@sixfactors-ai/codeloop 0.1.0 → 0.2.0

package/README.md

@@ -1,43 +1,43 @@
 # codeloop
 
-**Code agents that project manage themselves.**
+**The full dev lifecycle for AI coding agents.**
 
-Your AI agent plans the work, tracks its own tasks, and learns from every mistake — across sessions, across tools, without you babysitting it.
+Your AI agent plans the work, tests it, reviews its own commits, deploys to staging, debugs production, and learns from every mistake — across sessions, across tools, without you babysitting it.
 
-![Codeloop Board](docs/board.png)
-
-codeloop gives your project a memory that survives across sessions — and a live dashboard where you watch the agent think.
+![Codeloop Board](https://codeloop.sixfactors.ai/board.png)
 
 ## The Problem
 
 AI coding tools (Claude Code, Cursor, Codex) are stateless. Every session starts from zero. You've explained that `doc.save()` has race conditions six times. You've caught `console.log` in production code on every PR. The agent never learns, because it can't remember.
 
-Your team's hard-won knowledge — the gotchas, the patterns, the "don't do that, here's why" — lives in people's heads. Not where the AI can use it.
+Worse — the agent can write code, but it can't test, deploy, or debug. You're still the glue between "code complete" and "live in production." That's where most of the time goes.
 
-## The Loop
+## The Pipeline
 
-codeloop creates a closed feedback loop between you and your AI agent:
+codeloop gives your project ten slash commands that cover the full development lifecycle:
 
 ```
-Plan → Build → Commit → Reflect
-  ↑                         |
-  └─────────────────────────┘
-      lessons feed back in
+/design → /plan → /manage → /test → /commit → /qa → /deploy → /debug → /reflect → /ship
 ```
 
-Four slash commands. That's the entire interface.
-
-**`/plan`** reads your project's known gotchas before you start. "Last time we touched auth, we forgot to scope queries by workspace." The agent plans around landmines it hasn't personally stepped on yet.
-
-**`/commit`** does a three-phase commit: first it **reviews** your diff against learned rubrics (not just lint rules — *your team's actual mistakes*), then it **reflects** on what happened this session ("we discovered that collection names are inconsistent — save this?"), then it commits. One command, three layers of quality.
-
-**`/reflect`** is the deep version. End of a long session, multiple commits, hard-fought bugs. It scans everything that happened and proposes lessons to save. You pick what matters. It writes to your knowledge base.
-
-**`/manage`** tracks the plan. Check off steps, add new ones, get a summary of where things stand.
+| Command | What it does |
+|---------|-------------|
+| `/design` | Analyze the codebase, generate a lightweight architectural spec |
+| `/plan` | Write a task plan with acceptance criteria, enter plan mode |
+| `/manage` | Track steps, check off progress, manage the task board |
+| `/test` | Run your test suite, parse results, track coverage over time |
+| `/commit` | Three-phase commit: review diff against learned rubrics → reflect on session → commit |
+| `/qa` | Quality gate: static analysis + tests + coverage threshold + integrity checks |
+| `/deploy` | Deploy to staging or production with verification gates |
+| `/debug` | Search production logs, check health, cross-reference with recent commits |
+| `/reflect` | Deep session review: scan all work, propose lessons to save |
+| `/ship` | Close the loop: QA → staging → production → verify → done |
+
+Each command reads your project's config and knowledge files. No runtime, no server — just markdown and YAML that the LLM reads directly.
 
 ## How Knowledge Compounds
 
-Here's where it gets interesting. Every gotcha has a frequency counter:
+Every gotcha has a frequency counter:
 
 ```
 Session 1: You discover that boolean query params need Transform decorators.
@@ -56,7 +56,7 @@ Session 20: [freq:10+]
 
 **Frequency = severity.** The more something bites you, the harder the system fights to prevent it. No configuration needed — it emerges from use.
 
-The review isn't one-size-fits-all either. Changed a backend file? It loads backend gotchas. Frontend only? It skips database warnings entirely. Scopes in your config file control what's relevant:
+The review is scoped too. Changed a backend file? It loads backend gotchas. Frontend only? It skips database warnings. Scopes in your config control what's relevant:
 
 ```yaml
 scopes:
@@ -68,10 +68,10 @@ scopes:
     gotcha_sections: ["Frontend", "React"]
 ```
 
-## What Gets Created
+## Quick Start
 
