@sporesec/arcana 3.0.3 → 4.0.0

package/dist/commands/scan.js

@@ -1,21 +1,25 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { getInstallDir } from "../utils/fs.js";
-import { scanSkillContent, formatScanResults } from "../utils/scanner.js";
+import { scanSkillContentFull, formatScanResults } from "../utils/scanner.js";
 import { ui, banner } from "../utils/ui.js";
 export async function scanCommand(skill, opts) {
+    /* v8 ignore start */
     if (!opts.json) {
         banner();
-        console.log(ui.bold("  Security Scan\n"));
+        console.log(ui.bold("  Security Scan") + (opts.strict ? ui.dim(" (strict mode)") : "") + "\n");
     }
+    /* v8 ignore stop */
     const installDir = getInstallDir();
     if (!existsSync(installDir)) {
         if (opts.json) {
             console.log(JSON.stringify({ results: [] }));
         }
         else {
+            /* v8 ignore start */
             console.log(ui.dim("  No skills installed."));
             console.log();
+            /* v8 ignore stop */
         }
         return;
     }
@@ -31,15 +35,18 @@ export async function scanCommand(skill, opts) {
             console.log(JSON.stringify({ error: "Specify a skill name or use --all" }));
         }
         else {
+            /* v8 ignore start */
             console.log(ui.error("  Specify a skill name or use --all"));
             console.log(ui.dim("  Usage: arcana scan <skill>"));
             console.log(ui.dim("         arcana scan --all [--json]"));
             console.log();
+            /* v8 ignore stop */
         }
         process.exit(1);
     }
     const results = [];
     let totalIssues = 0;
+    let totalSuppressed = 0;
     let criticalCount = 0;
     let highCount = 0;
     let mediumCount = 0;
@@ -47,13 +54,13 @@ export async function scanCommand(skill, opts) {
     for (const name of skills) {
         const skillMd = join(installDir, name, "SKILL.md");
         if (!existsSync(skillMd)) {
-            results.push({ skill: name, issues: [], error: "Missing SKILL.md" });
+            results.push({ skill: name, issues: [], suppressed: [], error: "Missing SKILL.md" });
             continue;
         }
         try {
             const content = readFileSync(skillMd, "utf-8");
-            const issues = scanSkillContent(content);
-            results.push({ skill: name, issues });
+            const { issues, suppressed } = scanSkillContentFull(content, { strict: opts.strict });
+            results.push({ skill: name, issues, suppressed });
             if (issues.length === 0) {
                 cleanCount++;
             }
@@ -63,13 +70,19 @@ export async function scanCommand(skill, opts) {
                 highCount += issues.filter((i) => i.level === "high").length;
                 mediumCount += issues.filter((i) => i.level === "medium").length;
             }
+            totalSuppressed += suppressed.length;
         }
         catch (err) {
-            results.push({ skill: name, issues: [], error: err instanceof Error ? err.message : "Read failed" });
+            results.push({
+                skill: name,
+                issues: [],
+                suppressed: [],
+                error: err instanceof Error ? err.message : "Read failed",
+            });
         }
     }
     if (opts.json) {
-        console.log(JSON.stringify({
+        const jsonOutput = {
             summary: {
                 total: skills.length,
                 clean: cleanCount,
@@ -77,17 +90,30 @@ export async function scanCommand(skill, opts) {
                 critical: criticalCount,
                 high: highCount,
                 medium: mediumCount,
+                ...(opts.verbose ? { suppressed: totalSuppressed } : {}),
             },
             results: results.map((r) => ({
                 skill: r.skill,
                 ...(r.error ? { error: r.error } : {}),
                 issues: r.issues.map((i) => ({ level: i.level, category: i.category, detail: i.detail, line: i.line })),
+                ...(opts.verbose
+                    ? {
+                        suppressed: r.suppressed.map((i) => ({
+                            level: i.level,
+                            category: i.category,
+                            detail: i.detail,
+                            line: i.line,
+                        })),
+                    }
+                    : {}),
             })),
-        }, null, 2));
+        };
+        console.log(JSON.stringify(jsonOutput, null, 2));
         if (criticalCount > 0)
             process.exit(1);
         return;
     }
+    /* v8 ignore start */
     // Display results
     for (const r of results) {
         if (r.error) {
@@ -95,6 +121,12 @@ export async function scanCommand(skill, opts) {
             continue;
         }
         console.log(formatScanResults(r.skill, r.issues));
+        if (opts.verbose && !opts.strict && r.suppressed.length > 0) {
+            for (const s of r.suppressed) {
+                const icon = s.level === "critical" ? "CRIT" : s.level === "high" ? "HIGH" : "MED";
+                console.log(`    ${ui.dim(`[SKIP] [${icon}] ${s.category}: ${s.detail} (line ${s.line})`)}`);
+            }
+        }
     }
     console.log();
     const parts = [];
@@ -106,11 +138,17 @@ export async function scanCommand(skill, opts) {
         parts.push(ui.warn(`${highCount} high`));
     if (mediumCount > 0)
         parts.push(ui.dim(`${mediumCount} medium`));
+    if (totalSuppressed > 0 && !opts.strict)
+        parts.push(ui.dim(`${totalSuppressed} suppressed`));
     console.log(`  ${parts.join(ui.dim(" | "))}`);
     if (totalIssues === 0) {
         console.log(ui.success("  No security issues detected."));
     }
+    if (!opts.strict) {
+        console.log(ui.dim("  Note: BAD/DON'T example blocks are skipped. Use --strict to scan everything."));
+    }
     console.log();
     if (criticalCount > 0)
         process.exit(1);
+    /* v8 ignore stop */
 }

