@sporesec/arcana 2.4.0 → 3.0.1

package/dist/commands/update.js

@@ -6,15 +6,29 @@ import { getProvider, getProviders } from "../registry.js";
 import { ui, banner, spinner, noopSpinner } from "../utils/ui.js";
 import { loadConfig } from "../utils/config.js";
 import { validateSlug } from "../utils/validate.js";
+import { updateLockEntry } from "../utils/integrity.js";
 function isNewer(remoteVersion, localVersion) {
     const local = semver.valid(semver.coerce(localVersion)) ?? "0.0.0";
     const remote = semver.valid(semver.coerce(remoteVersion)) ?? "0.0.0";
     return semver.gt(remote, local);
 }
+/** Fetch, write files, write meta, update lock for a single skill. */
+async function applyUpdate(skillName, remote, provider) {
+    const files = await provider.fetch(skillName);
+    installSkill(skillName, files);
+    writeSkillMeta(skillName, {
+        version: remote.version,
+        installedAt: new Date().toISOString(),
+        source: provider.name,
+        description: remote.description,
+        fileCount: files.length,
+    });
+    updateLockEntry(skillName, remote.version, provider.name, files);
+    return files;
+}
 export async function updateCommand(skills, opts) {
-    if (!opts.json) {
+    if (!opts.json)
         banner();
-    }
     if (skills.length === 0 && !opts.all) {
         if (opts.json) {
             console.log(JSON.stringify({ error: "Specify a skill name or use --all" }));
@@ -40,13 +54,13 @@ export async function updateCommand(skills, opts) {
     }
     const providerName = opts.provider ?? loadConfig().defaultProvider;
     if (opts.all) {
-        await updateAll(installDir, providerName, opts.json, opts.dryRun);
+        await updateBatch(null, installDir, providerName, opts.json, opts.dryRun);
     }
     else if (skills.length === 1) {
         await updateOne(skills[0], installDir, providerName, opts.json, opts.dryRun);
     }
     else {
-        await updateMultiple(skills, installDir, providerName, opts.json, opts.dryRun);
+        await updateBatch(skills, installDir, providerName, opts.json, opts.dryRun);
     }
 }
 async function updateOne(skillName, installDir, providerName, json, dryRun) {
@@ -55,7 +69,12 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
     }
     catch (err) {
         if (json) {
-            console.log(JSON.stringify({ updated: [], upToDate: [], failed: [skillName], error: err instanceof Error ? err.message : "Invalid name" }));
+            console.log(JSON.stringify({
+                updated: [],
+                upToDate: [],
+                failed: [skillName],
+                error: err instanceof Error ? err.message : "Invalid name",
+            }));
         }
         else {
             console.log(ui.error(`  ${err instanceof Error ? err.message : "Invalid skill name"}`));
@@ -102,7 +121,10 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
         }
         if (dryRun) {
             if (json) {
-                console.log(JSON.stringify({ dryRun: true, wouldUpdate: [{ name: skillName, from: meta?.version ?? "unknown", to: remote.version }] }));
+                console.log(JSON.stringify({
+                    dryRun: true,
+                    wouldUpdate: [{ name: skillName, from: meta?.version ?? "unknown", to: remote.version }],
+                }));
             }
             else {
                 s.info(`${ui.bold(skillName)} would be updated: v${meta?.version ?? "unknown"} -> v${remote.version}`);
@@ -111,15 +133,7 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
             return;
         }
         s.text = `Updating ${ui.bold(skillName)}...`;
-        const files = await provider.fetch(skillName);
-        installSkill(skillName, files);
-        writeSkillMeta(skillName, {
-            version: remote.version,
-            installedAt: new Date().toISOString(),
-            source: providerName,
-            description: remote.description,
-            fileCount: files.length,
-        });
+        const files = await applyUpdate(skillName, remote, provider);
         if (json) {
             console.log(JSON.stringify({ updated: [skillName], upToDate: [], failed: [] }));
         }
@@ -130,7 +144,12 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
     }
     catch (err) {
         if (json) {
-            console.log(JSON.stringify({ updated: [], upToDate: [], failed: [skillName], error: err instanceof Error ? err.message : "Update failed" }));
+            console.log(JSON.stringify({
+                updated: [],
+                upToDate: [],
+                failed: [skillName],
+                error: err instanceof Error ? err.message : "Update failed",
+            }));
         }
         else {
             s.fail(`Failed to update ${skillName}`);
@@ -141,102 +160,35 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
         process.exit(1);
     }
 }
-async function updateMultiple(skillNames, installDir, providerName, json, dryRun) {
-    for (const name of skillNames) {
-        try {
-            validateSlug(name, "skill name");
-        }
-        catch (err) {
-            if (json) {
-                console.log(JSON.stringify({ updated: [], upToDate: [], failed: skillNames, error: err instanceof Error ? err.message : "Invalid name" }));
+/**
+ * Batch update. If `skillNames` is null, update all installed skills.