 ```bash
-npm install -g codeloop
+npm install -g @sixfactors-ai/codeloop
 cd your-project
 codeloop init
 ```
@@ -80,43 +80,45 @@ It asks which AI tools you use, detects your tech stack, and scaffolds:
 
 ```
 .codeloop/
-  config.yaml       ← Scopes, quality checks, diff scan rules
-  rules.md          ← Non-negotiable rules (always CRITICAL)
+  config.yaml       ← Scopes, quality checks, deploy/test/debug config
+  rules.md          ← Non-negotiable rules (always CRITICAL in review)
   gotchas.md        ← Discovered gotchas with frequency tracking
   patterns.md       ← Proven patterns with confidence levels
-  principles.md     ← Operating principles for the AI agent
+  principles.md     ← How you want the AI to operate
 
-.claude/commands/   ← Slash commands (Claude Code)
-.cursor/commands/   ← Slash commands (Cursor)
-.agents/skills/     ← Skills (Codex)
+.claude/commands/   ← 10 slash commands (Claude Code)
+.cursor/commands/   ← 10 slash commands (Cursor)
+.agents/skills/     ← 10 skills (Codex)
 
 tasks/todo.md       ← Current task plan
 ```
 
-The knowledge base (`.codeloop/`) is shared across all tools. Doesn't matter if you use Claude Code on Monday and Cursor on Tuesday — same gotchas, same patterns, same rules.
+The knowledge base (`.codeloop/`) is shared across all tools. Doesn't matter if you use Claude Code on Monday and Cursor on Tuesday — same gotchas, same rules.
 
 ## The Config
 
-`.codeloop/config.yaml` is the brain. The AI reads it directly — no runtime, no server, just a YAML file the LLM parses.
+`.codeloop/config.yaml` controls everything. The AI reads it directly.
 
 ```yaml
 project:
   name: "my-api"
 
+# Map file paths to knowledge sections
 scopes:
   backend:
     paths: ["src/**"]
     gotcha_sections: ["Backend", "Database", "API"]
-    pattern_sections: ["Backend", "Error Handling"]
   tests:
-    paths: ["**/*.test.*", "**/*.spec.*"]
+    paths: ["**/*.test.*"]
     gotcha_sections: ["Testing"]
 
+# Build/lint checks run during /commit and /qa
 quality_checks:
   backend:
     - name: "Typecheck"
       command: "npx tsc --noEmit 2>&1 | tail -20"
 
+# Patterns banned in diffs
 diff_scan:
   - pattern: "console\\.log"
     files: "*.ts,*.js"
@@ -124,27 +126,42 @@ diff_scan:
     severity: CRITICAL
     message: "console.log in production code"
 
+# Test runner config (used by /test and /qa)
+test:
+  command: "npm test"
+  coverage_threshold: 80
+  integrity_checks: true
+
+# Deployment gates (used by /deploy and /ship)
+deploy:
+  staging:
+    command: "make deploy-staging"
+    verify: "curl -sf https://staging.example.com/health"
+  production:
+    command: "make deploy-prod"
+    verify: "curl -sf https://example.com/health"
+    requires: staging
+
+# Production debugging (used by /debug)
+debug:
+  logs: "fly logs --app myapp"
+  health: "curl -sf https://example.com/health"
+
+# Frequency thresholds
 codeloop:
   critical_frequency: 3
   promote_frequency: 10
 ```
 
-**Scopes** connect file paths to knowledge sections — so `/commit` only loads relevant rubrics.
-
-**Quality checks** run build/lint/type commands and report failures as CRITICAL.
-
-**Diff scan** searches the actual diff for patterns you've banned (debug statements, .env files, explicit `any` types).
-
 ## The Commit Flow
 
-When you type `/commit`, this happens:
+When you type `/commit`:
 
 ```
 Phase 1: Review
-  ├─ Map changed files → scopes (from config.yaml)
-  ├─ Load gotchas for those scopes (freq ≥ 3 = CRITICAL, 1-2 = WARNING)
-  ├─ Load patterns (HIGH confidence = expected, deviation = WARNING)
-  ├─ Load rules (always CRITICAL)
+  ├─ Map changed files → scopes
+  ├─ Load gotchas (freq ≥ 3 = CRITICAL, 1-2 = WARNING)
+  ├─ Load patterns (HIGH confidence = expected)
   ├─ Run quality checks for active scopes
   ├─ Scan diff for violations
   └─ Verdict: CLEAN / WARNINGS / BLOCKED
@@ -152,7 +169,7 @@ Phase 1: Review
 Phase 2: Reflect (lightweight)
   ├─ Scan session for new gotchas or patterns
   ├─ Propose saves (you pick what to keep)
-  └─ Write to .codeloop/gotchas.md or patterns.md
+  └─ Write to gotchas.md or patterns.md
 
