@skillbase/spm 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (160) hide show
  1. package/CHANGELOG.md +341 -0
  2. package/LICENSE +21 -0
  3. package/README.md +90 -0
  4. package/dist/cli/commands/connect.d.ts +3 -0
  5. package/dist/cli/commands/connect.d.ts.map +1 -0
  6. package/dist/cli/commands/connect.js +95 -0
  7. package/dist/cli/commands/connect.js.map +1 -0
  8. package/dist/cli/commands/convert.d.ts +9 -0
  9. package/dist/cli/commands/convert.d.ts.map +1 -0
  10. package/dist/cli/commands/convert.js +189 -0
  11. package/dist/cli/commands/convert.js.map +1 -0
  12. package/dist/cli/commands/create.d.ts +4 -0
  13. package/dist/cli/commands/create.d.ts.map +1 -0
  14. package/dist/cli/commands/create.js +104 -0
  15. package/dist/cli/commands/create.js.map +1 -0
  16. package/dist/cli/commands/info.d.ts +2 -0
  17. package/dist/cli/commands/info.d.ts.map +1 -0
  18. package/dist/cli/commands/info.js +51 -0
  19. package/dist/cli/commands/info.js.map +1 -0
  20. package/dist/cli/commands/init.d.ts +4 -0
  21. package/dist/cli/commands/init.d.ts.map +1 -0
  22. package/dist/cli/commands/init.js +53 -0
  23. package/dist/cli/commands/init.js.map +1 -0
  24. package/dist/cli/commands/install.d.ts +6 -0
  25. package/dist/cli/commands/install.d.ts.map +1 -0
  26. package/dist/cli/commands/install.js +272 -0
  27. package/dist/cli/commands/install.js.map +1 -0
  28. package/dist/cli/commands/list.d.ts +4 -0
  29. package/dist/cli/commands/list.d.ts.map +1 -0
  30. package/dist/cli/commands/list.js +29 -0
  31. package/dist/cli/commands/list.js.map +1 -0
  32. package/dist/cli/commands/login.d.ts +10 -0
  33. package/dist/cli/commands/login.d.ts.map +1 -0
  34. package/dist/cli/commands/login.js +141 -0
  35. package/dist/cli/commands/login.js.map +1 -0
  36. package/dist/cli/commands/publish.d.ts +6 -0
  37. package/dist/cli/commands/publish.d.ts.map +1 -0
  38. package/dist/cli/commands/publish.js +109 -0
  39. package/dist/cli/commands/publish.js.map +1 -0
  40. package/dist/cli/commands/rate.d.ts +5 -0
  41. package/dist/cli/commands/rate.d.ts.map +1 -0
  42. package/dist/cli/commands/rate.js +22 -0
  43. package/dist/cli/commands/rate.js.map +1 -0
  44. package/dist/cli/commands/search.d.ts +5 -0
  45. package/dist/cli/commands/search.d.ts.map +1 -0
  46. package/dist/cli/commands/search.js +70 -0
  47. package/dist/cli/commands/search.js.map +1 -0
  48. package/dist/cli/commands/stats.d.ts +2 -0
  49. package/dist/cli/commands/stats.d.ts.map +1 -0
  50. package/dist/cli/commands/stats.js +33 -0
  51. package/dist/cli/commands/stats.js.map +1 -0
  52. package/dist/cli/commands/uninstall.d.ts +2 -0
  53. package/dist/cli/commands/uninstall.d.ts.map +1 -0
  54. package/dist/cli/commands/uninstall.js +37 -0
  55. package/dist/cli/commands/uninstall.js.map +1 -0
  56. package/dist/cli/commands/update.d.ts +5 -0
  57. package/dist/cli/commands/update.d.ts.map +1 -0
  58. package/dist/cli/commands/update.js +97 -0
  59. package/dist/cli/commands/update.js.map +1 -0
  60. package/dist/cli/commands/validate.d.ts +2 -0
  61. package/dist/cli/commands/validate.d.ts.map +1 -0
  62. package/dist/cli/commands/validate.js +72 -0
  63. package/dist/cli/commands/validate.js.map +1 -0
  64. package/dist/cli/index.d.ts +3 -0
  65. package/dist/cli/index.d.ts.map +1 -0
  66. package/dist/cli/index.js +159 -0
  67. package/dist/cli/index.js.map +1 -0
  68. package/dist/core/config.d.ts +7 -0
  69. package/dist/core/config.d.ts.map +1 -0
  70. package/dist/core/config.js +72 -0
  71. package/dist/core/config.js.map +1 -0
  72. package/dist/core/feedback.d.ts +22 -0
  73. package/dist/core/feedback.d.ts.map +1 -0
  74. package/dist/core/feedback.js +93 -0
  75. package/dist/core/feedback.js.map +1 -0
  76. package/dist/core/github/client.d.ts +18 -0
  77. package/dist/core/github/client.d.ts.map +1 -0
  78. package/dist/core/github/client.js +141 -0
  79. package/dist/core/github/client.js.map +1 -0
  80. package/dist/core/indexer.d.ts +4 -0
  81. package/dist/core/indexer.d.ts.map +1 -0
  82. package/dist/core/indexer.js +90 -0
