@sentry/warden 0.0.0 → 0.1.0

package/.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'pnpm'
 
       - run: pnpm install --frozen-lockfile

package/.github/workflows/release.yml

@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   release:
@@ -20,13 +21,17 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'pnpm'
+          registry-url: 'https://registry.npmjs.org'
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
       - run: pnpm build:action
 
+      - name: Publish to npm
+        run: npm publish --provenance --access public
+
       - name: Get version info
         id: version
         run: |

package/.github/workflows/warden.yml

@@ -22,7 +22,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'pnpm'
 
       - run: pnpm install --frozen-lockfile

package/dist/action/159.index.js

@@ -0,0 +1,523 @@
+export const id = 159;
+export const ids = [159];
+export const modules = {
+
+/***/ 2159:
+/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   resolveRemoteSkill: () => (/* binding */ resolveRemoteSkill)
+/* harmony export */ });
+/* unused harmony exports parseRemoteRef, formatRemoteRef, getSkillsCacheDir, getRemotePath, getStatePath, loadState, saveState, getCacheTtlSeconds, shouldRefresh, fetchRemote, discoverRemoteSkills, removeRemote, listCachedRemotes */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(node_fs__WEBPACK_IMPORTED_MODULE_0__);
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8161);
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(node_os__WEBPACK_IMPORTED_MODULE_1__);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(node_path__WEBPACK_IMPORTED_MODULE_2__);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(1421);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(node_child_process__WEBPACK_IMPORTED_MODULE_3__);
+/* harmony import */ var zod__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(606);
+/* harmony import */ var _loader_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(7081);
+
+
+
+
+
+
+/** Default TTL for unpinned remote skills: 24 hours */
+const DEFAULT_TTL_SECONDS = 86400;
+/** Schema for a single remote entry in state.json */
+const RemoteEntrySchema = zod__WEBPACK_IMPORTED_MODULE_5__/* .object */ .Ikc({
+    sha: zod__WEBPACK_IMPORTED_MODULE_5__/* .string */ .YjP(),
+    fetchedAt: zod__WEBPACK_IMPORTED_MODULE_5__/* .string */ .YjP().datetime(),
+});
+/** Schema for the entire state.json file */
+const RemoteStateSchema = zod__WEBPACK_IMPORTED_MODULE_5__/* .object */ .Ikc({
+    remotes: zod__WEBPACK_IMPORTED_MODULE_5__/* .record */ .g1P(zod__WEBPACK_IMPORTED_MODULE_5__/* .string */ .YjP(), RemoteEntrySchema),
+});
+/** Schema for a plugin in marketplace.json */
+const MarketplacePluginSchema = zod__WEBPACK_IMPORTED_MODULE_5__/* .object */ .Ikc({
+    name: zod__WEBPACK_IMPORTED_MODULE_5__/* .string */ .YjP(),
+    source: zod__WEBPACK_IMPORTED_MODULE_5__/* .string */ .YjP(),
+    description: zod__WEBPACK_IMPORTED_MODULE_5__/* .string */ .YjP().optional(),
+    category: zod__WEBPACK_IMPORTED_MODULE_5__/* .string */ .YjP().optional(),
+});
+/** Schema for .claude-plugin/marketplace.json */
+const MarketplaceConfigSchema = zod__WEBPACK_IMPORTED_MODULE_5__/* .object */ .Ikc({
+    $schema: zod__WEBPACK_IMPORTED_MODULE_5__/* .string */ .YjP().optional(),
+    name: zod__WEBPACK_IMPORTED_MODULE_5__/* .string */ .YjP(),
+    description: zod__WEBPACK_IMPORTED_MODULE_5__/* .string */ .YjP().optional(),
+    plugins: zod__WEBPACK_IMPORTED_MODULE_5__/* .array */ .YOg(MarketplacePluginSchema),
+});
+/**
+ * Normalize a GitHub URL to owner/repo format.
+ * Returns null if the input is not a recognized GitHub URL.
+ *
+ * Supports:
+ * - https://github.com/owner/repo
+ * - https://github.com/owner/repo.git
+ * - git@github.com:owner/repo.git
+ */
+function normalizeGitHubUrl(input) {
+    // HTTPS URL: https://github.com/owner/repo or https://github.com/owner/repo.git
+    const httpsMatch = input.match(/^https?:\/\/github\.com\/([^/]+)\/([^/@]+?)(?:\.git)?$/);
+    if (httpsMatch) {
+        return `${httpsMatch[1]}/${httpsMatch[2]}`;
+    }
+    // SSH URL: git@github.com:owner/repo.git
+    const sshMatch = input.match(/^git@github\.com:([^/]+)\/([^/@]+?)(?:\.git)?$/);
+    if (sshMatch) {
+        return `${sshMatch[1]}/${sshMatch[2]}`;
+    }
+    return null;
+}
+/**
+ * Parse a remote reference string into its components.
+ * Supports formats:
+ * - "owner/repo" or "owner/repo@sha"
+ * - "https://github.com/owner/repo" or "https://github.com/owner/repo@sha"
+ * - "https://github.com/owner/repo.git" or "https://github.com/owner/repo.git@sha"
+ * - "git@github.com:owner/repo.git" or "git@github.com:owner/repo.git@sha"
+ */
+function parseRemoteRef(ref) {
+    let inputRef = ref;
+    let sha;
+    // Extract SHA suffix from the input before URL normalization.
+    // The SHA is always at the end, after a @ that follows the repo name.
+    // For git@github.com URLs, we need to find the @ after the colon.