 Phase 3: Commit
   ├─ Stage files
@@ -160,11 +177,49 @@ Phase 3: Commit
   └─ Create commit
 ```
 
-If the review finds CRITICAL issues, it blocks. You can fix them, override, or abort. No silent failures.
+If the review finds CRITICAL issues, it blocks. You can fix them, override, or abort.
+
+## The Deployment Pipeline
+
+`/qa` → `/deploy staging` → `/deploy prod` forms a gate chain:
+
+```
+/qa passes           → sets env:local-pass    → unlocks staging
+/deploy staging      → sets env:staging-pass  → unlocks production
+/deploy prod         → sets env:prod-pass     → task is done
+```
+
+`/ship` runs the full chain in one command. If any gate fails, it stops and creates a regression task on the board.
+
+## Watch Mode
+
+Monitor your project in the background:
+
+```bash
+codeloop watch                # Start watching
+codeloop watch --with-serve   # Watch + board server (live UI)
+```
+
+Watch detects file changes, git commits, test results, and build errors. Events are logged to `.codeloop/watch.log` and pushed to the board UI via SSE when the server is running.
+
+## Skill Registry
+
+Install community skills or share your own:
+
+```bash
+codeloop search "deploy"              # Find skills
+codeloop install review-checklist     # Install from registry
+codeloop install github:user/repo     # Install from GitHub
+codeloop install ./local-skill        # Install from local path
+codeloop list                         # Show installed skills
+codeloop remove review-checklist      # Uninstall
+```
+
+Every installed skill gets security-validated (no `exec()`, no credential access, no pipe-to-shell) and locked with integrity hashes in `.codeloop/skills.lock`.
 
 ## Works With Everything
 
-codeloop auto-detects your stack and your tools:
+codeloop auto-detects your stack and tools:
 
 | Stack | Detected by | Starter config |
 |-------|-------------|----------------|
@@ -173,41 +228,48 @@ codeloop auto-detects your stack and your tools:
 | Go | `go.mod` | go vet, go build, fmt.Print detection |
 | Generic | Fallback | Minimal — you configure |
 
-| Tool | Commands go to | Format |
-|------|---------------|--------|
-| Claude Code | `.claude/commands/` | Markdown + frontmatter |
-| Cursor | `.cursor/commands/` | Markdown + frontmatter |
-| Codex | `.agents/skills/` | SKILL.md with YAML frontmatter |
+| Tool | Commands installed to | Compatibility |
+|------|---------------------|---------------|
+| Claude Code | `.claude/commands/` | Full (primary target) |
+| Cursor | `.cursor/commands/` | Knowledge + config (tool hints are Claude-specific) |
+| Codex | `.agents/skills/` | Knowledge + config (tool hints are Claude-specific) |
 
-## CLI
+**Note**: The `allowed-tools` frontmatter in skill files uses Claude Code tool names (Bash, Read, Edit, etc.). Cursor and Codex ignore this field — the skill instructions still work, but tool restrictions aren't enforced. The knowledge files (gotchas, patterns, rules) and config are fully portable across all tools.
 
-```bash
-codeloop init                        # Interactive setup
-codeloop init --tools claude,cursor  # Skip tool prompt
-codeloop init --starter python       # Force specific stack
+## CLI Reference
 
-codeloop status                      # Knowledge stats, version check
-codeloop update                      # Update skills (never touches knowledge)
-codeloop update --dry-run            # Preview what would change
+```bash
+# Project setup
+codeloop init                         # Interactive setup
+codeloop init --tools claude,cursor   # Skip tool prompt
+codeloop init --starter python        # Force specific stack
+codeloop status                       # Knowledge stats, version check
+codeloop update                       # Update skills (never touches knowledge)
+
+# Live monitoring
+codeloop watch                        # Background file + git monitor
+codeloop serve                        # Board UI server (http://localhost:4242)
+
+# Skill registry
+codeloop search <query>               # Search for skills
+codeloop install <name>               # Install a skill
+codeloop list                         # Show installed skills
+codeloop remove <name>                # Uninstall a skill
+codeloop publish                      # Publish your skill to the registry
+codeloop login                        # Authenticate with GitHub
 ```
 
-`init` never overwrites existing knowledge files. Your gotchas and patterns are sacred.
-
-`update` refreshes the slash commands to the latest version (version-tagged with `<!-- codeloop-version: X.Y.Z -->`). Knowledge files are never touched.
-
 ## The Knowledge Files
 
-These are the files that make your project smarter:
-
-**`rules.md`** — Non-negotiable. Always loaded as CRITICAL. Start with 4 universal rules, add yours.
+**`rules.md`** — Non-negotiable. Always loaded as CRITICAL. Start with universal rules, add yours.
 
