@rackerlabs/agent-skills-cli 1.5.0

package/dist/_chunks/libs/xdg-basedir.mjs

@@ -0,0 +1,14 @@
+import path from "path";
+import os from "os";
+const homeDirectory = os.homedir();
+const { env } = process;
+const xdgData = env.XDG_DATA_HOME || (homeDirectory ? path.join(homeDirectory, ".local", "share") : void 0);
+const xdgConfig = env.XDG_CONFIG_HOME || (homeDirectory ? path.join(homeDirectory, ".config") : void 0);
+env.XDG_STATE_HOME || homeDirectory && path.join(homeDirectory, ".local", "state");
+env.XDG_CACHE_HOME || homeDirectory && path.join(homeDirectory, ".cache");
+env.XDG_RUNTIME_DIR;
+const xdgDataDirectories = (env.XDG_DATA_DIRS || "/usr/local/share/:/usr/share/").split(":");
+if (xdgData) xdgDataDirectories.unshift(xdgData);
+const xdgConfigDirectories = (env.XDG_CONFIG_DIRS || "/etc/xdg").split(":");
+if (xdgConfig) xdgConfigDirectories.unshift(xdgConfig);
+export { xdgConfig as t };

package/dist/_chunks/manifest-cli.mjs

@@ -0,0 +1,73 @@
+import { r as __toESM } from "./rolldown-runtime.mjs";
+import { u as require_picocolors } from "./libs/@clack/core.mjs";
+import { n as M } from "./libs/@clack/prompts.mjs";
+import "./libs/@kwsites/file-exists.mjs";
+import "./libs/@kwsites/promise-deferred.mjs";
+import "./libs/@simple-git/argv-parser.mjs";
+import "./libs/simple-git.mjs";
+import "./libs/gray-matter.mjs";
+import "./libs/extend-shallow.mjs";
+import "./libs/esprima.mjs";
+import "./libs/xdg-basedir.mjs";
+import { l as CENTRAL_REGISTRY_REPO, r as getLocalLockPath, t as runAdd } from "../cli.mjs";
+import { n as assertConsumerGroupsShape, r as readManifest, t as ManifestSchemaError } from "./manifest.mjs";
+import { n as resolveRegistryManifest, r as resolveSkillPath, t as resolveGroupSkills } from "./registry.mjs";
+import { access } from "fs/promises";
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+async function runInstallFromManifest(options) {
+	if (options.strict) try {
+		await access(getLocalLockPath());
+		M.error(import_picocolors.default.red("skills-lock.json already exists. In --strict mode this is not allowed — it may have been force-committed by a malicious actor."));
+		process.exit(1);
+	} catch {}
+	let manifest;
+	try {
+		manifest = await readManifest();
+	} catch (error) {
+		if (error instanceof ManifestSchemaError) {
+			M.error(import_picocolors.default.red(`Invalid skills.json: ${error.message}`));
+			process.exit(1);
+		}
+		throw error;
+	}
+	const toInstall = [];
+	if (manifest.groups) assertConsumerGroupsShape(manifest.groups);
+	if (manifest.groups && manifest.groups.include.length > 0) {
+		M.step(`Resolving groups from ${import_picocolors.default.cyan(CENTRAL_REGISTRY_REPO)} @ ${import_picocolors.default.yellow(manifest.groups.version)}...`);
+		const registryManifest = await resolveRegistryManifest(manifest.groups.version);
+		for (const groupName of manifest.groups.include) {
+			M.message(`  Group: ${import_picocolors.default.cyan(groupName)}`);
+			const skills = resolveGroupSkills(registryManifest, groupName);
+			toInstall.push(...skills);
+		}
+	}
+	if (manifest.skills && Object.keys(manifest.skills).length > 0) for (const [skillName, ref] of Object.entries(manifest.skills)) {
+		M.step(`Resolving skill ${import_picocolors.default.cyan(skillName)} @ ${import_picocolors.default.yellow(ref)}...`);
+		const fullPath = resolveSkillPath(await resolveRegistryManifest(ref), skillName);
+		toInstall.push({
+			source: fullPath,
+			ref
+		});
+	}
+	if (toInstall.length === 0) {
+		M.info("No skills to install from manifest.");
+		return;
+	}
+	const unique = /* @__PURE__ */ new Map();
+	for (const item of toInstall) unique.set(item.source, item.ref || unique.get(item.source) || "latest");
+	M.info(`Installing ${unique.size} skills from registry...`);
+	for (const [source, ref] of unique.entries()) {
+		M.step(`Installing ${import_picocolors.default.cyan(source)} @ ${import_picocolors.default.yellow(ref)}`);
+		try {
+			await runAdd([source], {
+				...options,
+				ref
+			});
+		} catch (err) {
+			M.error(`Failed to install ${source}: ${err instanceof Error ? err.message : err}`);
+			if (options.strict) process.exit(1);
+		}
+	}
+	M.success("Manifest installation complete");
+}
+export { runInstallFromManifest };

