@sporesec/arcana 2.4.0 → 3.0.0

package/dist/commands/update.js

@@ -6,15 +6,29 @@ import { getProvider, getProviders } from "../registry.js";
 import { ui, banner, spinner, noopSpinner } from "../utils/ui.js";
 import { loadConfig } from "../utils/config.js";
 import { validateSlug } from "../utils/validate.js";
+import { updateLockEntry } from "../utils/integrity.js";
 function isNewer(remoteVersion, localVersion) {
     const local = semver.valid(semver.coerce(localVersion)) ?? "0.0.0";
     const remote = semver.valid(semver.coerce(remoteVersion)) ?? "0.0.0";
     return semver.gt(remote, local);
 }
+/** Fetch, write files, write meta, update lock for a single skill. */
+async function applyUpdate(skillName, remote, provider) {
+    const files = await provider.fetch(skillName);
+    installSkill(skillName, files);
+    writeSkillMeta(skillName, {
+        version: remote.version,
+        installedAt: new Date().toISOString(),
+        source: provider.name,
+        description: remote.description,
+        fileCount: files.length,
+    });
+    updateLockEntry(skillName, remote.version, provider.name, files);
+    return files;
+}
 export async function updateCommand(skills, opts) {
-    if (!opts.json) {
+    if (!opts.json)
         banner();
-    }
     if (skills.length === 0 && !opts.all) {
         if (opts.json) {
             console.log(JSON.stringify({ error: "Specify a skill name or use --all" }));
@@ -40,13 +54,13 @@ export async function updateCommand(skills, opts) {
     }
     const providerName = opts.provider ?? loadConfig().defaultProvider;
     if (opts.all) {
-        await updateAll(installDir, providerName, opts.json, opts.dryRun);
+        await updateBatch(null, installDir, providerName, opts.json, opts.dryRun);
     }
     else if (skills.length === 1) {
         await updateOne(skills[0], installDir, providerName, opts.json, opts.dryRun);
     }
     else {
-        await updateMultiple(skills, installDir, providerName, opts.json, opts.dryRun);
+        await updateBatch(skills, installDir, providerName, opts.json, opts.dryRun);
     }
 }
 async function updateOne(skillName, installDir, providerName, json, dryRun) {
@@ -55,7 +69,12 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
     }
     catch (err) {
         if (json) {
-            console.log(JSON.stringify({ updated: [], upToDate: [], failed: [skillName], error: err instanceof Error ? err.message : "Invalid name" }));
+            console.log(JSON.stringify({
+                updated: [],
+                upToDate: [],
+                failed: [skillName],
+                error: err instanceof Error ? err.message : "Invalid name",
+            }));
         }
         else {
             console.log(ui.error(`  ${err instanceof Error ? err.message : "Invalid skill name"}`));
@@ -102,7 +121,10 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
         }
         if (dryRun) {
             if (json) {
-                console.log(JSON.stringify({ dryRun: true, wouldUpdate: [{ name: skillName, from: meta?.version ?? "unknown", to: remote.version }] }));
+                console.log(JSON.stringify({
+                    dryRun: true,
+                    wouldUpdate: [{ name: skillName, from: meta?.version ?? "unknown", to: remote.version }],
+                }));
             }
             else {
                 s.info(`${ui.bold(skillName)} would be updated: v${meta?.version ?? "unknown"} -> v${remote.version}`);
@@ -111,15 +133,7 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
             return;
         }
         s.text = `Updating ${ui.bold(skillName)}...`;
-        const files = await provider.fetch(skillName);
-        installSkill(skillName, files);
-        writeSkillMeta(skillName, {
-            version: remote.version,
-            installedAt: new Date().toISOString(),
-            source: providerName,
-            description: remote.description,
-            fileCount: files.length,
-        });
+        const files = await applyUpdate(skillName, remote, provider);
         if (json) {
             console.log(JSON.stringify({ updated: [skillName], upToDate: [], failed: [] }));
         }
@@ -130,7 +144,12 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
     }
     catch (err) {
         if (json) {
-            console.log(JSON.stringify({ updated: [], upToDate: [], failed: [skillName], error: err instanceof Error ? err.message : "Update failed" }));
+            console.log(JSON.stringify({
+                updated: [],
+                upToDate: [],
+                failed: [skillName],
