@sporesec/arcana 3.0.3 → 4.0.0

package/dist/mcp/registry.js

@@ -0,0 +1,27 @@
+export const MCP_REGISTRY = [
+    {
+        name: "context7",
+        description: "Live version-specific documentation from source repos (Upstash)",
+        command: "npx",
+        args: ["-y", "@upstash/context7-mcp"],
+        envKeys: ["CONTEXT7_API_KEY"],
+    },
+    {
+        name: "filesystem",
+        description: "File system operations for AI agents (Anthropic)",
+        command: "npx",
+        args: ["-y", "@anthropic/mcp-filesystem"],
+    },
+    {
+        name: "memory",
+        description: "Persistent key-value memory for agents (Anthropic)",
+        command: "npx",
+        args: ["-y", "@anthropic/mcp-memory"],
+    },
+];
+export function getServerDef(name) {
+    return MCP_REGISTRY.find((s) => s.name === name);
+}
+export function listRegistry() {
+    return [...MCP_REGISTRY];
+}

package/dist/providers/anthropics.d.ts

@@ -0,0 +1,4 @@
+import { GitHubProvider } from "./github.js";
+export declare class AnthropicsProvider extends GitHubProvider {
+    constructor();
+}

package/dist/providers/anthropics.js

@@ -0,0 +1,10 @@
+import { GitHubProvider } from "./github.js";
+export class AnthropicsProvider extends GitHubProvider {
+    constructor() {
+        super("anthropics", "skills", {
+            name: "anthropics",
+            displayName: "Anthropic Official",
+            branch: "main",
+        });
+    }
+}

package/dist/registry.js

@@ -1,4 +1,5 @@
 import { ArcanaProvider } from "./providers/arcana.js";
+import { AnthropicsProvider } from "./providers/anthropics.js";
 import { GitHubProvider, validateSlug } from "./providers/github.js";
 import { loadConfig } from "./utils/config.js";
 import { errorAndExit } from "./utils/ui.js";
@@ -21,6 +22,9 @@ function createProvider(name, type, url) {
     if (name === "arcana") {
         provider = new ArcanaProvider();
     }
+    else if (name === "anthropics") {
+        provider = new AnthropicsProvider();
+    }
     else if (type === "github") {
         const { owner, repo } = parseProviderSlug(url);
         try {

package/dist/session/trim.d.ts

@@ -0,0 +1,23 @@
+export interface TrimResult {
+    originalLines: number;
+    trimmedLines: number;
+    originalBytes: number;
+    trimmedBytes: number;
+    savedBytes: number;
+    savedPct: number;
+    toolResultsTrimmed: number;
+    base64Removed: number;
+}
+/**
+ * Analyze a session JSONL for trimmable content.
+ * Returns stats without modifying the file.
+ */
+export declare function analyzeSession(filePath: string): TrimResult;
+/**
+ * Trim a session JSONL and write trimmed copy.
+ * NEVER modifies the original file.
+ */
+export declare function trimSession(filePath: string): {
+    destPath: string;
+    result: TrimResult;
+} | null;

