npm - @noodleseed/one - Versions diffs - 0.4.0 → 0.5.0 - Mend

@noodleseed/one 0.4.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (369) hide show

package/dist/react-widget-build.js ADDED Viewed

@@ -0,0 +1,176 @@
+import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { build as viteBuild } from 'vite';
+export async function buildReactWidgetViews(manifestJson, options) {
+    const manifest = JSON.parse(manifestJson);
+    const widgets = manifest.widgets ?? [];
+    if (widgets.every((widget) => widget.view === undefined))
+        return manifestJson;
+    manifest.widgets = await Promise.all(widgets.map(async (widget) => {
+        if (widget.view === undefined)
+            return widget;
+        return {
+            ...widget,
+            view: {
+                ...widget.view,
+                compiledHtml: await buildReactWidgetHtml({
+                    rootDir: options.rootDir,
+                    title: widget.title ?? widget.view.component,
+                    component: widget.view.component,
+                    entry: widget.view.entry,
+                }),
+            },
+        };
+    }));
+    return JSON.stringify(manifest);
+}
+async function buildReactWidgetHtml(input) {
+    const entry = resolveWidgetEntry(input.rootDir, input.entry);
+    const dir = mkdtempSync(join(tmpdir(), `noodle-react-widget-${process.pid}-`));
+    mkdirSync(dir, { recursive: true });
+    const generatedEntry = join(dir, 'entry.tsx');
+    writeFileSync(generatedEntry, reactWidgetEntrySource(entry));
+    const result = await viteBuild({
+        root: input.rootDir,
+        configFile: false,
+        logLevel: 'silent',
+        mode: 'production',
+        define: { 'process.env.NODE_ENV': JSON.stringify('production') },
+        esbuild: { jsxDev: false },
+        plugins: [reactSourceAliasPlugin()],
+        resolve: {
+            alias: [
+                { find: /^react$/, replacement: resolvePackageModule('react', input.rootDir) },
+                {
+                    find: /^react\/jsx-runtime$/,
+                    replacement: resolvePackageModule('react/jsx-runtime', input.rootDir),
+                },
+                {
+                    find: /^react\/jsx-dev-runtime$/,
+                    replacement: resolvePackageModule('react/jsx-dev-runtime', input.rootDir),
+                },
+                {
+                    find: /^react-dom\/client$/,
+                    replacement: resolvePackageModule('react-dom/client', input.rootDir),
+                },
+                { find: /^@noodleseed\/one\/react$/, replacement: reactHelperModulePath() },
+            ],
+            dedupe: ['react', 'react-dom'],
+        },
+        build: {
+            write: false,
+            sourcemap: false,
+            minify: true,
+            assetsInlineLimit: Number.MAX_SAFE_INTEGER,
+            rollupOptions: {
+                input: generatedEntry,
+                output: {
+                    format: 'es',
+                    inlineDynamicImports: true,
+                    entryFileNames: 'widget.js',
+                    assetFileNames: 'widget.[ext]',
+                },
+            },
+        },
+    });
+    const output = viteOutput(result);
+    if (output === undefined)
+        throw new Error(`React widget "${input.component}" produced no bundle`);
+    const scripts = output
+        .filter(isViteChunk)
+        .map((item) => item.code)
+        .join('\n');
+    const styles = output
+        .filter(isViteCssAsset)
+        .map((item) => String(item.source))
+        .join('\n');
+    return [
+        '<!doctype html>',
+        '<html>',
+        '<head>',
+        '<meta charset="utf-8">',
+        `<title>${escapeHtml(input.title)}</title>`,
+        styles ? `<style data-noodle-react-bundle>${safeStyle(styles)}</style>` : '',
+        '</head>',
+        '<body>',
+        `<main id="noodle-react-root" data-noodle-react-view="${escapeHtml(input.component)}"></main>`,
+        '<noscript>This React widget requires JavaScript in the host iframe.</noscript>',
+        `<script type="module" data-noodle-react-bundle>${safeScript(scripts)}</script>`,
+        '</body>',
+        '</html>',
+    ].join('');
+}
+function viteOutput(result) {
+    if (Array.isArray(result))
+        return result[0]?.output;
+    return result?.output;
+}
+function isViteChunk(item) {
+    return item.type === 'chunk';
+}
+function isViteCssAsset(item) {
+    return item.type === 'asset' && item.fileName.endsWith('.css');
+}
+function resolveWidgetEntry(rootDir, entry) {
+    const resolved = isAbsolute(entry) ? entry : resolve(rootDir, entry);
+    if (!existsSync(resolved))
+        throw new Error(`React widget entry not found: ${entry}`);
+    return resolved;
+}
+function reactWidgetEntrySource(entry) {
+    return `
+import React from 'react';
+import { createRoot } from 'react-dom/client';
+import Component from ${JSON.stringify(pathToFileURL(entry).href)};
+const root = document.getElementById('noodle-react-root');
+if (root) {
+  createRoot(root).render(React.createElement(Component));
+}
+`;
+}
+function reactHelperModulePath() {
+    const sourcePath = resolve(packageRoot(), '..', 'authoring', 'src', 'react.ts');
+    if (existsSync(sourcePath))
+        return sourcePath;
+    return resolve(packageRoot(), 'node_modules', '@noodle-borg', 'authoring', 'dist', 'react.js');
+}
+function resolvePackageModule(id, rootDir) {
+    const fromApp = createRequire(join(rootDir, 'package.json'));
+    try {
+        return fromApp.resolve(id);
+    }
+    catch {
+        return createRequire(import.meta.url).resolve(id);
+    }
+}
+function reactSourceAliasPlugin() {
+    return {
+        name: 'noodle-react-source-alias',
+        resolveId(source) {
+            if (source === '@noodleseed/one/react')
+                return reactHelperModulePath();
+            return null;
+        },
+    };
+}
+function packageRoot() {
+    return resolve(dirname(fileURLToPath(import.meta.url)), '..');
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('"', '&quot;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;');
+}
+function safeScript(value) {
+    return value.replaceAll('</script', '<\\/script');
+}
+function safeStyle(value) {
+    return value.replaceAll('</style', '<\\/style');
+}
+//# sourceMappingURL=react-widget-build.js.map

