@p4code/cli 0.0.43 → 0.0.44

package/dist/bin.mjs

@@ -233,7 +233,7 @@ const make$71 = () => {
 const layer$67 = Layer.sync(NetService, make$71);
 //#endregion
 //#region package.json
-var version = "0.0.43";
+var version = "0.0.44";
 //#endregion
 //#region src/config.ts
 /**
@@ -13925,9 +13925,10 @@ const HubHttpServerLive = Layer.unwrap(Effect.gen(function* () {
 /**
 * Says on startup exactly what the hub is exposing and to whom.
 *
-* A hub bound past loopback is reachable by every device the tailnet ACL lets
-* through, and the bearer token is then the only remaining control. That is a
-* deliberate configuration, but it should never be a silent one.
+* A hub bound past loopback is reachable by whatever can route to it — on the
+* hosted deployment, the public internet — and the bearer token is then the
+* only remaining control. That is a deliberate configuration, but it should
+* never be a silent one.
 */
 const announce = Layer.effectDiscard(Effect.gen(function* () {
 	const config = yield* HubConfig;
@@ -13939,7 +13940,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 		dbPath: config.dbPath,
 		authorizedServers: config.tokenHashes.size
 	});
-	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is bound beyond loopback; the bearer token and your tailnet ACL are the only controls.", { host: config.host });
+	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
 const makeHubLayer = HttpRouter.serve(layer$58).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
@@ -14906,15 +14907,188 @@ const removeMcpRegistration = Effect.fn("mcpRegistrationFiles.remove")(function*
 	yield* fileSystem.remove(path.join(input.registrationsRoot, input.name), { force: true });
 });
 //#endregion
+//#region src/sync/skillDirectory.ts
+/**
+* Reading and writing skill directories on disk.
+*
+* Kept apart from the sync itself so the filesystem shape has its own tests,
+* and so the rules about what is refusable — binaries, oversized files, deep
+* trees — live in one place rather than being rediscovered at each call site.
+*
+* @module sync/skillDirectory
+*/
+/** Bounded so a stray symlink or a vendored `node_modules` cannot walk forever. */
+const MAX_SKILL_DEPTH = 4;
+/**
+* Entries that are never part of a skill, skipped rather than refused.
+*
+* The distinction matters. Refusing an asset because it cannot be represented
+* faithfully is right — a half-materialized skill loads and misbehaves. But a
+* `.DS_Store` is not part of the skill at all, and macOS drops one into any
+* directory that has been opened in Finder, so refusing on its account rejects
+* a perfectly good skill for a reason its author cannot see.
+*
+* These could not sync in any case: `AgentAssetFilePath` rejects a leading dot,
+* so a dotfile has no representable path even if it were text.
+*/
+const IGNORED_ENTRIES = /* @__PURE__ */ new Set([
+	".DS_Store",
+	"Thumbs.db",
+	".git",
+	".svn",
+	".hg",
+	"node_modules",
+	"__pycache__",
+	".venv",
+	".pytest_cache",
+	".ruff_cache",
+	".mypy_cache"
+]);
+/**
+* Anything else with a leading dot is skipped too — an editor's `.idea`, a
+* `.gitignore` that belongs to the checkout rather than the skill. The rule is
+* the same one the path schema already enforces, applied earlier so it reads as
+* "not part of the skill" instead of "this skill is broken".
+*/
+const isIgnoredEntry = (entry) => IGNORED_ENTRIES.has(entry) || entry.startsWith(".");
+/**
+* A file is binary if decoding it yields a NUL.
+*
+* Cheap, and right for what is being asked: the question is not "is this valid
+* UTF-8" but "can this round-trip through a JSON text column", and a NUL is
+* what actually breaks that on the way back out of SQLite.
+*/
+const looksBinary$1 = (content) => content.includes("\0");
+/**
+* Read one directory as an asset's files, or say why it cannot be one.
+*
+* Exported because memory's `global-memory/` is the same shape by a different
+* name: a directory whose whole contents are the asset. Sharing this keeps the
+* refusal rules — depth, file count, binaries, size — identical for both,
+* rather than letting a second copy drift into accepting what the first
+* rejects.
