@skillport/cli 0.1.3 → 0.1.6

package/dist/index.js

@@ -2502,12 +2502,45 @@ async function uninstallCommand(skillId) {
 init_config();
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 import inquirer4 from "inquirer";
-function listenOnPort(server, port) {
+
+// src/utils/register-key.ts
+init_config();
+import chalk9 from "chalk";
+async function registerPublicKey(config) {
+  if (!hasKeys()) {
+    return false;
+  }
+  try {
+    const publicKey = loadPublicKey2();
+    const res = await fetch(`${config.marketplace_url}/v1/keys`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${config.auth_token}`
+      },
+      body: JSON.stringify({ public_key_pem: publicKey, label: "default" })
+    });
+    if (res.ok || res.status === 409) {
+      console.log(chalk9.dim("  Public key registered with marketplace."));
+      return true;
+    }
+    const body = await res.json().catch(() => ({}));
+    console.log(chalk9.yellow(`  Warning: Could not register public key: ${body.error || res.statusText}`));
+    return false;
+  } catch {
+    console.log(chalk9.yellow("  Warning: Could not reach marketplace to register public key."));
+    return false;
+  }
+}
+
+// src/commands/login.ts
+var DEFAULT_HOST = "127.0.0.1";
+function listenOnPort(server, port, host) {
   return new Promise((resolve, reject) => {
     server.once("error", reject);
-    server.listen(port, () => {
+    server.listen(port, host, () => {
       server.removeListener("error", reject);
       const addr = server.address();
       resolve(addr.port);
@@ -2516,8 +2549,8 @@ function listenOnPort(server, port) {
 }
 async function loginCommand(options) {
   const config = loadConfig();
-  console.log(chalk9.bold("SkillPort Market Login"));
-  console.log(chalk9.dim(`Marketplace: ${config.marketplace_web_url}`));
+  console.log(chalk10.bold("SkillPort Market Login"));
+  console.log(chalk10.dim(`Marketplace: ${config.marketplace_web_url}`));
   console.log();
   let method = options.method;
   if (options.token) {
@@ -2530,8 +2563,8 @@ async function loginCommand(options) {
         name: "method",
         message: "Login method:",
         choices: [
-          { name: "Browser (GitHub OAuth)", value: "browser" },
-          { name: "Paste API token", value: "token" }
+          { name: "Paste CLI token (recommended)", value: "token" },
+          { name: "Browser (GitHub OAuth)", value: "browser" }
         ]
       }
     ]);
@@ -2539,43 +2572,56 @@ async function loginCommand(options) {
   }
   if (method === "token") {
     let token2 = options.token;
+    if (!token2 && options.yes) {
+      console.error(chalk10.red("Error: --token is required in non-interactive mode."));
+      console.log(chalk10.dim("  Get your token at: https://skillport.market/auth/cli-token"));
+      process.exitCode = 1;
+      return;
+    }
     if (!token2) {
+      console.log(chalk10.dim("Get your token at: https://skillport.market/auth/cli-token"));
+      console.log();
       const answer = await inquirer4.prompt([
-        { type: "password", name: "token", message: "Enter your API token:" }
+        { type: "password", name: "token", message: "Enter your CLI token:" }
       ]);
       token2 = answer.token;
     }
     config.auth_token = token2;
     saveConfig(config);
-    console.log(chalk9.green("Login successful! Token saved."));
+    await registerPublicKey(config);
+    console.log(chalk10.green("Login successful! Token saved."));
     return;
   }
   const state = randomBytes(16).toString("hex");
   const requestedPort = options.port !== void 0 ? parseInt(options.port, 10) : 9876;
   const userExplicitPort = options.port !== void 0;
+  const bindHost = options.host || DEFAULT_HOST;
   const server = createServer();
   let actualPort;
   try {
-    actualPort = await listenOnPort(server, requestedPort);
+    actualPort = await listenOnPort(server, requestedPort, bindHost);
   } catch (err) {
     const code = err.code;
     if (code === "EADDRINUSE" && !userExplicitPort) {
-      console.log(chalk9.yellow(`Port ${requestedPort} in use, selecting a free port...`));
-      actualPort = await listenOnPort(server, 0);