package/dist/react-widget-build.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"react-widget-build.js","sourceRoot":"","sources":["../src/react-widget-build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAoB1C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,OAAqC;IAErC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAkB,CAAC;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IAC9E,QAAQ,CAAC,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QAC7C,OAAO;YACL,GAAG,MAAM;YACT,IAAI,EAAE;gBACJ,GAAG,MAAM,CAAC,IAAI;gBACd,YAAY,EAAE,MAAM,oBAAoB,CAAC;oBACvC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS;oBAC5C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;oBAChC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;iBACzB,CAAC;aACH;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAKnC;IACC,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC/E,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9C,aAAa,CAAC,cAAc,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,OAAO;QACnB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,EAAE,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;QAChE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1B,OAAO,EAAE,CAAC,sBAAsB,EAAE,CAAC;QACnC,OAAO,EAAE;YACP,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;gBAC9E;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC;iBACtE;gBACD;oBACE,IAAI,EAAE,0BAA0B;oBAChC,WAAW,EAAE,oBAAoB,CAAC,uBAAuB,EAAE,KAAK,CAAC,OAAO,CAAC;iBAC1E;gBACD;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,oBAAoB,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC;iBACrE;gBACD,EAAE,IAAI,EAAE,2BAA2B,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE;aAC5E;YACD,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;SAC/B;QACD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,IAAI;YACZ,iBAAiB,EAAE,MAAM,CAAC,gBAAgB;YAC1C,aAAa,EAAE;gBACb,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE;oBACN,MAAM,EAAE,IAAI;oBACZ,oBAAoB,EAAE,IAAI;oBAC1B,cAAc,EAAE,WAAW;oBAC3B,cAAc,EAAE,cAAc;iBAC/B;aACF;SACF;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,SAAS,sBAAsB,CAAC,CAAC;IAClG,MAAM,OAAO,GAAG,MAAM;SACnB,MAAM,CAAC,WAAW,CAAC;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,MAAM;SAClB,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;SAClC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,iBAAiB;QACjB,QAAQ;QACR,QAAQ;QACR,wBAAwB;QACxB,UAAU,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU;QAC3C,MAAM,CAAC,CAAC,CAAC,mCAAmC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;QAC5E,SAAS;QACT,QAAQ;QACR,wDAAwD,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW;QAC9F,gFAAgF;QAChF,kDAAkD,UAAU,CAAC,OAAO,CAAC,WAAW;QAChF,SAAS;QACT,SAAS;KACV,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAQ,MAAM,CAAC,CAAC,CAA4B,EAAE,MAAM,CAAC;IAChF,OAAQ,MAAiC,EAAE,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,IAAoB;IACvC,OAAO,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,IAAoB;IAC1C,OAAO,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAa;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC;IACrF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO;;;wBAGe,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;;;;;;CAMhE,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9C,OAAO,OAAO,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,oBAAoB,CAAC,EAAU,EAAE,OAAe;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,SAAS,CAAC,MAAc;YACtB,IAAI,MAAM,KAAK,uBAAuB;gBAAE,OAAO,qBAAqB,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAClD,CAAC"}