package/dist/_chunks/manifest.mjs

@@ -0,0 +1,49 @@
+import { join } from "path";
+import { readFile } from "fs/promises";
+const SKILLS_MANIFEST_FILE = "skills.json";
+function getManifestPath(cwd) {
+	return join(cwd || process.cwd(), SKILLS_MANIFEST_FILE);
+}
+async function readManifest(cwd) {
+	const manifestPath = getManifestPath(cwd);
+	try {
+		const content = await readFile(manifestPath, "utf-8");
+		const parsed = JSON.parse(content);
+		validateManifestSchema(parsed);
+		return parsed;
+	} catch (error) {
+		if (error instanceof ManifestSchemaError) throw error;
+		return { skills: {} };
+	}
+}
+var ManifestSchemaError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ManifestSchemaError";
+	}
+};
+function assertConsumerGroupsShape(groups) {
+	const correctShape = "Expected groups to be { \"version\": string, \"include\": string[] }, e.g. { \"version\": \"latest\", \"include\": [\"baseline\"] }. Inline/registry-style group maps (groupName → { source: ref }) are not valid in a local skills.json.";
+	if (typeof groups !== "object" || groups === null || Array.isArray(groups)) throw new ManifestSchemaError(`Invalid groups in skills.json. ${correctShape}`);
+	const obj = groups;
+	for (const key of Object.keys(obj)) if (key !== "version" && key !== "include") throw new ManifestSchemaError(`Invalid key "${key}" in groups — this looks like a registry/inline group map, not a consumer manifest. ${correctShape}`);
+	if (typeof obj.version !== "string" || !obj.version) throw new ManifestSchemaError(`groups.version must be a non-empty string. ${correctShape}`);
+	if (!Array.isArray(obj.include) || obj.include.some((item) => typeof item !== "string")) throw new ManifestSchemaError(`groups.include must be an array of strings. ${correctShape}`);
+}
+function validateManifestSchema(parsed) {
+	if (typeof parsed !== "object" || parsed === null) throw new ManifestSchemaError("skills.json must be a JSON object");
+	const obj = parsed;
+	if (obj.groups !== void 0) {
+		if (typeof obj.groups !== "object" || obj.groups === null) throw new ManifestSchemaError("groups must be an object with {version, include}");
+		const groups = obj.groups;
+		for (const [key, value] of Object.entries(groups)) if (key !== "version" && key !== "include") throw new ManifestSchemaError(`Invalid key "${key}" in groups. Groups must only contain "version" and "include". Inline group definitions are no longer supported.`);
+		if (typeof groups.version !== "string" || !groups.version) throw new ManifestSchemaError("groups.version is required and must be a non-empty string");
+		if (!Array.isArray(groups.include) || groups.include.length === 0) throw new ManifestSchemaError("groups.include is required and must be a non-empty array of strings");
+		for (const item of groups.include) if (typeof item !== "string") throw new ManifestSchemaError("groups.include must contain only strings");
+	}
+	if (obj.skills !== void 0) {
+		if (typeof obj.skills !== "object" || obj.skills === null || Array.isArray(obj.skills)) throw new ManifestSchemaError("skills must be an object mapping skill names to version refs");
+		for (const [key, value] of Object.entries(obj.skills)) if (typeof value !== "string") throw new ManifestSchemaError(`skills.${key} must be a version string (e.g., "v0.1.0" or "latest")`);
+	}
+}
+export { assertConsumerGroupsShape as n, readManifest as r, ManifestSchemaError as t };