package/dist/commands/search.js

@@ -3,6 +3,7 @@ import { isSkillInstalled } from "../utils/fs.js";
 import { getProviders } from "../registry.js";
 import { detectProjectContext } from "../utils/project-context.js";
 export async function searchCommand(query, opts) {
+    /* v8 ignore next */
     if (!opts.json)
         banner();
     const providers = getProviders(opts.provider);
@@ -10,6 +11,7 @@ export async function searchCommand(query, opts) {
         for (const provider of providers)
             provider.clearCache();
     }
+    /* v8 ignore next */
     const s = opts.json ? noopSpinner() : spinner(`Searching for "${query}"...`);
     s.start();
     let results = [];
@@ -29,9 +31,11 @@ export async function searchCommand(query, opts) {
             console.log(JSON.stringify({ error: err instanceof Error ? err.message : "Search failed" }));
             process.exit(1);
         }
+        /* v8 ignore start */
         s.fail("Search failed due to a network or provider error.");
         printErrorWithHint(err, true);
         process.exit(1);
+        /* v8 ignore stop */
     }
     // Filter by tag
     if (opts.tag) {
@@ -62,6 +66,7 @@ export async function searchCommand(query, opts) {
         }, null, 2));
         return;
     }
+    /* v8 ignore start */
     if (results.length === 0) {
         console.log(ui.dim(`  No skills matching "${query}"${opts.tag ? ` with tag "${opts.tag}"` : ""}`));
     }
@@ -78,4 +83,5 @@ export async function searchCommand(query, opts) {
         table(rows);
     }
     console.log();
+    /* v8 ignore stop */
 }

