@rayul/kordis 0.1.9 → 0.1.11

package/assets/kordis-publishing/SKILL.md

@@ -14,10 +14,18 @@ Publish a valid, AI-review-passing version. ALWAYS dry-run first.
 - `name` — must equal slug, lowercase-with-hyphens.
 - `description` — 1–2 sentences, slightly **pushy** ("Use whenever the
   user…"). Claude under-triggers without pushiness.
-- `version` — semver.
+- `version` — semver. **Behaviour differs by path** (see below).
 - `license` — SPDX (e.g. `MIT`, `Apache-2.0`, `CC-BY-4.0`).
 - Optional: `homepage`, `tags`, `type`.
 
+**`version` field handling:**
+- **First publish** — used as-is (else defaults to `0.1.0`).
+- **Update** — the registry computes the next version from
+  `current_version + --bump <strategy>` (default `patch`). If the file's
+  `version` differs from that result, the API rejects with `usage`. Either
+  drop the `version` field on updates, set `--bump` to match, or align
+  them.
+
 If the body contains third-party content, MUST preserve the original copyright
 and license text inside the body and link to source via `homepage`.
 
@@ -40,7 +48,14 @@ and license text inside the body and link to source via `homepage`.
 
 ### 1. Dry-run
 `kordis push <file> --dry-run --json`. Returns the same validation, conflict,
-and AI-review verdicts a real push would produce.
+and version-resolution verdicts a real push would produce.
+
+CAVEAT: dry-run does NOT exercise the AI reviewer — it short-circuits with
+a synthetic `review.result: "passed"` (`prompt_version: "stub-v0"`). Treat
+dry-run as syntactic + structural validation only. A real push routes
+through the AI review worker, which can land terminal `passed` /
+`rejected`, OR leave the publish in `status: "pending"` if the worker
+hasn't decided within the wait window.
 
 **Success criteria**: dry-run returns a `status: "published"`-shaped envelope
 with no error flags.
@@ -51,7 +66,8 @@ Possible verdicts:
 - `conflict` (exit 40) — slug taken; suggest a different slug (or pass
   `--slug` if first publish).
 - `ai_review_rejected` (exit 32) — EXPLAIN the rejection to the user. Do NOT
-  silently retry.
+  silently retry. Includes deterministic Stage-1 hits like
+  `curl_pipe_shell`, `aws_access_key`, `private_key_block`, etc.
 - `rate_limited` (exit 31) — wait `retry_after_seconds`.
 - `not_authenticated` (exit 10) — `kordis login`, then retry.
 
@@ -61,8 +77,12 @@ Possible verdicts:
 `kordis push <file> --json`. Add `--bump minor` (or `major`) when shipping a
 non-patch update.
 
-**Success criteria**: returns `{full_slug, version, url}`. Show all three to
-the user.
+**Success criteria**: returns `{full_slug, version, url, status}`. Show all
+four to the user. If `status: "pending"`, the AI reviewer hasn't decided
+yet — re-check with `kordis info <full_slug> --json` (or wait and re-run
+`kordis info`); the `pending` page is not yet served on the public URL.
+If `status: "rejected"`, surface `review.flags` to the user and DO NOT
+silently retry — explain why.
 
 ## Examples
 
@@ -76,7 +96,10 @@ User: "publish my new skill"
 