package/dist/_chunks/registry-hashes.mjs

@@ -0,0 +1,56 @@
+import { r as __toESM } from "./rolldown-runtime.mjs";
+import { u as require_picocolors } from "./libs/@clack/core.mjs";
+import { n as M } from "./libs/@clack/prompts.mjs";
+import { n as computeSkillFolderHash, u as parseSource } from "../cli.mjs";
+import { r as readManifest } from "./manifest.mjs";
+import { join } from "path";
+import { access, writeFile } from "fs/promises";
+import { createHash } from "crypto";
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+const REGISTRY_HASHES_FILE = "registry-hashes.json";
+async function generateRegistryHashesCommand(cwd) {
+	const currentDir = cwd || process.cwd();
+	M.step(`Generating registry hashes in ${currentDir}`);
+	const manifest = await readManifest(currentDir);
+	const hashes = {
+		version: 1,
+		skills: {},
+		groups: {}
+	};
+	let processedSkills = 0;
+	let missingSkills = 0;
+	if (manifest.skills) for (const [source, ref] of Object.entries(manifest.skills)) {
+		const parsed = parseSource(source);
+		let localTargetDir = currentDir;
+		if (parsed.subpath) localTargetDir = join(currentDir, parsed.subpath);
+		try {
+			await access(localTargetDir);
+			const hash = await computeSkillFolderHash(localTargetDir);
+			hashes.skills[source] = hash;
+			processedSkills++;
+			M.message(`Hashed ${import_picocolors.default.cyan(source)} -> ${hash.substring(0, 16)}...`);
+		} catch (err) {
+			missingSkills++;
+			M.warn(`Could not access local folder for ${source}. Looked in: ${localTargetDir}`);
+		}
+	}
+	if (manifest.groups) for (const [groupName, groupSkills] of Object.entries(manifest.groups)) {
+		const memberHashes = [];
+		let groupValid = true;
+		for (const source of Object.keys(groupSkills)) if (hashes.skills[source]) memberHashes.push(hashes.skills[source]);
+		else {
+			M.warn(`Group '${groupName}' references skill '${source}' which has no generated hash. Group hash might be invalid.`);
+			groupValid = false;
+		}
+		memberHashes.sort();
+		const groupHash = createHash("sha256");
+		for (const h of memberHashes) groupHash.update(`${h.length}:${h}`);
+		const finalGroupHash = groupHash.digest("hex");
+		hashes.groups[groupName] = finalGroupHash;
+		if (groupValid) M.message(`Hashed group ${import_picocolors.default.cyan(groupName)} -> ${finalGroupHash.substring(0, 16)}...`);
+	}
+	await writeFile(join(currentDir, REGISTRY_HASHES_FILE), JSON.stringify(hashes, null, 2) + "\n", "utf-8");
+	M.success(import_picocolors.default.green(`Successfully wrote ${REGISTRY_HASHES_FILE} with ${processedSkills} skill hashes and ${Object.keys(hashes.groups).length} group hashes.`));
+	if (missingSkills > 0) M.warn(import_picocolors.default.yellow(`Failed to compute hashes for ${missingSkills} skills.`));
+}
+export { generateRegistryHashesCommand };

package/dist/_chunks/registry.mjs

@@ -0,0 +1,47 @@
+import { l as CENTRAL_REGISTRY_REPO } from "../cli.mjs";
+import { exec } from "child_process";
+import { promisify } from "util";
+const execAsync = promisify(exec);
+function describeType(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "an array";
+	return `a ${typeof value}`;
+}
+async function resolveVersionRef(ref) {
+	if (ref === "latest") {
+		const { stdout } = await execAsync(`gh api repos/${CENTRAL_REGISTRY_REPO}/releases/latest --jq .tag_name`);
+		const tag = stdout.trim();
+		if (!tag) throw new Error(`No releases found in ${CENTRAL_REGISTRY_REPO}`);
+		return tag;
+	}
+	return ref;
+}
+async function resolveRegistryManifest(versionRef) {
+	const tag = await resolveVersionRef(versionRef);
+	const { stdout } = await execAsync(`gh api repos/${CENTRAL_REGISTRY_REPO}/contents/skills.json?ref=${tag} --jq .content`);
+	const content = Buffer.from(stdout.trim(), "base64").toString("utf-8");
+	const parsed = JSON.parse(content);
+	if (!parsed.groups || typeof parsed.groups !== "object" || Array.isArray(parsed.groups)) throw new Error(`Registry skills.json at ${tag} has an invalid or missing groups definition (expected an object mapping group names to skill maps).`);
+	return {
+		skills: parsed.skills || {},
+		groups: parsed.groups
+	};
+}
+function resolveGroupSkills(registryManifest, groupName) {
+	if (!(groupName in registryManifest.groups)) throw new Error(`Group '${groupName}' not found in ${CENTRAL_REGISTRY_REPO}`);
+	const group = registryManifest.groups[groupName];
+	if (group === null || typeof group !== "object" || Array.isArray(group)) throw new Error(`Group '${groupName}' in ${CENTRAL_REGISTRY_REPO} has an invalid shape: expected an object mapping skill sources to version refs (e.g. { "owner/repo/skills/foo": "latest" }), but got ${describeType(group)}.`);
+	return Object.entries(group).map(([source, ref]) => {
+		if (typeof source !== "string" || typeof ref !== "string") throw new Error(`Group '${groupName}' in ${CENTRAL_REGISTRY_REPO} contains a malformed entry: each member must map a skill source string to a version ref string.`);
+		return {
+			source,
+			ref
+		};
+	});
+}
+function resolveSkillPath(registryManifest, skillName) {
+	const fullPath = Object.keys(registryManifest.skills).find((key) => key.endsWith(`/skills/${skillName}`) || key.endsWith(`/${skillName}`));
+	if (!fullPath) throw new Error(`Skill '${skillName}' not found in ${CENTRAL_REGISTRY_REPO}`);
+	return fullPath;
+}
+export { resolveRegistryManifest as n, resolveSkillPath as r, resolveGroupSkills as t };