+*/
+const readSkillFiles = Effect.fn("skillDirectory.readSkillFiles")(function* (root) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const files = [];
+	const walk = Effect.fn("skillDirectory.walk")(function* (directory, prefix, depth) {
+		if (depth > MAX_SKILL_DEPTH) return "too-deep";
+		const entries = yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
+		for (const entry of [...entries].sort()) {
+			if (isIgnoredEntry(entry)) continue;
+			const absolute = path.join(directory, entry);
+			const relative = prefix === "" ? entry : `${prefix}/${entry}`;
+			const info = yield* fileSystem.stat(absolute).pipe(Effect.orElseSucceed(() => void 0));
+			if (info === void 0) return "unreadable";
+			if (info.type === "Directory") {
+				const nested = yield* walk(absolute, relative, depth + 1);
+				if (nested !== null) return nested;
+				continue;
+			}
+			if (info.type !== "File") continue;
+			if (files.length >= 512) return "too-many-files";
+			const content = yield* fileSystem.readFileString(absolute).pipe(Effect.orElseSucceed(() => void 0));
+			if (content === void 0) return "unreadable";
+			if (looksBinary$1(content)) return "binary-file";
+			if (content.length > 524288) return "file-too-large";
+			files.push({
+				path: relative,
+				content
+			});
+		}
+		return null;
+	});
+	const refusal = yield* walk(root, "", 1);
+	if (refusal !== null) return { refusal };
+	if (agentAssetTotalBytes(files) > 4194304) return { refusal: "asset-too-large" };
+	return { files };
+});
+/**
+* Read every skill directory under a user-scope `skills/` root.
+*
+* A directory with no `SKILL.md` is not a skill and is skipped silently —
+* Claude Code would ignore it too, so reporting it would be noise about
+* something that was never a skill in the first place.
+*/
+const readSkillDirectory = Effect.fn("skillDirectory.readSkillDirectory")(function* (skillsRoot) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const entries = yield* fileSystem.readDirectory(skillsRoot).pipe(Effect.orElseSucceed(() => []));
+	const skills = [];
+	const refused = [];
+	for (const entry of [...entries].sort()) {
+		if (isIgnoredEntry(entry)) continue;
+		const directory = path.join(skillsRoot, entry);
+		if ((yield* fileSystem.stat(directory).pipe(Effect.orElseSucceed(() => void 0)))?.type !== "Directory") continue;
+		if (!(yield* fileSystem.exists(path.join(directory, "SKILL.md")).pipe(Effect.orElseSucceed(() => false)))) continue;
+		const read = yield* readSkillFiles(directory);
+		if ("refusal" in read) {
+			refused.push({
+				name: entry,
+				reason: read.refusal
+			});
+			continue;
+		}
+		skills.push({
+			name: entry,
+			files: read.files
+		});
+	}
+	return {
+		skills,
+		refused
+	};
+});
+/**
+* Replace a skill directory with exactly the asset's files.
+*
+* Written to a sibling and then swapped, so a crash mid-write leaves the old
+* skill intact rather than half of the new one. A skill is loaded as a unit and
+* a partially written one is instructions with the middle missing, which an
+* agent will happily follow.
+*/
+const writeSkillDirectory = Effect.fn("skillDirectory.writeSkillDirectory")(function* (input) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const target = path.join(input.skillsRoot, input.name);
+	const staging = path.join(input.skillsRoot, `.${input.name}.p4code-staging`);
+	yield* fileSystem.makeDirectory(input.skillsRoot, { recursive: true });
+	yield* fileSystem.remove(staging, {
+		recursive: true,
+		force: true
+	});
+	yield* fileSystem.makeDirectory(staging, { recursive: true });
+	for (const file of input.files) {
+		const destination = path.join(staging, file.path);
+		yield* fileSystem.makeDirectory(path.dirname(destination), { recursive: true });
+		yield* fileSystem.writeFileString(destination, file.content);
+	}
+	yield* fileSystem.remove(target, {
+		recursive: true,
+		force: true
+	});
+	yield* fileSystem.rename(staging, target);
+});
+const removeSkillDirectory = Effect.fn("skillDirectory.removeSkillDirectory")(function* (input) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	yield* fileSystem.remove(path.join(input.skillsRoot, input.name), {
+		recursive: true,
+		force: true
+	});
+});
+//#endregion
 //#region src/sync/memoryFile.ts
 /**
 * Reading and writing user-scope memory files.
 *
 * Memory is the instruction file an agent reads before anything else, so a
 * machine whose `CLAUDE.md` differs is a machine whose agent behaves
-* differently — which is the whole reason the hub exists. Unlike a skill it is
-* a single file, and it sits *directly* in the provider's config directory
-* rather than in a subdirectory the sync could own outright.