+      console.log(chalk10.yellow(`Port ${requestedPort} in use, selecting a free port...`));
+      actualPort = await listenOnPort(server, 0, bindHost);
     } else {
       throw err;
     }
   }
-  const authUrl = `${config.marketplace_web_url}/auth/cli?state=${state}&port=${actualPort}`;
+  const callbackHost = bindHost === "::1" ? "[::1]" : bindHost;
+  const authUrl = `${config.marketplace_web_url}/auth/cli?state=${state}&port=${actualPort}&host=${encodeURIComponent(callbackHost)}`;
   if (options.browser === false) {
-    console.log(chalk9.bold("Open this URL in your browser to authenticate:"));
+    console.log(chalk10.bold("Open this URL in your browser to authenticate:"));
     console.log();
     console.log(`  ${authUrl}`);
     console.log();
-    console.log(chalk9.dim("Waiting for authentication callback..."));
+    console.log(chalk10.dim(`Listening on ${callbackHost}:${actualPort}`));
+    console.log(chalk10.dim("Waiting for authentication callback..."));
   } else {
-    console.log(chalk9.dim(`Opening browser to: ${authUrl}`));
-    console.log(chalk9.dim("Waiting for authentication..."));
+    console.log(chalk10.dim(`Opening browser to: ${authUrl}`));
+    console.log(chalk10.dim(`Listening on ${callbackHost}:${actualPort}`));
+    console.log(chalk10.dim("Waiting for authentication..."));
     const { exec } = await import("node:child_process");
     const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
     exec(`${openCmd} "${authUrl}"`);
@@ -2583,10 +2629,16 @@ async function loginCommand(options) {
   const token = await new Promise((resolve, reject) => {
     const timeout = setTimeout(() => {
       server.close();
-      reject(new Error("Authentication timed out (60s). Try again or use: skillport login --method token --token <your-token>"));
+      reject(new Error(
+        `Authentication timed out (60s).
+  Listened on: ${callbackHost}:${actualPort}
+  Self-test:   curl http://${callbackHost}:${actualPort}/callback?state=test\\&token=test
+  Retry:       skillport login --yes --no-browser --port 0 --host 127.0.0.1
+  Or use:      skillport login --method token --token <your-token>`
+      ));
     }, 6e4);
     server.on("request", (req, res) => {
-      const url = new URL(req.url || "", `http://localhost:${actualPort}`);
+      const url = new URL(req.url || "", `http://${callbackHost}:${actualPort}`);
       if (url.pathname === "/callback") {
         const callbackState = url.searchParams.get("state");
         const accessToken = url.searchParams.get("token");
@@ -2627,34 +2679,20 @@ async function loginCommand(options) {
     config.auth_token = token;
   }
   saveConfig(config);
-  if (hasKeys()) {
-    try {
-      const publicKey = loadPublicKey2();
-      await fetch(`${config.marketplace_url}/v1/keys`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${config.auth_token}`
-        },
-        body: JSON.stringify({ public_key_pem: publicKey, label: "default" })
-      });
-      console.log(chalk9.dim("  Public key registered with marketplace."));
-    } catch {
-    }
-  }
-  console.log(chalk9.green("Login successful! Token saved."));
+  await registerPublicKey(config);
+  console.log(chalk10.green("Login successful! Token saved."));
 }
 
 // src/commands/publish.ts
 import { readFileSync as readFileSync8, existsSync as existsSync5 } from "node:fs";
 import { join as join6 } from "node:path";
 import { homedir as homedir3 } from "node:os";
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 init_config();
 async function publishCommand(sspPath) {
   const config = loadConfig();
   if (!config.auth_token) {
-    console.log(chalk10.red("Not logged in. Run 'skillport login' first."));
+    console.log(chalk11.red("Not logged in. Run 'skillport login' first."));
     process.exitCode = 1;
     return;
   }
@@ -2663,12 +2701,12 @@ async function publishCommand(sspPath) {
   const extracted = await extractSSP(data);
   const { valid } = verifyChecksums(extracted.files, extracted.checksums);
   if (!valid) {
-    console.log(chalk10.red("Checksum verification failed. Cannot publish."));
+    console.log(chalk11.red("Checksum verification failed. Cannot publish."));
     process.exitCode = 1;
     return;