package/dist/session/trim.js

@@ -0,0 +1,132 @@
+import { existsSync, readFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { atomicWriteSync } from "../utils/atomic.js";
+/** Threshold for tool result bodies (chars). Results larger than this get stubbed. */
+const RESULT_THRESHOLD = 500;
+/**
+ * Analyze a session JSONL for trimmable content.
+ * Returns stats without modifying the file.
+ */
+export function analyzeSession(filePath) {
+    if (!existsSync(filePath)) {
+        return {
+            originalLines: 0,
+            trimmedLines: 0,
+            originalBytes: 0,
+            trimmedBytes: 0,
+            savedBytes: 0,
+            savedPct: 0,
+            toolResultsTrimmed: 0,
+            base64Removed: 0,
+        };
+    }
+    const content = readFileSync(filePath, "utf-8");
+    const lines = content.split("\n").filter((l) => l.trim());
+    let toolResultsTrimmed = 0;
+    let base64Removed = 0;
+    let trimmedSize = 0;
+    for (const line of lines) {
+        try {
+            const msg = JSON.parse(line);
+            const role = msg.role;
+            // Tool results: stub if too large
+            if (role === "tool" || msg.type === "tool_result") {
+                const content = JSON.stringify(msg);
+                if (content.length > RESULT_THRESHOLD) {
+                    toolResultsTrimmed++;
+                    trimmedSize += 100; // stub size
+                    continue;
+                }
+            }
+            // Base64 encoded content
+            const lineStr = JSON.stringify(msg);
+            if (lineStr.includes("base64,") || lineStr.includes('"type":"image"')) {
+                base64Removed++;
+                trimmedSize += 50; // stub size
+                continue;
+            }
+            trimmedSize += line.length;
+        }
+        catch {
+            trimmedSize += line.length;
+        }
+    }
+    const originalBytes = content.length;
+    const savedBytes = originalBytes - trimmedSize;
+    const savedPct = originalBytes > 0 ? Math.round((savedBytes / originalBytes) * 100) : 0;
+    return {
+        originalLines: lines.length,
+        trimmedLines: lines.length - toolResultsTrimmed - base64Removed,
+        originalBytes,
+        trimmedBytes: trimmedSize,
+        savedBytes,
+        savedPct,
+        toolResultsTrimmed,
+        base64Removed,
+    };
+}
+/**
+ * Trim a session JSONL and write trimmed copy.
+ * NEVER modifies the original file.
+ */
+export function trimSession(filePath) {
+    if (!existsSync(filePath))
+        return null;
+    const content = readFileSync(filePath, "utf-8");
+    const lines = content.split("\n").filter((l) => l.trim());
+    const trimmedLines = [];
+    let toolResultsTrimmed = 0;
+    let base64Removed = 0;
+    for (const line of lines) {
+        try {
+            const msg = JSON.parse(line);
+            const role = msg.role;
+            // Tool results: stub if too large
+            if (role === "tool" || msg.type === "tool_result") {
+                const msgStr = JSON.stringify(msg);
+                if (msgStr.length > RESULT_THRESHOLD) {
+                    toolResultsTrimmed++;
+                    // Replace with stub preserving structure
+                    const stubbed = { ...msg, content: `[trimmed: ${Math.round(msgStr.length / 1024)}KB]` };
+                    trimmedLines.push(JSON.stringify(stubbed));
+                    continue;
+                }
+            }
+            // Base64 encoded content
+            const lineStr = JSON.stringify(msg);
+            if (lineStr.includes("base64,") || lineStr.includes('"type":"image"')) {
+                base64Removed++;
+                const stubbed = { ...msg, content: "[base64 image removed]" };
+                trimmedLines.push(JSON.stringify(stubbed));
+                continue;
+            }
+            trimmedLines.push(line);
+        }
+        catch {
+            trimmedLines.push(line);
+        }
+    }
+    // Write to ~/.arcana/trimmed/
+    const trimmedDir = join(homedir(), ".arcana", "trimmed");
+    if (!existsSync(trimmedDir))
+        mkdirSync(trimmedDir, { recursive: true });
+    const trimmedContent = trimmedLines.join("\n") + "\n";
+    const destPath = join(trimmedDir, `trimmed-${Date.now()}.jsonl`);
+    atomicWriteSync(destPath, trimmedContent);
+    const originalBytes = content.length;
+    const trimmedBytes = trimmedContent.length;
+    return {
+        destPath,
+        result: {
+            originalLines: lines.length,
+            trimmedLines: trimmedLines.length,
+            originalBytes,
+            trimmedBytes,
+            savedBytes: originalBytes - trimmedBytes,
+            savedPct: originalBytes > 0 ? Math.round(((originalBytes - trimmedBytes) / originalBytes) * 100) : 0,
+            toolResultsTrimmed,
+            base64Removed,
+        },
+    };
+}

