@systemdox/mcp-server 0.1.41 → 0.1.43

package/dist/cli.js

@@ -122,6 +122,16 @@ var init_api_client = __esm({
         this.cache.set(cacheKey, data);
         return data;
       }
+      /** A read that skips the cache: an install must take the version that is
+       * latest now, not the one cached before someone published another. */
+      async getFresh(path) {
+        const res = await this.fetchRaw(path);
+        if (!res.ok) {
+          const body = await res.text();
+          throw new Error(`SystemDox API error ${res.status}: ${body}`);
+        }
+        return await res.json();
+      }
       async post(path, body) {
         return this.mutate("POST", path, body);
       }
@@ -142,8 +152,8 @@ var init_api_client = __esm({
           body: JSON.stringify(body)
         });
         if (!res.ok) {
-          const text = await res.text();
-          throw new Error(`SystemDox API error ${res.status}: ${text}`);
+          const text2 = await res.text();
+          throw new Error(`SystemDox API error ${res.status}: ${text2}`);
         }
         return await res.json();
       }
@@ -178,6 +188,287 @@ var init_api_client = __esm({
   }
 });
 
+// src/lib/skills.ts
+import { createHash } from "crypto";
+import { lstat, mkdir, readdir, readFile, rm, writeFile } from "fs/promises";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { dirname, join, relative, resolve, sep } from "path";
+function sha256(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+function isValidName(name) {
+  return name.length <= 64 && NAME_RE.test(name);
+}
+function isValidPath(path) {
+  return path.length > 0 && path.length <= 512 && !path.startsWith("/") && path.split("/").every((s) => SEGMENT_RE.test(s) && s !== "." && s !== "..");
+}
+function frontmatterName(skillMd) {
+  const block = /^---\r?\n([\s\S]*?)\r?\n---/.exec(skillMd);
+  if (!block) return void 0;
+  const line = /^name:[ \t]*(.+?)[ \t]*$/m.exec(block[1]);
+  return line ? line[1].replace(/^(['"])(.*)\1$/, "$2") : void 0;
+}
+function defaultSkillDir(name) {
+  return join(homedir(), ".claude", "skills", name);
+}
+async function walk(root, { skipHidden }, dir = root, out = { files: [], links: [], hidden: [] }) {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    if (SKIPPED.has(entry.name) || entry.name.endsWith(".pyc")) continue;
+    const full = join(dir, entry.name);
+    const rel = relative(root, full).split(sep).join("/");
+    if (entry.isSymbolicLink()) out.links.push(rel);
+    else if (skipHidden && entry.name.startsWith(".")) out.hidden.push(rel);
+    else if (entry.isDirectory()) await walk(root, { skipHidden }, full, out);
+    else if (entry.isFile()) out.files.push(rel);
+  }
+  out.files.sort();
+  return out;
+}
+async function readSkillDirectory(directory) {
+  const root = resolve(directory);
+  if (!existsSync(join(root, ENTRY_FILE))) {
+    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
+  }
+  const walked = await walk(root, { skipHidden: true });
+  if (walked.links.length) {
+    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
+  }
+  const paths = walked.files;
+  if (paths.length > MAX_FILES) {
+    throw new Error(`${root} holds ${paths.length} files: a skill holds at most ${MAX_FILES}`);
+  }
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  const files = [];
+  let total = 0;
+  for (const path of paths) {
+    if (!isValidPath(path)) {
+      throw new Error(`${path}: file names may use letters, digits, ".", "_" and "-" only`);
+    }
+    const raw = await readFile(join(root, ...path.split("/")));
+    if (raw.includes(0)) throw new Error(`${path} is binary: a skill holds text files only`);
+    if (raw.length > MAX_FILE_BYTES) {
+      throw new Error(`${path} is ${raw.length} bytes: a file holds at most ${MAX_FILE_BYTES}`);
+    }
+    total += raw.length;
+    if (total > MAX_TOTAL_BYTES) {
+      throw new Error(`the files pass ${MAX_TOTAL_BYTES} bytes at ${path}`);
+    }
+    let content;
+    try {
+      content = decoder.decode(raw);
+    } catch {
+      throw new Error(`${path} is not UTF-8 text`);
+    }
+    files.push({ path, content });
+  }
+  const skillMd = files.find((f) => f.path === ENTRY_FILE);
+  const name = frontmatterName(skillMd.content);