   }
   if (!extracted.authorSignature) {
-    console.log(chalk10.red("No author signature. Sign the package first."));
+    console.log(chalk11.red("No author signature. Sign the package first."));
     process.exitCode = 1;
     return;
   }
@@ -2682,53 +2720,91 @@ async function publishCommand(sspPath) {
       pubKeyPem
     );
     if (!sigValid) {
-      console.log(chalk10.red("Signature verification failed. Package may have been tampered with after signing."));
-      console.log(chalk10.dim(`  Key ID: ${keyId}`));
+      console.log(chalk11.red("Signature verification failed. Package may have been tampered with after signing."));
+      console.log(chalk11.dim(`  Key ID: ${keyId}`));
       process.exitCode = 1;
       return;
     }
-    console.log(chalk10.green("\u2713 Signature verified"));
+    console.log(chalk11.green("\u2713 Signature verified"));
   } else {
-    console.log(chalk10.yellow("\u26A0 Local public key not found \u2014 skipping local signature check"));
-    console.log(chalk10.dim("  Server will verify signature against registered key."));
+    console.log(chalk11.yellow("\u26A0 Local public key not found \u2014 skipping local signature check"));
+    console.log(chalk11.dim("  Server will verify signature against registered key."));
   }
   console.log("Uploading to marketplace...");
-  try {
+  async function upload() {
     const formData = new FormData();
     formData.append("file", new Blob([data]), sspPath.split("/").pop());
-    const response = await fetch(`${config.marketplace_url}/v1/skills`, {
+    return fetch(`${config.marketplace_url}/v1/skills`, {
       method: "POST",
-      headers: {
-        Authorization: `Bearer ${config.auth_token}`
-      },
+      headers: { Authorization: `Bearer ${config.auth_token}` },
       body: formData
     });
+  }
+  try {
+    let response = await upload();
     if (!response.ok) {
-      const errorBody = await response.json();
-      console.log(chalk10.red(`Upload failed: ${errorBody.error || response.statusText}`));
-      process.exitCode = 1;
-      return;
+      const errorBody = await response.json().catch(() => ({}));
+      const errorMsg = String(errorBody.error || "");
+      if (errorMsg.includes("Signing key is not registered") && hasKeys()) {
+        console.log(chalk11.yellow("Signing key not registered. Registering automatically..."));
+        const registered = await registerPublicKey(config);
+        if (registered) {
+          console.log("Retrying upload...");
+          response = await upload();
+        } else {
+          console.log(chalk11.red("Could not register key. Run 'skillport keys register' manually."));
+          process.exitCode = 1;
+          return;
+        }
+      }
+      if (!response.ok) {
+        const retryBody = await response.json().catch(() => ({}));
+        console.log(chalk11.red(`Upload failed: ${retryBody.error || response.statusText}`));
+        process.exitCode = 1;
+        return;
+      }
     }
     const result = await response.json();
-    console.log(chalk10.green("Published successfully!"));
+    console.log(chalk11.green("Published successfully!"));
     console.log();
-    console.log(`  ${chalk10.bold("Skill ID:")}    ${result.id}`);
-    console.log(`  ${chalk10.bold("SSP ID:")}      ${result.ssp_id}`);
-    console.log(`  ${chalk10.bold("Version:")}     ${result.version}`);
-    console.log(`  ${chalk10.bold("Scan:")}        ${result.scan_passed ? chalk10.green("PASSED") : chalk10.red("FAILED")}`);
-    console.log(`  ${chalk10.bold("Risk Score:")}  ${result.risk_score}/100`);
+    console.log(`  ${chalk11.bold("Skill ID:")}    ${result.id}`);
+    console.log(`  ${chalk11.bold("SSP ID:")}      ${result.ssp_id}`);
+    console.log(`  ${chalk11.bold("Version:")}     ${result.version}`);
+    console.log(`  ${chalk11.bold("Scan:")}        ${result.scan_passed ? chalk11.green("PASSED") : chalk11.red("FAILED")}`);
+    console.log(`  ${chalk11.bold("Risk Score:")}  ${result.risk_score}/100`);
     console.log();
-    console.log(chalk10.dim(`  URL: ${config.marketplace_web_url}/skills/${result.id}`));
-    console.log(chalk10.dim(`  Install: skillport install ${result.ssp_id}@${result.version}`));