package/dist/skills-update.d.ts ADDED Viewed

@@ -0,0 +1,43 @@
+import { type AgentKitManifest } from '@noodle-borg/agent-kit';
+export declare const AGENT_KIT_PACKAGE_NAME = "@noodleseed/agent-kit";
+/** The agent-kit version vendored into this CLI build. The offline fallback uses this snapshot. */
+export declare function bundledAgentKitVersion(): string;
+export declare function skillsUpdatePromptMessage(latest: string, current: string): string;
+/** Fetch the registry `latest` dist-tag version of `@noodleseed/agent-kit`. Returns undefined on any failure. */
+export declare function fetchLatestAgentKitVersion(fetchImpl?: typeof fetch): Promise<string | undefined>;
+export declare function isSkillsUpdateAvailable(registryVersion: string | undefined, current?: string): boolean;
+export type SkillsStaleness = 'current' | 'stale' | 'unknown';
+/** Compare an installed skill file's frontmatter version to the registry latest. */
+export declare function skillStaleness(installedVersion: string | undefined, registryVersion: string | undefined): SkillsStaleness;
+/**
+ * Extract every regular file from a `.tgz` tarball as `{package-relative path: text content}`.
+ * A minimal, dependency-free ustar reader; only handles the entries npm `pack` produces.
+ * Throws on malformed input so callers fall back to the bundled snapshot.
+ */
+export declare function extractTarGz(tgz: Buffer): Map<string, string>;
+export interface FetchedAgentKit {
+    readonly version: string;
+    readonly manifest: AgentKitManifest;
+    /** package-relative path → file content (every file listed in the manifest: SKILL.md + references). */
+    readonly files: ReadonlyMap<string, string>;
+}
+export interface AgentKitResolveResult {
+    readonly status: 'no-update' | 'fetch-failed' | 'integrity-mismatch' | 'ready' | 'offline';
+    readonly kit?: FetchedAgentKit;
+}
+/**
+ * Resolve the latest `@noodleseed/agent-kit` skill files for writing.
+ *
+ * Fetches the published tarball (via `npm pack` by default), verifies every file's sha256 against
+ * the shipped `manifest.json`, and returns the verified files. Any failure (network, missing manifest,
+ * sha256 mismatch) returns a non-`ready` status so the caller falls back to the bundled snapshot —
+ * the CLI never writes untrusted or unverified content into a user's repo.
+ */
+export declare function resolveAgentKit(input: {
+    readonly registryVersion: string | undefined;
+    readonly cacheDir: string;
+    readonly fetchImpl?: typeof fetch;
+    readonly packImpl?: (version: string, dir: string) => Promise<Buffer | undefined>;
+    readonly force?: boolean;
+}): Promise<AgentKitResolveResult>;
+//# sourceMappingURL=skills-update.d.ts.map