+                error: err instanceof Error ? err.message : "Update failed",
+            }));
         }
         else {
             s.fail(`Failed to update ${skillName}`);
@@ -141,102 +160,35 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
         process.exit(1);
     }
 }
-async function updateMultiple(skillNames, installDir, providerName, json, dryRun) {
-    for (const name of skillNames) {
-        try {
-            validateSlug(name, "skill name");
-        }
-        catch (err) {
-            if (json) {
-                console.log(JSON.stringify({ updated: [], upToDate: [], failed: skillNames, error: err instanceof Error ? err.message : "Invalid name" }));
+/**
+ * Batch update. If `skillNames` is null, update all installed skills.
+ * If `skillNames` is provided, update only those specific skills.
+ */
+async function updateBatch(skillNames, installDir, providerName, json, dryRun) {
+    // Validate explicit skill names
+    if (skillNames) {
+        for (const name of skillNames) {
+            try {
+                validateSlug(name, "skill name");
             }
-            else {
-                console.log(ui.error(`  ${err instanceof Error ? err.message : "Invalid skill name"}`));
-                console.log();
-            }
-            process.exit(1);
-        }
-    }
-    const s = json ? noopSpinner() : spinner(`Checking ${skillNames.length} skills for updates...`);
-    s.start();
-    const provider = getProvider(providerName);
-    const updatedList = [];
-    const upToDateList = [];
-    const failedList = [];
-    const dryRunUpdates = [];
-    for (let i = 0; i < skillNames.length; i++) {
-        const skillName = skillNames[i];
-        const skillDir = join(installDir, skillName);
-        if (!existsSync(skillDir)) {
-            failedList.push(skillName);
-            if (!json)
-                console.error(ui.dim(`  ${skillName} is not installed`));
-            continue;
-        }
-        try {
-            const remote = await provider.info(skillName);
-            if (!remote) {
-                failedList.push(skillName);
-                continue;
-            }
-            const meta = readSkillMeta(skillName);
-            if (!isNewer(remote.version, meta?.version)) {
-                upToDateList.push(skillName);
-                continue;
-            }
-            if (dryRun) {
-                dryRunUpdates.push({ name: skillName, from: meta?.version ?? "unknown", to: remote.version });
-                continue;
-            }
-            s.text = `Updating ${ui.bold(skillName)} (${i + 1}/${skillNames.length})...`;
-            const files = await provider.fetch(skillName);
-            installSkill(skillName, files);
-            writeSkillMeta(skillName, {
-                version: remote.version,
-                installedAt: new Date().toISOString(),
-                source: providerName,
-                description: remote.description,
-                fileCount: files.length,
-            });
-            updatedList.push(skillName);
-        }
-        catch (err) {
-            failedList.push(skillName);
-            if (err instanceof Error && !json)
-                console.error(ui.dim(`  Failed to update ${skillName}: ${err.message}`));
-        }
-    }
-    if (dryRun) {
-        if (json) {
-            console.log(JSON.stringify({ dryRun: true, wouldUpdate: dryRunUpdates, upToDate: upToDateList, failed: failedList }));
-        }
-        else {
-            s.stop();
-            if (dryRunUpdates.length === 0) {
-                console.log(ui.dim("  All skills are up to date."));
-            }
-            else {
-                for (const u of dryRunUpdates) {
-                    console.log(`  ${ui.bold(u.name)}: v${u.from} -> v${u.to}`);
+            catch (err) {
+                if (json) {
+                    console.log(JSON.stringify({
+                        updated: [],
+                        upToDate: [],
+                        failed: skillNames,
+                        error: err instanceof Error ? err.message : "Invalid name",
+                    }));
+                }
+                else {
+                    console.log(ui.error(`  ${err instanceof Error ? err.message : "Invalid skill name"}`));
+                    console.log();
                 }
+                process.exit(1);
             }
-            console.log();
         }
-        return;
-    }
-    if (json) {
-        console.log(JSON.stringify({ updated: updatedList, upToDate: upToDateList, failed: failedList }));
     }
-    else {
-        s.succeed(`Update complete`);