package/dist/_chunks/rolldown-runtime.mjs

@@ -0,0 +1,24 @@
+import { createRequire } from "node:module";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+export { __require as n, __toESM as r, __commonJSMin as t };

package/dist/_chunks/verify.mjs

@@ -0,0 +1,170 @@
+import { r as __toESM } from "./rolldown-runtime.mjs";
+import { u as require_picocolors } from "./libs/@clack/core.mjs";
+import { n as M } from "./libs/@clack/prompts.mjs";
+import "./libs/gray-matter.mjs";
+import "./libs/extend-shallow.mjs";
+import "./libs/esprima.mjs";
+import "./libs/xdg-basedir.mjs";
+import { a as getAgentBaseDir, c as detectInstalledAgents, i as readLocalLock, n as computeSkillFolderHash, o as getCanonicalSkillsDir, s as agents } from "../cli.mjs";
+import { n as assertConsumerGroupsShape, r as readManifest, t as ManifestSchemaError } from "./manifest.mjs";
+import { n as resolveRegistryManifest, r as resolveSkillPath, t as resolveGroupSkills } from "./registry.mjs";
+import { join } from "path";
+import { homedir } from "os";
+import { access, readdir } from "fs/promises";
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+async function runVerifyCommand(args) {
+	const subcommand = args[0];
+	if (subcommand === "structure") await runVerifyStructureCommand();
+	else if (subcommand === "integrity") await runVerifyIntegrityCommand();
+	else if (subcommand === "empty-global-skills") await runVerifyEmptyGlobalSkillsCommand();
+	else {
+		M.error(`Unknown verify subcommand: ${subcommand}. Use 'structure', 'integrity', or 'empty-global-skills'.`);
+		process.exit(1);
+	}
+}
+async function runVerifyStructureCommand() {
+	let manifest;
+	try {
+		manifest = await readManifest();
+	} catch (error) {
+		if (error instanceof ManifestSchemaError) {
+			M.error(import_picocolors.default.red(`Invalid skills.json: ${error.message}`));
+			process.exit(1);
+		}
+		throw error;
+	}
+	let failures = 0;
+	let total = 0;
+	if (manifest.groups) try {
+		assertConsumerGroupsShape(manifest.groups);
+	} catch (error) {
+		if (error instanceof ManifestSchemaError) {
+			M.error(import_picocolors.default.red(`Invalid skills.json: ${error.message}`));
+			process.exit(1);
+		}
+		throw error;
+	}
+	if (manifest.groups && manifest.groups.include.length > 0) {
+		M.step(`Verifying groups from registry @ ${import_picocolors.default.yellow(manifest.groups.version)}...`);
+		let registryManifest;
+		try {
+			registryManifest = await resolveRegistryManifest(manifest.groups.version);
+		} catch (error) {
+			M.error(import_picocolors.default.red(`Failed to fetch registry at ref "${manifest.groups.version}": ${error instanceof Error ? error.message : error}`));
+			process.exit(1);
+		}
+		for (const groupName of manifest.groups.include) {
+			total++;
+			try {
+				const skills = resolveGroupSkills(registryManifest, groupName);
+				M.message(`  ${import_picocolors.default.green("✓")} Group ${import_picocolors.default.cyan(groupName)}: ${skills.length} skills`);
+			} catch (error) {
+				M.error(`  ${import_picocolors.default.red("✗")} Group ${import_picocolors.default.cyan(groupName)}: ${error instanceof Error ? error.message : error}`);
+				failures++;
+			}
+		}
+	}
+	if (manifest.skills) for (const [skillName, ref] of Object.entries(manifest.skills)) {
+		total++;
+		try {
+			resolveSkillPath(await resolveRegistryManifest(ref), skillName);
+			M.message(`  ${import_picocolors.default.green("✓")} Skill ${import_picocolors.default.cyan(skillName)} @ ${import_picocolors.default.yellow(ref)}`);
+		} catch (error) {
+			M.error(`  ${import_picocolors.default.red("✗")} Skill ${import_picocolors.default.cyan(skillName)} @ ${import_picocolors.default.yellow(ref)}: ${error instanceof Error ? error.message : error}`);
+			failures++;
+		}
+	}
+	if (total === 0) {
+		M.info("No skills or groups found in skills.json to verify.");