+* differently — which is the whole reason the hub exists. It comes in two
+* shapes: the entry-point files, which sit *directly* in the provider's config
+* directory rather than in a subdirectory the sync could own outright, and the
+* directory of rules those files include by reference.
 *
 * That last part is the entire design constraint. `<configDir>` also holds
 * `settings.json`, `.claude.json` and `.credentials.json`. "Write the file this
@@ -14951,9 +15125,38 @@ const MEMORY_FILE_NAMES = ["CLAUDE.md", "AGENTS.md"];
 * it on a case-sensitive one would make the same hub row materialize on one
 * machine and refuse on another.
 */
-const isMemoryAssetName = (name) => MEMORY_FILE_NAMES.includes(name);
+const isMemoryFileName = (name) => MEMORY_FILE_NAMES.includes(name);
+/**
+* The directories in the config directory this sync will carry whole.
+*
+* A memory file is rarely the whole of the memory. `CLAUDE.md` is written to be
+* an index — a dozen `@~/.claude/global-memory/...` lines and little else — so
+* syncing the file alone hands the other machine a list of pointers to files
+* that are not there, and an agent reading it behaves as if the rules it names
+* do not exist. That failure is silent: the includes resolve to nothing rather
+* than to an error.
+*
+* So this is an allowlist too, and for the same reason the file one exists. The
+* escape it prevents is different, though, and weaker: `AgentAssetFilePath`
+* already forbids `..`, leading slashes and backslashes, so a directory asset
+* cannot write outside its own directory whatever it names its files. What the
+* allowlist adds is that the *directory* cannot be named freely either — an
+* asset is not permitted to claim `.claude/projects` or any other directory
+* that already means something to the provider.
+*/
+const MEMORY_DIRECTORY_NAMES = ["global-memory"];
+/** Whether this name is one of the memory directories. Exact match, as above. */
+const isMemoryDirectoryName = (name) => MEMORY_DIRECTORY_NAMES.includes(name);
+/**
+* Whether this name is memory of either shape.
+*
+* The two lists must stay disjoint, and are: an asset that is a file in one and
+* a directory in the other would have the writer delete a file to put a
+* directory in its place, or the reverse, depending on which machine ran last.
+*/
+const isMemoryAssetName = (name) => isMemoryFileName(name) || isMemoryDirectoryName(name);
 /** The same test the skill reader uses: a NUL is what breaks a JSON text column. */
-const looksBinary$1 = (content) => content.includes("\0");
+const looksBinary = (content) => content.includes("\0");
 /**
 * Read whichever memory files exist in this machine's config directory.
 *
@@ -14977,7 +15180,7 @@ const readMemoryFiles = Effect.fn("memoryFile.readMemoryFiles")(function* (memor
 			});
 			continue;
 		}
-		if (looksBinary$1(content)) {
+		if (looksBinary(content)) {
 			refused.push({
 				name,
 				reason: "binary-file"
@@ -15007,6 +15210,23 @@ const readMemoryFiles = Effect.fn("memoryFile.readMemoryFiles")(function* (memor
 			files
 		});
 	}
+	for (const name of MEMORY_DIRECTORY_NAMES) {
+		const absolute = path.join(memoryRoot, name);
+		if ((yield* fileSystem.stat(absolute).pipe(Effect.orElseSucceed(() => void 0)))?.type !== "Directory") continue;
+		const read = yield* readSkillFiles(absolute);
+		if ("refusal" in read) {
+			refused.push({
+				name,
+				reason: read.refusal
+			});
+			continue;
+		}
+		if (read.files.length === 0) continue;
+		skills.push({
+			name,
+			files: read.files
+		});
+	}
 	return {
 		skills,
 		refused
@@ -15020,7 +15240,10 @@ const readMemoryFiles = Effect.fn("memoryFile.readMemoryFiles")(function* (memor
 * carrying a second file called `settings.json` would otherwise write it, which
 * is the same escape by a longer route.
 */
-const isWritableMemoryAsset = (input) => isMemoryAssetName(input.name) && input.files.length === 1 && input.files[0]?.path === input.name;
+const isWritableMemoryAsset = (input) => {
+	if (isMemoryDirectoryName(input.name)) return true;
+	return isMemoryFileName(input.name) && input.files.length === 1 && input.files[0]?.path === input.name;
+};
 /**
 * Write a memory file, or refuse.