package/dist/utils/cache.js

@@ -2,8 +2,8 @@ import { existsSync, mkdirSync, readFileSync, unlinkSync, statSync } from "node:
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { atomicWriteSync } from "./atomic.js";
+import { CACHE_MAX_AGE_MS } from "../constants.js";
 const CACHE_DIR = join(homedir(), ".arcana", "cache");
-const DEFAULT_TTL = 60 * 60 * 1000; // 1 hour
 function ensureCacheDir() {
     if (!existsSync(CACHE_DIR)) {
         mkdirSync(CACHE_DIR, { recursive: true });
@@ -12,7 +12,7 @@ function ensureCacheDir() {
 function cacheFile(key) {
     return join(CACHE_DIR, `${key}.json`);
 }
-export function readCache(key, maxAgeMs = DEFAULT_TTL) {
+export function readCache(key, maxAgeMs = CACHE_MAX_AGE_MS) {
     const file = cacheFile(key);
     if (!existsSync(file))
         return null;

package/dist/utils/config.d.ts

@@ -3,5 +3,7 @@ import type { ArcanaConfig, ProviderConfig } from "../types.js";
 export declare function validateConfig(config: ArcanaConfig): string[];
 export declare function loadConfig(): ArcanaConfig;
 export declare function saveConfig(config: ArcanaConfig): void;
+/** Clear the config cache. Call from tests to ensure isolated state. */
+export declare function clearConfigCache(): void;
 export declare function addProvider(provider: ProviderConfig): void;
 export declare function removeProvider(name: string): boolean;

package/dist/utils/config.js

@@ -4,6 +4,8 @@ import { homedir } from "node:os";
 import { ui } from "./ui.js";
 import { atomicWriteSync } from "./atomic.js";
 const CONFIG_PATH = join(homedir(), ".arcana", "config.json");
+/** Module-level config cache. Avoids repeated disk reads during a single CLI invocation. */
+let _cache = null;
 /** Matches owner/repo slug format (e.g. "medy-gribkov/arcana") */
 const SLUG_RE = /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/;
 const DEFAULT_CONFIG = {
@@ -16,6 +18,12 @@ const DEFAULT_CONFIG = {
             url: "medy-gribkov/arcana",
             enabled: true,
         },
+        {
+            name: "anthropics",
+            type: "github",
+            url: "anthropics/skills",
+            enabled: true,
+        },
     ],
 };
 function cloneConfig(config) {
@@ -42,23 +50,29 @@ export function validateConfig(config) {
     return warnings;
 }
 export function loadConfig() {
+    if (_cache)
+        return cloneConfig(_cache);
+    let config;
     if (!existsSync(CONFIG_PATH)) {
-        return applyEnvOverrides(cloneConfig(DEFAULT_CONFIG));
-    }
-    try {
-        const raw = readFileSync(CONFIG_PATH, "utf-8");
-        const loaded = JSON.parse(raw);
-        const config = {
-            ...DEFAULT_CONFIG,
-            ...loaded,
-            providers: loaded.providers ?? DEFAULT_CONFIG.providers.map((p) => ({ ...p })),
-        };
-        return applyEnvOverrides(config);
+        config = applyEnvOverrides(cloneConfig(DEFAULT_CONFIG));
     }
-    catch {
-        console.error(ui.warn("  Warning: Config file is corrupted, using defaults"));
-        return applyEnvOverrides(cloneConfig(DEFAULT_CONFIG));
+    else {
+        try {
+            const raw = readFileSync(CONFIG_PATH, "utf-8");
+            const loaded = JSON.parse(raw);
+            config = applyEnvOverrides({
+                ...DEFAULT_CONFIG,
+                ...loaded,
+                providers: loaded.providers ?? DEFAULT_CONFIG.providers.map((p) => ({ ...p })),
+            });
+        }
+        catch {
+            console.error(ui.warn("  Warning: Config file is corrupted, using defaults"));
+            config = applyEnvOverrides(cloneConfig(DEFAULT_CONFIG));
+        }
     }
+    _cache = config;
+    return cloneConfig(config);
 }
 function applyEnvOverrides(base) {
     const config = { ...base, providers: base.providers };
@@ -92,6 +106,11 @@ export function saveConfig(config) {
         mkdirSync(dir, { recursive: true });
     }
     atomicWriteSync(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", 0o600);
+    _cache = null; // Invalidate cache on write
+}
+/** Clear the config cache. Call from tests to ensure isolated state. */
+export function clearConfigCache() {
+    _cache = null;
 }
 export function addProvider(provider) {
     const config = loadConfig();