 <example>
 User: "release v0.2.0 of <full_slug>"
-1. update `version: 0.2.0` in the file's frontmatter
+- previous version was 0.1.x
+1. drop or align the frontmatter `version` field — `--bump minor` from
+   0.1.x will yield 0.2.0; if the file says `0.2.0` that matches and is OK,
+   if it says anything else (e.g. `0.1.0`) the API will reject
 2. kordis push <file> --bump minor --dry-run --json
 3. clean → kordis push <file> --bump minor --json
 </example>
@@ -86,3 +109,25 @@ User: "release with a note that breaking-changes the API"
 1. kordis push <file> --bump major --changelog "BREAKING: <summary>" --dry-run --json
 2. clean → drop --dry-run for the real push
 </example>
+
+## Forking another Kordis package
+
+When the user asks to fork / adapt / republish someone else's package
+under their own slug, do the following:
+
+1. **License first.** Read the upstream `license` field (`kordis info
+   <upstream> --json`). MIT / Apache-2.0 / BSD all permit derivatives;
+   CC-BY-SA forces ShareAlike (your fork must use the same license).
+   GPL-flavoured / proprietary → STOP and tell the user.
+2. **Carry the legal minimum.** Preserve the upstream copyright and
+   permission notices verbatim inside the body. Do NOT strip them.
+3. **Credit upstream.** In the new package's body, add a `Derived from
+   <upstream-full-slug>` line near the top, and point `homepage` at the
+   upstream source (the original repo, not the Kordis page — `homepage`
+   is for the canonical authoring source).
+4. **Pick a fresh slug.** A fork is a *new* package; do not reuse the
+   upstream slug. Start at `0.1.0` (or whatever the file's `version` says
+   on first publish).
+5. **Tag derivation in `description`.** A short " — fork of
+   <upstream-full-slug>" suffix is enough; users searching the fork need
+   to know.

package/assets/kordis-search/SKILL.md

@@ -59,7 +59,15 @@ array.
 - For trending results, the `trending_score` field is populated — surface it
   when comparing.
 - IMPORTANT: if results are 0, RELAX one filter at a time before giving up.
-  Do NOT invent a slug to fill the gap.
+  **Drop `--tool` first** — many published packages have an empty
+  `tools_compatible` field, so `--tool <name>` undercounts hard. Then drop
+  `--type`. Then shorten the query. Do NOT invent a slug to fill the gap.
+- Most packages on the registry are very young — `stars` and `downloads` are
+  often `0`. Lean on `review_status: passed` and the description text match,
+  not on social signals alone.
+- For richer triage data, prefer `kordis search --json` over
+  `kordis info --json` — search returns `description`, `tier`,
+  `review_status`, `tools_compatible`, etc. per result; `info` is sparser.
 - Surface the top 3–5 with slug, type, tier, stars, one-line description.
 
 **Success criteria**: user picked one, or you reported "no fit" honestly.

package/assets/kordis-social/SKILL.md

@@ -34,15 +34,30 @@ Post a top-level comment on a package. Auth required.
 | `--kind <k>`   | `comment` (default), `tip`, `report`, `praise`, `question`       |
 | `--title <t>`  | 1–140 chars; honoured for top-level posts only                   |
 
-Replies, edits, status flips (open/resolved on a `report`), and listing
-existing comments are NOT yet exposed in the CLI. Direct the user to
-`https://kordis.store/p/<full_slug>` for those interactions until verbs land.
+**Pick the right `--kind`:**
+- `comment` — generic remark, default when nothing more specific fits.
+- `tip` — actionable advice for OTHER users ("works great if you also
+  pull <other-slug>"). Subject of the post is reader, not author.
+- `report` — bug / problem report. Has an open/resolved status (managed on
+  the web today).
+- `praise` — short thank-you / compliment to the author. Body is enough;
+  `--title` is optional.
+- `question` — explicit question expecting a reply (typically from the
+  author). Use when the user wants a response, not just to share thought.
+
+Replies, edits, status flips (open/resolved on a `report`), listing
+existing comments, and reading back your own comments are NOT yet exposed
+in the CLI. Direct the user to `https://kordis.store/p/<full_slug>` for
+those interactions until verbs land.
 
 ## Star commands
 
 ### `kordis star <full_slug> [--json]`
 Mark a package as a favourite. Idempotent — re-running on an already-starred
-package returns the current count without a duplicate. Auth required.
+package returns the current count without a duplicate. Auth required. The
+response shape is the same whether the call newly starred or no-op'd; if the
+user wants to verify a NEW star landed, compare `stars` from `kordis info
+<full_slug> --json` before and after.
 