package/dist/skills-update.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"skills-update.d.ts","sourceRoot":"","sources":["../src/skills-update.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqB,KAAK,gBAAgB,EAAiB,MAAM,wBAAwB,CAAC;AAGjG,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAG9D,mGAAmG;AACnG,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,iHAAiH;AACjH,wBAAsB,0BAA0B,CAC9C,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAY7B;AAED,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,OAAO,GAAE,MAAiC,GACzC,OAAO,CAET;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE9D,oFAAoF;AACpF,wBAAgB,cAAc,CAC5B,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,eAAe,CAMjB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmB7D;AAUD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,uGAAuG;IACvG,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,oBAAoB,GAAG,OAAO,GAAG,SAAS,CAAC;IAC3F,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA+BjC"}

package/dist/skills-update.js ADDED Viewed

@@ -0,0 +1,191 @@
+import { spawn } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { gunzipSync } from 'node:zlib';
+import { AGENT_KIT_VERSION, contentSha256 } from '@noodle-borg/agent-kit';
+import { compareVersions } from './update.js';
+export const AGENT_KIT_PACKAGE_NAME = '@noodleseed/agent-kit';
+const REGISTRY_LATEST_URL = `https://registry.npmjs.org/${AGENT_KIT_PACKAGE_NAME.replace('/', '%2F')}/latest`;
+/** The agent-kit version vendored into this CLI build. The offline fallback uses this snapshot. */
+export function bundledAgentKitVersion() {
+    return AGENT_KIT_VERSION;
+}
+export function skillsUpdatePromptMessage(latest, current) {
+    return `Skills updated in v${latest} (you have v${current}). Run \`noodle agents setup --write\` to refresh.`;
+}
+/** Fetch the registry `latest` dist-tag version of `@noodleseed/agent-kit`. Returns undefined on any failure. */
+export async function fetchLatestAgentKitVersion(fetchImpl = fetch) {
+    try {
+        const res = await fetchImpl(REGISTRY_LATEST_URL, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(1500),
+        });
+        if (!res.ok)
+            return undefined;
+        const body = (await res.json());
+        return typeof body.version === 'string' ? body.version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isSkillsUpdateAvailable(registryVersion, current = bundledAgentKitVersion()) {
+    return registryVersion !== undefined && compareVersions(registryVersion, current) > 0;
+}
+/** Compare an installed skill file's frontmatter version to the registry latest. */
+export function skillStaleness(installedVersion, registryVersion) {
+    if (registryVersion === undefined)
+        return 'unknown';
+    if (installedVersion === undefined)
+        return 'stale';
+    const cmp = compareVersions(registryVersion, installedVersion);
+    if (cmp === 0)
+        return 'current';
+    return cmp > 0 ? 'stale' : 'current';
+}
+/**
+ * Extract every regular file from a `.tgz` tarball as `{package-relative path: text content}`.
+ * A minimal, dependency-free ustar reader; only handles the entries npm `pack` produces.
+ * Throws on malformed input so callers fall back to the bundled snapshot.
+ */
+export function extractTarGz(tgz) {
+    const tar = gunzipSync(tgz);
+    const files = new Map();
+    let offset = 0;
+    while (offset + 512 <= tar.length) {
+        const header = tar.subarray(offset, offset + 512);
+        const name = readField(header, 0, 100).replace(/\0/g, '');
+        if (name === '')
+            break;
+        const size = parseOctal(readField(header, 124, 12));
+        const typeflag = String.fromCharCode(header[156] ?? 0x30);
+        offset += 512;
+        if (typeflag === '0' || typeflag === '\0') {
+            const content = tar.subarray(offset, offset + size);
+            files.set(name, Buffer.from(content).toString('utf8'));
+        }
+        // tar records are padded to 512-byte boundaries
+        offset += Math.ceil(size / 512) * 512;
+    }
+    return files;
+}
+function readField(buf, start, len) {
+    return buf.toString('latin1', start, start + len);
+}
+function parseOctal(s) {
+    return Number.parseInt(s.replace(/\0/g, '').trim(), 8) || 0;
+}
+/**
+ * Resolve the latest `@noodleseed/agent-kit` skill files for writing.