-        console.log(ui.dim(`  ${updatedList.length} updated, ${upToDateList.length} up to date${failedList.length > 0 ? `, ${failedList.length} failed` : ""}`));
-        console.log();
-    }
-    if (failedList.length > 0)
-        process.exit(1);
-}
-async function updateAll(installDir, providerName, json, dryRun) {
-    const installed = readdirSync(installDir).filter((d) => statSync(join(installDir, d)).isDirectory());
+    const installed = skillNames ?? readdirSync(installDir).filter((d) => statSync(join(installDir, d)).isDirectory());
     if (installed.length === 0) {
         if (json) {
             console.log(JSON.stringify({ updated: [], upToDate: [], failed: [] }));
@@ -254,69 +206,106 @@ async function updateAll(installDir, providerName, json, dryRun) {
     const failedList = [];
     const skippedList = [];
     const dryRunUpdates = [];
-    const providers = getProviders(providerName === "arcana" ? undefined : providerName);
-    // Pre-fetch skill lists to avoid N+1 info() calls
+    // For --all mode, use all providers and pre-fetch skill lists (avoids N+1 info() calls)
+    // For explicit names, use single provider with per-skill info() calls
+    const isAllMode = skillNames === null;
+    const providers = isAllMode ? getProviders(providerName === "arcana" ? undefined : providerName) : [];
+    const singleProvider = isAllMode ? null : getProvider(providerName);
+    // Pre-fetch provider skill maps for --all mode
     const providerSkillMaps = new Map();
-    for (const provider of providers) {
-        try {
-            const skills = await provider.list();
-            const map = new Map();
-            for (const skill of skills) {
-                map.set(skill.name, { version: skill.version, description: skill.description });
+    if (isAllMode) {
+        for (const provider of providers) {
+            try {
+                const skills = await provider.list();
+                const map = new Map();
+                for (const skill of skills) {
+                    map.set(skill.name, { version: skill.version, description: skill.description });
+                }
+                providerSkillMaps.set(provider.name, map);
+            }
+            catch (err) {
+                if (err instanceof Error && !json)
+                    console.error(ui.dim(`  Failed to list ${provider.name}: ${err.message}`));
             }
-            providerSkillMaps.set(provider.name, map);
-        }
-        catch (err) {
-            if (err instanceof Error && !json)
-                console.error(ui.dim(`  Failed to list ${provider.name}: ${err.message}`));
         }
     }
     const total = installed.length;
     for (let i = 0; i < total; i++) {
-        const skillName = installed[i];
-        let found = false;
+        const name = installed[i];
+        // Check installation exists (for explicit names)
+        if (!isAllMode) {
+            const skillDir = join(installDir, name);
+            if (!existsSync(skillDir)) {
+                failedList.push(name);
+                if (!json)
+                    console.error(ui.dim(`  ${name} is not installed`));
+                continue;
+            }
+        }
         try {
-            for (const provider of providers) {
-                const skillMap = providerSkillMaps.get(provider.name);
-                const remote = skillMap?.get(skillName) ?? null;
-                if (!remote)
+            if (isAllMode) {
+                // Find across all providers
+                let found = false;
+                for (const provider of providers) {
+                    const skillMap = providerSkillMaps.get(provider.name);
+                    const remote = skillMap?.get(name) ?? null;
+                    if (!remote)
+                        continue;
+                    found = true;
+                    const meta = readSkillMeta(name);
+                    if (!isNewer(remote.version, meta?.version)) {
+                        upToDateList.push(name);
+                        break;
+                    }
+                    if (dryRun) {
+                        dryRunUpdates.push({ name, from: meta?.version ?? "unknown", to: remote.version });
+                        break;
+                    }
+                    s.text = `Updating ${ui.bold(name)} (${i + 1}/${total})...`;
+                    await applyUpdate(name, remote, provider);
+                    updatedList.push(name);
+                    break;
+                }
+                if (!found)
+                    skippedList.push(name);
+            }
+            else {
+                // Single provider mode