 ### `kordis unstar <full_slug> [--json]`
 Remove your star. Idempotent — silent no-op when not previously starred.

package/assets/kordis-using/SKILL.md

@@ -43,6 +43,15 @@ Writes files into the current project.
 | `--target <path>`     | install into a sub-directory (default: cwd)          |
 | `--with-recommends`   | also install recommended dependencies                |
 
+IMPORTANT: `pull` **fails fast** when the target tool can't be inferred from
+the cwd (no `.claude/`, `.codex/`, `.cursor/`, `AGENTS.md`, `CLAUDE.md`,
+etc.). Pass `--tool <name>` explicitly when running in a project that has
+not been initialised for any specific tool yet. Don't rely on the old "drop
+a canonical SKILL.md at cwd" fallback — Claude Code never picked it up.
+
+Valid `--tool` values: `claude-code`, `codex`, `cursor`, `continue`,
+`windsurf`, `antigravity`, `copilot`.
+
 ### `kordis info <full_slug> --json`
 Inspect metadata (description, tier, deps, license, review status, …) before
 reading or pulling. ALWAYS run this for `mcp-server` / `hook` types, where the
@@ -91,6 +100,17 @@ auto-resolve silently.
 `"following <full_slug>@<version>"`). RECOMMENDED: end your reply with that
 exact line. Skip only when it would clutter a casual non-technical reply.
 
+## Bundled assets
+Skills published as a `.skill` bundle or directory include `assets/`,
+`references/`, `scripts/`, and `agents/` subdirectories alongside
+`SKILL.md`. After `kordis pull`, these files land next to `SKILL.md` in
+the tool's skill directory (e.g. `.claude/skills/<name>/assets/foo.html`)
+and are directly readable by the agent.
+
+If a skill body references a helper file and the file isn't present after
+pull, the package was published as a single-file skill — follow its
+`homepage` to the upstream source.
+
 ## Examples
 
 <example>

package/dist/index.js

@@ -459,7 +459,7 @@ var init_auth = __esm({
 
 // ../../packages/contracts/src/api.ts
 import { z as z9 } from "zod";
-var SearchQuerySchema, SearchResponseSchema, TrendingQuerySchema, RisingQuerySchema, StarResponseSchema, PublishPackageRequestSchema, PublishWaitQuerySchema, PublishPackageResponseSchema, PackagePathParamsSchema, ContentQuerySchema, PackageContentResponseSchema, JitReadRequestSchema, JitReadResponseSchema, PullPackageResponseSchema, ListVersionsResponseSchema, VersionDiffQuerySchema, ListCommentsQuerySchema, ListCommentsResponseSchema, UserProfileResponseSchema, UserPackagesQuerySchema;
+var SearchQuerySchema, SearchResponseSchema, TrendingQuerySchema, RisingQuerySchema, StarResponseSchema, AssetSchema, PublishPackageRequestSchema, PublishWaitQuerySchema, PublishPackageResponseSchema, PackagePathParamsSchema, ContentQuerySchema, PackageContentResponseSchema, JitReadRequestSchema, JitReadResponseSchema, PullPackageResponseSchema, ListVersionsResponseSchema, VersionDiffQuerySchema, ListCommentsQuerySchema, ListCommentsResponseSchema, UserProfileResponseSchema, UserPackagesQuerySchema;
 var init_api = __esm({
   "../../packages/contracts/src/api.ts"() {
     "use strict";
@@ -498,6 +498,11 @@ var init_api = __esm({
       starred: z9.boolean(),
       star_count: z9.number().int().nonnegative()
     });
+    AssetSchema = z9.object({
+      path: z9.string().min(1).max(255),
+      content: z9.string(),
+      encoding: z9.enum(["utf8", "base64"]).default("utf8")
+    });
     PublishPackageRequestSchema = z9.object({
       /**
        * Raw source content — YAML frontmatter + markdown body. Server parses and
@@ -528,7 +533,12 @@ var init_api = __esm({
       /**
        * Skip draft validation (preview mode) — only allowed in dev builds.
        */
-      dry_run: z9.boolean().optional()
+      dry_run: z9.boolean().optional(),
+      /**
+       * Bundled files beyond SKILL.md: assets, references, scripts, agents, etc.
+       * Max 50 entries; max 2 MB per file; max 5 MB total bundle.
+       */
+      assets: z9.array(AssetSchema).max(50).optional()
     });
     PublishWaitQuerySchema = z9.object({
       /**
@@ -574,8 +584,9 @@ var init_api = __esm({
       version: SemverSchema,
       format: z9.string(),
       content: z9.string(),
-      notes: z9.array(z9.string()).default([])
+      notes: z9.array(z9.string()).default([]),
       // translator warnings, e.g. ".mdc → Claude: @filepath unsupported"
+      assets: z9.array(AssetSchema).default([])
     });
     JitReadRequestSchema = z9.object({
       /**
@@ -1004,6 +1015,7 @@ import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, unlink
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 var SERVICE = "kordis";
+var plaintextWarningEmitted = false;
 async function loadKeytar() {
   try {
     const mod = await import("keytar");
@@ -1031,6 +1043,16 @@ async function createKeychain() {
       }
     };
   }
+  if (!plaintextWarningEmitted && process.env["KORDIS_JSON"] !== "1") {
+    plaintextWarningEmitted = true;
+    const yellow = "\x1B[33m";
+    const reset = "\x1B[0m";
+    process.stderr.write(
+      `${yellow}[kordis] WARNING: OS keychain unavailable; falling back to plaintext token storage at ~/.kordis/.tokens.json (mode 0600).
+[kordis] On macOS install Xcode Command Line Tools, on Linux install libsecret-1-dev to enable keytar.${reset}
+`
+    );
+  }
   const store = await readAll();
   return {
     async save(username, tokens) {
@@ -1321,8 +1343,9 @@ function searchCommand() {
 