+ *
+ * Fetches the published tarball (via `npm pack` by default), verifies every file's sha256 against
+ * the shipped `manifest.json`, and returns the verified files. Any failure (network, missing manifest,
+ * sha256 mismatch) returns a non-`ready` status so the caller falls back to the bundled snapshot —
+ * the CLI never writes untrusted or unverified content into a user's repo.
+ */
+export async function resolveAgentKit(input) {
+    const version = input.registryVersion;
+    if (version === undefined)
+        return { status: 'offline' };
+    if (!isSkillsUpdateAvailable(version) && input.force !== true) {
+        return { status: 'no-update' };
+    }
+    const cacheVersionDir = join(input.cacheDir, version);
+    const manifestPath = join(cacheVersionDir, 'manifest.json');
+    if (!input.force && existsSync(manifestPath)) {
+        const cached = loadCachedKit(cacheVersionDir);
+        if (cached !== undefined)
+            return { status: 'ready', kit: cached };
+    }
+    const packImpl = input.packImpl ?? defaultPack;
+    const tgz = await packImpl(version, cacheVersionDir).catch(() => undefined);
+    if (tgz === undefined)
+        return { status: 'fetch-failed' };
+    try {
+        const entries = extractTarGz(tgz);
+        const manifest = readManifest(entries);
+        if (manifest === undefined)
+            return { status: 'fetch-failed' };
+        const files = new Map();
+        for (const entry of manifest.files) {
+            const content = entries.get(`package/${entry.path}`);
+            if (content === undefined)
+                return { status: 'integrity-mismatch' };
+            if (contentSha256(content) !== entry.sha256)
+                return { status: 'integrity-mismatch' };
+            files.set(entry.path, content);
+        }
+        writeCache(cacheVersionDir, manifest, files);
+        return { status: 'ready', kit: { version, manifest, files } };
+    }
+    catch {
+        return { status: 'fetch-failed' };
+    }
+}
+function readManifest(entries) {
+    const content = entries.get('package/manifest.json');
+    if (content === undefined)
+        return undefined;
+    try {
+        return JSON.parse(content);
+    }
+    catch {
+        return undefined;
+    }
+}
+function loadCachedKit(dir) {
+    try {
+        const manifest = JSON.parse(readFileSync(join(dir, 'manifest.json'), 'utf8'));
+        const files = new Map();
+        for (const entry of manifest.files) {
+            const content = readFileSync(join(dir, entry.path), 'utf8');
+            if (contentSha256(content) !== entry.sha256)
+                return undefined;
+            files.set(entry.path, content);
+        }
+        return { version: manifest.packageVersion, manifest, files };
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeCache(dir, manifest, files) {
+    mkdirSync(dir, { recursive: true });
+    for (const [path, content] of files) {
+        const full = join(dir, path);
+        mkdirSync(dirname(full), { recursive: true });
+        writeFileSync(full, content);
+    }
+    writeFileSync(join(dir, 'manifest.json'), JSON.stringify(manifest, null, 2));
+}
+// Default pack implementation: `npm pack @noodleseed/agent-kit@<version>` into a temp directory.
+async function defaultPack(version, dir) {
+    mkdirSync(dir, { recursive: true });
+    return new Promise((resolve) => {
+        const child = spawn('npm', ['pack', `${AGENT_KIT_PACKAGE_NAME}@${version}`], {
+            cwd: dir,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        let stdout = '';
+        child.stdout?.on('data', (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.on('error', () => resolve(undefined));
+        child.on('close', (code) => {
+            if (code !== 0)
+                return resolve(undefined);
+            const filename = stdout.trim().split('\n').pop();
+            if (filename === undefined)
+                return resolve(undefined);
+            try {
+                const bytes = readFileSync(join(dir, filename));
+                rmSync(join(dir, filename), { force: true });
+                resolve(bytes);
+            }
+            catch {
+                resolve(undefined);
+            }
+        });
+    });
+}
+//# sourceMappingURL=skills-update.js.map