+    if (ref.startsWith('git@')) {
+        const colonIndex = ref.indexOf(':');
+        if (colonIndex !== -1) {
+            const afterColon = ref.slice(colonIndex + 1);
+            const shaAtIndex = afterColon.lastIndexOf('@');
+            if (shaAtIndex !== -1) {
+                sha = afterColon.slice(shaAtIndex + 1);
+                inputRef = ref.slice(0, colonIndex + 1 + shaAtIndex);
+            }
+        }
+    }
+    else {
+        const lastAtIndex = ref.lastIndexOf('@');
+        if (lastAtIndex !== -1) {
+            const potentialSha = ref.slice(lastAtIndex + 1);
+            // SHA should not contain : or / (those would indicate URL structure)
+            if (!potentialSha.includes(':') && !potentialSha.includes('/')) {
+                if (!potentialSha) {
+                    throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Invalid remote ref: ${ref} (empty SHA after @)`);
+                }
+                sha = potentialSha;
+                inputRef = ref.slice(0, lastAtIndex);
+            }
+        }
+    }
+    // Normalize GitHub URLs to owner/repo format
+    const repoPath = normalizeGitHubUrl(inputRef) ?? inputRef;
+    const slashIndex = repoPath.indexOf('/');
+    if (slashIndex === -1) {
+        throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Invalid remote ref: ${ref} (expected owner/repo format)`);
+    }
+    const owner = repoPath.slice(0, slashIndex);
+    const repo = repoPath.slice(slashIndex + 1);
+    if (!owner || !repo) {
+        throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Invalid remote ref: ${ref} (empty owner or repo)`);
+    }
+    if (repo.includes('/')) {
+        throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Invalid remote ref: ${ref} (repo name cannot contain /)`);
+    }
+    // Security: Prevent git flag injection by rejecting values starting with '-'
+    if (owner.startsWith('-')) {
+        throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Invalid remote ref: ${ref} (owner cannot start with -)`);
+    }
+    if (repo.startsWith('-')) {
+        throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Invalid remote ref: ${ref} (repo cannot start with -)`);
+    }
+    if (sha?.startsWith('-')) {
+        throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Invalid remote ref: ${ref} (SHA cannot start with -)`);
+    }
+    return { owner, repo, sha };
+}
+/**
+ * Format a parsed remote ref back to string format.
+ */
+function formatRemoteRef(parsed) {
+    const base = `${parsed.owner}/${parsed.repo}`;
+    return parsed.sha ? `${base}@${parsed.sha}` : base;
+}
+/**
+ * Get the base directory for caching remote skills.
+ * Respects WARDEN_STATE_DIR environment variable.
+ * Default: ~/.local/warden/skills/
+ */
+function getSkillsCacheDir() {
+    const stateDir = process.env['WARDEN_STATE_DIR'];
+    if (stateDir) {
+        return (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(stateDir, 'skills');
+    }
+    return (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)((0,node_os__WEBPACK_IMPORTED_MODULE_1__.homedir)(), '.local', 'warden', 'skills');
+}
+/**
+ * Get the cache path for a specific remote ref.
+ * - Unpinned: ~/.local/warden/skills/owner/repo/
+ * - Pinned: ~/.local/warden/skills/owner/repo@sha/
+ */
+function getRemotePath(ref) {
+    const parsed = parseRemoteRef(ref);
+    const cacheDir = getSkillsCacheDir();
+    if (parsed.sha) {
+        return (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(cacheDir, parsed.owner, `${parsed.repo}@${parsed.sha}`);
+    }
+    return (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(cacheDir, parsed.owner, parsed.repo);
+}
+/**
+ * Get the path to the state.json file.
+ */
+function getStatePath() {
+    return (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(getSkillsCacheDir(), 'state.json');
+}
+/**
+ * Load the remote state from state.json.
+ * Returns an empty state if the file doesn't exist.
+ */
+function loadState() {
+    const statePath = getStatePath();
+    if (!(0,node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync)(statePath)) {
+        return { remotes: {} };
+    }
+    try {
+        const content = (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync)(statePath, 'utf-8');
+        const data = JSON.parse(content);
+        return RemoteStateSchema.parse(data);
+    }
+    catch (error) {
+        // If state is corrupted, start fresh
+        const message = error instanceof Error ? error.message : String(error);
+        console.warn(`Warning: Failed to load state.json, starting fresh: ${message}`);
+        return { remotes: {} };
+    }
+}
+/**
+ * Save the remote state to state.json.
+ * Uses atomic write (write to temp, then rename).
+ */
+function saveState(state) {
+    const statePath = getStatePath();
+    const stateDir = (0,node_path__WEBPACK_IMPORTED_MODULE_2__.dirname)(statePath);
+    // Ensure directory exists
+    if (!(0,node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync)(stateDir)) {
+        (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync)(stateDir, { recursive: true });
+    }
+    // Write atomically
+    const tempPath = `${statePath}.tmp`;
+    (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync)(tempPath, JSON.stringify(state, null, 2), 'utf-8');
+    // Rename is atomic on most filesystems
+    (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.renameSync)(tempPath, statePath);
+}
+/**
+ * Get the TTL for remote skill cache in seconds.
+ * Respects WARDEN_SKILL_CACHE_TTL environment variable.
+ */
+function getCacheTtlSeconds() {
+    const envTtl = process.env['WARDEN_SKILL_CACHE_TTL'];
+    if (envTtl) {
+        const parsed = parseInt(envTtl, 10);
+        if (!isNaN(parsed) && parsed > 0) {
+            return parsed;
+        }
+    }
+    return DEFAULT_TTL_SECONDS;
+}
+/**
+ * Check if an unpinned remote ref needs to be refreshed.
+ * Pinned refs (with @sha) never need refresh.