 // src/commands/push.ts
 import { Command as Command4 } from "commander";
-import { readFile as readFile3 } from "fs/promises";
-import { resolve } from "path";
+import { readFile as readFile3, stat, readdir } from "fs/promises";
+import { resolve, join as join4, posix, sep } from "path";
+import JSZip from "jszip";
 
 // ../../packages/harness-schema/src/parser.ts
 import { parse as parseYaml } from "yaml";
@@ -1366,21 +1389,30 @@ var FrontmatterParseError = class extends Error {
 
 // src/commands/push.ts
 function pushCommand() {
-  return new Command4("push").description("publish a new package or a new version").argument("<file>", "path to the canonical package source").option("--bump <strategy>", "patch|minor|major (update only)", "patch").option(
+  return new Command4("push").description("publish a new package or a new version").argument("<path>", "SKILL.md file, .skill ZIP, or skill directory").option("--bump <strategy>", "patch|minor|major (update only)", "patch").option(
     "--slug <slug>",
     'override slug; accepts "user/slug" to point at a specific package'
   ).option("--type <type>", "override type inference").option("--changelog <text>", "optional changelog entry").option("--dry-run", "validate only; do not publish").option("--no-wait", "return immediately without waiting for review").action(
-    async (file, opts) => {
+    async (path, opts) => {
       const bundle = await useClient();
-      const abs = resolve(process.cwd(), file);
-      const content = await readFile3(abs, "utf8");
+      const abs = resolve(process.cwd(), path);
+      const s = await stat(abs);
+      let content;
+      let assets = [];
+      if (s.isDirectory()) {
+        ({ content, assets } = await bundleDirectory(abs));
+      } else if (abs.endsWith(".skill")) {
+        ({ content, assets } = await bundleSkillZip(abs));
+      } else {
+        content = await readFile3(abs, "utf8");
+      }
       let targetUser = null;
       let targetSlug = null;
       if (opts.slug && opts.slug.includes("/")) {
-        const [u, s] = opts.slug.split("/", 2);
-        if (u && s) {
+        const [u, s2] = opts.slug.split("/", 2);
+        if (u && s2) {
           targetUser = u;
-          targetSlug = s;
+          targetSlug = s2;
         }
       } else {
         let nameFromFm = null;
@@ -1415,6 +1447,7 @@ function pushCommand() {
         (api) => api.publish(
           {
             content,
+            assets: assets.length > 0 ? assets : void 0,
             bump: opts.bump,
             slug: opts.slug && !opts.slug.includes("/") ? opts.slug : void 0,
             target_full_slug: targetFullSlug,
@@ -1434,7 +1467,17 @@ function pushCommand() {
           printHuman(
             `${c.bold(res.full_slug)} ${c.gray(`v${res.version}`)} \u2192 ${res.status === "published" ? c.green("published") : res.status === "pending" ? c.yellow("pending review") : c.red("rejected")}`
           );
+          if (assets.length > 0) {
+            printHuman(c.gray(`  + ${assets.length} bundled file(s)`));
+          }
           printHuman(`  ${c.cyan(res.url)}`);
+          if (res.status === "pending") {
+            printHuman(
+              c.yellow(
+                `  ! AI review is still pending \u2014 re-check with \`kordis info ${res.full_slug} --json\` for the verdict.`
+              )
+            );
+          }
           if (res.review.flags.length > 0) {
             printHuman(c.yellow(`  ${res.review.flags.length} review flag(s):`));
             for (const f of res.review.flags) {
@@ -1446,11 +1489,94 @@ function pushCommand() {