package/dist/skills-update.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"skills-update.js","sourceRoot":"","sources":["../src/skills-update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAyB,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAC9D,MAAM,mBAAmB,GAAG,8BAA8B,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;AAE9G,mGAAmG;AACnG,MAAM,UAAU,sBAAsB;IACpC,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,OAAe;IACvE,OAAO,sBAAsB,MAAM,eAAe,OAAO,oDAAoD,CAAC;AAChH,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,YAA0B,KAAK;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,mBAAmB,EAAE;YAC/C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,OAAO,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,eAAmC,EACnC,UAAkB,sBAAsB,EAAE;IAE1C,OAAO,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAID,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAC5B,gBAAoC,EACpC,eAAmC;IAEnC,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACnD,MAAM,GAAG,GAAG,eAAe,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM;QACvB,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,CAAC;QACd,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;YACpD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,gDAAgD;QAChD,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,KAAa,EAAE,GAAW;IACxD,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAMrC;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxD,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACnE,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACrF,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,UAAU,CAAC,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAA4B;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAqB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAC7B,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5D,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9D,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,QAA0B,EAC1B,KAAkC;IAElC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,GAAW;IACrD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,sBAAsB,IAAI,OAAO,EAAE,CAAC,EAAE;YAC3E,GAAG,EAAE,GAAG;YACR,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACjD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tunnel.d.ts ADDED Viewed

@@ -0,0 +1,42 @@
+/**
+ * Dev tunnel — phase 1 (cloudflared stopgap). See ADR 0103.
+ *
+ * Wraps `cloudflared tunnel --url <loopback>` (Cloudflare Quick Tunnels) so a cloud-hosted AI client
+ * can reach the loopback `noodle dev` server. `cloudflared` is an external, user-installed binary
+ * (Apache-2.0) — never an npm dependency and never bundled. The dev server stays bound to loopback;
+ * cloudflared dials it locally. This module never logs request/response bodies, headers, or tokens —
+ * it only parses the assigned public URL and never forwards raw child output.
+ */
+/** The subset of `node:child_process` ChildProcess this module needs, so tests can inject a fake. */
+export interface TunnelProcess {
+    readonly stdout: NodeJS.EventEmitter | null;
+    readonly stderr: NodeJS.EventEmitter | null;
+    on(event: 'error', listener: (err: Error) => void): unknown;
+    on(event: 'exit', listener: (code: number | null) => void): unknown;
+    kill(signal?: NodeJS.Signals): boolean;
+}
+export type SpawnFn = (command: string, args: readonly string[]) => TunnelProcess;
+export interface StartTunnelOptions {
+    /** The loopback origin of the dev server, e.g. `http://127.0.0.1:54321`. */
+    readonly localOrigin: string;
+    /** The full loopback MCP URL the dev server serves (origin + tenant path). */
+    readonly localMcpUrl: string;
+    /** Injectable spawner (defaults to `node:child_process` spawn); used by tests to avoid cloudflared. */
+    readonly spawn?: SpawnFn;
+    /** Max time to wait for cloudflared to report a URL before giving up. */
+    readonly timeoutMs?: number;
+}
+export interface TunnelHandle {
+    /** The public Cloudflare origin, e.g. `https://blue-cat-1234.trycloudflare.com`. */
+    readonly publicOrigin: string;
+    /** The public MCP URL (public origin + the dev server's tenant path). */
+    readonly publicMcpUrl: string;
+    /** Stop the cloudflared process. */
+    close(): Promise<void>;
+}
+/**
+ * Start a Cloudflare Quick Tunnel to the loopback dev server and resolve once the public URL appears.
+ * Rejects with install guidance when the binary is missing, or if cloudflared exits / times out first.
+ */
+export declare function startTunnel(options: StartTunnelOptions): Promise<TunnelHandle>;
+//# sourceMappingURL=tunnel.d.ts.map