  83. package/dist/core/indexer.js.map +1 -0
  84. package/dist/core/loader.d.ts +3 -0
  85. package/dist/core/loader.d.ts.map +1 -0
  86. package/dist/core/loader.js +37 -0
  87. package/dist/core/loader.js.map +1 -0
  88. package/dist/core/lock.d.ts +4 -0
  89. package/dist/core/lock.d.ts.map +1 -0
  90. package/dist/core/lock.js +86 -0
  91. package/dist/core/lock.js.map +1 -0
  92. package/dist/core/manifest.d.ts +6 -0
  93. package/dist/core/manifest.d.ts.map +1 -0
  94. package/dist/core/manifest.js +33 -0
  95. package/dist/core/manifest.js.map +1 -0
  96. package/dist/core/paths.d.ts +8 -0
  97. package/dist/core/paths.d.ts.map +1 -0
  98. package/dist/core/paths.js +30 -0
  99. package/dist/core/paths.js.map +1 -0
  100. package/dist/core/plugins/index.d.ts +8 -0
  101. package/dist/core/plugins/index.d.ts.map +1 -0
  102. package/dist/core/plugins/index.js +30 -0
  103. package/dist/core/plugins/index.js.map +1 -0
  104. package/dist/core/plugins/loader.d.ts +9 -0
  105. package/dist/core/plugins/loader.d.ts.map +1 -0
  106. package/dist/core/plugins/loader.js +57 -0
  107. package/dist/core/plugins/loader.js.map +1 -0
  108. package/dist/core/plugins/types.d.ts +79 -0
  109. package/dist/core/plugins/types.d.ts.map +1 -0
  110. package/dist/core/plugins/types.js +3 -0
  111. package/dist/core/plugins/types.js.map +1 -0
  112. package/dist/core/registry-client.d.ts +80 -0
  113. package/dist/core/registry-client.d.ts.map +1 -0
  114. package/dist/core/registry-client.js +166 -0
  115. package/dist/core/registry-client.js.map +1 -0
  116. package/dist/core/registry.d.ts +11 -0
  117. package/dist/core/registry.d.ts.map +1 -0
  118. package/dist/core/registry.js +44 -0
  119. package/dist/core/registry.js.map +1 -0
  120. package/dist/core/resolver.d.ts +17 -0
  121. package/dist/core/resolver.d.ts.map +1 -0
  122. package/dist/core/resolver.js +44 -0
  123. package/dist/core/resolver.js.map +1 -0
  124. package/dist/core/storage/index.d.ts +9 -0
  125. package/dist/core/storage/index.d.ts.map +1 -0
  126. package/dist/core/storage/index.js +34 -0
  127. package/dist/core/storage/index.js.map +1 -0
  128. package/dist/core/storage/local-provider.d.ts +12 -0
  129. package/dist/core/storage/local-provider.d.ts.map +1 -0
  130. package/dist/core/storage/local-provider.js +44 -0
  131. package/dist/core/storage/local-provider.js.map +1 -0
  132. package/dist/core/storage/packager.d.ts +10 -0
  133. package/dist/core/storage/packager.d.ts.map +1 -0
  134. package/dist/core/storage/packager.js +185 -0
  135. package/dist/core/storage/packager.js.map +1 -0
  136. package/dist/core/storage/s3-provider.d.ts +12 -0
  137. package/dist/core/storage/s3-provider.d.ts.map +1 -0
  138. package/dist/core/storage/s3-provider.js +84 -0
  139. package/dist/core/storage/s3-provider.js.map +1 -0
  140. package/dist/core/storage/types.d.ts +27 -0
  141. package/dist/core/storage/types.d.ts.map +1 -0
  142. package/dist/core/storage/types.js +4 -0
  143. package/dist/core/storage/types.js.map +1 -0
  144. package/dist/mcp/server.d.ts +3 -0
  145. package/dist/mcp/server.d.ts.map +1 -0
  146. package/dist/mcp/server.js +349 -0
  147. package/dist/mcp/server.js.map +1 -0
  148. package/dist/schema/skill-schema.d.ts +6 -0
  149. package/dist/schema/skill-schema.d.ts.map +1 -0
  150. package/dist/schema/skill-schema.js +147 -0
  151. package/dist/schema/skill-schema.js.map +1 -0
  152. package/dist/scripts/reindex.d.ts +3 -0
  153. package/dist/scripts/reindex.d.ts.map +1 -0
  154. package/dist/scripts/reindex.js +37 -0
  155. package/dist/scripts/reindex.js.map +1 -0
  156. package/dist/types/index.d.ts +191 -0
  157. package/dist/types/index.d.ts.map +1 -0
  158. package/dist/types/index.js +3 -0
  159. package/dist/types/index.js.map +1 -0
  160. package/package.json +62 -0
package/CHANGELOG.md ADDED
@@ -0,0 +1,341 @@
1
+ # Changelog
2
+
3
+ ## [0.10.0] - 2026-03-12
4
+
5
+ ### Phase 5 — Semver Dependency Resolution
6
+
7
+ Skills with dependencies now auto-resolve and auto-install transitive dependencies from the registry during `skills install`.
