@stainlu/faam-cli 0.2.1 → 0.2.4

package/CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+## 0.2.4 (2026-02-10)
+
+- Fix CI workflow (pin pnpm version)
+
+## 0.2.3 (2026-02-10)
+
+- Add npm badges, Security & Safety section, and install-skills docs to README
+- Add SECURITY.md and CHANGELOG.md
+- Add package metadata (homepage, author, bugs, funding, expanded keywords)
+- Set up GitHub Actions for npm provenance attestation
+- Fix license text in README (was incorrectly listed as MIT)
+
+## 0.2.2 (2026-02-09)
+
+- Dynamic version display (reads from package.json)
+- Fix `install-skills` authentication (use Bearer token)
+- Rebrand rlp → faam across all CLI output
+
+## 0.2.1 (2026-02-09)
+
+- Use Authorization header instead of query params for API requests
+
+## 0.2.0 (2026-02-08)
+
+- Add `install-skills` command — download personalized skills from FAAM
+- Add `config` command — manage agent card configuration
+- All-in-one `init` command with auto-discovery and auto-sync
+- Support for multiple agents: Claude Code, Codex, Cursor, OpenCode, Windsurf
+- Auto-migration from `~/.rlp/` to `~/.faam/`

package/README.md

@@ -1,5 +1,10 @@
 # FAAM CLI
 
+[![npm version](https://img.shields.io/npm/v/@stainlu/faam-cli)](https://www.npmjs.com/package/@stainlu/faam-cli)
+[![license](https://img.shields.io/npm/l/@stainlu/faam-cli)](https://github.com/stainlu/faam/blob/main/apps/cli/LICENSE)
+[![downloads](https://img.shields.io/npm/dm/@stainlu/faam-cli)](https://www.npmjs.com/package/@stainlu/faam-cli)
+[![node](https://img.shields.io/node/v/@stainlu/faam-cli)](https://nodejs.org)
+
 **Make your local AI agent discoverable to the world.**
 
 Local AI agents like Claude Code, Codex, and Clawdbot have powerful skills but are invisible to others. Google's A2A (Agent-to-Agent) protocol defines `/.well-known/agent-card.json` for agent discovery, but local agents can't host their own files.
@@ -116,6 +121,31 @@ Options:
 - `-p, --path <directory>` - Custom skills directory path
 - `--no-delete` - Don't delete remote skills that are not in local
 
+### `faam install-skills`
+
+Download your personalized skills from FAAM and save them locally. This is completely optional — it fetches SKILL.md files (plain markdown instructions) based on your profile and saves them to your agent's skills directory. No executable code is downloaded or run.
+
+```bash
+# Install to default agents (Claude Code + Codex)
+faam install-skills
+
+# Install to a specific agent
+faam install-skills --agent claude-code
+
+# Install to project directory instead of global
+faam install-skills --no-global
+
+# Overwrite existing skills
+faam install-skills --force
+```
+
+Options:
+- `--agent <name>` - Target agent (claude-code, codex, cursor, opencode, windsurf)
+- `--no-global` - Install to project directory instead of `~/`
+- `-f, --force` - Overwrite existing skill files
+
+Supported agents: `claude-code`, `codex`, `cursor`, `opencode`, `windsurf`
+
 ### `faam status`
 
 Show current account and skills sync status.
@@ -206,10 +236,33 @@ Defines your agent card metadata. Create with `faam init` or edit directly:
 
 Skills can be defined in agent-card.json OR as SKILL.md files. If a skill ID exists in both, the SKILL.md file takes precedence.
 
+## Security & Safety
+
+This CLI is fully open source ([Apache-2.0](./LICENSE)). Here's exactly what it does and doesn't do:
+
+**Data stored locally** (`~/.faam/`):
+- `config.json` — your account key and API URL
+- `agent-card.json` — your agent card metadata
+
+**What each command does**:
+- `sync-skills` — reads SKILL.md files from your local skills directories and uploads their metadata (name, description, tags) to the FAAM API
+- `install-skills` — downloads SKILL.md files (plain markdown, not executable code) from the FAAM API and saves them to your agent's skills directory. This is the same format used by Claude Code, Codex, and other agents for skill discovery. Skill installation is a standard pattern across AI coding agents.
+- `init` / `config` — manage local JSON configuration and sync to the API
+- `login` / `logout` — store or remove your account key locally
+
+**What this CLI does NOT do**:
+- Run any downloaded code or scripts
+- Install system packages or dependencies
+- Access files outside of `~/.faam/` and your agent's skills directories
+- Send telemetry or analytics
+- Run background processes or auto-update
+
+See [SECURITY.md](./SECURITY.md) for our security policy.
+
 ## Migration from rlp-cli
 
 If you were using the previous `@stainlu/rlp-cli` package, the FAAM CLI will automatically migrate your config from `~/.rlp/` to `~/.faam/` on first run. No action required.
 