package/dist/utils/help.js

@@ -4,7 +4,8 @@ import { homedir } from "node:os";
 import * as p from "@clack/prompts";
 import chalk from "chalk";
 import { ui } from "./ui.js";
-import { getGroupedCommands } from "../command-registry.js";
+import { getGroupedCommands } from "../command-defs.js";
+/* v8 ignore start */
 const noColor = !!(process.env.NO_COLOR || process.env.TERM === "dumb");
 function amberShade(hex, text) {
     if (noColor)
@@ -33,27 +34,31 @@ export function renderBanner() {
     }
     return BANNER_LINES.map((line, i) => `  ${amberShade(AMBER_HEXES[i], line)}`).join("\n");
 }
+/* v8 ignore stop */
 // Help groups: subset of registry for --help display (keeps output scannable)
 const HELP_GROUPS = {
     "GETTING STARTED": ["init", "doctor"],
-    SKILLS: ["list", "search", "info", "install", "update", "uninstall", "recommend"],
-    DEVELOPMENT: ["create", "validate", "audit"],
-    CONFIGURATION: ["config", "providers", "clean", "stats"],
+    SKILLS: ["list", "search", "install", "update", "uninstall", "recommend"],
+    "CONTEXT INTELLIGENCE": ["curate", "compress", "remember", "recall", "mcp"],
+    SECURITY: ["scan", "verify", "lock"],
+    CONFIGURATION: ["config", "providers", "clean"],
 };
 const EXAMPLES = [
-    "$ arcana install code-reviewer typescript golang",
-    '$ arcana search "testing"',
-    "$ arcana init --tool claude",
+    "$ arcana install --all && arcana curate",
+    '$ arcana remember "always use pnpm"',
+    "$ arcana compress git status --json",
+    "$ arcana init",
 ];
 function padRight(str, width) {
     return str + " ".repeat(Math.max(0, width - str.length));
 }
+/* v8 ignore start */
 export function buildCustomHelp(version) {
     const lines = [];
     lines.push("");
     lines.push(renderBanner());
     lines.push("");
-    lines.push(`  ${ui.bold("Supercharge any AI coding agent.")}${" ".repeat(20)}${ui.dim(`v${version}`)}`);
+    lines.push(`  ${ui.bold("Context intelligence for AI coding agents.")}${" ".repeat(11)}${ui.dim(`v${version}`)}`);
     lines.push("");
     lines.push(`  ${ui.dim("USAGE")}`);
     lines.push("    arcana <command> [options]");
@@ -81,6 +86,7 @@ export function buildCustomHelp(version) {
     lines.push("");
     return lines.join("\n");
 }
+/* v8 ignore stop */
 const FIRST_RUN_FLAG = join(homedir(), ".arcana", ".initialized");
 export function isFirstRun() {
     return !existsSync(FIRST_RUN_FLAG);
@@ -92,6 +98,7 @@ export function markInitialized() {
     }
     writeFileSync(FIRST_RUN_FLAG, new Date().toISOString(), "utf-8");
 }
+/* v8 ignore start */
 export function showWelcome(version) {
     console.log();
     console.log(renderBanner());
@@ -102,3 +109,4 @@ export function showWelcome(version) {
     p.log.info("They install on-demand and only load when relevant, not all at once.");
     console.log();
 }
+/* v8 ignore stop */