8
+
9
+ ### Added
10
+
11
+ - **Dependency resolver** (`src/core/resolver.ts`):
12
+ - Resolves semver ranges (`^`, `~`, `>=`, exact) to concrete versions via registry
13
+ - Cycle detection via visited set
14
+ - Reports missing skills, unsatisfied ranges, invalid ranges
15
+ - **Server endpoint**: `GET /api/skills/:name/versions` — lists all published versions of a skill
16
+ - **Registry client**: `getVersions(name)` method for fetching available versions
17
+ - **Auto-install dependencies**: `skills install @scope/name` now resolves and installs transitive dependencies from registry
18
+ - **8 tests** for resolver (exact, caret, tilde, missing, cycles, multiple deps)
19
+
20
+ ### Changed
21
+
22
+ - `installFromRegistry` refactored into `installSingleFromRegistry` + dependency resolution layer
23
+ - Health endpoint version bumped to `0.10.0`
24
+
25
+ ---
26
+
27
+ ## [0.9.0] - 2026-03-12
28
+
29
+ ### Phase 4, Iteration 7 — Deployment Config + skills convert
30
+
31
+ Production deployment configuration for Fly.io + Tigris. New `skills convert` command for converting existing prompts into skills.
32
+
33
+ ### Added
34
+
35
+ - **Deployment config**:
36
+ - `Dockerfile` — multi-stage build (Node 22, TypeScript build → production image)
37
+ - `fly.toml` — Fly.io config (Amsterdam region, health checks, auto-suspend)
38
+ - `.dockerignore` — excludes tests, docs, dev files from image
39
+ - `src/server/start.ts` — standalone server entrypoint for Docker
40
+ - `npm run server` script
41
+ - **`skills convert <source>`** — convert prompt files (.md, .txt, .prompt) into skill scaffolds:
42
+ - Single file or directory of prompts
43
+ - Interactive mode: prompts for author, scope, license
44
+ - Non-interactive: `--author`, `--scope`, `--license`, `--output` flags
45
+ - Slugifies file names, creates skill.json + SKILL.md per prompt
46
+ - 5 tests covering single file, directory, skip existing, slugify, .prompt extension
47
+
48
+ ### Changed
49
+
50
+ - `.gitignore` updated: added `dist`, `.env`, `.env.*`
51
+
52
+ ---
53
+
54
+ ## [0.8.0] - 2026-03-11
55
+
56
+ ### Phase 4, Iterations 4-6 — Install Flow, Update Command, GitHub OAuth
57
+
58
+ Install flow now downloads `.tar.gz` packages from S3 via presigned URLs with integrity verification. New `skills update` command for re-publishing skills. GitHub OAuth device flow for CLI authentication.
59
+
60
+ ### Added
61
+
62
+ - **Install from S3** (Iteration 4):
63
+ - `installFromRegistry` downloads .tar.gz via presigned URL from `getDownloadUrl()`
64
+ - SHA-256 integrity verification before unpack
65
+ - DB content fallback for backwards compatibility
66
+ - 4 new tests in `tests/install-s3.test.ts`
67
+ - **`skills update <source>`** (Iteration 5):
68
+ - Verifies skill exists in registry, packages and re-publishes
69
+ - Shows version diff: "Updated @author/skill@1.1.0 (was 1.0.0)"
70
+ - Supports `--registry` and `--dry-run` flags
71
+ - **GitHub device flow** (Iteration 6):
72
+ - `POST /auth/github/device` — initiates GitHub device flow, returns `user_code` and `verification_uri`
73
+ - `POST /auth/github/device/poll` — polls for completion, returns API token when authorized
74
+ - In-memory session store with TTL and automatic cleanup
75
+ - Creates or links author by `github_id` (new → create, existing name → link, existing github_id → reuse)
76
+ - **DB schema**: `github_id` column on `authors` table (nullable, unique) for GitHub account linking
77
+ - **Registry client methods**: `startDeviceAuth()`, `pollDeviceAuth(sessionId)`
78
+ - **CLI `skills login --github`**:
79
+ - Initiates device flow against registry server
80
+ - Opens browser automatically, shows code for manual entry
81
+ - Polls until authorized, saves token to config
82
+ - **7 new tests** for device auth client methods
83
+
84
+ ### Changed
85
+
86
+ - **`skills login`**: registry URL is now optional (auto-selects if only one configured)
87
+ - **`skills login --name`**: still works for direct registration (backwards compatible)
88
+ - **Server env**: `GITHUB_CLIENT_ID` required for GitHub OAuth (server works without it, returns 503)
89
+ - Health endpoint version bumped to `0.8.0`
90
+
91
+ ---
92
+
93
+ ## [0.7.0] - 2026-03-11
94
+
95
+ ### Phase 4, Iteration 3 — Publish & Download via S3
96
+
97
+ Publish flow now packages skills as `.tar.gz` and uploads to S3. Download endpoint returns presigned URLs for fast install. Server initializes storage provider on startup and supports multipart upload.