     }
   );
 }
+var EXCLUDE_NAMES = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db", ".gitkeep"]);
+var EXCLUDE_DIRS = /* @__PURE__ */ new Set(["__pycache__", "node_modules", ".git", "evals", "dist", ".turbo"]);
+var EXCLUDE_EXTS = /* @__PURE__ */ new Set([".pyc", ".pyo", ".rbc"]);
+function shouldExclude(relPath, isDir) {
+  const parts = relPath.split(posix.sep);
+  const name = parts[parts.length - 1];
+  if (EXCLUDE_NAMES.has(name)) return true;
+  if (isDir && EXCLUDE_DIRS.has(name)) return true;
+  const ext = name.includes(".") ? "." + name.split(".").pop() : "";
+  if (EXCLUDE_EXTS.has(ext)) return true;
+  return false;
+}
+async function walkDir(base, relDir, collected) {
+  const entries = await readdir(join4(base, relDir), { withFileTypes: true });
+  for (const entry of entries) {
+    const rel = relDir ? `${relDir}/${entry.name}` : entry.name;
+    if (shouldExclude(rel, entry.isDirectory())) continue;
+    if (entry.isDirectory()) {
+      await walkDir(base, rel, collected);
+    } else if (entry.isFile()) {
+      collected.push({ rel, abs: join4(base, rel) });
+    }
+  }
+}
+async function readAsset(absPath) {
+  const buf = await readFile3(absPath);
+  const text = buf.toString("utf8");
+  const roundtrip = Buffer.from(text, "utf8");
+  if (roundtrip.equals(buf)) {
+    return { content: text, encoding: "utf8" };
+  }
+  const b64 = buf.toString("base64");
+  printHuman(c.gray(`  \u2192 encoding ${absPath.split(sep).pop()} as base64`));
+  return { content: b64, encoding: "base64" };
+}
+async function bundleDirectory(dir) {
+  const all = [];
+  await walkDir(dir, "", all);
+  const skillEntry = all.find((f) => f.rel === "SKILL.md");
+  if (!skillEntry) {
+    throw new Error(`No SKILL.md found in directory ${dir}. Push a directory that has SKILL.md at its root.`);
+  }
+  const content = await readFile3(skillEntry.abs, "utf8");
+  const assets = [];
+  for (const f of all) {
+    if (f.rel === "SKILL.md") continue;
+    const { content: fc, encoding } = await readAsset(f.abs);
+    assets.push({ path: f.rel, content: fc, encoding });
+  }
+  return { content, assets };
+}
+async function bundleSkillZip(zipPath) {
+  const buf = await readFile3(zipPath);
+  const zip = await JSZip.loadAsync(buf);
+  const entries = Object.keys(zip.files).filter((k) => !zip.files[k].dir);
+  if (entries.length === 0) throw new Error(".skill file is empty");
+  const firstParts = entries[0].split("/");
+  const prefix = firstParts.length > 1 ? firstParts[0] + "/" : "";
+  const stripped = entries.map((k) => ({
+    zipKey: k,
+    rel: prefix ? k.slice(prefix.length) : k
+  })).filter((f) => f.rel.length > 0 && !shouldExclude(f.rel, false));
+  const skillEntry = stripped.find((f) => f.rel === "SKILL.md");
+  if (!skillEntry) {
+    throw new Error(`.skill ZIP has no SKILL.md at its root (prefix="${prefix}")`);
+  }
+  const content = await zip.files[skillEntry.zipKey].async("string");
+  const assets = [];
+  for (const f of stripped) {
+    if (f.rel === "SKILL.md") continue;
+    const rawBuf = await zip.files[f.zipKey].async("uint8array");
+    const buf2 = Buffer.from(rawBuf);
+    const text = buf2.toString("utf8");
+    const roundtrip = Buffer.from(text, "utf8");
+    if (roundtrip.equals(buf2)) {
+      assets.push({ path: f.rel, content: text, encoding: "utf8" });
+    } else {
+      printHuman(c.gray(`  \u2192 encoding ${f.rel} as base64`));
+      assets.push({ path: f.rel, content: buf2.toString("base64"), encoding: "base64" });
+    }
+  }
+  return { content, assets };
+}
 