 ## License
 
-MIT
+Apache-2.0

package/SECURITY.md

@@ -0,0 +1,53 @@
+# Security Policy
+
+## Reporting Vulnerabilities
+
+If you discover a security vulnerability, please report it via:
+
+- **Email**: stainlu@newtype-ai.org
+- **GitHub Issues**: https://github.com/stainlu/faam/issues (for non-sensitive issues)
+
+We will acknowledge reports within 48 hours and aim to release fixes promptly.
+
+## Data Handling
+
+### What is stored locally
+
+All data is stored in `~/.faam/` as plain JSON:
+
+- `config.json` — account key and API URL
+- `agent-card.json` — agent card metadata (name, description, skills list)
+
+### What is transmitted
+
+- `sync-skills` sends skill metadata (name, description, tags) to `api.faam.io` over HTTPS
+- `install-skills` downloads SKILL.md content (plain markdown) from `api.faam.io` over HTTPS
+- All API requests use your account key for authentication via Bearer token
+
+### What is NOT transmitted
+
+- File contents outside of SKILL.md files
+- System information, environment variables, or telemetry
+- Any data without explicit user action (no background processes)
+
+## File System Access
+
+This CLI only accesses:
+
+- `~/.faam/` — configuration storage (read/write)
+- Agent skills directories — e.g. `~/.claude/skills/`, `~/.codex/skills/` (read for sync, write for install-skills)
+
+No other directories are read from or written to.
+
+## Dependencies
+
+This package uses a minimal set of well-known dependencies:
+
+- `commander` — CLI argument parsing
+- `chalk` — terminal colors
+- `ora` — terminal spinners
+- `prompts` — interactive prompts
+- `glob` — file pattern matching
+- `gray-matter` — YAML frontmatter parsing
+
+All dependencies are pinned and auditable.