+ */
+function shouldRefresh(ref, state) {
+    const parsed = parseRemoteRef(ref);
+    // Pinned refs are immutable - never refresh
+    if (parsed.sha) {
+        return false;
+    }
+    const entry = state.remotes[ref];
+    if (!entry) {
+        return true; // Not cached, needs fetch
+    }
+    const fetchedAt = new Date(entry.fetchedAt).getTime();
+    const now = Date.now();
+    const ttl = getCacheTtlSeconds() * 1000;
+    return now - fetchedAt > ttl;
+}
+/**
+ * Execute a git command and return stdout.
+ * Uses execFileSync to avoid shell injection vulnerabilities.
+ * Throws SkillLoaderError on failure.
+ */
+function execGit(args, options) {
+    try {
+        return (0,node_child_process__WEBPACK_IMPORTED_MODULE_3__.execFileSync)('git', args, {
+            encoding: 'utf-8',
+            cwd: options?.cwd,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Git command failed: git ${args.join(' ')}: ${message}`);
+    }
+}
+/**
+ * Clone or update a remote repository to the cache.
+ * Returns the SHA of the fetched commit.
+ */
+async function fetchRemote(ref, options = {}) {
+    const { force = false, offline = false, onProgress } = options;
+    const parsed = parseRemoteRef(ref);
+    const remotePath = getRemotePath(ref);
+    const state = loadState();
+    const isPinned = !!parsed.sha;
+    const isCached = (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync)(remotePath);
+    const needsRefresh = shouldRefresh(ref, state);
+    // Check if we have a valid cache (directory exists AND state entry exists)
+    const stateEntry = state.remotes[ref];
+    const hasValidCache = isCached && !!stateEntry;
+    // Handle offline mode
+    if (offline) {
+        if (hasValidCache) {
+            return stateEntry.sha;
+        }
+        throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Remote skill not cached and offline mode enabled: ${ref}`);
+    }
+    // Pinned + valid cache = use cache (SHA is immutable)
+    if (isPinned && hasValidCache && !force && parsed.sha) {
+        return parsed.sha;
+    }
+    // Unpinned + valid cache + fresh = use cache
+    if (!isPinned && hasValidCache && !needsRefresh && !force) {
+        return stateEntry.sha;
+    }
+    const repoUrl = `https://github.com/${parsed.owner}/${parsed.repo}.git`;
+    // Clone or update
+    if (!isCached) {
+        onProgress?.(`Cloning ${ref}...`);
+        // Ensure parent directory exists
+        const parentDir = (0,node_path__WEBPACK_IMPORTED_MODULE_2__.dirname)(remotePath);
+        if (!(0,node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync)(parentDir)) {
+            (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync)(parentDir, { recursive: true });
+        }
+        // Clone with minimal depth for unpinned refs
+        // Note: '--' separates flags from positional args to prevent flag injection
+        if (isPinned && parsed.sha) {
+            // For pinned refs, we need full history to checkout the specific SHA
+            // Use a shallow clone then deepen if needed
+            execGit(['clone', '--depth=1', '--', repoUrl, remotePath]);
+            try {
+                // Try to checkout the pinned SHA
+                // Note: 'checkout' without '--' treats arg as ref; with '--' it's a file path
+                execGit(['fetch', '--depth=1', 'origin', '--', parsed.sha], { cwd: remotePath });
+                execGit(['checkout', parsed.sha], { cwd: remotePath });
+            }
+            catch {
+                // If SHA not found, do a full fetch and retry
+                execGit(['fetch', '--unshallow'], { cwd: remotePath });
+                execGit(['checkout', parsed.sha], { cwd: remotePath });
+            }
+        }
+        else if (!isPinned) {
+            // For unpinned refs, shallow clone of default branch
+            execGit(['clone', '--depth=1', '--', repoUrl, remotePath]);
+        }
+    }
+    else {
+        // Update existing cache
+        onProgress?.(`Updating ${ref}...`);
+        if (!isPinned) {
+            // For unpinned refs, pull latest
+            execGit(['fetch', '--depth=1', 'origin'], { cwd: remotePath });
+            execGit(['reset', '--hard', 'origin/HEAD'], { cwd: remotePath });
+        }
+        // Pinned refs don't need updates - SHA is immutable
+    }
+    // Get the current HEAD SHA
+    const sha = execGit(['rev-parse', 'HEAD'], { cwd: remotePath });
+    // Update state
+    state.remotes[ref] = {
+        sha,
+        fetchedAt: new Date().toISOString(),
+    };
+    saveState(state);
+    return sha;
+}
+/**
+ * Parse marketplace.json from a remote repository if it exists.
+ * Returns null if the file doesn't exist or is invalid.
+ */
+function parseMarketplaceConfig(remotePath) {
+    const marketplacePath = (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(remotePath, '.claude-plugin', 'marketplace.json');
+    if (!(0,node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync)(marketplacePath)) {
+        return null;
+    }
+    try {
+        const content = (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync)(marketplacePath, 'utf-8');
+        const data = JSON.parse(content);
+        return MarketplaceConfigSchema.parse(data);
+    }
+    catch {
+        // Invalid or malformed marketplace.json - fall back to traditional discovery
+        return null;
+    }
+}
+/** Directories to search for skills in remote repositories */
+const REMOTE_SKILL_DIRECTORIES = [
+    '', // root level
+    'skills', // skills/ subdirectory
+    '.warden/skills', // Warden-specific
+    '.agents/skills', // General agent skills
+    '.claude/skills', // Claude Code skills
+];
+/**
+ * Discover skills using traditional directory layout.
+ * Searches root level, skills/, and conventional skill directories.
+ */
+async function discoverTraditionalSkills(remotePath) {
+    const skills = [];
+    const seenNames = new Set();
+    for (const subdir of REMOTE_SKILL_DIRECTORIES) {
+        const searchPath = subdir ? (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(remotePath, subdir) : remotePath;
+        if (!(0,node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync)(searchPath))
+            continue;
+        const entries = (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.readdirSync)(searchPath);
+        for (const entry of entries) {
+            if (entry.startsWith('.'))