98
+
99
+ ### Added
100
+
101
+ - **Multipart publish** (`POST /api/skills`):
102
+ - Accepts `multipart/form-data` with `metadata` (JSON) + `archive` (.tar.gz file)
103
+ - Server uploads archive to S3 via `StorageProvider`, stores `s3_key` in PostgreSQL
104
+ - On update, cleans up old S3 object if key changed
105
+ - Legacy JSON body path preserved for GitHub source and backwards compatibility
106
+ - **Download endpoint** (`GET /api/skills/:name/download`):
107
+ - Returns presigned S3 URL when package is in S3 (`download_url` field)
108
+ - Falls back to DB content when no S3 package (`content` field)
109
+ - Increments install counter
110
+ - **Registry client methods**:
111
+ - `publishWithArchive(metadata, archive)` — sends multipart FormData with archive buffer
112
+ - `getDownloadUrl(name, version?)` — fetches presigned URL or content fallback
113
+ - `PublishResult` and `DownloadResult` types exported
114
+ - **CLI publish improvements**:
115
+ - `skills publish ./my-skill` now packages skill as `.tar.gz` before upload
116
+ - Displays package size, token estimate after publish
117
+ - Dry-run shows package size, file count, integrity hash
118
+
119
+ ### Changed
120
+
121
+ - **Server startup** (`src/server/index.ts`):
122
+ - Initializes `StorageProvider` from env config (`STORAGE_TYPE`, `S3_*`)
123
+ - Registers `@fastify/multipart` plugin (50 MB file size limit)
124
+ - Passes `StorageProvider | null` to skill routes
125
+ - Storage is optional — server works in DB-only mode without S3 config
126
+ - Health endpoint version bumped to `0.6.0`
127
+
128
+ ### Dependencies added
129
+
130
+ - `@fastify/multipart` — multipart form data parsing for Fastify
131
+
132
+ ---
133
+
134
+ ## [0.6.0] - 2026-03-11
135
+
136
+ ### Phase 4, Iteration 2 — S3 Storage Provider & Skill Packager
137
+
138
+ Storage infrastructure for skill packages. S3-compatible provider for production, local filesystem provider for development. Skill directories are packed into `.tar.gz` archives with SHA-256 integrity hashes.
139
+
140
+ ### Added
141
+
142
+ - **Storage provider system** (`src/core/storage/`):
143
+ - `StorageProvider` interface — `upload`, `download`, `getSignedUrl`, `delete`, `exists`
144
+ - `S3StorageProvider` — production provider via `@aws-sdk/client-s3` (supports AWS S3, Tigris, R2, MinIO)
145
+ - `LocalStorageProvider` — local filesystem provider for development (same interface)
146
+ - `createStorageProvider(config)` factory — instantiates provider by config type
147
+ - `loadStorageConfigFromEnv()` — reads `STORAGE_TYPE`, `S3_BUCKET`, `S3_REGION`, `S3_ENDPOINT`, `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY` from env
148
+ - **Skill packager** (`src/core/storage/packager.ts`):
149
+ - `packSkill(dir)` — collects skill directory into `.tar.gz` with SHA-256 integrity hash
150
+ - `unpackSkill(data, destDir)` — extracts `.tar.gz` archive into target directory
151
+ - `computeIntegrity(data)` — SHA-256 hash for verification
152
+ - Ignores `node_modules`, `.git`, `.DS_Store`, `Thumbs.db`
153
+ - **S3 key helper**: `buildSkillS3Key(author, name, version)` → `skills/{author}/{name}/{version}.tar.gz`
154
+ - **Tests**: 12 tests covering LocalStorageProvider, packSkill/unpackSkill roundtrip, nested dirs, ignore patterns, integrity verification
155
+
156
+ ### Changed
157
+
158
+ - **DB schema**: added `s3_key` column to `skills` table; `entry_content` is now nullable (content lives in S3, DB stores preview for search)
159
+ - **Migration**: `ALTER TABLE skills ADD COLUMN IF NOT EXISTS s3_key TEXT`, `ALTER COLUMN entry_content DROP NOT NULL`
160
+
161
+ ### Dependencies added
162
+
163
+ - `@aws-sdk/client-s3` — S3 client
164
+ - `@aws-sdk/s3-request-presigner` — presigned URL generation
165
+ - `tar-stream` — tar archive creation/extraction
166
+
167
+ ---
168
+
169
+ ## [0.5.0] - 2026-03-11
170
+
171
+ ### Phase 4, Iteration 1 — Architecture Pivot: Remove Blockchain
172
+
173
+ Removed all blockchain/NFT/token infrastructure. The project now uses a simpler centralized architecture: S3-compatible storage for skill packages, PostgreSQL for metadata, API token auth for publishing.