package/dist/commands/uninstall.js

@@ -10,6 +10,7 @@ export async function uninstallCommand(skillNames, opts = {}) {
     if (opts.json) {
         return uninstallJson(skillNames);
     }
+    /* v8 ignore start */
     console.log(renderBanner());
     console.log();
     if (skillNames.length === 0) {
@@ -32,7 +33,9 @@ export async function uninstallCommand(skillNames, opts = {}) {
     else {
         await uninstallMultipleInteractive(skillNames, opts.yes);
     }
+    /* v8 ignore stop */
 }
+/* v8 ignore start */
 async function uninstallOneInteractive(skillName, skipConfirm) {
     p.intro(chalk.bold("Uninstall skill"));
     const skillDir = getSkillDir(skillName);
@@ -54,12 +57,29 @@ async function uninstallOneInteractive(skillName, skipConfirm) {
     backupSkill(skillName);
     rmSync(skillDir, { recursive: true, force: true });
     const symlinksRemoved = removeSymlinksFor(skillName);
+    // Regenerate skill index and active curation
+    try {
+        const { regenerateIndex } = await import("./index.js");
+        regenerateIndex();
+    }
+    catch {
+        /* best-effort */
+    }
+    try {
+        const { regenerateActive } = await import("./curate.js");
+        regenerateActive();
+    }
+    catch {
+        /* best-effort */
+    }
     spin.stop(`Removed ${chalk.bold(skillName)}`);
     if (symlinksRemoved > 0) {
         p.log.info(`Removed ${symlinksRemoved} symlink${symlinksRemoved > 1 ? "s" : ""}`);
     }
     p.outro(`Next: ${chalk.cyan("arcana list --installed")}`);
 }
+/* v8 ignore stop */
+/* v8 ignore start */
 async function uninstallMultipleInteractive(skillNames, skipConfirm) {
     p.intro(chalk.bold(`Uninstall ${skillNames.length} skills`));
     const missing = [];
@@ -94,12 +114,28 @@ async function uninstallMultipleInteractive(skillNames, skipConfirm) {
         rmSync(getSkillDir(skillName), { recursive: true, force: true });
         totalSymlinks += removeSymlinksFor(skillName);
     }
+    // Regenerate skill index and active curation
+    try {
+        const { regenerateIndex } = await import("./index.js");
+        regenerateIndex();
+    }
+    catch {
+        /* best-effort */
+    }
+    try {
+        const { regenerateActive } = await import("./curate.js");
+        regenerateActive();
+    }
+    catch {
+        /* best-effort */
+    }
     spin.stop(`Removed ${toRemove.length} skills`);
     if (totalSymlinks > 0) {
         p.log.info(`Removed ${totalSymlinks} symlink${totalSymlinks > 1 ? "s" : ""}`);
     }
     p.outro(`Next: ${chalk.cyan("arcana list --installed")}`);
 }
+/* v8 ignore stop */
 export function removeSymlinksFor(skillName) {
     let removed = 0;
     const expectedTarget = resolve(getSkillDir(skillName));