+                continue;
+            const entryPath = (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(searchPath, entry);
+            const stat = (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.statSync)(entryPath);
+            if (stat.isDirectory()) {
+                const skillMdPath = (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(entryPath, 'SKILL.md');
+                if ((0,node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync)(skillMdPath)) {
+                    try {
+                        const skill = await (0,_loader_js__WEBPACK_IMPORTED_MODULE_4__/* .loadSkillFromMarkdown */ .hl)(skillMdPath);
+                        // First occurrence wins (root takes precedence over skills/)
+                        if (!seenNames.has(skill.name)) {
+                            seenNames.add(skill.name);
+                            skills.push({
+                                name: skill.name,
+                                description: skill.description,
+                                path: entryPath,
+                            });
+                        }
+                    }
+                    catch {
+                        // Skip invalid skill directories
+                    }
+                }
+            }
+        }
+    }
+    return skills;
+}
+/**
+ * Discover skills using marketplace format.
+ * Searches plugins/{plugin}/skills/ for each plugin defined in marketplace.json.
+ */
+async function discoverMarketplaceSkills(remotePath, config) {
+    const skills = [];
+    const seenNames = new Set();
+    for (const plugin of config.plugins) {
+        // Resolve plugin source path (e.g., "./plugins/sentry-skills" -> "plugins/sentry-skills")
+        const pluginSource = plugin.source.replace(/^\.\//, '');
+        const skillsPath = (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(remotePath, pluginSource, 'skills');
+        if (!(0,node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync)(skillsPath))
+            continue;
+        const entries = (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.readdirSync)(skillsPath);
+        for (const entry of entries) {
+            if (entry.startsWith('.'))
+                continue;
+            const entryPath = (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(skillsPath, entry);
+            const stat = (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.statSync)(entryPath);
+            if (stat.isDirectory()) {
+                const skillMdPath = (0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(entryPath, 'SKILL.md');
+                if ((0,node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync)(skillMdPath)) {
+                    try {
+                        const skill = await (0,_loader_js__WEBPACK_IMPORTED_MODULE_4__/* .loadSkillFromMarkdown */ .hl)(skillMdPath);
+                        // First plugin wins for duplicate skill names
+                        if (!seenNames.has(skill.name)) {
+                            seenNames.add(skill.name);
+                            skills.push({
+                                name: skill.name,
+                                description: skill.description,
+                                path: entryPath,
+                                pluginName: plugin.name,
+                            });
+                        }
+                    }
+                    catch {
+                        // Skip invalid skill directories
+                    }
+                }
+            }
+        }
+    }
+    return skills;
+}
+/**
+ * Discover all skills in a cached remote repository.
+ * Detects format and delegates to appropriate discovery function:
+ * - If .claude-plugin/marketplace.json exists, uses marketplace discovery
+ * - Otherwise, uses traditional discovery (root, skills/, .warden/skills, etc.)
+ */
+async function discoverRemoteSkills(ref) {
+    const remotePath = getRemotePath(ref);
+    if (!(0,node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync)(remotePath)) {
+        throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Remote not cached: ${ref}. Run fetch first.`);
+    }
+    // Check for marketplace format
+    const marketplaceConfig = parseMarketplaceConfig(remotePath);
+    if (marketplaceConfig) {
+        return discoverMarketplaceSkills(remotePath, marketplaceConfig);
+    }
+    // Fall back to traditional discovery
+    return discoverTraditionalSkills(remotePath);
+}
+/**
+ * Resolve a skill from a remote repository.
+ * Ensures the remote is fetched/cached, then loads the skill.
+ * Matches by skill name (from SKILL.md), not directory name.
+ */
+async function resolveRemoteSkill(ref, skillName, options = {}) {
+    await fetchRemote(ref, options);
+    const availableSkills = await discoverRemoteSkills(ref);
+    const match = availableSkills.find((s) => s.name === skillName);
+    if (match) {
+        return (0,_loader_js__WEBPACK_IMPORTED_MODULE_4__/* .loadSkillFromMarkdown */ .hl)((0,node_path__WEBPACK_IMPORTED_MODULE_2__.join)(match.path, 'SKILL.md'));
+    }
+    if (availableSkills.length === 0) {
+        throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`No skills found in remote: ${ref}`);
+    }
+    throw new _loader_js__WEBPACK_IMPORTED_MODULE_4__/* .SkillLoaderError */ .vN(`Skill '${skillName}' not found in remote: ${ref}. Available skills: ${availableSkills.map((s) => s.name).join(', ')}`);
+}
+/**
+ * Remove a remote from the cache.
+ */
+function removeRemote(ref) {
+    const remotePath = getRemotePath(ref);
+    if (existsSync(remotePath)) {
+        rmSync(remotePath, { recursive: true, force: true });
+    }
+    const state = loadState();
+    const { [ref]: _removed, ...remainingRemotes } = state.remotes;
+    state.remotes = remainingRemotes;
+    saveState(state);
+}
+/**
+ * List all cached remotes with their metadata.