174
+
175
+ ### Removed
176
+
177
+ - **Blockchain code**: `contracts/` (Solidity smart contracts, tests, deploy scripts), `src/core/blockchain/` (wallet, contracts, IPFS, chain-config, ABIs)
178
+ - **Reward system**: `src/server/rewards/` (merkle trees, anti-fraud), `src/server/routes/rewards.ts`, reward API endpoints
179
+ - **Blockchain CLI commands**: `skills wallet`, `skills rewards`, blockchain-based `skills update`
180
+ - **Blockchain publish path**: `--chain` flag, `WALLET_PRIVATE_KEY` auto-detection, NFT minting in `skills publish`
181
+ - **DB tables**: `reward_epochs`, `reward_leaves`; `reporter_address` column from `skill_feedback`
182
+ - **Dependencies**: `viem` (EVM client)
183
+
184
+ ### Changed
185
+
186
+ - `skills publish` — simplified to registry-only (removed `--chain` flag and blockchain path)
187
+ - `src/server/index.ts` — removed reward routes registration
188
+ - `src/types/index.ts` — removed blockchain type re-exports, removed `blockchain`/`ipfs` from `SkillsConfig`
189
+ - `src/core/config.ts` — removed blockchain/ipfs config fields
190
+ - Documentation updated: spec, phase4 plan, architecture, CLI reference, getting started, creating skills
191
+
192
+ ### Technical decisions
193
+
194
+ - **Blockchain removed**: excessive complexity without proportional value at current stage
195
+ - **S3 storage planned**: Tigris (Fly.io) as primary, any S3-compatible provider supported
196
+ - **Auth model**: API tokens for CLI (existing), GitHub OAuth planned for Web UI
197
+ - **Dual storage**: entry content in PostgreSQL (for search/quick access) + full .tar.gz packages in S3
198
+
199
+ ---
200
+
201
+ ## [0.4.0] - 2026-03-11
202
+
203
+ ### Phase 3 — Remote Registry
204
+
205
+ Skills can be published, discovered, and installed from remote registries. Anyone can run a private registry server. GitHub integration for skill hosting (public + private repos).
206
+
207
+ ### Added
208
+
209
+ - **Registry server** (`src/server/`):
210
+ - Fastify HTTP server with auto-migration on startup
211
+ - PostgreSQL via Drizzle ORM — skills, authors, feedback, API tokens
212
+ - REST API: publish, search, content download, feedback, author profiles
213
+ - GraphQL API (`/graphql`): search, skill details, author queries
214
+ - Token-based authentication (register → get API token)
215
+ - Confidence recalculation on feedback
216
+ - `skills server start` — launch a registry server (`DATABASE_URL` required)
217
+ - **GitHub integration** (`src/server/github/`):
218
+ - Fetch skills from GitHub repos (public + private via PAT)
219
+ - Parse multiple URL formats: `https://github.com/owner/repo/tree/branch/path`, `github:owner/repo`, `owner/repo`
220
+ - Download full skill directory for install
221
+ - Publish from GitHub source (server fetches content)
222
+ - **Multi-registry config**:
223
+ - `registries[]` in `config.json` — named registries with URL and optional token
224
+ - `scopes` mapping — bind `@scope` to a specific registry (e.g. `@company → company-registry`)
225
+ - `github.token` for private repo access
226
+ - `resolveRegistry()` / `getRegistryToken()` helpers
227
+ - **Registry client** (`src/core/registry-client.ts`):
228
+ - HTTP client for communicating with remote registries
229
+ - `RegistryClient` class: search, getSkill, getContent, publish, register, sendFeedback
230
+ - `getClientForSkill()` — resolves skill name → correct registry client via scope config
231
+ - **CLI commands**:
232
+ - `skills search <query> [--remote|--all]` — search local and/or remote registries
233
+ - `skills publish <source> [--registry name] [--github]` — publish from local path or GitHub URL
234
+ - `skills login <registry-url> --name <author>` — register + save token
235
+ - `skills registry add <url> [--name] [--token] [--scope]` — add registry to config
236
+ - `skills server start [-p port] [--database-url]` — start registry server
237
+ - **Enhanced `skills install`**:
238
+ - `skills install <local-path>` — existing local install
239
+ - `skills install @scope/name [--version]` — install from remote registry
240
+ - `skills install <github-url> [--github token]` — install directly from GitHub
241
+ - **MCP tools**:
242
+ - `skill_search` now accepts `scope` param: `local`, `remote`, or `all`
243