-**`gotchas.md`** — Discovered through work. Each entry has `[freq:N]`. The system auto-promotes severity as frequency climbs. Organized by sections that match your scopes.
+**`gotchas.md`** — Discovered through work. Each entry has `[freq:N]`. Severity auto-scales with frequency. Organized by sections matching your scopes.
 
 **`patterns.md`** — What works well. HIGH-confidence patterns become expectations — deviations trigger warnings during review.
 
-**`principles.md`** — How you want the AI to operate. Plan first? Verify before done? Subagents for research? Write it here once, it applies everywhere.
+**`principles.md`** — How you want the AI to operate. Plan first? Verify before done? Write it here once, it applies everywhere.
 
-All of these are plain markdown. No lock-in, no proprietary format. If you stop using codeloop tomorrow, the knowledge stays in your repo as useful documentation.
+All plain markdown. No lock-in, no proprietary format. If you stop using codeloop tomorrow, the knowledge stays as useful documentation.
 
 ## License
 

package/dist/commands/install.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const installCommand: Command;

package/dist/commands/install.js

@@ -0,0 +1,125 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { installFromLocal, installFromContent, installBuiltin } from '../registry/installer.js';
+import { findInLocalIndex, loadLocalIndex } from '../registry/local-index.js';
+const REGISTRY_URL = process.env.CODELOOP_REGISTRY_URL || 'https://skills.codeloop.dev';
+export const installCommand = new Command('install')
+    .description('Install a skill from the registry, GitHub, or local path')
+    .argument('<source>', 'Skill name, github:user/repo/path, or local path')
+    .action(async (source) => {
+    const projectDir = process.cwd();
+    console.log();
+    // Determine install source
+    if (source.startsWith('./') || source.startsWith('/') || source.startsWith('../')) {
+        // Local path install
+        console.log(chalk.dim(`  Installing from local path: ${source}`));
+        const result = installFromLocal(projectDir, source);
+        if (!result.success) {
+            console.log(chalk.red(`  Failed: ${result.error}`));
+            process.exit(1);
+        }
+        console.log(chalk.green(`  Installed ${result.name}@${result.version}`));
+        for (const file of result.files) {
+            console.log(chalk.dim(`    → ${file}`));
+        }
+    }
+    else if (source.startsWith('github:')) {
+        // GitHub install
+        const githubPath = source.slice(7); // Remove "github:"
+        console.log(chalk.dim(`  Installing from GitHub: ${githubPath}`));
+        try {
+            // Fetch from GitHub raw content
+            const [owner, repo, ...pathParts] = githubPath.split('/');
+            const filePath = pathParts.length > 0 ? pathParts.join('/') : 'SKILL.md';
+            const url = `https://raw.githubusercontent.com/${owner}/${repo}/main/${filePath}`;
+            const res = await fetch(url);
+            if (!res.ok) {
+                // Try HEAD branch
+                const headUrl = `https://raw.githubusercontent.com/${owner}/${repo}/HEAD/${filePath}`;
+                const headRes = await fetch(headUrl);
+                if (!headRes.ok) {
+                    console.log(chalk.red(`  Failed to fetch: ${url} (${res.status})`));
+                    process.exit(1);
+                }
+                const content = await headRes.text();
+                const result = installFromContent(projectDir, content, `github:${githubPath}`, 'community');
+                logResult(result);
+                return;
+            }
+            const content = await res.text();
+            const result = installFromContent(projectDir, content, `github:${githubPath}`, 'community');
+            logResult(result);
+        }
+        catch (error) {
+            console.log(chalk.red(`  Failed: ${error.message}`));
+            process.exit(1);
+        }
+    }
+    else {
+        // Registry install (by name)
+        console.log(chalk.dim(`  Looking up: ${source}`));
+        // 1. Check local index first
+        const localIndex = loadLocalIndex();
+        const localEntry = findInLocalIndex(localIndex, source);
+        if (localEntry && localEntry.source === 'builtin') {
+            // Install from built-in templates
+            const result = installBuiltin(projectDir, source);
+            logResult(result);
+            return;
+        }
+        // 2. Try registry API
+        try {
+            const res = await fetch(`${REGISTRY_URL}/api/skills/${source}`);
+            if (!res.ok) {
+                if (res.status === 404) {
+                    console.log(chalk.red(`  Skill "${source}" not found in registry.`));
+                    console.log(chalk.dim(`  Try: codeloop search "${source}"`));
+                }
+                else {
+                    console.log(chalk.red(`  Registry error: ${res.status}`));
+                }
+                process.exit(1);
+            }
+            const data = await res.json();
+            const latestVersion = data.versions?.find((v) => v.dist_tag === 'latest') || data.versions?.[0];
+            if (!latestVersion?.artifact_url) {
+                console.log(chalk.red(`  No downloadable version found for "${source}"`));
+                process.exit(1);
+            }
+            // Download artifact
+            const artifactRes = await fetch(latestVersion.artifact_url);
+            if (!artifactRes.ok) {
+                console.log(chalk.red(`  Failed to download artifact: ${artifactRes.status}`));
+                process.exit(1);
+            }
+            const content = await artifactRes.text();
+            const tier = data.skill?.tier || 'community';
+            const result = installFromContent(projectDir, content, `registry:${source}`, tier);
+            logResult(result);
+        }
+        catch (error) {
+            console.log(chalk.red(`  Failed to connect to registry: ${error.message}`));
+            // Fallback: check if it's a builtin name
+            if (localEntry) {
+                console.log(chalk.yellow(`  Falling back to local index...`));
+                const result = installBuiltin(projectDir, source);
+                logResult(result);
+            }
+            else {
+                process.exit(1);
+            }
+        }
+    }
+    console.log();
+});
+function logResult(result) {
+    if (!result.success) {
+        console.log(chalk.red(`  Failed: ${result.error}`));
+        process.exit(1);
+    }
+    console.log(chalk.green(`  Installed ${result.name}@${result.version}`));
+    for (const file of result.files) {
+        console.log(chalk.dim(`    → ${file}`));
+    }
+}
+//# sourceMappingURL=install.js.map