+  if (!name) throw new Error(`${ENTRY_FILE} has no frontmatter name`);
+  return { name, files, skipped: walked.hidden };
+}
+function within(dest, path) {
+  if (!isValidPath(path)) throw new Error(`refusing to write ${JSON.stringify(path)}: not a skill path`);
+  const full = resolve(dest, ...path.split("/"));
+  if (!full.startsWith(resolve(dest) + sep)) throw new Error(`refusing to write outside ${dest}: ${path}`);
+  return full;
+}
+async function readManifest(dest) {
+  try {
+    return JSON.parse(await readFile(join(dest, MANIFEST_FILE), "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function installSkill(version, dest, { overwrite = false } = {}) {
+  if (!isValidName(version.name)) throw new Error(`refusing to install ${JSON.stringify(version.name)}: not a skill name`);
+  const incoming = new Map(version.files.map((f) => [f.path, f]));
+  for (const f of version.files) within(dest, f.path);
+  if (existsSync(dest) && (await lstat(dest)).isSymbolicLink()) {
+    throw new Error(`${dest} is a link: install into a real folder`);
+  }
+  const walked = existsSync(dest) ? await walk(dest, { skipHidden: false }) : { files: [], links: [], hidden: [] };
+  if (walked.links.length) {
+    throw new Error(`${dest} holds links (${walked.links.join(", ")}): remove them, nothing was written`);
+  }
+  const present = walked.files;
+  const manifest = await readManifest(dest);
+  const known = Object.fromEntries(
+    Object.entries(manifest?.files ?? {}).filter(([p, h]) => isValidPath(p) && typeof h === "string")
+  );
+  const edited = [];
+  const untracked = [];
+  for (const path of present) {
+    const content = await readFile(join(dest, ...path.split("/")), "utf8");
+    if (Object.hasOwn(known, path)) {
+      if (sha256(content) !== known[path]) edited.push(path);
+    } else if (!incoming.has(path) || sha256(content) !== incoming.get(path).sha256) {
+      if (incoming.has(path) || !manifest) edited.push(path);
+      else untracked.push(path);
+    }
+  }
+  const blocking = edited.filter((p) => incoming.has(p) || !manifest);
+  if (blocking.length && !overwrite) throw new SkillInstallRefused(dest, blocking);
+  const written = [];
+  for (const f of version.files) {
+    const full = within(dest, f.path);
+    await mkdir(dirname(full), { recursive: true });
+    await writeFile(full, f.content, "utf8");
+    written.push(f.path);
+  }
+  const removed = [];
+  const keptEdited = [];
+  for (const path of Object.keys(known)) {
+    if (incoming.has(path) || !present.includes(path)) continue;
+    if (edited.includes(path)) {
+      keptEdited.push(path);
+      continue;
+    }
+    await rm(within(dest, path));
+    removed.push(path);
+  }
+  const next = {
+    name: version.name,
+    version: version.version,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    files: Object.fromEntries(version.files.map((f) => [f.path, f.sha256]))
+  };
+  await writeFile(join(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
+  return {
+    dest,
+    version: version.version,
+    written,
+    removed,
+    keptUntracked: untracked.filter((p) => !incoming.has(p)),
+    keptEdited
+  };
+}
+function fenceFor(text2) {
+  const longest = Math.max(0, ...(text2.match(/`+/g) ?? []).map((r) => r.length));
+  return "`".repeat(Math.max(3, longest + 1));
+}
+function describeInstall(name, r) {
+  const lines = [
+    `Installed ${name} version ${r.version} into ${r.dest} (${r.written.length} file(s)).`
+  ];
+  if (r.removed.length) lines.push(`Removed (no longer in the skill): ${r.removed.join(", ")}`);
+  if (r.keptEdited.length) {
+    lines.push(`Kept, edited here and no longer in the skill: ${r.keptEdited.join(", ")}`);
+  }
+  if (r.keptUntracked.length) lines.push(`Kept, added here: ${r.keptUntracked.join(", ")}`);
+  lines.push("Start a new Claude Code session to load it.");
+  return lines.join("\n");
+}
+var MANIFEST_FILE, ENTRY_FILE, MAX_FILES, MAX_FILE_BYTES, MAX_TOTAL_BYTES, NAME_RE, SEGMENT_RE, SKIPPED, SkillInstallRefused;
+var init_skills = __esm({
+  "src/lib/skills.ts"() {
+    "use strict";
+    MANIFEST_FILE = ".systemdox-skill.json";
+    ENTRY_FILE = "SKILL.md";
+    MAX_FILES = 100;
+    MAX_FILE_BYTES = 256 * 1024;