+ * If `skillNames` is provided, update only those specific skills.
+ */
+async function updateBatch(skillNames, installDir, providerName, json, dryRun) {
+    // Validate explicit skill names
+    if (skillNames) {
+        for (const name of skillNames) {
+            try {
+                validateSlug(name, "skill name");
             }
-            else {
-                console.log(ui.error(`  ${err instanceof Error ? err.message : "Invalid skill name"}`));
-                console.log();
-            }
-            process.exit(1);
-        }
-    }
-    const s = json ? noopSpinner() : spinner(`Checking ${skillNames.length} skills for updates...`);
-    s.start();
-    const provider = getProvider(providerName);
-    const updatedList = [];
-    const upToDateList = [];
-    const failedList = [];
-    const dryRunUpdates = [];
-    for (let i = 0; i < skillNames.length; i++) {
-        const skillName = skillNames[i];
-        const skillDir = join(installDir, skillName);
-        if (!existsSync(skillDir)) {
-            failedList.push(skillName);
-            if (!json)
-                console.error(ui.dim(`  ${skillName} is not installed`));
-            continue;
-        }
-        try {
-            const remote = await provider.info(skillName);
-            if (!remote) {
-                failedList.push(skillName);
-                continue;
-            }
-            const meta = readSkillMeta(skillName);
-            if (!isNewer(remote.version, meta?.version)) {
-                upToDateList.push(skillName);
-                continue;
-            }
-            if (dryRun) {
-                dryRunUpdates.push({ name: skillName, from: meta?.version ?? "unknown", to: remote.version });
-                continue;
-            }
-            s.text = `Updating ${ui.bold(skillName)} (${i + 1}/${skillNames.length})...`;
-            const files = await provider.fetch(skillName);
-            installSkill(skillName, files);
-            writeSkillMeta(skillName, {
-                version: remote.version,
-                installedAt: new Date().toISOString(),
-                source: providerName,
-                description: remote.description,
-                fileCount: files.length,
-            });
-            updatedList.push(skillName);
-        }
-        catch (err) {
-            failedList.push(skillName);
-            if (err instanceof Error && !json)
-                console.error(ui.dim(`  Failed to update ${skillName}: ${err.message}`));
-        }
-    }
-    if (dryRun) {
-        if (json) {
-            console.log(JSON.stringify({ dryRun: true, wouldUpdate: dryRunUpdates, upToDate: upToDateList, failed: failedList }));
-        }
-        else {
-            s.stop();
-            if (dryRunUpdates.length === 0) {
-                console.log(ui.dim("  All skills are up to date."));
-            }
-            else {
-                for (const u of dryRunUpdates) {
-                    console.log(`  ${ui.bold(u.name)}: v${u.from} -> v${u.to}`);
+            catch (err) {
+                if (json) {
+                    console.log(JSON.stringify({
+                        updated: [],
+                        upToDate: [],
+                        failed: skillNames,
+                        error: err instanceof Error ? err.message : "Invalid name",
+                    }));
+                }
+                else {
+                    console.log(ui.error(`  ${err instanceof Error ? err.message : "Invalid skill name"}`));
+                    console.log();
                 }
+                process.exit(1);
             }
-            console.log();
         }
-        return;
-    }
-    if (json) {
-        console.log(JSON.stringify({ updated: updatedList, upToDate: upToDateList, failed: failedList }));
     }
-    else {
-        s.succeed(`Update complete`);
-        console.log(ui.dim(`  ${updatedList.length} updated, ${upToDateList.length} up to date${failedList.length > 0 ? `, ${failedList.length} failed` : ""}`));
-        console.log();
-    }
-    if (failedList.length > 0)