package/dist/tunnel.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../src/tunnel.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,qGAAqG;AACrG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAC5C,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;IAC5D,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACxC;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,aAAa,CAAC;AAElF,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oCAAoC;IACpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAOD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAyDpF"}

package/dist/tunnel.js ADDED Viewed

@@ -0,0 +1,60 @@
+import { spawn as nodeSpawn } from 'node:child_process';
+const CLOUDFLARED = 'cloudflared';
+const URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+const INSTALL_HINT = 'cloudflared not found. Install it (https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/), then retry `noodle dev --tunnel`.';
+/**
+ * Start a Cloudflare Quick Tunnel to the loopback dev server and resolve once the public URL appears.
+ * Rejects with install guidance when the binary is missing, or if cloudflared exits / times out first.
+ */
+export async function startTunnel(options) {
+    const spawnFn = options.spawn ?? ((command, args) => nodeSpawn(command, [...args]));
+    const timeoutMs = options.timeoutMs ?? 20_000;
+    const child = spawnFn(CLOUDFLARED, ['tunnel', '--url', options.localOrigin]);
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let buffer = '';
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            child.kill('SIGTERM');
+            reject(new Error(`cloudflared did not report a tunnel URL within ${timeoutMs}ms`));
+        }, timeoutMs);
+        timer.unref?.();
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            fn();
+        };
+        // Parse the assigned URL from cloudflared's output. We deliberately never echo the raw output.
+        const onData = (chunk) => {
+            if (settled)
+                return;
+            buffer += chunk.toString();
+            const match = buffer.match(URL_RE);
+            if (!match)
+                return;
+            const publicOrigin = match[0];
+            const publicMcpUrl = publicOrigin + options.localMcpUrl.slice(options.localOrigin.length);
+            finish(() => resolve({
+                publicOrigin,
+                publicMcpUrl,
+                close: () => new Promise((res) => {
+                    child.on('exit', () => res());
+                    child.kill('SIGTERM');
+                }),
+            }));
+        };
+        child.stdout?.on('data', onData);
+        child.stderr?.on('data', onData);
+        child.on('error', (err) => {
+            finish(() => reject(new Error(err.code === 'ENOENT' ? INSTALL_HINT : `cloudflared: ${err.message}`)));
+        });
+        child.on('exit', (code) => {
+            finish(() => reject(new Error(`cloudflared exited (code ${code ?? 'null'}) before opening a tunnel`)));
+        });
+    });
+}
+//# sourceMappingURL=tunnel.js.map

package/dist/tunnel.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"tunnel.js","sourceRoot":"","sources":["../src/tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AA2CxD,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,MAAM,MAAM,GAAG,2CAA2C,CAAC;AAC3D,MAAM,YAAY,GAChB,iKAAiK,CAAC;AAEpK;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B;IAC3D,MAAM,OAAO,GAAY,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAE7E,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,SAAS,IAAI,CAAC,CAAC,CAAC;QACrF,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAEhB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAQ,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,EAAE,EAAE,CAAC;QACP,CAAC,CAAC;QAEF,+FAA+F;QAC/F,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAQ,EAAE;YAC9C,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1F,MAAM,CAAC,GAAG,EAAE,CACV,OAAO,CAAC;gBACN,YAAY;gBACZ,YAAY;gBACZ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE;oBACxB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;oBAC9B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC,CAAC;aACL,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA8B,EAAE,EAAE;YACnD,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CACxF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,IAAI,IAAI,MAAM,2BAA2B,CAAC,CAAC,CACzF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/update.d.ts CHANGED Viewed