 // src/commands/pull.ts
 import { Command as Command5 } from "commander";
 import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 
 // ../../packages/harness-schema/src/deps.ts
 init_src();
@@ -1770,7 +1896,12 @@ var BLOCKING_CODES = /* @__PURE__ */ new Set([
   "missing_description",
   "invalid_frontmatter",
   "content_too_short",
-  "content_too_long"
+  "content_too_long",
+  // asset-bundle codes
+  "asset_path_unsafe",
+  "asset_too_large",
+  "bundle_too_large",
+  "too_many_assets"
 ]);
 function earlyExit(firstFlag, override = {}) {
   return {
@@ -1853,10 +1984,11 @@ function buildSkillFile(input, outputPath) {
   }
   frontmatter.push("---");
   const content = frontmatter.join("\n") + "\n\n" + body;
+  const resolvedPath = outputPath.replace("{name}", String(name));
   return {
     files: [
       {
-        path: outputPath.replace("{name}", String(name)),
+        path: resolvedPath,
         content,
         mergeable: false,
         format: "markdown"
@@ -1866,17 +1998,45 @@ function buildSkillFile(input, outputPath) {
     format: "agent-skills"
   };
 }
-var skillToClaude = (input) => buildSkillFile(input, ".claude/skills/{name}/SKILL.md");
-var skillToCodex = (input) => buildSkillFile(input, ".codex/skills/{name}.md");
-var skillToCursor = (input) => buildSkillFile(input, ".cursor/skills/{name}.md");
-var skillToWindsurf = (input) => buildSkillFile(input, ".windsurf/skills/{name}.md");
-var skillToContinue = (input) => buildSkillFile(input, ".continue/skills/{name}.md");
-var skillToCopilot = (input) => buildSkillFile(input, ".github/skills/{name}.md");
-var skillToGeminiCli = (input) => buildSkillFile(input, ".gemini/skills/{name}.md");
-var skillToOpenCode = (input) => buildSkillFile(input, ".opencode/skills/{name}.md");
-var skillToAntigravity = (input) => buildSkillFile(input, ".antigravity/skills/{name}.md");
+function buildSkillDir(input, outputPath) {
+  const result = buildSkillFile(input, outputPath);
+  const skillMdPath = result.files[0].path;
+  const skillDir = skillMdPath.slice(0, skillMdPath.lastIndexOf("/"));
+  const assetFiles = (input.assets ?? []).map((asset) => ({
+    path: `${skillDir}/${asset.path}`,
+    content: asset.content,
+    mergeable: false,
+    format: "plain",
+    encoding: asset.encoding ?? "utf8"
+  }));
+  return {
+    files: [...result.files, ...assetFiles],
+    notes: result.notes,
+    format: result.format
+  };
+}
+function buildSkillSingleFile(input, outputPath) {
+  const result = buildSkillFile(input, outputPath);
+  const notes = [...result.notes];
+  if (input.assets && input.assets.length > 0) {
+    const tool = outputPath.split("/")[0]?.replace(".", "") ?? "this tool";
+    notes.push(
+      `${input.assets.length} bundled asset(s) not installed \u2014 ${tool} uses single-file skill convention. Pull with --tool claude-code to install the full bundle.`
+    );
+  }
+  return { ...result, notes };
+}
+var skillToClaude = (input) => buildSkillDir(input, ".claude/skills/{name}/SKILL.md");
+var skillToCodex = (input) => buildSkillDir(input, ".codex/skills/{name}/SKILL.md");
+var skillToCursor = (input) => buildSkillSingleFile(input, ".cursor/skills/{name}.md");
+var skillToWindsurf = (input) => buildSkillSingleFile(input, ".windsurf/skills/{name}.md");
+var skillToContinue = (input) => buildSkillSingleFile(input, ".continue/skills/{name}.md");
+var skillToCopilot = (input) => buildSkillSingleFile(input, ".github/skills/{name}.md");
+var skillToGeminiCli = (input) => buildSkillDir(input, ".gemini/skills/{name}/SKILL.md");
+var skillToOpenCode = (input) => buildSkillSingleFile(input, ".opencode/skills/{name}.md");