-        process.exit(1);
-}
-async function updateAll(installDir, providerName, json, dryRun) {
-    const installed = readdirSync(installDir).filter((d) => statSync(join(installDir, d)).isDirectory());
+    const installed = skillNames ?? readdirSync(installDir).filter((d) => statSync(join(installDir, d)).isDirectory());
     if (installed.length === 0) {
         if (json) {
             console.log(JSON.stringify({ updated: [], upToDate: [], failed: [] }));
@@ -254,69 +206,106 @@ async function updateAll(installDir, providerName, json, dryRun) {
     const failedList = [];
     const skippedList = [];
     const dryRunUpdates = [];
-    const providers = getProviders(providerName === "arcana" ? undefined : providerName);
-    // Pre-fetch skill lists to avoid N+1 info() calls
+    // For --all mode, use all providers and pre-fetch skill lists (avoids N+1 info() calls)
+    // For explicit names, use single provider with per-skill info() calls
+    const isAllMode = skillNames === null;
+    const providers = isAllMode ? getProviders(providerName === "arcana" ? undefined : providerName) : [];
+    const singleProvider = isAllMode ? null : getProvider(providerName);
+    // Pre-fetch provider skill maps for --all mode
     const providerSkillMaps = new Map();
-    for (const provider of providers) {
-        try {
-            const skills = await provider.list();
-            const map = new Map();
-            for (const skill of skills) {
-                map.set(skill.name, { version: skill.version, description: skill.description });
+    if (isAllMode) {
+        for (const provider of providers) {
+            try {
+                const skills = await provider.list();
+                const map = new Map();
+                for (const skill of skills) {
+                    map.set(skill.name, { version: skill.version, description: skill.description });
+                }
+                providerSkillMaps.set(provider.name, map);
+            }
+            catch (err) {
+                if (err instanceof Error && !json)
+                    console.error(ui.dim(`  Failed to list ${provider.name}: ${err.message}`));
             }
-            providerSkillMaps.set(provider.name, map);
-        }
-        catch (err) {
-            if (err instanceof Error && !json)
-                console.error(ui.dim(`  Failed to list ${provider.name}: ${err.message}`));
         }
     }
     const total = installed.length;
     for (let i = 0; i < total; i++) {
-        const skillName = installed[i];
-        let found = false;
+        const name = installed[i];
+        // Check installation exists (for explicit names)
+        if (!isAllMode) {
+            const skillDir = join(installDir, name);
+            if (!existsSync(skillDir)) {
+                failedList.push(name);
+                if (!json)
+                    console.error(ui.dim(`  ${name} is not installed`));
+                continue;
+            }
+        }
         try {
-            for (const provider of providers) {
-                const skillMap = providerSkillMaps.get(provider.name);
-                const remote = skillMap?.get(skillName) ?? null;
-                if (!remote)
+            if (isAllMode) {
+                // Find across all providers
+                let found = false;
+                for (const provider of providers) {
+                    const skillMap = providerSkillMaps.get(provider.name);
+                    const remote = skillMap?.get(name) ?? null;
+                    if (!remote)
+                        continue;
+                    found = true;
+                    const meta = readSkillMeta(name);
+                    if (!isNewer(remote.version, meta?.version)) {
+                        upToDateList.push(name);
+                        break;
+                    }
+                    if (dryRun) {
+                        dryRunUpdates.push({ name, from: meta?.version ?? "unknown", to: remote.version });
+                        break;
+                    }
+                    s.text = `Updating ${ui.bold(name)} (${i + 1}/${total})...`;