+                const remote = await singleProvider.info(name);
+                if (!remote) {
+                    failedList.push(name);
                     continue;
-                found = true;
-                const meta = readSkillMeta(skillName);
+                }
+                const meta = readSkillMeta(name);
                 if (!isNewer(remote.version, meta?.version)) {
-                    upToDateList.push(skillName);
-                    break;
+                    upToDateList.push(name);
+                    continue;
                 }
                 if (dryRun) {
-                    dryRunUpdates.push({ name: skillName, from: meta?.version ?? "unknown", to: remote.version });
-                    break;
+                    dryRunUpdates.push({ name, from: meta?.version ?? "unknown", to: remote.version });
+                    continue;
                 }
-                s.text = `Updating ${ui.bold(skillName)} (${i + 1}/${total})...`;
-                const files = await provider.fetch(skillName);
-                installSkill(skillName, files);
-                writeSkillMeta(skillName, {
-                    version: remote.version,
-                    installedAt: new Date().toISOString(),
-                    source: provider.name,
-                    description: remote.description,
-                    fileCount: files.length,
-                });
-                updatedList.push(skillName);
-                break;
+                s.text = `Updating ${ui.bold(name)} (${i + 1}/${total})...`;
+                await applyUpdate(name, remote, singleProvider);
+                updatedList.push(name);
             }
         }
         catch (err) {
-            failedList.push(skillName);
+            failedList.push(name);
             if (err instanceof Error && !json)
-                console.error(ui.dim(`  Failed to update ${skillName}: ${err.message}`));
-            continue;
+                console.error(ui.dim(`  Failed to update ${name}: ${err.message}`));
         }
-        if (!found)
-            skippedList.push(skillName);
     }
+    // Output results
     if (dryRun) {
         if (json) {
-            console.log(JSON.stringify({ dryRun: true, wouldUpdate: dryRunUpdates, upToDate: upToDateList, skipped: skippedList, failed: failedList }));
+            console.log(JSON.stringify({
+                dryRun: true,
+                wouldUpdate: dryRunUpdates,
+                upToDate: upToDateList,
+                ...(isAllMode ? { skipped: skippedList } : {}),
+                failed: failedList,
+            }));
         }
         else {
             s.stop();
@@ -324,8 +313,10 @@ async function updateAll(installDir, providerName, json, dryRun) {
                 console.log(ui.dim("  All skills are up to date."));
             }
             else {
-                console.log(ui.bold(`  ${dryRunUpdates.length} of ${total} skills have updates available:`));
-                console.log();
+                if (isAllMode) {
+                    console.log(ui.bold(`  ${dryRunUpdates.length} of ${total} skills have updates available:`));
+                    console.log();
+                }
                 for (const u of dryRunUpdates) {
                     console.log(`  ${ui.bold(u.name)}: v${u.from} -> v${u.to}`);
                 }
@@ -335,14 +326,23 @@ async function updateAll(installDir, providerName, json, dryRun) {
         return;
     }
     if (json) {
-        console.log(JSON.stringify({ updated: updatedList, upToDate: upToDateList, skipped: skippedList, failed: failedList }));
+        console.log(JSON.stringify({
+            updated: updatedList,
+            upToDate: upToDateList,
+            ...(isAllMode ? { skipped: skippedList } : {}),
+            failed: failedList,
+        }));
     }
     else {
         s.succeed(`Update complete`);
-        console.log(ui.dim(`  ${updatedList.length} updated, ${upToDateList.length} up to date${skippedList.length > 0 ? `, ${skippedList.length} skipped (not on provider)` : ""}${failedList.length > 0 ? `, ${failedList.length} failed` : ""}`));
+        const parts = [`${updatedList.length} updated`, `${upToDateList.length} up to date`];
+        if (skippedList.length > 0)
+            parts.push(`${skippedList.length} skipped (not on provider)`);
+        if (failedList.length > 0)
+            parts.push(`${failedList.length} failed`);
+        console.log(ui.dim(`  ${parts.join(", ")}`));
         console.log();
     }
     if (failedList.length > 0)
         process.exit(1);
 }
-//# sourceMappingURL=update.js.map