 *
@@ -15034,6 +15257,11 @@ const writeMemoryFile = Effect.fn("memoryFile.writeMemoryFile")(function* (input
 	if (!isWritableMemoryAsset(input)) return "refused";
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
+	if (isMemoryDirectoryName(input.name)) return yield* writeSkillDirectory({
+		skillsRoot: input.memoryRoot,
+		name: input.name,
+		files: input.files
+	}).pipe(Effect.as("written"), Effect.orElseSucceed(() => "failed"));
 	const contents = input.files[0]?.content ?? "";
 	yield* fileSystem.makeDirectory(input.memoryRoot, { recursive: true }).pipe(Effect.ignore);
 	return yield* writeFileStringAtomically({
@@ -15043,6 +15271,13 @@ const writeMemoryFile = Effect.fn("memoryFile.writeMemoryFile")(function* (input
 });
 const removeMemoryFile = Effect.fn("memoryFile.removeMemoryFile")(function* (input) {
 	if (!isMemoryAssetName(input.name)) return;
+	if (isMemoryDirectoryName(input.name)) {
+		yield* removeSkillDirectory({
+			skillsRoot: input.memoryRoot,
+			name: input.name
+		});
+		return;
+	}
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	yield* fileSystem.remove(path.join(input.memoryRoot, input.name), { force: true });
@@ -15108,169 +15343,6 @@ const writeSkillManifest = Effect.fn("skillManifest.write")(function* (manifestP
 	});
 });
 //#endregion
-//#region src/sync/skillDirectory.ts
-/**
-* Reading and writing skill directories on disk.
-*
-* Kept apart from the sync itself so the filesystem shape has its own tests,
-* and so the rules about what is refusable — binaries, oversized files, deep
-* trees — live in one place rather than being rediscovered at each call site.
-*
-* @module sync/skillDirectory
-*/
-/** Bounded so a stray symlink or a vendored `node_modules` cannot walk forever. */
-const MAX_SKILL_DEPTH = 4;
-/**
-* Entries that are never part of a skill, skipped rather than refused.
-*
-* The distinction matters. Refusing an asset because it cannot be represented
-* faithfully is right — a half-materialized skill loads and misbehaves. But a
-* `.DS_Store` is not part of the skill at all, and macOS drops one into any
-* directory that has been opened in Finder, so refusing on its account rejects
-* a perfectly good skill for a reason its author cannot see.
-*
-* These could not sync in any case: `AgentAssetFilePath` rejects a leading dot,
-* so a dotfile has no representable path even if it were text.
-*/
-const IGNORED_ENTRIES = /* @__PURE__ */ new Set([
-	".DS_Store",
-	"Thumbs.db",
-	".git",
-	".svn",
-	".hg",
-	"node_modules",
-	"__pycache__",
-	".venv",
-	".pytest_cache",
-	".ruff_cache",
-	".mypy_cache"
-]);
-/**
-* Anything else with a leading dot is skipped too — an editor's `.idea`, a
-* `.gitignore` that belongs to the checkout rather than the skill. The rule is
-* the same one the path schema already enforces, applied earlier so it reads as
-* "not part of the skill" instead of "this skill is broken".
-*/
-const isIgnoredEntry = (entry) => IGNORED_ENTRIES.has(entry) || entry.startsWith(".");
-/**
-* A file is binary if decoding it yields a NUL.
-*
-* Cheap, and right for what is being asked: the question is not "is this valid
-* UTF-8" but "can this round-trip through a JSON text column", and a NUL is
-* what actually breaks that on the way back out of SQLite.
-*/
-const looksBinary = (content) => content.includes("\0");
-const readSkillFiles = Effect.fn("skillDirectory.readSkillFiles")(function* (root) {
-	const fileSystem = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const files = [];
-	const walk = Effect.fn("skillDirectory.walk")(function* (directory, prefix, depth) {
-		if (depth > MAX_SKILL_DEPTH) return "too-deep";
-		const entries = yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
-		for (const entry of [...entries].sort()) {
-			if (isIgnoredEntry(entry)) continue;
-			const absolute = path.join(directory, entry);
-			const relative = prefix === "" ? entry : `${prefix}/${entry}`;
-			const info = yield* fileSystem.stat(absolute).pipe(Effect.orElseSucceed(() => void 0));
-			if (info === void 0) return "unreadable";
-			if (info.type === "Directory") {
-				const nested = yield* walk(absolute, relative, depth + 1);
-				if (nested !== null) return nested;
-				continue;
-			}
-			if (info.type !== "File") continue;
-			if (files.length >= 512) return "too-many-files";
-			const content = yield* fileSystem.readFileString(absolute).pipe(Effect.orElseSucceed(() => void 0));
-			if (content === void 0) return "unreadable";
-			if (looksBinary(content)) return "binary-file";
-			if (content.length > 524288) return "file-too-large";
-			files.push({
-				path: relative,
-				content
-			});
-		}
-		return null;
-	});
-	const refusal = yield* walk(root, "", 1);
-	if (refusal !== null) return { refusal };
-	if (agentAssetTotalBytes(files) > 4194304) return { refusal: "asset-too-large" };
-	return { files };
-});
-/**
-* Read every skill directory under a user-scope `skills/` root.