+                    await applyUpdate(name, remote, provider);
+                    updatedList.push(name);
+                    break;
+                }
+                if (!found)
+                    skippedList.push(name);
+            }
+            else {
+                // Single provider mode
+                const remote = await singleProvider.info(name);
+                if (!remote) {
+                    failedList.push(name);
                     continue;
-                found = true;
-                const meta = readSkillMeta(skillName);
+                }
+                const meta = readSkillMeta(name);
                 if (!isNewer(remote.version, meta?.version)) {
-                    upToDateList.push(skillName);
-                    break;
+                    upToDateList.push(name);
+                    continue;
                 }
                 if (dryRun) {
-                    dryRunUpdates.push({ name: skillName, from: meta?.version ?? "unknown", to: remote.version });
-                    break;
+                    dryRunUpdates.push({ name, from: meta?.version ?? "unknown", to: remote.version });
+                    continue;
                 }
-                s.text = `Updating ${ui.bold(skillName)} (${i + 1}/${total})...`;
-                const files = await provider.fetch(skillName);
-                installSkill(skillName, files);
-                writeSkillMeta(skillName, {
-                    version: remote.version,
-                    installedAt: new Date().toISOString(),
-                    source: provider.name,
-                    description: remote.description,
-                    fileCount: files.length,
-                });
-                updatedList.push(skillName);
-                break;
+                s.text = `Updating ${ui.bold(name)} (${i + 1}/${total})...`;
+                await applyUpdate(name, remote, singleProvider);
+                updatedList.push(name);
             }
         }
         catch (err) {
-            failedList.push(skillName);
+            failedList.push(name);
             if (err instanceof Error && !json)
-                console.error(ui.dim(`  Failed to update ${skillName}: ${err.message}`));
-            continue;
+                console.error(ui.dim(`  Failed to update ${name}: ${err.message}`));
         }
-        if (!found)
-            skippedList.push(skillName);
     }
+    // Output results
     if (dryRun) {
         if (json) {
-            console.log(JSON.stringify({ dryRun: true, wouldUpdate: dryRunUpdates, upToDate: upToDateList, skipped: skippedList, failed: failedList }));
+            console.log(JSON.stringify({
+                dryRun: true,
+                wouldUpdate: dryRunUpdates,
+                upToDate: upToDateList,
+                ...(isAllMode ? { skipped: skippedList } : {}),
+                failed: failedList,
+            }));
         }
         else {
             s.stop();
@@ -324,8 +313,10 @@ async function updateAll(installDir, providerName, json, dryRun) {
                 console.log(ui.dim("  All skills are up to date."));
             }
             else {
-                console.log(ui.bold(`  ${dryRunUpdates.length} of ${total} skills have updates available:`));
-                console.log();
+                if (isAllMode) {
+                    console.log(ui.bold(`  ${dryRunUpdates.length} of ${total} skills have updates available:`));
+                    console.log();
+                }
                 for (const u of dryRunUpdates) {
                     console.log(`  ${ui.bold(u.name)}: v${u.from} -> v${u.to}`);
                 }
@@ -335,14 +326,23 @@ async function updateAll(installDir, providerName, json, dryRun) {
         return;
     }
     if (json) {
-        console.log(JSON.stringify({ updated: updatedList, upToDate: upToDateList, skipped: skippedList, failed: failedList }));
+        console.log(JSON.stringify({
+            updated: updatedList,
+            upToDate: upToDateList,
+            ...(isAllMode ? { skipped: skippedList } : {}),
+            failed: failedList,