package/dist/commands/validate.d.ts

@@ -3,4 +3,3 @@ export declare function validateCommand(skill: string | undefined, opts: {
     fix?: boolean;
     json?: boolean;
 }): Promise<void>;
-//# sourceMappingURL=validate.d.ts.map

package/dist/commands/validate.js

@@ -81,12 +81,23 @@ export async function validateCommand(skill, opts) {
                     }
                 }
             }
-            catch { /* skip if unreadable */ }
+            catch {
+                /* skip if unreadable */
+            }
         }
         results.push(result);
     }
     if (opts.json) {
-        console.log(JSON.stringify({ results: results.map((r) => ({ skill: r.skill, valid: r.valid, errors: r.errors, warnings: r.warnings, infos: r.infos, fixed: r.fixed ?? false })) }, null, 2));
+        console.log(JSON.stringify({
+            results: results.map((r) => ({
+                skill: r.skill,
+                valid: r.valid,
+                errors: r.errors,
+                warnings: r.warnings,
+                infos: r.infos,
+                fixed: r.fixed ?? false,
+            })),
+        }, null, 2));
         if (results.some((r) => !r.valid))
             process.exit(1);
         return;
@@ -96,9 +107,7 @@ export async function validateCommand(skill, opts) {
     let failed = 0;
     let fixed = 0;
     for (const r of results) {
-        const icon = r.valid
-            ? r.warnings.length > 0 ? ui.warn("[!!]") : ui.success("[OK]")
-            : ui.error("[XX]");
+        const icon = r.valid ? (r.warnings.length > 0 ? ui.warn("[!!]") : ui.success("[OK]")) : ui.error("[XX]");
         const fixTag = r.fixed ? ui.cyan(" [fixed]") : "";
         console.log(`  ${icon} ${ui.bold(r.skill)}${fixTag}`);
         for (const err of r.errors) {
@@ -137,4 +146,3 @@ export async function validateCommand(skill, opts) {
     if (failed > 0)
         process.exit(1);
 }
-//# sourceMappingURL=validate.js.map

package/dist/commands/verify.d.ts

@@ -0,0 +1,4 @@
+export declare function verifyCommand(skillNames: string[], opts: {
+    all?: boolean;
+    json?: boolean;
+}): Promise<void>;

package/dist/commands/verify.js

@@ -0,0 +1,116 @@
+import { readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import * as p from "@clack/prompts";
+import chalk from "chalk";
+import { getInstallDir, isSkillInstalled } from "../utils/fs.js";
+import { verifySkillIntegrity } from "../utils/integrity.js";
+import { validateSlug } from "../utils/validate.js";
+import { renderBanner } from "../utils/help.js";
+export async function verifyCommand(skillNames, opts) {
+    if (opts.json) {
+        return verifyJson(skillNames, opts);
+    }
+    console.log(renderBanner());
+    console.log();
+    const installDir = getInstallDir();
+    if (skillNames.length === 0 && !opts.all) {
+        p.intro(chalk.bold("Verify skill integrity"));
+        p.cancel("Specify a skill name or use --all");
+        p.log.info("Usage: arcana verify <skill-name> [skill2 ...]");
+        p.log.info("       arcana verify --all");
+        process.exit(1);
+    }
+    let skills;
+    if (opts.all) {
+        try {
+            skills = readdirSync(installDir).filter((d) => statSync(join(installDir, d)).isDirectory());
+        }
+        catch {
+            skills = [];
+        }
+        if (skills.length === 0) {
+            p.intro(chalk.bold("Verify skill integrity"));
+            p.log.info("No installed skills found.");
+            p.outro("Nothing to verify.");
+            return;
+        }
+    }
+    else {
+        for (const name of skillNames) {
+            try {
+                validateSlug(name, "skill name");
+            }
+            catch (err) {
+                p.log.error(err instanceof Error ? err.message : `Invalid skill name: ${name}`);
+                process.exit(1);
+            }
+        }
+        for (const name of skillNames) {
+            if (!isSkillInstalled(name)) {
+                p.log.error(`Skill ${chalk.bold(name)} is not installed.`);
+                process.exit(1);
+            }
+        }
+        skills = skillNames;
+    }
+    p.intro(chalk.bold("Verify skill integrity"));
+    const results = [];
+    for (const skill of skills) {
+        const status = verifySkillIntegrity(skill, installDir);
+        results.push({ skill, status });
+        if (status === "ok") {
+            p.log.info(`${chalk.green("[OK]")} ${skill}`);
+        }
+        else if (status === "modified") {
+            p.log.warn(`${chalk.yellow("[MODIFIED]")} ${skill}`);
+        }
+        else {
+            p.log.info(`${chalk.dim("[MISSING]")} ${skill}`);
+        }
+    }
+    const total = results.length;
+    const okCount = results.filter((r) => r.status === "ok").length;
+    const modifiedCount = results.filter((r) => r.status === "modified").length;
+    const missingCount = results.filter((r) => r.status === "missing").length;
+    console.log();
+    p.outro(`${total} skills verified, ${okCount} OK, ${modifiedCount} modified, ${missingCount} not tracked`);
+    if (modifiedCount > 0) {
+        process.exit(1);
+    }
+}
+async function verifyJson(skillNames, opts) {
+    const installDir = getInstallDir();
+    let skills;
+    if (opts.all) {
+        try {
+            skills = readdirSync(installDir).filter((d) => statSync(join(installDir, d)).isDirectory());
+        }
+        catch {
+            skills = [];
+        }
+    }
+    else if (skillNames.length === 0) {
+        console.log(JSON.stringify({ error: "Specify a skill name or use --all" }));
+        process.exit(1);
+        return;
+    }
+    else {
+        skills = skillNames;
+    }
+    const results = [];
+    for (const skill of skills) {
+        const status = verifySkillIntegrity(skill, installDir);
+        results.push({ skill, status });
+    }
+    const total = results.length;
+    const ok = results.filter((r) => r.status === "ok").length;
+    const modified = results.filter((r) => r.status === "modified").length;
+    const missing = results.filter((r) => r.status === "missing").length;
+    console.log(JSON.stringify({
+        results: results.map((r) => ({ skill: r.skill, status: r.status })),
+        summary: { total, ok, modified, missing },
+    }));
+    if (modified > 0) {
+        process.exit(1);
+    }
+}

