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newlandnpt/pep-cli",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "PEP CLI —— 凭 PEP 身份读取 Newland 开发者文档与 agent skills",
   "license": "UNLICENSED",
   "type": "module",