+ */
+function listCachedRemotes() {
+    const state = loadState();
+    return Object.entries(state.remotes).map(([ref, entry]) => ({ ref, entry }));
+}
+
+
+/***/ })
+
+};
+
+//# sourceMappingURL=159.index.js.map

package/dist/action/159.index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"159.index.js","mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AAGA;AACA;AAEA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AAWA;;;;;;;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AAEA;AACA;AAEA;;;;;;;AAOA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AAEA;AACA;AACA;AACA;AAEA;AACA;AAEA;AACA;AACA;AAEA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AAEA;;AAEA;AACA;AACA;AACA;AACA;AAEA;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;;;;AAIA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AAEA;;AAEA;AACA;AACA;AACA;AAEA;;;AAGA;AACA;AACA;AAEA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;;;AAGA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AAEA;AACA;AACA;AAEA;AACA;AACA;AAEA;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;;;AAGA;AACA;AACA;AAEA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AAEA;AACA;AACA;AAEA;AACA;AAWA;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAAA;AACA;AACA;AACA;AACA;AAEA;;;AAGA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AAEA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AAEA;AAEA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AAAA;AACA;AACA;AACA;AACA;AACA;AAAA;AACA;AACA;AACA;AACA;AAAA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AAUA;;;AAGA;AACA;AACA;AAEA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AAAA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;;;AAGA;AACA;AACA;AACA;AAEA;AACA;AACA;AAAA;AAEA;AAEA;AACA;AAAA;AAEA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AAEA;;;AAGA;AACA;AAIA;AACA;AAEA;AACA;AACA;AACA;AAEA;AAAA;AAEA;AAEA;AACA;AAAA;AAEA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AAEA;;;;;AAKA;AACA;AACA;AAEA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AAEA;;;;AAIA;AACA;AAKA;AAEA;AACA;AAEA;AACA;AACA;AAEA;AACA;AACA;AAEA;AAGA;AAEA;;AAEA;AACA;AACA;AAEA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AAEA;;AAEA;AACA;AACA;AACA;AACA","sources":[".././src/skills/remote.ts"],"sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, renameSync, readdirSync, statSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, join } from 'node:path';\nimport { execFileSync } from 'node:child_process';\nimport { z } from 'zod';\nimport { loadSkillFromMarkdown, SkillLoaderError } from './loader.js';\nimport type { SkillDefinition } from '../config/schema.js';\n\n/** Default TTL for unpinned remote skills: 24 hours */\nconst DEFAULT_TTL_SECONDS = 86400;\n\n/** Schema for a single remote entry in state.json */\nconst RemoteEntrySchema = z.object({\n  sha: z.string(),\n  fetchedAt: z.string().datetime(),\n});\n\n/** Schema for the entire state.json file */\nconst RemoteStateSchema = z.object({\n  remotes: z.record(z.string(), RemoteEntrySchema),\n});\n\nexport type RemoteEntry = z.infer<typeof RemoteEntrySchema>;\nexport type RemoteState = z.infer<typeof RemoteStateSchema>;\n\n/** Schema for a plugin in marketplace.json */\nconst MarketplacePluginSchema = z.object({\n  name: z.string(),\n  source: z.string(),\n  description: z.string().optional(),\n  category: z.string().optional(),\n});\n\n/** Schema for .claude-plugin/marketplace.json */\nconst MarketplaceConfigSchema = z.object({\n  $schema: z.string().optional(),\n  name: z.string(),\n  description: z.string().optional(),\n  plugins: z.array(MarketplacePluginSchema),\n});\n\ntype MarketplaceConfig = z.infer<typeof MarketplaceConfigSchema>;\n\n/** Parsed remote reference */\nexport interface ParsedRemoteRef {\n  owner: string;\n  repo: string;\n  sha?: string;\n}\n\n/**\n * Normalize a GitHub URL to owner/repo format.\n * Returns null if the input is not a recognized GitHub URL.\n *\n * Supports:\n * - https://github.com/owner/repo\n * - https://github.com/owner/repo.git\n * - git@github.com:owner/repo.git\n */\nfunction normalizeGitHubUrl(input: string): string | null {\n  // HTTPS URL: https://github.com/owner/repo or https://github.com/owner/repo.git\n  const httpsMatch = input.match(/^https?:\\/\\/github\\.com\\/([^/]+)\\/([^/@]+?)(?:\\.git)?$/);\n  if (httpsMatch) {\n    return `${httpsMatch[1]}/${httpsMatch[2]}`;\n  }\n\n  // SSH URL: git@github.com:owner/repo.git\n  const sshMatch = input.match(/^git@github\\.com:([^/]+)\\/([^/@]+?)(?:\\.git)?$/);\n  if (sshMatch) {\n    return `${sshMatch[1]}/${sshMatch[2]}`;\n  }\n\n  return null;\n}\n\n/**\n * Parse a remote reference string into its components.\n * Supports formats:\n * - \"owner/repo\" or \"owner/repo@sha\"\n * - \"https://github.com/owner/repo\" or \"https://github.com/owner/repo@sha\"\n * - \"https://github.com/owner/repo.git\" or \"https://github.com/owner/repo.git@sha\"\n * - \"git@github.com:owner/repo.git\" or \"git@github.com:owner/repo.git@sha\"\n */\nexport function parseRemoteRef(ref: string): ParsedRemoteRef {\n  let inputRef = ref;\n  let sha: string | undefined;\n\n  // Extract SHA suffix from the input before URL normalization.\n  // The SHA is always at the end, after a @ that follows the repo name.\n  // For git@github.com URLs, we need to find the @ after the colon.\n  if (ref.startsWith('git@')) {\n    const colonIndex = ref.indexOf(':');\n    if (colonIndex !