+var skillToAntigravity = (input) => buildSkillSingleFile(input, ".antigravity/skills/{name}.md");
 var skillCanonical = (input) => {
-  const res = buildSkillFile(input, "SKILL.md");
+  const res = buildSkillDir(input, "SKILL.md");
   res.format = "agent-skills-canonical";
   return res;
 };
@@ -2255,6 +2415,11 @@ function pullCommand() {
       const userCwd = process.env["INIT_CWD"] ?? process.cwd();
       const installRoot = opts.target ?? userCwd;
       const detected = opts.tool ?? await detectTool(installRoot);
+      if (!detected) {
+        throw new Error(
+          "Cannot detect target tool from the current directory.\n  Pass --tool <name> explicitly. Valid: claude-code, codex, cursor,\n  continue, windsurf, antigravity, copilot.\n  Or run `kordis pull` inside a project that already has one of:\n  .claude/, .codex/, .cursor/, AGENTS.md, CLAUDE.md, .cursorrules,\n  .continue/, .windsurf/, .antigravity/, .github/copilot-instructions.md"
+        );
+      }
       const spin = spinner(`Pulling ${fullSlug}`);
       const detail = await bundle.api.getPackage(username, slug);
       await bundle.api.pull(username, slug);
@@ -2268,19 +2433,20 @@ function pullCommand() {
       }
       const written = [];
       const notes = [];
-      const format = detected ?? "canonical";
+      const format = detected;
       try {
         const translator = getTranslator(parsed.type, format);
         const result = translator({
           fullSlug,
           frontmatter: parsed.frontmatter.data,
           body: parsed.body,
-          version: contentRes.version
+          version: contentRes.version,
+          assets: contentRes.assets
         });
         for (const f of result.files) {
-          const abs = join4(installRoot, f.path);
+          const abs = join5(installRoot, f.path);
           await mkdir3(dirname2(abs), { recursive: true });
-          await writeFile3(abs, f.content, "utf8");
+          await writeEmittedFile(abs, f.content, f.encoding);
           written.push(abs);
         }
         notes.push(...result.notes);
@@ -2291,15 +2457,16 @@ function pullCommand() {
             fullSlug,
             frontmatter: parsed.frontmatter.data,
             body: parsed.body,
-            version: contentRes.version
+            version: contentRes.version,
+            assets: contentRes.assets
           });
           notes.push(
             `Tool "${format}" is not supported for type "${parsed.type}"; installed canonical form instead.`
           );
           for (const f of result.files) {
-            const abs = join4(installRoot, f.path);
+            const abs = join5(installRoot, f.path);
             await mkdir3(dirname2(abs), { recursive: true });
-            await writeFile3(abs, f.content, "utf8");
+            await writeEmittedFile(abs, f.content, f.encoding);
             written.push(abs);
           }
         } else {
@@ -2327,7 +2494,7 @@ function pullCommand() {
   );
 }
 async function detectTool(root) {
-  const { stat } = await import("fs/promises");
+  const { stat: stat2 } = await import("fs/promises");
   const checks = [
     [".claude", "claude-code"],
     [".cursor", "cursor"],
@@ -2343,13 +2510,20 @@ async function detectTool(root) {
   ];
   for (const [path, tool] of checks) {
     try {
-      await stat(join4(root, path));
+      await stat2(join5(root, path));
       return tool;
     } catch {
     }
   }
   return null;
 }
+async function writeEmittedFile(abs, content, encoding) {
+  if (encoding === "base64") {
+    await writeFile3(abs, Buffer.from(content, "base64"));
+  } else {
+    await writeFile3(abs, content, "utf8");
+  }
+}
 