package/dist/constants.d.ts

@@ -0,0 +1,10 @@
+export declare const AGENT_LOG_MAX_AGE_DAYS = 7;
+export declare const MAIN_LOG_MAX_AGE_DAYS = 30;
+export declare const STALE_PROJECT_DAYS = 90;
+export declare const PRUNE_DEFAULT_DAYS = 14;
+export declare const PRUNE_SIZE_THRESHOLD_BYTES: number;
+export declare const PRUNE_KEEP_NEWEST = 3;
+export declare const LARGE_SKILL_KB_THRESHOLD = 50;
+export declare const TOKENS_PER_KB = 256;
+export declare const CONTEXT_WINDOW_TOKENS = 200000;
+export declare const DESCRIPTION_TRUNCATION = 50;

package/dist/constants.js

@@ -0,0 +1,13 @@
+// Retention & pruning
+export const AGENT_LOG_MAX_AGE_DAYS = 7;
+export const MAIN_LOG_MAX_AGE_DAYS = 30;
+export const STALE_PROJECT_DAYS = 90;
+export const PRUNE_DEFAULT_DAYS = 14;
+export const PRUNE_SIZE_THRESHOLD_BYTES = 10 * 1024 * 1024; // 10 MB
+export const PRUNE_KEEP_NEWEST = 3;
+// Skill size warnings
+export const LARGE_SKILL_KB_THRESHOLD = 50;
+export const TOKENS_PER_KB = 256;
+export const CONTEXT_WINDOW_TOKENS = 200_000;
+// Display
+export const DESCRIPTION_TRUNCATION = 50;

package/dist/index.d.ts

@@ -1,3 +1,2 @@
 #!/usr/bin/env node
 export {};
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -36,4 +36,3 @@ catch (err) {
     }
     process.exit(1);
 }
-//# sourceMappingURL=index.js.map

package/dist/interactive/browse.d.ts

@@ -0,0 +1,4 @@
+import type { SkillInfo } from "../types.js";
+declare function doBatchInstall(names: string[], providerName: string): Promise<number>;
+export declare function browseByCategory(allSkills: SkillInfo[], providerName: string): Promise<void>;
+export { doBatchInstall };