== -1) {\n      const afterColon = ref.slice(colonIndex + 1);\n      const shaAtIndex = afterColon.lastIndexOf('@');\n      if (shaAtIndex !== -1) {\n        sha = afterColon.slice(shaAtIndex + 1);\n        inputRef = ref.slice(0, colonIndex + 1 + shaAtIndex);\n      }\n    }\n  } else {\n    const lastAtIndex = ref.lastIndexOf('@');\n    if (lastAtIndex !== -1) {\n      const potentialSha = ref.slice(lastAtIndex + 1);\n      // SHA should not contain : or / (those would indicate URL structure)\n      if (!potentialSha.includes(':') && !potentialSha.includes('/')) {\n        if (!potentialSha) {\n          throw new SkillLoaderError(`Invalid remote ref: ${ref} (empty SHA after @)`);\n        }\n        sha = potentialSha;\n        inputRef = ref.slice(0, lastAtIndex);\n      }\n    }\n  }\n\n  // Normalize GitHub URLs to owner/repo format\n  const repoPath = normalizeGitHubUrl(inputRef) ?? inputRef;\n\n  const slashIndex = repoPath.indexOf('/');\n  if (slashIndex === -1) {\n    throw new SkillLoaderError(`Invalid remote ref: ${ref} (expected owner/repo format)`);\n  }\n\n  const owner = repoPath.slice(0, slashIndex);\n  const repo = repoPath.slice(slashIndex + 1);\n\n  if (!owner || !repo) {\n    throw new SkillLoaderError(`Invalid remote ref: ${ref} (empty owner or repo)`);\n  }\n\n  if (repo.includes('/')) {\n    throw new SkillLoaderError(`Invalid remote ref: ${ref} (repo name cannot contain /)`);\n  }\n\n  // Security: Prevent git flag injection by rejecting values starting with '-'\n  if (owner.startsWith('-')) {\n    throw new SkillLoaderError(`Invalid remote ref: ${ref} (owner cannot start with -)`);\n  }\n  if (repo.startsWith('-')) {\n    throw new SkillLoaderError(`Invalid remote ref: ${ref} (repo cannot start with -)`);\n  }\n  if (sha?.startsWith('-')) {\n    throw new SkillLoaderError(`Invalid remote ref: ${ref} (SHA cannot start with -)`);\n  }\n\n  return { owner, repo, sha };\n}\n\n/**\n * Format a parsed remote ref back to string format.\n */\nexport function formatRemoteRef(parsed: ParsedRemoteRef): string {\n  const base = `${parsed.owner}/${parsed.repo}`;\n  return parsed.sha ? `${base}@${parsed.sha}` : base;\n}\n\n/**\n * Get the base directory for caching remote skills.\n * Respects WARDEN_STATE_DIR environment variable.\n * Default: ~/.local/warden/skills/\n */\nexport function getSkillsCacheDir(): string {\n  const stateDir = process.env['WARDEN_STATE_DIR'];\n  if (stateDir) {\n    return join(stateDir, 'skills');\n  }\n  return join(homedir(), '.local', 'warden', 'skills');\n}\n\n/**\n * Get the cache path for a specific remote ref.\n * - Unpinned: ~/.local/warden/skills/owner/repo/\n * - Pinned: ~/.local/warden/skills/owner/repo@sha/\n */\nexport function getRemotePath(ref: string): string {\n  const parsed = parseRemoteRef(ref);\n  const cacheDir = getSkillsCacheDir();\n\n  if (parsed.sha) {\n    return join(cacheDir, parsed.owner, `${parsed.repo}@${parsed.sha}`);\n  }\n  return join(cacheDir, parsed.owner, parsed.repo);\n}\n\n/**\n * Get the path to the state.json file.\n */\nexport function getStatePath(): string {\n  return join(getSkillsCacheDir(), 'state.json');\n}\n\n/**\n * Load the remote state from state.json.\n * Returns an empty state if the file doesn't exist.\n */\nexport function loadState(): RemoteState {\n  const statePath = getStatePath();\n\n  if (!existsSync(statePath)) {\n    return { remotes: {} };\n  }\n\n  try {\n    const content = readFileSync(statePath, 'utf-8');\n    const data = JSON.parse(content);\n    return RemoteStateSchema.parse(data);\n  } catch (error) {\n    // If state is corrupted, start fresh\n    const message = error instanceof Error ? error.message : String(error);\n    console.warn(`Warning: Failed to load state.json, starting fresh: ${message}`);\n    return { remotes: {} };\n  }\n}\n\n/**\n * Save the remote state to state.json.\n * Uses atomic write (write to temp, then rename).\n */\nexport function saveState(state: RemoteState): void {\n  const statePath = getStatePath();\n  const stateDir = dirname(statePath);\n\n  // Ensure directory exists\n  if (!existsSync(stateDir)) {\n    mkdirSync(stateDir, { recursive: true });\n  }\n\n  // Write atomically\n  const tempPath = `${statePath}.tmp`;\n  writeFileSync(tempPath, JSON.stringify(state, null, 2), 'utf-8');\n\n  // Rename is atomic on most filesystems\n  renameSync(tempPath, statePath);\n}\n\n/**\n * Get the TTL for remote skill cache in seconds.\n * Respects WARDEN_SKILL_CACHE_TTL environment variable.\n */\nexport function getCacheTtlSeconds(): number {\n  const envTtl = process.env['WARDEN_SKILL_CACHE_TTL'];\n  if (envTtl) {\n    const parsed = parseInt(envTtl, 10);\n    if (!isNaN(parsed) && parsed > 0) {\n      return parsed;\n    }\n  }\n  return DEFAULT_TTL_SECONDS;\n}\n\n/**\n * Check if an unpinned remote ref needs to be refreshed.\n * Pinned refs (with @sha) never need refresh.\n */\nexport function shouldRefresh(ref: string, state: RemoteState): boolean {\n  const parsed = parseRemoteRef(ref);\n\n  // Pinned refs are immutable - never refresh\n  if (parsed.sha) {\n    return false;\n  }\n\n  const entry = state.remotes[ref];\n  if (!entry) {\n    return true; // Not cached, needs fetch\n  }\n\n  const fetchedAt = new Date(entry.fetchedAt).getTime();\n  const now = Date.now();\n  const ttl = getCacheTtlSeconds() * 1000;\n\n  return now - fetchedAt > ttl;\n}\n\nexport interface FetchRemoteOptions {\n  /** Force refresh even if cache is valid */\n  force?: boolean;\n  /** Skip network operations - only use cache */\n  offline?: boolean;\n  /** Callback for progress messages */\n  onProgress?: (message: string) => void;\n}\n\n/**\n * Execute a git command and return stdout.