+        }));
     }
     else {
         s.succeed(`Update complete`);
-        console.log(ui.dim(`  ${updatedList.length} updated, ${upToDateList.length} up to date${skippedList.length > 0 ? `, ${skippedList.length} skipped (not on provider)` : ""}${failedList.length > 0 ? `, ${failedList.length} failed` : ""}`));
+        const parts = [`${updatedList.length} updated`, `${upToDateList.length} up to date`];
+        if (skippedList.length > 0)
+            parts.push(`${skippedList.length} skipped (not on provider)`);
+        if (failedList.length > 0)
+            parts.push(`${failedList.length} failed`);
+        console.log(ui.dim(`  ${parts.join(", ")}`));
         console.log();
     }
     if (failedList.length > 0)
         process.exit(1);
 }
-//# sourceMappingURL=update.js.map

package/dist/commands/validate.d.ts

@@ -2,5 +2,7 @@ export declare function validateCommand(skill: string | undefined, opts: {
     all?: boolean;
     fix?: boolean;
     json?: boolean;
+    source?: string;
+    cross?: boolean;
+    minScore?: number;
 }): Promise<void>;
-//# sourceMappingURL=validate.d.ts.map

package/dist/commands/validate.js

@@ -1,5 +1,5 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { getInstallDir } from "../utils/fs.js";
 import { validateSkillDir, fixSkillFrontmatter } from "../utils/frontmatter.js";
 import { atomicWriteSync } from "../utils/atomic.js";
@@ -8,8 +8,8 @@ import { scanSkillContent } from "../utils/scanner.js";
 export async function validateCommand(skill, opts) {
     if (!opts.json)
         banner();
-    const installDir = getInstallDir();
-    if (!existsSync(installDir)) {
+    const baseDir = opts.source ? resolve(opts.source) : getInstallDir();
+    if (!existsSync(baseDir)) {
         if (opts.json) {
             console.log(JSON.stringify({ results: [] }));
         }
@@ -21,7 +21,14 @@ export async function validateCommand(skill, opts) {
     }
     let skills;
     if (opts.all) {
-        skills = readdirSync(installDir).filter((d) => statSync(join(installDir, d)).isDirectory());
+        skills = readdirSync(baseDir).filter((d) => {
+            try {
+                return statSync(join(baseDir, d)).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        });
     }
     else if (skill) {
         skills = [skill];
@@ -40,7 +47,7 @@ export async function validateCommand(skill, opts) {
     }
     const results = [];
     for (const name of skills) {
-        const skillDir = join(installDir, name);
+        const skillDir = join(baseDir, name);
         if (!existsSync(skillDir)) {
             results.push({ skill: name, valid: false, errors: ["Not installed"], warnings: [], infos: [] });
             continue;
@@ -81,26 +88,84 @@ export async function validateCommand(skill, opts) {
                     }
                 }
             }
-            catch { /* skip if unreadable */ }
+            catch {
+                /* skip if unreadable */
+            }
+        }
+        // Quality scoring (when --min-score is set)
+        const entry = { ...result };
+        if (opts.minScore !== undefined) {
+            const { auditSkill } = await import("./audit.js");
+            const audit = auditSkill(skillDir, name);
+            entry.qualityScore = audit.score;
+            entry.qualityRating = audit.rating;
+            if (audit.score < opts.minScore) {
+                entry.valid = false;
+                entry.errors.push(`Quality score ${audit.score} below minimum ${opts.minScore} (${audit.rating})`);
+            }
+        }
+        results.push(entry);
+    }
+    // Cross-validation (when --cross is set)
+    let crossIssues = [];
+    if (opts.cross) {
+        const { crossValidate } = await import("../utils/quality.js");
+        const marketplacePaths = opts.source
+            ? [
+                resolve(opts.source, "..", ".claude-plugin", "marketplace.json"),
+                resolve(opts.source, ".claude-plugin", "marketplace.json"),
+            ]
+            : [resolve(baseDir, "..", ".claude-plugin", "marketplace.json")];