+ - `skill_install` — new tool, installs skills from remote registry (requires user confirmation)
244
+ - **New types**: `RegistryEntry`, `RemoteSkillEntry`, `PublishRequest`, `RegistrySearchResult`
245
+ - **DB schema**: `authors`, `skills`, `skill_feedback`, `api_tokens` tables with GIN index on tags
246
+
247
+ ### Changed
248
+
249
+ - Config system extended: `SkillsConfig` now includes `registries`, `scopes`, `github`
250
+ - MCP server version bumped to 0.4.0
251
+ - Server instructions updated with remote search and install guidance
252
+ - CLI version bumped to 0.4.0
253
+
254
+ ### Dependencies added
255
+
256
+ - `fastify` — HTTP server
257
+ - `drizzle-orm` + `postgres` — PostgreSQL ORM
258
+ - `graphql` + `graphql-yoga` — GraphQL server
259
+ - `@octokit/rest` — GitHub API client
260
+ - `semver` — version resolution
261
+
262
+ ## [0.3.0] - 2026-03-11
263
+
264
+ ### Phase 2 — Feedback + Quality
265
+
266
+ Skills learn from usage. The system collects feedback, calculates confidence, and surfaces metrics via CLI and MCP.
267
+
268
+ ### Added
269
+
270
+ - **Feedback system**:
271
+ - `FeedbackEntry`, `FeedbackStore`, `SkillStats` types — structured feedback data model
272
+ - `src/core/feedback.ts` — storage CRUD (`addFeedback`, `getEntriesForSkill`, `getAllStats`, `getStatsForSkill`)
273
+ - `src/core/config.ts` — read/write `config.json` with safe merge over defaults
274
+ - Path helpers: `getFeedbackPath()`, `getConfigPath()`
275
+ - Confidence formula: `success_rate × min(1, log₂(usage_count + 1) / 5)`
276
+ - **MCP tool `skill_feedback`** — records usage result (success/partial/failure/false_trigger) with optional comment
277
+ - **Enhanced `skill_load`** — response now includes metadata block with `confidence`, `works_with`, `permissions`
278
+ - **Enhanced `skill_search`** — results include `confidence` score per skill
279
+ - **Config-based tool toggles** — each MCP tool registered only if enabled in `config.json`; `skill_feedback` also requires `feedback.enabled`
280
+ - **CLI commands**:
281
+ - `skills stats` — feedback dashboard (uses, success rate, rating, confidence with ⚠ for low confidence)
282
+ - `skills rate <name> --score <1-5> [--comment]` — explicit user feedback
283
+ - **`skills init`** now uses canonical `getDefaultConfig()` from `src/core/config.ts`
284
+
285
+ ### Changed
286
+
287
+ - `createServer()` is now async (reads config before registering tools)
288
+ - MCP server version bumped to 0.3.0
289
+ - Server instructions updated with feedback workflow and confidence guidance
290
+
291
+ ## [0.2.0] - 2026-03-11
292
+
293
+ ### Phase 1 — CLI "npm for skills"
294
+
295
+ Full local workflow through CLI. Create, validate, install, and manage skills.
296
+
297
+ ### Added
298
+
299
+ - **CLI commands**:
300
+ - `skills init [--project]` — initialize global or per-project skills directory
301
+ - `skills create <name> [-s scope]` — scaffold a new skill with template
302
+ - `skills validate <path>` — validate skill.json and file structure
303
+ - `skills install <path>` — install from local path with auto reindex + lock
304
+ - `skills uninstall <name>` — remove skill with auto reindex + lock
305
+ - `skills list [-v]` — list installed skills (verbose mode available)
306
+ - `skills info <name>` — detailed skill information (permissions, works_with, etc.)
307
+ - `skills reindex [--project]` — rebuild index manually
308
+ - **Lock file** (`skills.lock`): auto-generated on install/uninstall with SHA-256 integrity hashes and token estimates
309
+ - **MCP tools**:
310
+ - `skill_context` — shows loaded skills, token budget used/available
311
+ - `skill_search` — search by keyword, tag, file pattern with scoring
312
+ - **Session tracking**: MCP server tracks which skills are loaded per session
313
+ - **Documentation** (`docs/`):
314
+ - `getting-started.md` — installation, setup, client integration
315
+ - `cli-reference.md` — all CLI commands with options and examples
316
+ - `creating-skills.md` — guide to writing skills (skill.json, SKILL.md, tips)
317
+ - `architecture.md` — system design, components, lazy loading, security
318
+
319
+ ## [0.1.0] - 2026-03-11
320
+
321
+ ### Phase 0 — "Hello, Skill"
322
+
323
+ First working prototype. Skills can be installed manually, indexed, and served to any MCP-compatible AI client.