 // src/commands/read.ts
 import { Command as Command6 } from "commander";
@@ -2449,7 +2623,7 @@ function logoutCommand() {
 // src/commands/setup.ts
 import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir4, access } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join5, dirname as dirname3 } from "path";
+import { join as join6, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command as Command9 } from "commander";
 var MARKER_START = "<!-- kordis-start -->";
@@ -2482,18 +2656,18 @@ function assetRoots() {
   const __dir2 = dirname3(fileURLToPath2(import.meta.url));
   return {
     // Built binary: bin/kordis.js → assets/ is one level up
-    bundled: join5(__dir2, "..", "assets"),
+    bundled: join6(__dir2, "..", "assets"),
     // Dev mode: src/commands/setup.ts → 4 levels up to repo root, then packages/skills/
-    source: join5(__dir2, "..", "..", "..", "..", "packages", "skills")
+    source: join6(__dir2, "..", "..", "..", "..", "packages", "skills")
   };
 }
 async function pickAssetRoot() {
   const { bundled, source } = assetRoots();
-  return await exists(join5(bundled, "KORDIS.md")) ? bundled : source;
+  return await exists(join6(bundled, "KORDIS.md")) ? bundled : source;
 }
 async function loadHubContent() {
   const root = await pickAssetRoot();
-  const raw = await readFile4(join5(root, "KORDIS.md"), "utf-8");
+  const raw = await readFile4(join6(root, "KORDIS.md"), "utf-8");
   if (raw.startsWith("---")) {
     const end = raw.indexOf("\n---", 4);
     if (end !== -1) return raw.slice(end + 4).trimStart();
@@ -2502,7 +2676,7 @@ async function loadHubContent() {
 }
 async function loadSubSkillContent(name) {
   const root = await pickAssetRoot();
-  return readFile4(join5(root, name, "SKILL.md"), "utf-8");
+  return readFile4(join6(root, name, "SKILL.md"), "utf-8");
 }
 async function injectBlock(filePath, content, dryRun) {
   const block = `${MARKER_START}
@@ -2570,8 +2744,8 @@ function setupCommand() {
     let anyFound = false;
     const changedTools = /* @__PURE__ */ new Set();
     for (const target of HUB_TARGETS) {
-      const dirPath = join5(home, target.dir);
-      const filePath = join5(home, target.file);
+      const dirPath = join6(home, target.dir);
+      const filePath = join6(home, target.file);
       if (!await exists(dirPath)) {
         if (!opts.silent) {
           printHuman(c.gray(`  - ${target.tool.padEnd(12)} not installed, skipped`));
@@ -2598,10 +2772,10 @@ function setupCommand() {
       }
     }
     for (const target of SKILL_TARGETS) {
-      const dirPath = join5(home, target.dir);
+      const dirPath = join6(home, target.dir);
       if (!await exists(dirPath)) continue;
       for (const subName of SUB_SKILLS) {
-        const filePath = join5(home, target.skillsDir, subName, "SKILL.md");
+        const filePath = join6(home, target.skillsDir, subName, "SKILL.md");
         const dest = `~/${target.skillsDir}/${subName}/SKILL.md`;
         try {
           const result = await copyBundledSkill(filePath, subSkillContents[subName], dryRun);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rayul/kordis",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": false,
   "description": "Command-line client for the Kordis registry — discover, install, and publish agentic-coding packages.",
   "license": "MIT",
@@ -26,6 +26,7 @@
   "dependencies": {
     "@iarna/toml": "^2.2.5",
     "commander": "^12.1.0",
+    "jszip": "^3.10.1",
     "kleur": "^4.1.5",
     "open": "^10.1.0",
     "ora": "^8.1.1",
@@ -42,6 +43,7 @@
     "@kordis/contracts": "workspace:*",
     "@kordis/harness-schema": "workspace:*",
     "@kordis/translators": "workspace:*",
+    "@types/jszip": "^3.4.1",
     "@types/node": "^22.9.0",
     "@types/prompts": "^2.4.9",
     "tsup": "^8.3.5",