-*
-* A directory with no `SKILL.md` is not a skill and is skipped silently —
-* Claude Code would ignore it too, so reporting it would be noise about
-* something that was never a skill in the first place.
-*/
-const readSkillDirectory = Effect.fn("skillDirectory.readSkillDirectory")(function* (skillsRoot) {
-	const fileSystem = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const entries = yield* fileSystem.readDirectory(skillsRoot).pipe(Effect.orElseSucceed(() => []));
-	const skills = [];
-	const refused = [];
-	for (const entry of [...entries].sort()) {
-		if (isIgnoredEntry(entry)) continue;
-		const directory = path.join(skillsRoot, entry);
-		if ((yield* fileSystem.stat(directory).pipe(Effect.orElseSucceed(() => void 0)))?.type !== "Directory") continue;
-		if (!(yield* fileSystem.exists(path.join(directory, "SKILL.md")).pipe(Effect.orElseSucceed(() => false)))) continue;
-		const read = yield* readSkillFiles(directory);
-		if ("refusal" in read) {
-			refused.push({
-				name: entry,
-				reason: read.refusal
-			});
-			continue;
-		}
-		skills.push({
-			name: entry,
-			files: read.files
-		});
-	}
-	return {
-		skills,
-		refused
-	};
-});
-/**
-* Replace a skill directory with exactly the asset's files.
-*
-* Written to a sibling and then swapped, so a crash mid-write leaves the old
-* skill intact rather than half of the new one. A skill is loaded as a unit and
-* a partially written one is instructions with the middle missing, which an
-* agent will happily follow.
-*/
-const writeSkillDirectory = Effect.fn("skillDirectory.writeSkillDirectory")(function* (input) {
-	const fileSystem = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const target = path.join(input.skillsRoot, input.name);
-	const staging = path.join(input.skillsRoot, `.${input.name}.p4code-staging`);
-	yield* fileSystem.makeDirectory(input.skillsRoot, { recursive: true });
-	yield* fileSystem.remove(staging, {
-		recursive: true,
-		force: true
-	});
-	yield* fileSystem.makeDirectory(staging, { recursive: true });
-	for (const file of input.files) {
-		const destination = path.join(staging, file.path);
-		yield* fileSystem.makeDirectory(path.dirname(destination), { recursive: true });
-		yield* fileSystem.writeFileString(destination, file.content);
-	}
-	yield* fileSystem.remove(target, {
-		recursive: true,
-		force: true
-	});
-	yield* fileSystem.rename(staging, target);
-});
-const removeSkillDirectory = Effect.fn("skillDirectory.removeSkillDirectory")(function* (input) {
-	const fileSystem = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	yield* fileSystem.remove(path.join(input.skillsRoot, input.name), {
-		recursive: true,
-		force: true
-	});
-});
-//#endregion
 //#region src/sync/skillSyncPlan.ts
 /**
 * Deciding what a skill sync should do, given three views of the world.
@@ -16212,7 +16284,7 @@ const makeAssetCommands = (words) => {
 			name: nameArgument,
 			yes: Flag.boolean("yes").pipe(Flag.withDescription("Confirm: this removes it from the hub and from every machine."))
 		}).pipe(Command.withDescription(`Delete a ${words.singular} from the hub and from every machine.`), Command.withHandler((flags) => runWithSync(flags, ({ sync }) => Effect.gen(function* () {
-			if (!flags.yes) return yield* Console.error(`This deletes ${flags.name} from the hub and from every machine that syncs it.\nRe-run with --yes if that is what you want.\nTo stop sharing it from here only:  p4 ${words.command} unpublish ${flags.name}`);
+			if (!flags.yes) return yield* Console.error(`This deletes ${flags.name} from the hub and from every machine that syncs it.\nRe-run with --yes if that is what you want.\nTo stop sharing it from here only:  p4c ${words.command} unpublish ${flags.name}`);
 			const report = yield* sync.deleteFromHub({
 				kind: words.kind,
 				name: flags.name