package/dist/commands/update.js

@@ -27,6 +27,7 @@ async function applyUpdate(skillName, remote, provider) {
     return files;
 }
 export async function updateCommand(skills, opts) {
+    /* v8 ignore next */
     if (!opts.json)
         banner();
     if (skills.length === 0 && !opts.all) {
@@ -34,10 +35,12 @@ export async function updateCommand(skills, opts) {
             console.log(JSON.stringify({ error: "Specify a skill name or use --all" }));
         }
         else {
+            /* v8 ignore start */
             console.log(ui.error("  Specify a skill name or use --all"));
             console.log(ui.dim("  Usage: arcana update <skill> [skill2 ...]"));
             console.log(ui.dim("         arcana update --all"));
             console.log();
+            /* v8 ignore stop */
         }
         process.exit(1);
     }
@@ -47,8 +50,10 @@ export async function updateCommand(skills, opts) {
             console.log(JSON.stringify({ updated: [], upToDate: [], failed: [] }));
         }
         else {
+            /* v8 ignore start */
             console.log(ui.dim("  No skills installed."));
             console.log();
+            /* v8 ignore stop */
         }
         return;
     }
@@ -77,8 +82,10 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
             }));
         }
         else {
+            /* v8 ignore start */
             console.log(ui.error(`  ${err instanceof Error ? err.message : "Invalid skill name"}`));
             console.log();
+            /* v8 ignore stop */
         }
         process.exit(1);
     }
@@ -88,8 +95,10 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
             console.log(JSON.stringify({ updated: [], upToDate: [], failed: [skillName], error: "Not installed" }));
         }
         else {
+            /* v8 ignore start */
             console.log(ui.error(`  Skill "${skillName}" is not installed.`));
             console.log();
+            /* v8 ignore stop */
         }
         process.exit(1);
     }
@@ -103,8 +112,10 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
                 console.log(JSON.stringify({ updated: [], upToDate: [], failed: [skillName], error: `Not found on ${providerName}` }));
             }
             else {
+                /* v8 ignore start */
                 s.fail(`Skill "${skillName}" not found on ${providerName}`);
                 console.log();
+                /* v8 ignore stop */
             }
             process.exit(1);
         }
@@ -114,8 +125,10 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
                 console.log(JSON.stringify({ updated: [], upToDate: [skillName], failed: [] }));
             }
             else {
+                /* v8 ignore start */
                 s.info(`${ui.bold(skillName)} is already up to date (v${remote.version})`);
                 console.log();
+                /* v8 ignore stop */
             }
             return;
         }
@@ -127,8 +140,10 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
                 }));
             }
             else {
+                /* v8 ignore start */
                 s.info(`${ui.bold(skillName)} would be updated: v${meta?.version ?? "unknown"} -> v${remote.version}`);
                 console.log();
+                /* v8 ignore stop */
             }
             return;
         }
@@ -138,8 +153,10 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
             console.log(JSON.stringify({ updated: [skillName], upToDate: [], failed: [] }));
         }
         else {
+            /* v8 ignore start */
             s.succeed(`Updated ${ui.bold(skillName)} to v${remote.version} (${files.length} files)`);
             console.log();
+            /* v8 ignore stop */
         }
     }
     catch (err) {
@@ -152,10 +169,12 @@ async function updateOne(skillName, installDir, providerName, json, dryRun) {
             }));
         }
         else {
+            /* v8 ignore start */
             s.fail(`Failed to update ${skillName}`);
             if (err instanceof Error)
                 console.error(ui.dim(`  ${err.message}`));
             console.log();
+            /* v8 ignore stop */
         }
         process.exit(1);
     }
@@ -181,8 +200,10 @@ async function updateBatch(skillNames, installDir, providerName, json, dryRun) {
                     }));
                 }
                 else {
+                    /* v8 ignore start */
                     console.log(ui.error(`  ${err instanceof Error ? err.message : "Invalid skill name"}`));
                     console.log();
+                    /* v8 ignore stop */
                 }
                 process.exit(1);
             }
@@ -194,8 +215,10 @@ async function updateBatch(skillNames, installDir, providerName, json, dryRun) {
             console.log(JSON.stringify({ updated: [], upToDate: [], failed: [] }));
         }
         else {
+            /* v8 ignore start */
             console.log(ui.dim("  No skills installed."));
             console.log();
+            /* v8 ignore stop */
         }
         return;
     }
@@ -308,6 +331,7 @@ async function updateBatch(skillNames, installDir, providerName, json, dryRun) {
             }));
         }
         else {
+            /* v8 ignore start */
             s.stop();
             if (dryRunUpdates.length === 0) {
                 console.log(ui.dim("  All skills are up to date."));
@@ -322,6 +346,7 @@ async function updateBatch(skillNames, installDir, providerName, json, dryRun) {
                 }
             }
             console.log();
+            /* v8 ignore stop */
         }
         return;
     }
@@ -334,6 +359,7 @@ async function updateBatch(skillNames, installDir, providerName, json, dryRun) {
         }));
     }
     else {
+        /* v8 ignore start */
         s.succeed(`Update complete`);
         const parts = [`${updatedList.length} updated`, `${upToDateList.length} up to date`];
         if (skippedList.length > 0)
@@ -342,6 +368,7 @@ async function updateBatch(skillNames, installDir, providerName, json, dryRun) {
             parts.push(`${failedList.length} failed`);
         console.log(ui.dim(`  ${parts.join(", ")}`));
         console.log();
+        /* v8 ignore stop */
     }
     if (failedList.length > 0)
         process.exit(1);