+    MAX_TOTAL_BYTES = 1024 * 1024;
+    NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+    SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
+    SKIPPED = /* @__PURE__ */ new Set([MANIFEST_FILE, ".git", "node_modules", "__pycache__", ".DS_Store"]);
+    SkillInstallRefused = class extends Error {
+      constructor(dest, edited) {
+        super(
+          `${dest} has local changes in ${edited.length} file(s): ${edited.join(", ")}. Nothing was written. Move your changes aside, or install again with overwrite.`
+        );
+        this.dest = dest;
+        this.edited = edited;
+      }
+      dest;
+      edited;
+    };
+  }
+});
+
+// src/install-skill.ts
+var install_skill_exports = {};
+__export(install_skill_exports, {
+  INSTALL_USAGE: () => INSTALL_USAGE,
+  parseInstallArgs: () => parseInstallArgs,
+  runInstallSkill: () => runInstallSkill
+});
+import { basename, resolve as resolve2 } from "path";
+function parseInstallArgs(argv) {
+  const args2 = { overwrite: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--overwrite") args2.overwrite = true;
+    else if (a === "--version" || a === "--target") {
+      const value = argv[++i];
+      if (!value) throw new Error(`${a} needs a value
+${INSTALL_USAGE}`);
+      if (a === "--target") args2.target = value;
+      else if (/^[1-9]\d*$/.test(value)) args2.version = Number(value);
+      else throw new Error(`--version must be a whole number, got ${value}`);
+    } else if (a.startsWith("-")) throw new Error(`Unknown option ${a}
+${INSTALL_USAGE}`);
+    else if (!args2.name) args2.name = a;
+    else throw new Error(`Unexpected argument ${a}
+${INSTALL_USAGE}`);
+  }
+  if (!args2.name) throw new Error(INSTALL_USAGE);
+  if (!isValidName(args2.name)) throw new Error(`${args2.name} is not a skill name`);
+  if (args2.target && basename(resolve2(args2.target)) !== args2.name) {
+    throw new Error(`--target must be a folder named ${args2.name} (e.g. .claude/skills/${args2.name})`);
+  }
+  return args2;
+}
+async function runInstallSkill(argv, io) {
+  let args2;
+  try {
+    args2 = parseInstallArgs(argv);
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  let client = io.client;
+  if (!client) {
+    try {
+      client = new SystemDoxApiClient(loadConfig());
+    } catch (e) {
+      io.err(
+        `${e.message}
+Set SYSTEMDOX_API_KEY in your environment (create a key under Settings \u203A API keys in SystemDox), then run this again.`
+      );
+      return 1;
+    }
+  }
+  let version;
+  try {
+    version = await client.getFresh(
+      `/v1/standards/skills/${encodeURIComponent(args2.name)}/versions/${args2.version ?? "latest"}`
+    );
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  try {
+    const result = await installSkill(version, args2.target ?? defaultSkillDir(version.name), {
+      overwrite: args2.overwrite
+    });
+    io.out(describeInstall(version.name, result));
+    return 0;
+  } catch (e) {
+    io.err(e.message);
+    return e instanceof SkillInstallRefused ? 2 : 1;
+  }
+}
+var INSTALL_USAGE;
+var init_install_skill = __esm({
+  "src/install-skill.ts"() {
+    "use strict";
+    init_api_client();
+    init_config();
+    init_skills();
+    INSTALL_USAGE = "Usage: systemdox-mcp-server install-skill <name> [--version <n>] [--target <dir>] [--overwrite]";
+  }
+});
+
 // src/lib/language.ts
 function detectLanguage(filePath) {
   const ext = filePath.slice(filePath.lastIndexOf("."));
@@ -310,12 +601,12 @@ function registerGetGuardrails(server2, apiClient2) {
       );
     }
     if (filtered.length === 0) {
-      const text2 = guardrails.length === 0 ? `No checks found. Add checks at ${configLink("/docs/guardrails", await workspaceBase(apiClient2))}` : `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`;
+      const text3 = guardrails.length === 0 ? `No checks found. Add checks at ${configLink("/docs/guardrails", await workspaceBase(apiClient2))}` : `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`;
       return {
-        content: [{ type: "text", text: text2 }]
+        content: [{ type: "text", text: text3 }]
       };
     }
-    const text = filtered.map(
+    const text2 = filtered.map(
       (g) => `## ${g.title} [${g.severity}]
 