+		return;
+	}
+	if (failures > 0) {
+		M.error(import_picocolors.default.red(`Verification failed: ${failures} out of ${total} entries could not be resolved.`));
+		process.exit(1);
+	} else M.success(import_picocolors.default.green(`Verification complete. All ${total} entries resolved successfully.`));
+}
+async function runVerifyIntegrityCommand() {
+	M.step(`Verifying local skills integrity...`);
+	const lock = await readLocalLock(process.cwd());
+	const allowedSkills = new Set(Object.keys(lock.skills));
+	let failures = 0;
+	const directoriesToScan = /* @__PURE__ */ new Set();
+	directoriesToScan.add(getCanonicalSkillsDir(false));
+	const installedAgents = await detectInstalledAgents();
+	for (const agent of installedAgents) directoriesToScan.add(getAgentBaseDir(agent, false));
+	for (const dir of directoriesToScan) {
+		try {
+			await access(dir);
+		} catch {
+			continue;
+		}
+		const entries = await readdir(dir, { withFileTypes: true });
+		for (const entry of entries) {
+			if (entry.name.startsWith(".")) continue;
+			if (!allowedSkills.has(entry.name)) {
+				M.error(import_picocolors.default.red(`Unauthorized skill detected in ${dir}: ${entry.name}`));
+				failures++;
+			}
+		}
+	}
+	for (const [skillName, entry] of Object.entries(lock.skills)) {
+		const canonicalDir = join(getCanonicalSkillsDir(false), skillName);
+		try {
+			await access(canonicalDir);
+			const computed = await computeSkillFolderHash(canonicalDir);
+			if (computed !== entry.computedHash) {
+				M.error(import_picocolors.default.red(`Integrity verification failed for authorized skill: ${skillName}`));
+				M.error(import_picocolors.default.dim(`Expected: ${entry.computedHash}`));
+				M.error(import_picocolors.default.dim(`Computed: ${computed}`));
+				failures++;
+			} else M.message(`Integrity verified for ${import_picocolors.default.cyan(skillName)}`);
+		} catch {
+			M.error(import_picocolors.default.red(`Skill ${skillName} is in lockfile but not found locally at ${canonicalDir}`));
+			failures++;
+		}
+	}
+	if (failures > 0) {
+		M.error(import_picocolors.default.red(`Integrity Verification Failed: ${failures} anomalies detected.`));
+		process.exit(1);
+	} else M.success(import_picocolors.default.green(`Integrity complete. No unauthorized skills or tampered contents detected.`));
+}
+async function checkEmptyGlobalSkills(homeDir) {
+	const findings = [];
+	const realHome = homedir();
+	const globalDirs = /* @__PURE__ */ new Set();
+	for (const config of Object.values(agents)) if (config.globalSkillsDir) {
+		let dir = config.globalSkillsDir;
+		if (homeDir && dir.startsWith(realHome)) dir = join(homeDir, dir.slice(realHome.length));
+		globalDirs.add(dir);
+	}
+	for (const dir of globalDirs) {
+		try {
+			await access(dir);
+		} catch {
+			continue;
+		}
+		const nonHidden = (await readdir(dir, { withFileTypes: true })).filter((e) => !e.name.startsWith("."));
+		if (nonHidden.length > 0) {
+			const names = nonHidden.map((e) => e.name);
+			findings.push(`Global skills found in ${dir}: ${names.join(", ")}`);
+		}
+	}
+	const lockPath = homeDir ? join(homeDir, ".agents", ".skill-lock.json") : join(realHome, ".agents", ".skill-lock.json");
+	try {
+		await access(lockPath);
+		findings.push(`Global skill lock file exists: ${lockPath}`);
+	} catch {}
+	return {
+		clean: findings.length === 0,
+		findings
+	};
+}
+async function runVerifyEmptyGlobalSkillsCommand() {
+	const result = await checkEmptyGlobalSkills();
+	if (result.clean) M.success(import_picocolors.default.green("No global skills detected. Global directories are clean."));
+	else {
+		for (const finding of result.findings) M.error(import_picocolors.default.red(finding));
+		process.exit(1);
+	}
+}
+export { runVerifyCommand };

package/dist/cli.d.mts

@@ -0,0 +1 @@
+export { };