@@ -10,4 +10,5 @@ export declare function maybeCheckForCliUpdate(input: {
     /** Injectable updater (defaults to {@link runUpdateCommand}); used by tests to avoid spawning npm. */
     readonly runUpdate?: (rest: readonly string[]) => Promise<number>;
 }): Promise<void>;
+export declare function compareVersions(a: string, b: string): number;
 //# sourceMappingURL=update.d.ts.map

package/dist/update.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"~~AAIA~~,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAClD,eAAO,MAAM,qBAAqB,0CAA8C,CAAC;AAOjF,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkB/E;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,sGAAsG;IACtG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnE,GAAG,OAAO,CAAC,IAAI,CAAC,~~CA2BhB~~"}
1	+ {"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAClD,eAAO,MAAM,qBAAqB,0CAA8C,CAAC;AAOjF,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkB/E;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,sGAAsG;IACtG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyChB;AA2CD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU5D"}

package/dist/update.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { spawn } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { readConfig, writeConfig } from './config.js';
+import { bundledAgentKitVersion, fetchLatestAgentKitVersion, isSkillsUpdateAvailable, skillsUpdatePromptMessage, } from './skills-update.js';
 export const CLI_PACKAGE_NAME = '@noodleseed/one';
 export const GLOBAL_UPDATE_COMMAND = `npm install -g ${CLI_PACKAGE_NAME}@latest`;
 const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
@@ -41,22 +42,33 @@ export async function maybeCheckForCliUpdate(input) {
     if (wasRecentlyChecked(config.updateCheck?.checkedAt))
         return;
     const latestVersion = await fetchLatestVersion(input.fetchImpl ?? fetch).catch(() => undefined);
-    if (latestVersion === undefined)
+    // Skills check shares the same interactive gate + 24h throttle as the CLI check (no second notifier).
+    const skillsLatest = await fetchLatestAgentKitVersion(input.fetchImpl ?? fetch).catch(() => undefined);
+    if (latestVersion === undefined && skillsLatest === undefined)
         return;
     writeConfig({
         ...readConfig(input.home),
-        updateCheck: { checkedAt: new Date().toISOString(), latestVersion },
+        updateCheck: {
+            checkedAt: new Date().toISOString(),
+            ...(latestVersion !== undefined ? { latestVersion } : {}),
+            ...(skillsLatest !== undefined ? { skillsLatestVersion: skillsLatest } : {}),
+        },
     }, input.home);
     const currentVersion = currentCliVersion();
-    if (compareVersions(latestVersion, currentVersion) <= 0)
-        return;
-    console.error(`A newer Noodle CLI is available: ${currentVersion} -> ${latestVersion}`);
-    if (isAutoUpdateEnabled(input.env)) {
-        console.error('NOODLE_AUTO_UPDATE is set — updating now...');
-        await (input.runUpdate ?? runUpdateCommand)(['--yes']);
-        return;
+    if (latestVersion !== undefined && compareVersions(latestVersion, currentVersion) > 0) {
+        console.error(`A newer Noodle CLI is available: ${currentVersion} -> ${latestVersion}`);
+        if (isAutoUpdateEnabled(input.env)) {
+            console.error('NOODLE_AUTO_UPDATE is set — updating now...');
+            await (input.runUpdate ?? runUpdateCommand)(['--yes']);
+        }
+        else {
+            console.error(`Update: ${GLOBAL_UPDATE_COMMAND}`);
+        }
+    }
+    // Self-checking skills: notify (no auto-update) when the registry has a newer agent-kit.
+    if (skillsLatest !== undefined && isSkillsUpdateAvailable(skillsLatest)) {
+        console.error(skillsUpdatePromptMessage(skillsLatest, bundledAgentKitVersion()));
     }
-    console.error(`Update: ${GLOBAL_UPDATE_COMMAND}`);
 }
 /** Opt-in auto-update. Enabled when `NOODLE_AUTO_UPDATE` is set to anything other than `0`/`false`. */
 function isAutoUpdateEnabled(env) {
@@ -99,7 +111,7 @@ async function fetchLatestVersion(fetchImpl) {
     const body = (await res.json());
     return typeof body.version === 'string' ? body.version : undefined;
 }
-function compareVersions(a, b) {
+export function compareVersions(a, b) {
     const left = parseVersion(a);
     const right = parseVersion(b);
     for (let i = 0; i < Math.max(left.length, right.length); i++) {