324
+
325
+ ### Added
326
+
327
+ - **Core types**: `SkillManifest`, `SkillIndex`, `LoadedSkill`, `SkillsLock` TypeScript definitions
328
+ - **JSON Schema validation** for `skill.json` with full spec compliance (schema_version, trigger, security, compatibility, works_with, etc.)
329
+ - **Indexer**: scans `~/.skills/installed/` (global) and `.skills/installed/` (per-project), generates `index.json` with token estimates
330
+ - **Registry**: reads and merges global + project indexes; project-level skills override global by name
331
+ - **Loader**: loads `SKILL.md` content from disk with metadata (permissions, works_with)
332
+ - **MCP server** (stdio transport) with two tools:
333
+ - `skill_list` — returns compact list of all installed skills
334
+ - `skill_load` — loads a skill's full instructions into model context
335
+ - **CLI**: `skills serve` command to start MCP server
336
+ - **Reindex script**: `npm run reindex` to rebuild `index.json`
337
+ - **3 starter skills**:
338
+ - `@examples/hello-world` — demo skill for testing
339
+ - `@core/docx` — Word document creation with python-docx
340
+ - `@core/xlsx` — Excel spreadsheet creation with openpyxl
341
+ - **Verified integration** with Claude Desktop and Zed IDE
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 SkillBase
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,90 @@
1
+ # SkillBase
2
+
3
+ Package manager for AI skills — discover, install, and publish reusable prompts and tools.
4
+
5
+ ```
6
+ npm install -g skillbase
7
+ ```
8
+
9
+ ## Quick start
10
+
11
+ ```bash
12
+ # Initialize skills directory
13
+ spm init
14
+
15
+ # Search for skills
16
+ spm search "code review"
17
+
18
+ # Install a skill
19
+ spm install author/skill-name
20
+
21
+ # Connect to your AI client
22
+ spm connect claude
23
+ ```
24
+
25
+ ## What is a skill?
26
+
27
+ A skill is a portable, versioned package containing prompts, tools, or instructions that any AI model can use. Think npm packages, but for AI capabilities.
28
+
29
+ ```
30
+ my-skill/
31
+ ├── skill.json # Manifest (name, version, dependencies)
32
+ ├── prompt.md # Main prompt
33
+ └── tools/ # Optional MCP tools
34
+ ```
35
+
36
+ ## Commands
37
+
38
+ | Command | Description |
39
+ |---------|-------------|
40
+ | `spm init` | Initialize skills directory |
41
+ | `spm create <name>` | Scaffold a new skill |
42
+ | `spm install [source]` | Install skills (supports GitHub URLs) |
43
+ | `spm publish <path>` | Publish to registry |
44
+ | `spm search <query>` | Search local and remote registries |
45
+ | `spm connect <client>` | Connect to AI client (Claude, Zed) |
46
+ | `spm convert <file>` | Convert .md/.txt prompts to skills |
47
+ | `spm list` | List installed skills |
48
+ | `spm info <name>` | Show skill details |
49
+ | `spm rate <name>` | Rate a skill |
50
+
51
+ ## MCP Server
52
+
53
+ SkillBase includes a built-in [Model Context Protocol](https://modelcontextprotocol.io) server for direct AI integration:
54
+
55
+ ```bash
56
+ spm serve --stdio
57
+ ```
58
+
59
+ ## Registries
60
+
61
+ Skills can be published to self-hosted registries or installed directly from GitHub:
62
+
63
+ ```bash
64
+ # Add a registry
65
+ spm registry add https://registry.example.com
66
+
67
+ # Install from GitHub
68
+ spm install github:author/repo
69
+
70
+ # Publish to a specific registry
71
+ spm publish ./my-skill --registry myregistry
72
+ ```
73
+
74
+ ## Authentication
75
+
76
+ ```bash
77
+ # Login via GitHub OAuth
78
+ spm login --github
79
+
80
+ # Or with a specific registry
81
+ spm login https://registry.example.com
82
+ ```
83
+
84
+ ## Requirements
85
+
86
+ - Node.js >= 20.0.0
87
+
88
+ ## License
89
+
90
+ [MIT](LICENSE)
@@ -0,0 +1,3 @@
1
+ export declare function connectCommand(client: string): Promise<void>;
2
+ export declare function disconnectCommand(client: string): Promise<void>;
3
+ //# sourceMappingURL=connect.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/connect.ts"],"names":[],"mappings":"AA+DA,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAyBf"}
@@ -0,0 +1,95 @@
1
+ import fs from "node:fs/promises";
2
+ import { realpathSync } from "node:fs";
3
+ import path from "node:path";
4
+ import os from "node:os";
5
+ const MCP_SERVER_KEY = "spm";
6
+ function getClients() {
7
+ const home = os.homedir();
8
+ const platform = process.platform;
9
+ const claudeConfigDir = platform === "darwin"
10
+ ? path.join(home, "Library", "Application Support", "Claude")
11
+ : path.join(home, ".config", "Claude");
12
+ return {
13
+ claude: {
14
+ name: "Claude Desktop",
15
+ configPath: path.join(claudeConfigDir, "claude_desktop_config.json"),
16
+ serverSection: "mcpServers",