package/dist/utils/install-core.js

@@ -4,7 +4,7 @@ import { scanSkillContent } from "./scanner.js";
 import { updateLockEntry } from "./integrity.js";
 import { checkConflicts } from "./conflict-check.js";
 import { detectProjectContext } from "./project-context.js";
-import { LARGE_SKILL_KB_THRESHOLD, TOKENS_PER_KB } from "../constants.js";
+import { LARGE_SKILL_KB_THRESHOLD, TOKENS_PER_KB, SKILL_NAME_REGEX } from "../constants.js";
 /** Scan fetched files for security threats. Returns true if install should proceed. */
 export function preInstallScan(_skillName, files, force) {
     const skillMd = files.find((f) => f.path.endsWith("SKILL.md"));
@@ -41,6 +41,13 @@ export function preInstallConflictCheck(skillName, remote, files, force) {
  * fetch -> security scan -> conflict check -> write files -> write meta -> update lock
  */
 export async function installOneCore(skillName, provider, opts) {
+    if (!SKILL_NAME_REGEX.test(skillName)) {
+        return {
+            success: false,
+            skillName,
+            error: `Invalid skill name "${skillName}". Must match: lowercase alphanumeric with hyphens, 1-64 chars.`,
+        };
+    }
     const files = await provider.fetch(skillName);
     // Security scan
     const scan = preInstallScan(skillName, files, opts.force);
@@ -81,6 +88,21 @@ export async function installOneCore(skillName, provider, opts) {
         sizeBytes,
     });
     updateLockEntry(skillName, version, provider.name, files);
+    // Auto-regenerate skill index and active curation
+    try {
+        const { regenerateIndex } = await import("../commands/index.js");
+        regenerateIndex();
+    }
+    catch {
+        /* non-critical, index regeneration is best-effort */
+    }
+    try {
+        const { regenerateActive } = await import("../commands/curate.js");
+        regenerateActive();
+    }
+    catch {
+        /* non-critical, active curation is best-effort */
+    }
     const sizeKB = sizeBytes / 1024;
     return { success: true, skillName, files, sizeKB, conflictWarnings };
 }

package/dist/utils/memory.d.ts

@@ -0,0 +1,25 @@
+export interface Memory {
+    id: string;
+    content: string;
+    tags: string[];
+    project?: string;
+    created: string;
+}
+/** Add a memory. Extracts tags from content if not provided. */
+export declare function addMemory(content: string, opts?: {
+    tags?: string[];
+    project?: string;
+}): Memory;
+/** Search memories by query (substring + tag match). */
+export declare function searchMemories(query: string, opts?: {
+    project?: string;
+}): Memory[];
+/** List all memories, optionally filtered by project. */
+export declare function listMemories(opts?: {
+    project?: string;
+    limit?: number;
+}): Memory[];
+/** Remove a memory by ID. */
+export declare function removeMemory(id: string): boolean;
+/** Get memories relevant to the current project for injection into _active.md */
+export declare function getProjectMemories(project?: string): Memory[];