package/dist/commands/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAG9E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,6BAA6B,CAAC;AAExF,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;KACjD,WAAW,CAAC,0DAA0D,CAAC;KACvE,QAAQ,CAAC,UAAU,EAAE,kDAAkD,CAAC;KACxE,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAEjC,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,2BAA2B;IAC3B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClF,qBAAqB;QACrB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAEpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,iBAAiB;QACjB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB;QACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,gCAAgC;YAChC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;YACzE,MAAM,GAAG,GAAG,qCAAqC,KAAK,IAAI,IAAI,SAAS,QAAQ,EAAE,CAAC;YAElF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,kBAAkB;gBAClB,MAAM,OAAO,GAAG,qCAAqC,KAAK,IAAI,IAAI,SAAS,QAAQ,EAAE,CAAC;gBACtF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,GAAG,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;gBAC5F,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClB,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;YAC5F,SAAS,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC,CAAC;QAElD,6BAA6B;QAC7B,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAExD,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,kCAAkC;YAClC,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAClD,SAAS,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,eAAe,MAAM,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,MAAM,0BAA0B,CAAC,CAAC,CAAC;oBACrE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC/D,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAErG,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wCAAwC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,oBAAoB;YACpB,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAC5D,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,WAAW,CAAC;YAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;YACnF,SAAS,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAE5E,yCAAyC;YACzC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAClD,SAAS,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,MAA2C;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/dist/commands/list.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const listCommand: Command;

package/dist/commands/list.js

@@ -0,0 +1,35 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { loadLockfile } from '../registry/lockfile.js';
+export const listCommand = new Command('list')
+    .description('Show installed skills')
+    .action(() => {
+    const projectDir = process.cwd();
+    const lockfile = loadLockfile(projectDir);
+    console.log();
+    const names = Object.keys(lockfile.installed);
+    if (names.length === 0) {
+        console.log(chalk.dim('  No skills installed via registry.'));
+        console.log(chalk.dim('  Built-in skills are managed by `codeloop init` and `codeloop update`.'));
+        console.log();
+        return;
+    }
+    console.log(chalk.bold('  Installed Skills'));
+    console.log();
+    for (const name of names.sort()) {
+        const entry = lockfile.installed[name];
+        const tierBadge = entry.tier === 'trusted'
+            ? chalk.green('trusted')
+            : entry.tier === 'community'
+                ? chalk.cyan('community')
+                : chalk.yellow('unreviewed');
+        console.log(`  ${chalk.bold(name)} ${chalk.dim(`v${entry.version}`)} ${tierBadge}`);
+        console.log(`  ${chalk.dim(`source: ${entry.source}`)}`);
+        console.log(`  ${chalk.dim(`installed: ${entry.installed}`)}`);
+        for (const file of entry.files) {
+            console.log(`  ${chalk.dim(`  → ${file}`)}`);
+        }
+        console.log();
+    }
+});
+//# sourceMappingURL=list.js.map