17
+ },
18
+ zed: {
19
+ name: "Zed",
20
+ configPath: path.join(home, ".config", "zed", "settings.json"),
21
+ serverSection: "context_servers",
22
+ },
23
+ };
24
+ }
25
+ function getSkillsBin() {
26
+ // Resolve the real path (follows symlinks) to the dist/cli/index.js entry
27
+ const arg1 = process.argv[1];
28
+ if (arg1) {
29
+ try {
30
+ return realpathSync(arg1);
31
+ }
32
+ catch {
33
+ return arg1;
34
+ }
35
+ }
36
+ return "spm";
37
+ }
38
+ async function readJsonFile(filePath) {
39
+ try {
40
+ const raw = await fs.readFile(filePath, "utf-8");
41
+ return JSON.parse(raw);
42
+ }
43
+ catch {
44
+ return {};
45
+ }
46
+ }
47
+ async function writeJsonFile(filePath, data) {
48
+ await fs.mkdir(path.dirname(filePath), { recursive: true });
49
+ await fs.writeFile(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
50
+ }
51
+ export async function connectCommand(client) {
52
+ const clients = getClients();
53
+ const config = clients[client];
54
+ if (!config) {
55
+ console.error(`Unknown client "${client}". Supported: ${Object.keys(clients).join(", ")}`);
56
+ process.exit(1);
57
+ }
58
+ const data = await readJsonFile(config.configPath);
59
+ const section = (data[config.serverSection] ?? {});
60
+ if (section[MCP_SERVER_KEY]) {
61
+ console.log(`Already connected to ${config.name}.`);
62
+ console.log(` Config: ${config.configPath}`);
63
+ return;
64
+ }
65
+ section[MCP_SERVER_KEY] = {
66
+ command: process.execPath,
67
+ args: [getSkillsBin(), "serve"],
68
+ };
69
+ data[config.serverSection] = section;
70
+ await writeJsonFile(config.configPath, data);
71
+ console.log(`Connected to ${config.name}.`);
72
+ console.log(` Config: ${config.configPath}`);
73
+ console.log(` Restart ${config.name} to activate.`);
74
+ }
75
+ export async function disconnectCommand(client) {
76
+ const clients = getClients();
77
+ const config = clients[client];
78
+ if (!config) {
79
+ console.error(`Unknown client "${client}". Supported: ${Object.keys(clients).join(", ")}`);
80
+ process.exit(1);
81
+ }
82
+ const data = await readJsonFile(config.configPath);
83
+ const section = (data[config.serverSection] ?? {});
84
+ if (!section[MCP_SERVER_KEY]) {
85
+ console.log(`Not connected to ${config.name}.`);
86
+ return;
87
+ }
88
+ delete section[MCP_SERVER_KEY];
89
+ data[config.serverSection] = section;
90
+ await writeJsonFile(config.configPath, data);
91
+ console.log(`Disconnected from ${config.name}.`);
92
+ console.log(` Config: ${config.configPath}`);
93
+ console.log(` Restart ${config.name} to apply.`);
94
+ }
95
+ //# sourceMappingURL=connect.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/cli/commands/connect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,cAAc,GAAG,KAAK,CAAC;AAQ7B,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,MAAM,eAAe,GACnB,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE3C,OAAO;QACL,MAAM,EAAE;YACN,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,4BAA4B,CAAC;YACpE,aAAa,EAAE,YAAY;SAC5B;QACD,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC;YAC9D,aAAa,EAAE,iBAAiB;SACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,0EAA0E;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,IAA6B;IAC1E,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc;IAEd,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,mBAAmB,MAAM,iBAAiB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAA4B,CAAC;IAE9E,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,cAAc,CAAC,GAAG;QACxB,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,IAAI,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IAErC,MAAM,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE7C,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc;IAEd,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,mBAAmB,MAAM,iBAAiB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAA4B,CAAC;IAE9E,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IAED,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IAErC,MAAM,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE7C,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC;AACpD,CAAC"}
@@ -0,0 +1,9 @@
1
+ interface ConvertOptions {
2
+ author?: string;
3
+ scope?: string;
4
+ license?: string;
5
+ output?: string;
6
+ }
7
+ export declare function convertCommand(source: string, options: ConvertOptions): Promise<void>;
8
+ export {};
9
+ //# sourceMappingURL=convert.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"convert.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/convert.ts"],"names":[],"mappings":"AAIA,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkMD,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CA0Cf"}