package/dist/utils/memory.js

@@ -0,0 +1,103 @@
+import { existsSync, readFileSync, mkdirSync } from "node:fs";
+import { join, basename } from "node:path";
+import { homedir } from "node:os";
+import { atomicWriteSync } from "./atomic.js";
+import { randomBytes } from "node:crypto";
+const MAX_MEMORIES = 200;
+function memoriesPath() {
+    return join(homedir(), ".arcana", "memories.json");
+}
+function readMemories() {
+    const p = memoriesPath();
+    if (!existsSync(p))
+        return [];
+    try {
+        const data = JSON.parse(readFileSync(p, "utf-8"));
+        return Array.isArray(data) ? data : [];
+    }
+    catch {
+        return [];
+    }
+}
+function writeMemories(memories) {
+    const dir = join(homedir(), ".arcana");
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    atomicWriteSync(memoriesPath(), JSON.stringify(memories, null, 2));
+}
+function generateId() {
+    return randomBytes(4).toString("hex");
+}
+/** Add a memory. Extracts tags from content if not provided. */
+export function addMemory(content, opts) {
+    const memories = readMemories();
+    const tags = opts?.tags ?? [];
+    // Auto-extract simple tags from content if none provided
+    if (tags.length === 0) {
+        const words = content.toLowerCase().split(/\s+/);
+        const keywords = words.filter((w) => w.length > 3 &&
+            !["always", "never", "should", "this", "that", "with", "from", "have", "will", "when", "then", "than"].includes(w));
+        tags.push(...keywords.slice(0, 3));
+    }
+    const project = opts?.project ?? basename(process.cwd());
+    const memory = {
+        id: generateId(),
+        content,
+        tags,
+        project,
+        created: new Date().toISOString(),
+    };
+    memories.push(memory);
+    // Cap at max
+    while (memories.length > MAX_MEMORIES)
+        memories.shift();
+    writeMemories(memories);
+    return memory;
+}
+/** Search memories by query (substring + tag match). */
+export function searchMemories(query, opts) {
+    const memories = readMemories();
+    const q = query.toLowerCase();
+    return memories
+        .filter((m) => {
+        // Project filter
+        if (opts?.project && m.project !== opts.project)
+            return false;
+        // Content match
+        if (m.content.toLowerCase().includes(q))
+            return true;
+        // Tag match
+        if (m.tags.some((t) => t.toLowerCase().includes(q)))
+            return true;
+        return false;
+    })
+        .sort((a, b) => new Date(b.created).getTime() - new Date(a.created).getTime());
+}
+/** List all memories, optionally filtered by project. */
+export function listMemories(opts) {
+    const memories = readMemories();
+    let filtered = memories;
+    if (opts?.project) {
+        filtered = filtered.filter((m) => m.project === opts.project);
+    }
+    filtered.sort((a, b) => new Date(b.created).getTime() - new Date(a.created).getTime());
+    if (opts?.limit) {
+        filtered = filtered.slice(0, opts.limit);
+    }
+    return filtered;
+}
+/** Remove a memory by ID. */
+export function removeMemory(id) {
+    const memories = readMemories();
+    const idx = memories.findIndex((m) => m.id === id);
+    if (idx === -1)
+        return false;
+    memories.splice(idx, 1);
+    writeMemories(memories);
+    return true;
+}
+/** Get memories relevant to the current project for injection into _active.md */
+export function getProjectMemories(project) {
+    const proj = project ?? basename(process.cwd());
+    return listMemories({ project: proj, limit: 10 });
+}

package/dist/utils/project-context.js

@@ -129,6 +129,10 @@ function extractNpmTags(cwd) {
     if (existsSync(join(cwd, "tsconfig.json")) || allDeps.typescript) {
         tags.add("typescript");
     }
+    // Detect package manager
+    if (existsSync(join(cwd, "pnpm-lock.yaml")) || existsSync(join(cwd, "pnpm-workspace.yaml"))) {
+        tags.add("pnpm");
+    }
     return [...tags];
 }
 function extractGoTags(cwd) {

package/dist/utils/scanner.d.ts

@@ -11,11 +11,32 @@ export interface ScanIssue {
     line: number;
     context: string;
 }
+export interface ScanOptions {
+    /** When true, scan all lines including BAD/DON'T blocks (no scope filtering). */
+    strict?: boolean;
+}
+/**
+ * Scan SKILL.md content for security threats.
+ * Returns an array of issues sorted by severity (critical first).
+ * By default, findings inside BAD/DON'T example blocks are suppressed.
+ * Use strict mode to scan everything.
+ */
+export interface ScanResult {
+    issues: ScanIssue[];
+    suppressed: ScanIssue[];
+}
+/**
+ * Scan with full result including suppressed findings.
+ * Used by scan command when --verbose is needed.
+ */
+export declare function scanSkillContentFull(content: string, options?: ScanOptions): ScanResult;
 /**
  * Scan SKILL.md content for security threats.
  * Returns an array of issues sorted by severity (critical first).
+ * By default, findings inside BAD/DON'T example blocks are suppressed.
+ * Use strict mode to scan everything.
  */
-export declare function scanSkillContent(content: string): ScanIssue[];
+export declare function scanSkillContent(content: string, options?: ScanOptions): ScanIssue[];
 /**
  * Quick check: does this content have any critical issues?
  */