 ${g.description}
@@ -339,7 +630,7 @@ ${g.fix}
           type: "text",
           text: `Found ${filtered.length} check(s):
 
-${text}`
+${text2}`
         }
       ]
     };
@@ -450,7 +741,7 @@ ${spec.taskContent}`);
           ]
         };
       }
-      const text = filtered.map(
+      const text2 = filtered.map(
         (s) => `- **${s.name}** (${s.draftId}) \u2014 ${s.status}, ${s.requirementCount} requirements` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
       ).join("\n");
       return {
@@ -459,7 +750,7 @@ ${spec.taskContent}`);
             type: "text",
             text: `Found ${filtered.length} spec(s):
 
-${text}`
+${text2}`
           }
         ]
       };
@@ -517,18 +808,18 @@ function registerGetDocs(server2, apiClient2) {
             isError: true
           };
         }
-        let text2 = doc.content;
+        let text3 = doc.content;
         if (anchor && doc.section_resolved === false) {
-          text2 = `_Section "${anchor}" not found \u2014 returning the full document._
+          text3 = `_Section "${anchor}" not found \u2014 returning the full document._
 
-` + text2;
+` + text3;
         } else if (anchor && doc.heading) {
-          text2 = `## ${doc.heading}
+          text3 = `## ${doc.heading}
 
 ${doc.content}`;
         }
         return {
-          content: [{ type: "text", text: text2 }]
+          content: [{ type: "text", text: text3 }]
         };
       }
       const params = {};
@@ -552,7 +843,7 @@ ${doc.content}`;
           ]
         };
       }
-      const text = items.map((d) => {
+      const text2 = items.map((d) => {
         const sections = (d.outline ?? []).slice(0, 8);
         const sectionHint = sections.length > 0 ? `
   sections: ${sections.map((s) => s.anchor).join(", ")}` : "";
@@ -566,7 +857,7 @@ ${doc.content}`;
             type: "text",
             text: `Found ${items.length} document(s) (${response.total} total):
 
-${text}
+${text2}
 
 Use doc_id for full content, or doc_id + section to fetch one section.`
           }
@@ -911,13 +1202,13 @@ var init_get_plan_board = __esm({
 });
 
 // src/lib/scoring.ts
-function estimateTokens(text) {
-  return Math.ceil(text.length / CHARS_PER_TOKEN);
+function estimateTokens(text2) {
+  return Math.ceil(text2.length / CHARS_PER_TOKEN);
 }
-function truncateToTokens(text, maxTokens) {
+function truncateToTokens(text2, maxTokens) {
   const maxChars = Math.max(0, maxTokens) * CHARS_PER_TOKEN;
-  if (text.length <= maxChars) return { text, truncated: false };
-  const head = text.slice(0, maxChars);
+  if (text2.length <= maxChars) return { text: text2, truncated: false };
+  const head = text2.slice(0, maxChars);
   const floor = Math.floor(maxChars * 0.75);
   const paragraph = head.lastIndexOf("\n\n");
   const line = head.lastIndexOf("\n");
@@ -962,7 +1253,7 @@ function scoreSeverity(item) {
   if (!item.severity) return 0.5;
   return SEVERITY_SCORES[item.severity] ?? 0.5;
 }
-function extractKeywords(text) {
+function extractKeywords(text2) {
   const stopWords = /* @__PURE__ */ new Set([
     "the",
     "a",
@@ -1047,7 +1338,7 @@ function extractKeywords(text) {
     "implement",
     "create"
   ]);
-  return text.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !stopWords.has(w));
+  return text2.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !stopWords.has(w));
 }
 function scoreItems(items, taskDescription, filePaths) {
   const languages = detectLanguages(filePaths);
@@ -1100,20 +1391,20 @@ var init_scoring = __esm({
 
 // src/lib/context-builder.ts
 function formatGuardrail(g) {
-  let text = `## ${g.title} [${g.severity}]
+  let text2 = `## ${g.title} [${g.severity}]
 