\n * Uses execFileSync to avoid shell injection vulnerabilities.\n * Throws SkillLoaderError on failure.\n */\nfunction execGit(args: string[], options?: { cwd?: string }): string {\n  try {\n    return execFileSync('git', args, {\n      encoding: 'utf-8',\n      cwd: options?.cwd,\n      stdio: ['pipe', 'pipe', 'pipe'],\n    }).trim();\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new SkillLoaderError(`Git command failed: git ${args.join(' ')}: ${message}`);\n  }\n}\n\n/**\n * Clone or update a remote repository to the cache.\n * Returns the SHA of the fetched commit.\n */\nexport async function fetchRemote(ref: string, options: FetchRemoteOptions = {}): Promise<string> {\n  const { force = false, offline = false, onProgress } = options;\n  const parsed = parseRemoteRef(ref);\n  const remotePath = getRemotePath(ref);\n  const state = loadState();\n\n  const isPinned = !!parsed.sha;\n  const isCached = existsSync(remotePath);\n  const needsRefresh = shouldRefresh(ref, state);\n\n  // Check if we have a valid cache (directory exists AND state entry exists)\n  const stateEntry = state.remotes[ref];\n  const hasValidCache = isCached && !!stateEntry;\n\n  // Handle offline mode\n  if (offline) {\n    if (hasValidCache) {\n      return stateEntry.sha;\n    }\n    throw new SkillLoaderError(`Remote skill not cached and offline mode enabled: ${ref}`);\n  }\n\n  // Pinned + valid cache = use cache (SHA is immutable)\n  if (isPinned && hasValidCache && !force && parsed.sha) {\n    return parsed.sha;\n  }\n\n  // Unpinned + valid cache + fresh = use cache\n  if (!isPinned && hasValidCache && !needsRefresh && !force) {\n    return stateEntry.sha;\n  }\n\n  const repoUrl = `https://github.com/${parsed.owner}/${parsed.repo}.git`;\n\n  // Clone or update\n  if (!isCached) {\n    onProgress?.(`Cloning ${ref}...`);\n\n    // Ensure parent directory exists\n    const parentDir = dirname(remotePath);\n    if (!existsSync(parentDir)) {\n      mkdirSync(parentDir, { recursive: true });\n    }\n\n    // Clone with minimal depth for unpinned refs\n    // Note: '--' separates flags from positional args to prevent flag injection\n    if (isPinned && parsed.sha) {\n      // For pinned refs, we need full history to checkout the specific SHA\n      // Use a shallow clone then deepen if needed\n      execGit(['clone', '--depth=1', '--', repoUrl, remotePath]);\n\n      try {\n        // Try to checkout the pinned SHA\n        // Note: 'checkout' without '--' treats arg as ref; with '--' it's a file path\n        execGit(['fetch', '--depth=1', 'origin', '--', parsed.sha], { cwd: remotePath });\n        execGit(['checkout', parsed.sha], { cwd: remotePath });\n      } catch {\n        // If SHA not found, do a full fetch and retry\n        execGit(['fetch', '--unshallow'], { cwd: remotePath });\n        execGit(['checkout', parsed.sha], { cwd: remotePath });\n      }\n    } else if (!isPinned) {\n      // For unpinned refs, shallow clone of default branch\n      execGit(['clone', '--depth=1', '--', repoUrl, remotePath]);\n    }\n  } else {\n    // Update existing cache\n    onProgress?.(`Updating ${ref}...`);\n\n    if (!isPinned) {\n      // For unpinned refs, pull latest\n      execGit(['fetch', '--depth=1', 'origin'], { cwd: remotePath });\n      execGit(['reset', '--hard', 'origin/HEAD'], { cwd: remotePath });\n    }\n    // Pinned refs don't need updates - SHA is immutable\n  }\n\n  // Get the current HEAD SHA\n  const sha = execGit(['rev-parse', 'HEAD'], { cwd: remotePath });\n\n  // Update state\n  state.remotes[ref] = {\n    sha,\n    fetchedAt: new Date().toISOString(),\n  };\n  saveState(state);\n\n  return sha;\n}\n\nexport interface DiscoveredRemoteSkill {\n  name: string;\n  description: string;\n  path: string;\n  /** Plugin name for marketplace format skills */\n  pluginName?: string;\n}\n\n/**\n * Parse marketplace.json from a remote repository if it exists.\n * Returns null if the file doesn't exist or is invalid.\n */\nfunction parseMarketplaceConfig(remotePath: string): MarketplaceConfig | null {\n  const marketplacePath = join(remotePath, '.claude-plugin', 'marketplace.json');\n\n  if (!existsSync(marketplacePath)) {\n    return null;\n  }\n\n  try {\n    const content = readFileSync(marketplacePath, 'utf-8');\n    const data = JSON.parse(content);\n    return MarketplaceConfigSchema.parse(data);\n  } catch {\n    // Invalid or malformed marketplace.json - fall back to traditional discovery\n    return null;\n  }\n}\n\n/** Directories to search for skills in remote repositories */\nconst REMOTE_SKILL_DIRECTORIES = [\n  '',               // root level\n  'skills',         // skills/ subdirectory\n  '.warden/skills', // Warden-specific\n  '.agents/skills', // General agent skills\n  '.claude/skills', // Claude Code skills\n];\n\n/**\n * Discover skills using traditional directory layout.\n * Searches root level, skills/, and conventional skill directories.