package/dist/commands/validate.js

@@ -6,6 +6,7 @@ import { atomicWriteSync } from "../utils/atomic.js";
 import { ui, banner } from "../utils/ui.js";
 import { scanSkillContent } from "../utils/scanner.js";
 export async function validateCommand(skill, opts) {
+    /* v8 ignore next */
     if (!opts.json)
         banner();
     const baseDir = opts.source ? resolve(opts.source) : getInstallDir();
@@ -14,8 +15,10 @@ export async function validateCommand(skill, opts) {
             console.log(JSON.stringify({ results: [] }));
         }
         else {
+            /* v8 ignore start */
             console.log(ui.dim("  No skills installed."));
             console.log();
+            /* v8 ignore stop */
         }
         return;
     }
@@ -38,10 +41,12 @@ export async function validateCommand(skill, opts) {
             console.log(JSON.stringify({ error: "Specify a skill name or use --all" }));
         }
         else {
+            /* v8 ignore start */
             console.log(ui.error("  Specify a skill name or use --all"));
             console.log(ui.dim("  Usage: arcana validate <skill>"));
             console.log(ui.dim("         arcana validate --all [--fix]"));
             console.log();
+            /* v8 ignore stop */
         }
         process.exit(1);
     }
@@ -121,6 +126,7 @@ export async function validateCommand(skill, opts) {
             crossIssues = crossValidate(baseDir, marketplacePath);
         }
         else if (!opts.json) {
+            /* v8 ignore next */
             console.log(ui.warn("  Could not find marketplace.json for cross-validation"));
         }
     }
@@ -156,6 +162,7 @@ export async function validateCommand(skill, opts) {
             process.exit(1);
         return;
     }
+    /* v8 ignore start */
     // Human-readable output
     let passed = 0;
     let warned = 0;
@@ -212,4 +219,5 @@ export async function validateCommand(skill, opts) {
     console.log();
     if (failed > 0 || hasCrossErrors)
         process.exit(1);
+    /* v8 ignore stop */
 }

package/dist/commands/verify.js

@@ -10,6 +10,7 @@ export async function verifyCommand(skillNames, opts) {
     if (opts.json) {
         return verifyJson(skillNames, opts);
     }
+    /* v8 ignore start */
     console.log(renderBanner());
     console.log();
     const installDir = getInstallDir();
@@ -77,6 +78,7 @@ export async function verifyCommand(skillNames, opts) {
     if (modifiedCount > 0) {
         process.exit(1);
     }
+    /* v8 ignore stop */
 }
 async function verifyJson(skillNames, opts) {
     const installDir = getInstallDir();

package/dist/compress/engine.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Output compression engine (RTK concept).
+ * 4-stage pipeline: filter -> group -> truncate -> dedup
+ */
+export interface CompressRule {
+    name: string;
+    /** Tool names this rule applies to (e.g. "git", "npm") */
+    tools: string[];
+    /** Apply compression to lines of output */
+    compress(lines: string[]): string[];
+}
+export declare function registerRule(rule: CompressRule): void;
+/** Run the full 4-stage compression pipeline. */
+export declare function compress(input: string, tool?: string, maxLines?: number): string;
+/** Calculate compression stats. */
+export declare function compressionStats(original: string, compressed: string): {
+    originalTokens: number;
+    compressedTokens: number;
+    savedTokens: number;
+    savedPct: number;
+};