+        const marketplacePath = marketplacePaths.find((p) => existsSync(p));
+        if (marketplacePath) {
+            crossIssues = crossValidate(baseDir, marketplacePath);
+        }
+        else if (!opts.json) {
+            console.log(ui.warn("  Could not find marketplace.json for cross-validation"));
         }
-        results.push(result);
     }
+    const hasErrors = results.some((r) => !r.valid);
+    const hasCrossErrors = crossIssues.some((i) => i.level === "error");
     if (opts.json) {
-        console.log(JSON.stringify({ results: results.map((r) => ({ skill: r.skill, valid: r.valid, errors: r.errors, warnings: r.warnings, infos: r.infos, fixed: r.fixed ?? false })) }, null, 2));
-        if (results.some((r) => !r.valid))
+        const output = {
+            results: results.map((r) => ({
+                skill: r.skill,
+                valid: r.valid,
+                errors: r.errors,
+                warnings: r.warnings,
+                infos: r.infos,
+                fixed: r.fixed ?? false,
+                ...(r.qualityScore !== undefined && { qualityScore: r.qualityScore, qualityRating: r.qualityRating }),
+            })),
+        };
+        if (opts.cross && crossIssues.length > 0) {
+            output.crossValidation = crossIssues;
+        }
+        const scores = results.filter((r) => r.qualityScore !== undefined).map((r) => r.qualityScore);
+        if (scores.length > 0) {
+            output.summary = {
+                total: results.length,
+                passed: results.filter((r) => r.valid).length,
+                failed: results.filter((r) => !r.valid).length,
+                averageScore: Math.round(scores.reduce((a, b) => a + b, 0) / scores.length),
+                belowThreshold: opts.minScore ? results.filter((r) => (r.qualityScore ?? 0) < opts.minScore).length : 0,
+            };
+        }
+        console.log(JSON.stringify(output, null, 2));
+        if (hasErrors || hasCrossErrors)
             process.exit(1);
         return;
     }
+    // Human-readable output
     let passed = 0;
     let warned = 0;
     let failed = 0;
     let fixed = 0;
     for (const r of results) {
-        const icon = r.valid
-            ? r.warnings.length > 0 ? ui.warn("[!!]") : ui.success("[OK]")
-            : ui.error("[XX]");
+        const icon = r.valid ? (r.warnings.length > 0 ? ui.warn("[!!]") : ui.success("[OK]")) : ui.error("[XX]");
         const fixTag = r.fixed ? ui.cyan(" [fixed]") : "";
-        console.log(`  ${icon} ${ui.bold(r.skill)}${fixTag}`);
+        const scoreTag = r.qualityScore !== undefined ? ui.dim(` (${r.qualityScore}/100 ${r.qualityRating})`) : "";
+        console.log(`  ${icon} ${ui.bold(r.skill)}${fixTag}${scoreTag}`);
         for (const err of r.errors) {
             console.log(ui.error(`    Error: ${err}`));
         }
@@ -122,6 +187,15 @@ export async function validateCommand(skill, opts) {
         if (r.fixed)
             fixed++;
     }
+    // Cross-validation output
+    if (opts.cross && crossIssues.length > 0) {
+        console.log();
+        console.log(ui.bold("  Cross-validation:"));
+        for (const issue of crossIssues) {
+            const icon = issue.level === "error" ? ui.error("[XX]") : ui.warn("[!!]");
+            console.log(`  ${icon} ${issue.skill}: ${issue.detail}`);
+        }
+    }
     console.log();
     const parts = [];
     if (passed > 0)
@@ -132,9 +206,10 @@ export async function validateCommand(skill, opts) {
         parts.push(ui.error(`${failed} failed`));
     if (fixed > 0)
         parts.push(ui.cyan(`${fixed} fixed`));
+    if (hasCrossErrors)
+        parts.push(ui.error(`${crossIssues.filter((i) => i.level === "error").length} cross-validation errors`));
     console.log(`  ${parts.join(ui.dim(" | "))}`);
     console.log();
-    if (failed > 0)
+    if (failed > 0 || hasCrossErrors)
         process.exit(1);
 }
-//# sourceMappingURL=validate.js.map

package/dist/commands/verify.d.ts

@@ -0,0 +1,4 @@
+export declare function verifyCommand(skillNames: string[], opts: {
+    all?: boolean;
+    json?: boolean;
+}): Promise<void>;