package/dist/index.cjs

@@ -14743,6 +14743,23 @@ var RlpApiClient = class {
       throw new Error(error.error || `API error: ${response.status}`);
     }
   }
+  /**
+   * Get personalized skills for the account
+   */
+  async getPersonalizedSkills() {
+    const url = `${this.apiUrl}/api/skills/me`;
+    const response = await fetch(url, {
+      headers: this.authHeaders
+    });
+    if (!response.ok) {
+      if (response.status === 404) {
+        return { skills: [] };
+      }
+      const error = await response.json().catch(() => ({ error: "Unknown error" }));
+      throw new Error(error.error || `API error: ${response.status}`);
+    }
+    return response.json();
+  }
   /**
    * Validate account key by fetching profile
    * Returns account_id if valid
@@ -22039,15 +22056,8 @@ async function installSkillsCommand(options2) {
   }
   const fetchSpinner = ora("Fetching personalized skills...").start();
   try {
-    const url = `${config.api_url}/api/skills/me?account_key=${encodeURIComponent(config.account_key)}`;
-    const response = await fetch(url);
-    if (!response.ok) {
-      const error = await response.json().catch(() => ({ error: "Unknown error" }));
-      fetchSpinner.fail("Failed to fetch skills");
-      console.error(source_default.red(error.error || `API error: ${response.status}`));
-      process.exit(1);
-    }
-    const data = await response.json();
+    const client = new RlpApiClient(config);
+    const data = await client.getPersonalizedSkills();
     if (data.error) {
       fetchSpinner.fail("Failed to fetch skills");
       console.error(source_default.red(data.error));
@@ -22374,7 +22384,7 @@ function configShowCommand() {
   if (!agentCardConfigExists()) {
     console.log(source_default.yellow("No agent-card.json found."));
     console.log();
-    console.log("Run", source_default.cyan("rlp init"), "to create one, or use", source_default.cyan("rlp config set <key> <value>"));
+    console.log("Run", source_default.cyan("faam init"), "to create one, or use", source_default.cyan("faam config set <key> <value>"));
     console.log();
     console.log("Config path:", source_default.gray(configPath));
     return;
@@ -22388,7 +22398,7 @@ function configShowCommand() {
 function configGetCommand(key) {
   if (!agentCardConfigExists()) {
     console.log(source_default.yellow("No agent-card.json found."));
-    console.log("Run", source_default.cyan("rlp init"), "to create one.");
+    console.log("Run", source_default.cyan("faam init"), "to create one.");
     return;
   }
   const config = readAgentCardConfig();
@@ -22430,7 +22440,7 @@ async function autoSync(config) {
   if (!isLoggedIn()) {
     console.log();
     console.log(source_default.gray("Not logged in - changes saved locally only."));
-    console.log("Run", source_default.cyan("rlp login --key <key>"), "then", source_default.cyan("rlp sync-skills"), "to sync.");
+    console.log("Run", source_default.cyan("faam login --key <key>"), "then", source_default.cyan("faam sync-skills"), "to sync.");
     return;
   }
   console.log();
@@ -22444,7 +22454,7 @@ async function autoSync(config) {
   } catch (err) {
     spinner.fail("Sync failed");
     console.error(source_default.red(err instanceof Error ? err.message : "Unknown error"));
-    console.log("You can retry with:", source_default.cyan("rlp sync-skills"));
+    console.log("You can retry with:", source_default.cyan("faam sync-skills"));
   }
 }
 function configListKeysCommand() {
@@ -22470,14 +22480,14 @@ function configListKeysCommand() {
   }
   console.log();
   console.log("Example usage:");
-  console.log(`  ${source_default.gray('rlp config set name "My AI Agent"')}`);
-  console.log(`  ${source_default.gray('rlp config set provider.organization "My Company"')}`);
-  console.log(`  ${source_default.gray("rlp config set capabilities.streaming true")}`);
+  console.log(`  ${source_default.gray('faam config set name "My AI Agent"')}`);
+  console.log(`  ${source_default.gray('faam config set provider.organization "My Company"')}`);
+  console.log(`  ${source_default.gray("faam config set capabilities.streaming true")}`);
 }
 
 // src/index.ts
 var program2 = new Command();
-program2.name("faam").description("CLI tool to sync local skills to your FAAM Agent Card").version("0.2.0");
+program2.name("faam").description("CLI tool to sync local skills to your FAAM Agent Card").version("0.2.4");
 program2.command("login").description("Store your FAAM account key").requiredOption("-k, --key <account_key>", "Your FAAM account key").option("--api-url <url>", "API URL (default: https://api.faam.io)").action(async (options2) => {
   await loginCommand({
     key: options2.key,

package/package.json

@@ -1,17 +1,12 @@
 {
   "name": "@stainlu/faam-cli",
-  "version": "0.2.1",
+  "version": "0.2.4",
   "description": "CLI tool to sync local skills to your FAAM Agent Card",
   "type": "module",
   "bin": {
     "faam": "./dist/index.cjs",
     "faam-cli": "./dist/index.cjs"
   },
-  "scripts": {
-    "dev": "tsx src/index.ts",
-    "build": "tsup",
-    "typecheck": "tsc --noEmit"
-  },
   "dependencies": {
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
@@ -30,19 +25,35 @@
     "node": ">=18"
   },
   "files": [
-    "dist"
+    "dist",
+    "LICENSE",
+    "SECURITY.md",
+    "CHANGELOG.md"
   ],
   "keywords": [
     "faam",
     "agent",
     "skills",
     "cli",
-    "a2a"
+    "a2a",
+    "a2a-protocol",
+    "agent-card",
+    "ai-agent",
+    "google-a2a"
   ],
+  "author": "stainlu <stainlu@newtype-ai.org>",
   "license": "Apache-2.0",
+  "homepage": "https://faam.io",
+  "bugs": "https://github.com/stainlu/faam/issues",
+  "funding": "https://faam.io",
   "repository": {
     "type": "git",
     "url": "https://github.com/stainlu/faam.git",
     "directory": "apps/cli"
+  },
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "build": "tsup",
+    "typecheck": "tsc --noEmit"
   }
-}
+}