package/dist/commands/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KAC3C,WAAW,CAAC,uBAAuB,CAAC;KACpC,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAE1C,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC,CAAC;QAClG,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS;YACxC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YACxB,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;gBAC1B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;gBACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEjC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/login.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const loginCommand: Command;

package/dist/commands/login.js

@@ -0,0 +1,77 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
+import { join, dirname } from 'path';
+const TOKEN_PATH = join(process.env.HOME || '~', '.codeloop', 'auth.json');
+export const loginCommand = new Command('login')
+    .description('Authenticate with the skill registry (check status with --status)')
+    .option('--token <token>', 'GitHub personal access token')
+    .option('--status', 'Check current auth status')
+    .action(async (options) => {
+    console.log();
+    if (options.status) {
+        if (!existsSync(TOKEN_PATH)) {
+            console.log(chalk.dim('  Not authenticated'));
+            console.log(chalk.dim('  Run `codeloop login --token <github-pat>` to authenticate'));
+        }
+        else {
+            try {
+                const auth = JSON.parse(readFileSync(TOKEN_PATH, 'utf-8'));
+                console.log(chalk.green(`  Authenticated as: ${auth.username || 'unknown'}`));
+                console.log(chalk.dim(`  Token stored at: ${TOKEN_PATH}`));
+            }
+            catch {
+                console.log(chalk.yellow('  Auth file exists but is invalid'));
+            }
+        }
+        console.log();
+        return;
+    }
+    if (!options.token) {
+        console.log(chalk.bold('  GitHub Authentication'));
+        console.log();
+        console.log('  Create a GitHub Personal Access Token at:');
+        console.log(chalk.cyan('  https://github.com/settings/tokens/new'));
+        console.log();
+        console.log('  Required scopes: (none — public read access is sufficient)');
+        console.log();
+        console.log('  Then run:');
+        console.log(chalk.dim('  codeloop login --token ghp_xxxx'));
+        console.log();
+        return;
+    }
+    // Verify the token
+    console.log(chalk.dim('  Verifying token...'));
+    try {
+        const res = await fetch('https://api.github.com/user', {
+            headers: {
+                Authorization: `Bearer ${options.token}`,
+                Accept: 'application/json',
+            },
+        });
+        if (!res.ok) {
+            console.log(chalk.red('  Invalid token'));
+            console.log();
+            return;
+        }
+        const user = await res.json();
+        // Save token
+        const authDir = dirname(TOKEN_PATH);
+        if (!existsSync(authDir)) {
+            mkdirSync(authDir, { recursive: true });
+        }
+        writeFileSync(TOKEN_PATH, JSON.stringify({
+            token: options.token,
+            username: user.login,
+            github_id: String(user.id),
+            authenticated_at: new Date().toISOString(),
+        }, null, 2), 'utf-8');
+        console.log(chalk.green(`  Authenticated as ${user.login}`));
+        console.log(chalk.dim(`  Token stored at: ${TOKEN_PATH}`));
+    }
+    catch (error) {
+        console.log(chalk.red(`  Failed to verify token: ${error.message}`));
+    }
+    console.log();
+});
+//# sourceMappingURL=login.js.map

package/dist/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAErC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,mEAAmE,CAAC;KAChF,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,CAAC;KACzD,MAAM,CAAC,UAAU,EAAE,2BAA2B,CAAC;KAC/C,MAAM,CAAC,KAAK,EAAE,OAA6C,EAAE,EAAE;IAC9D,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC,CAAC;QACxF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;YACrD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;gBACxC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,aAAa;QACb,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;YACvC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,IAAI,CAAC,KAAK;YACpB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,gBAAgB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC3C,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAEtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC,CAAC,CAAC"}

package/dist/commands/publish.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const publishCommand: Command;