\n */\nasync function discoverTraditionalSkills(remotePath: string): Promise<DiscoveredRemoteSkill[]> {\n  const skills: DiscoveredRemoteSkill[] = [];\n  const seenNames = new Set<string>();\n\n  for (const subdir of REMOTE_SKILL_DIRECTORIES) {\n    const searchPath = subdir ? join(remotePath, subdir) : remotePath;\n    if (!existsSync(searchPath)) continue;\n\n    const entries = readdirSync(searchPath);\n\n    for (const entry of entries) {\n      if (entry.startsWith('.')) continue;\n\n      const entryPath = join(searchPath, entry);\n      const stat = statSync(entryPath);\n\n      if (stat.isDirectory()) {\n        const skillMdPath = join(entryPath, 'SKILL.md');\n        if (existsSync(skillMdPath)) {\n          try {\n            const skill = await loadSkillFromMarkdown(skillMdPath);\n            // First occurrence wins (root takes precedence over skills/)\n            if (!seenNames.has(skill.name)) {\n              seenNames.add(skill.name);\n              skills.push({\n                name: skill.name,\n                description: skill.description,\n                path: entryPath,\n              });\n            }\n          } catch {\n            // Skip invalid skill directories\n          }\n        }\n      }\n    }\n  }\n\n  return skills;\n}\n\n/**\n * Discover skills using marketplace format.\n * Searches plugins/{plugin}/skills/ for each plugin defined in marketplace.json.\n */\nasync function discoverMarketplaceSkills(\n  remotePath: string,\n  config: MarketplaceConfig\n): Promise<DiscoveredRemoteSkill[]> {\n  const skills: DiscoveredRemoteSkill[] = [];\n  const seenNames = new Set<string>();\n\n  for (const plugin of config.plugins) {\n    // Resolve plugin source path (e.g., \"./plugins/sentry-skills\" -> \"plugins/sentry-skills\")\n    const pluginSource = plugin.source.replace(/^\\.\\//, '');\n    const skillsPath = join(remotePath, pluginSource, 'skills');\n\n    if (!existsSync(skillsPath)) continue;\n\n    const entries = readdirSync(skillsPath);\n\n    for (const entry of entries) {\n      if (entry.startsWith('.')) continue;\n\n      const entryPath = join(skillsPath, entry);\n      const stat = statSync(entryPath);\n\n      if (stat.isDirectory()) {\n        const skillMdPath = join(entryPath, 'SKILL.md');\n        if (existsSync(skillMdPath)) {\n          try {\n            const skill = await loadSkillFromMarkdown(skillMdPath);\n            // First plugin wins for duplicate skill names\n            if (!seenNames.has(skill.name)) {\n              seenNames.add(skill.name);\n              skills.push({\n                name: skill.name,\n                description: skill.description,\n                path: entryPath,\n                pluginName: plugin.name,\n              });\n            }\n          } catch {\n            // Skip invalid skill directories\n          }\n        }\n      }\n    }\n  }\n\n  return skills;\n}\n\n/**\n * Discover all skills in a cached remote repository.\n * Detects format and delegates to appropriate discovery function:\n * - If .claude-plugin/marketplace.json exists, uses marketplace discovery\n * - Otherwise, uses traditional discovery (root, skills/, .warden/skills, etc.)\n */\nexport async function discoverRemoteSkills(ref: string): Promise<DiscoveredRemoteSkill[]> {\n  const remotePath = getRemotePath(ref);\n\n  if (!existsSync(remotePath)) {\n    throw new SkillLoaderError(`Remote not cached: ${ref}. Run fetch first.`);\n  }\n\n  // Check for marketplace format\n  const marketplaceConfig = parseMarketplaceConfig(remotePath);\n  if (marketplaceConfig) {\n    return discoverMarketplaceSkills(remotePath, marketplaceConfig);\n  }\n\n  // Fall back to traditional discovery\n  return discoverTraditionalSkills(remotePath);\n}\n\n/**\n * Resolve a skill from a remote repository.\n * Ensures the remote is fetched/cached, then loads the skill.\n * Matches by skill name (from SKILL.md), not directory name.\n */\nexport async function resolveRemoteSkill(\n  ref: string,\n  skillName: string,\n  options: FetchRemoteOptions = {}\n): Promise<SkillDefinition> {\n  await fetchRemote(ref, options);\n\n  const availableSkills = await discoverRemoteSkills(ref);\n  const match = availableSkills.find((s) => s.name === skillName);\n\n  if (match) {\n    return loadSkillFromMarkdown(join(match.path, 'SKILL.md'));\n  }\n\n  if (availableSkills.length === 0) {\n    throw new SkillLoaderError(`No skills found in remote: ${ref}`);\n  }\n\n  throw new SkillLoaderError(\n    `Skill '${skillName}' not found in remote: ${ref}. Available skills: ${availableSkills.map((s) => s.name).join(', ')}`\n  );\n}\n\n/**\n * Remove a remote from the cache.\n */\nexport function removeRemote(ref: string): void {\n  const remotePath = getRemotePath(ref);\n\n  if (existsSync(remotePath)) {\n    rmSync(remotePath, { recursive: true, force: true });\n  }\n\n  const state = loadState();\n  const { [ref]: _removed, ...remainingRemotes } = state.remotes;\n  state.remotes = remainingRemotes;\n  saveState(state);\n}\n\n/**\n * List all cached remotes with their metadata.\n */\nexport function listCachedRemotes(): { ref: string; entry: RemoteEntry }[] {\n  const state = loadState();\n  return Object.entries(state.remotes).map(([ref, entry]) => ({ ref, entry }));\n}\n"],"names":[],"sourceRoot":""}

package/dist/action/action/index.d.ts

@@ -0,0 +1,2 @@
+export * from './main.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/action/action/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["file:///home/runner/work/warden/warden/src/action/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/dist/action/action/main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/action/action/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["file:///home/runner/work/warden/warden/src/action/main.ts"],"names":[],"mappings":""}