+    console.log(chalk11.dim(`  URL: ${config.marketplace_web_url}/skills/${result.id}`));
+    console.log(chalk11.dim(`  Install: skillport install ${result.ssp_id}@${result.version}`));
   } catch (error) {
-    console.log(chalk10.red(`Upload failed: ${error.message}`));
+    console.log(chalk11.red(`Upload failed: ${error.message}`));
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/keys-register.ts
+init_config();
+import chalk12 from "chalk";
+async function keysRegisterCommand() {
+  const config = loadConfig();
+  if (!config.auth_token) {
+    console.log(chalk12.red("Not logged in. Run 'skillport login' first."));
+    process.exitCode = 1;
+    return;
+  }
+  if (!hasKeys()) {
+    console.log(chalk12.red("No signing keys found. Run 'skillport init' first."));
+    process.exitCode = 1;
+    return;
+  }
+  const ok = await registerPublicKey(config);
+  if (!ok) {
     process.exitCode = 1;
   }
 }
 
 // src/index.ts
 var program = new Command();
-program.name("skillport").description("SkillPort \u2014 secure skill distribution for OpenClaw").version("0.1.3");
+program.name("skillport").description("SkillPort \u2014 secure skill distribution for OpenClaw").version("0.1.6");
 program.command("init").description("Generate Ed25519 key pair for signing").action(initCommand);
 program.command("scan <path>").description("Run security scan on a skill directory or .ssp file").action(scanCommand);
 program.command("export <path>").description("Export a skill directory as a SkillPort package (.ssp)").option("-o, --output <file>", "Output file path").option("-y, --yes", "Non-interactive mode (include all, skip prompts)").option("--id <id>", "Skill ID (author-slug/skill-slug)").option("--name <name>", "Skill name").option("--description <desc>", "Skill description").option("--skill-version <ver>", "Skill version (semver)").option("--author <name>", "Author name").option("--openclaw-compat <range>", "OpenClaw compatibility range").option("--os <os...>", "Compatible OS (macos, linux, windows)").action(exportCommand);
@@ -2737,6 +2813,8 @@ program.command("verify <ssp>").description("Verify SkillPort package signatures
 program.command("install <target>").description("Install a SkillPort package").option("--accept-risk", "Accept high-risk permissions (shell, critical flags)").option("-y, --yes", "Non-interactive mode (auto-approve, use defaults)").action(installCommand);
 program.command("dry-run <ssp>").description("Run installation diagnostics without installing").action(dryRunCommand);
 program.command("uninstall <id>").description("Uninstall an installed skill").action(uninstallCommand);
-program.command("login").description("Authenticate with SkillPort Market").option("--method <method>", "Login method: browser or token", "browser").option("--token <token>", "API token (for --method token)").option("-y, --yes", "Non-interactive mode (skip prompts)").option("--no-browser", "Print auth URL instead of opening browser").option("--port <port>", "Callback port (default: 9876, use 0 for auto)").action(loginCommand);
+program.command("login").description("Authenticate with SkillPort Market").option("--method <method>", "Login method: browser or token", "browser").option("--token <token>", "API token (for --method token)").option("-y, --yes", "Non-interactive mode (skip prompts)").option("--no-browser", "Print auth URL instead of opening browser").option("--port <port>", "Callback port (default: 9876, use 0 for auto)").option("--host <host>", "Callback host (default: 127.0.0.1)").action(loginCommand);
 program.command("publish <ssp>").description("Publish a SkillPort package to the marketplace").action(publishCommand);
+var keys = program.command("keys").description("Manage signing keys");
+keys.command("register").description("Register your public signing key with the marketplace").action(keysRegisterCommand);
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillport/cli",
-  "version": "0.1.3",
+  "version": "0.1.6",
   "description": "SkillPort CLI — secure skill distribution for OpenClaw. Export, scan, sign, and install AI skill packages.",
   "type": "module",
   "license": "MIT",