package/dist/compress/engine.js

@@ -0,0 +1,106 @@
+/**
+ * Output compression engine (RTK concept).
+ * 4-stage pipeline: filter -> group -> truncate -> dedup
+ */
+const rules = [];
+export function registerRule(rule) {
+    rules.push(rule);
+}
+/** Strip ANSI escape codes */
+function stripAnsi(str) {
+    // eslint-disable-next-line no-control-regex
+    return str.replace(/\x1b\[[0-9;]*m/g, "");
+}
+/** Stage 1: Filter - remove noise lines */
+function filterLines(lines) {
+    return lines.filter((line) => {
+        const clean = stripAnsi(line).trim();
+        // Remove empty lines in sequences of 2+
+        if (clean === "")
+            return true; // keep single blanks, dedup handles runs
+        // Remove progress bars and spinners
+        if (/^[⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏|\\/-]/.test(clean))
+            return false;
+        // Remove timing-only lines
+        if (/^\s*\d+(\.\d+)?\s*(ms|s|sec|seconds)\s*$/.test(clean))
+            return false;
+        return true;
+    });
+}
+/** Stage 2: Group - collapse similar consecutive lines */
+function groupLines(lines) {
+    const result = [];
+    let lastPattern = "";
+    let count = 0;
+    for (const line of lines) {
+        // Normalize for grouping: strip numbers, hashes, timestamps
+        const pattern = stripAnsi(line)
+            .replace(/\b[0-9a-f]{7,40}\b/g, "<hash>")
+            .replace(/\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}/g, "<time>")
+            .replace(/\d+/g, "<n>")
+            .trim();
+        if (pattern === lastPattern && count < 100) {
+            count++;
+        }
+        else {
+            if (count > 1) {
+                result.push(`  ... (${count}x similar)`);
+            }
+            result.push(line);
+            lastPattern = pattern;
+            count = 1;
+        }
+    }
+    if (count > 1) {
+        result.push(`  ... (${count}x similar)`);
+    }
+    return result;
+}
+/** Stage 3: Truncate - cap output length */
+function truncateLines(lines, maxLines) {
+    if (lines.length <= maxLines)
+        return lines;
+    const head = lines.slice(0, Math.floor(maxLines * 0.6));
+    const tail = lines.slice(-Math.floor(maxLines * 0.3));
+    const omitted = lines.length - head.length - tail.length;
+    return [...head, `\n... ${omitted} lines omitted ...\n`, ...tail];
+}
+/** Stage 4: Dedup - collapse consecutive blank lines */
+function dedupBlanks(lines) {
+    const result = [];
+    let lastBlank = false;
+    for (const line of lines) {
+        const isBlank = stripAnsi(line).trim() === "";
+        if (isBlank && lastBlank)
+            continue;
+        result.push(line);
+        lastBlank = isBlank;
+    }
+    return result;
+}
+/** Run the full 4-stage compression pipeline. */
+export function compress(input, tool, maxLines = 80) {
+    let lines = input.split("\n");
+    // Apply tool-specific rules first
+    if (tool) {
+        const matching = rules.filter((r) => r.tools.includes(tool));
+        for (const rule of matching) {
+            lines = rule.compress(lines);
+        }
+    }
+    // Generic pipeline
+    lines = filterLines(lines);
+    lines = groupLines(lines);
+    lines = truncateLines(lines, maxLines);
+    lines = dedupBlanks(lines);
+    return lines.join("\n");
+}
+/** Calculate compression stats. */
+export function compressionStats(original, compressed) {
+    // ~4 chars per token approximation
+    const originalTokens = Math.round(original.length / 4);
+    const compressedTokens = Math.round(compressed.length / 4);
+    const savedTokens = originalTokens - compressedTokens;
+    const savedPct = originalTokens > 0 ? Math.round((savedTokens / originalTokens) * 100) : 0;
+    return { originalTokens, compressedTokens, savedTokens, savedPct };
+}

package/dist/compress/index.d.ts

@@ -0,0 +1,7 @@
+export { compress, compressionStats, registerRule } from "./engine.js";
+export { recordCompression, getCompressionStats, resetCompressionStats } from "./tracker.js";
+import "./rules/git.js";
+import "./rules/npm.js";
+import "./rules/tsc.js";
+import "./rules/test-runner.js";
+import "./rules/generic.js";

package/dist/compress/index.js

@@ -0,0 +1,10 @@
+// Re-export compression engine and load all rules
+export { compress, compressionStats, registerRule } from "./engine.js";
+export { recordCompression, getCompressionStats, resetCompressionStats } from "./tracker.js";
+// Load built-in rules (side-effect imports).
+// Static imports are required for esbuild compatibility.
+import "./rules/git.js";
+import "./rules/npm.js";
+import "./rules/tsc.js";
+import "./rules/test-runner.js";
+import "./rules/generic.js";

package/dist/compress/rules/generic.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/compress/rules/generic.js

@@ -0,0 +1,9 @@
+import { registerRule } from "../engine.js";
+registerRule({
+    name: "generic-cleanup",
+    tools: [], // Empty = applies to all tools as fallback via engine
+    /* v8 ignore next 3 -- intentional no-op placeholder */
+    compress(lines) {
+        return lines;
+    },
+});

package/dist/compress/rules/git.d.ts

@@ -0,0 +1 @@
+export {};