 ${g.description}`;
-  if (g.pattern) text += `
+  if (g.pattern) text2 += `
 
 **Bad:** \`\`\`
 ${g.pattern}
 \`\`\``;
-  if (g.fix) text += `
+  if (g.fix) text2 += `
 
 **Good:** \`\`\`
 ${g.fix}
 \`\`\``;
-  return text;
+  return text2;
 }
 function formatSpecHeadline(s) {
   return `### ${s.name}
@@ -1135,19 +1426,19 @@ function formatRules(rules) {
     if (!byCategory.has(cat)) byCategory.set(cat, []);
     byCategory.get(cat).push(r);
   }
-  let text = "";
+  let text2 = "";
   for (const [cat, catRules] of byCategory) {
-    text += `### ${cat.charAt(0).toUpperCase() + cat.slice(1)}
+    text2 += `### ${cat.charAt(0).toUpperCase() + cat.slice(1)}
 `;
     for (const r of catRules) {
-      text += `- ${r.text}
+      text2 += `- ${r.text}
 `;
     }
-    text += "\n";
+    text2 += "\n";
   }
   return `## Project Rules (${rules.length})
 
-${text.trim()}`;
+${text2.trim()}`;
 }
 async function fetchSpecBody(api, draftId) {
   const spec = await api.get(
@@ -1501,13 +1792,13 @@ function registerGetContext(server2, apiClient2) {
       }
     },
     async ({ task_description, file_paths, max_tokens }) => {
-      const { text } = await buildContext(apiClient2, {
+      const { text: text2 } = await buildContext(apiClient2, {
         taskDescription: task_description,
         filePaths: file_paths,
         maxTokens: max_tokens
       });
       return {
-        content: [{ type: "text", text }]
+        content: [{ type: "text", text: text2 }]
       };
     }
   );
@@ -1770,9 +2061,9 @@ function registerGetProjectRules(server2, apiClient2) {
         );
       }
       if (filtered.length === 0) {
-        const text2 = rules.length === 0 ? `No project rules found. Add rules at ${configLink("/docs/rules", await workspaceBase(apiClient2))}` : `No project rules found${category ? ` in category "${category}"` : ""}.`;
+        const text3 = rules.length === 0 ? `No project rules found. Add rules at ${configLink("/docs/rules", await workspaceBase(apiClient2))}` : `No project rules found${category ? ` in category "${category}"` : ""}.`;
         return {
-          content: [{ type: "text", text: text2 }]
+          content: [{ type: "text", text: text3 }]
         };
       }
       const grouped = /* @__PURE__ */ new Map();
@@ -1781,25 +2072,25 @@ function registerGetProjectRules(server2, apiClient2) {
         if (!grouped.has(cat)) grouped.set(cat, []);
         grouped.get(cat).push(rule);
       }
-      let text = `Found ${filtered.length} project rule(s):
+      let text2 = `Found ${filtered.length} project rule(s):
 
 `;
       for (const [cat, catRules] of grouped) {
         const label = CATEGORY_LABELS[cat] ?? cat;
-        text += `## ${label}
+        text2 += `## ${label}
 
 `;
         for (const rule of catRules) {
-          text += `- ${rule.text}
+          text2 += `- ${rule.text}
 `;
         }
-        text += "\n";
+        text2 += "\n";
       }
       return {
         content: [
           {
             type: "text",
-            text
+            text: text2
           }
         ]
       };
@@ -1840,10 +2131,10 @@ function registerCreateProjectRule(server2, apiClient2) {
         readOnlyHint: false
       }
     },
-    async ({ text, category }) => {
+    async ({ text: text2, category }) => {
       const saved = await apiClient2.post(
         "/v1/standards/rules",
-        { text, category }
+        { text: text2, category }
       );
       apiClient2.invalidateCache("/v1/standards/rules");
       return {
@@ -1886,7 +2177,7 @@ function registerGetPromptTemplates(server2, apiClient2) {
           ]
         };
       }
-      const text = templates.map(
+      const text2 = templates.map(
         (t) => `## ${t.name}
 
 ` + (t.description ? `*${t.description}*
@@ -1901,7 +2192,7 @@ ${t.prompt}
             type: "text",
             text: `Found ${templates.length} prompt template(s):
 
-${text}`
+${text2}`
           }
         ]
       };
@@ -1959,9 +2250,151 @@ var init_create_prompt_template = __esm({
   }
 });
 
+// src/tools/skills.ts
+import { z as z13 } from "zod";
+import { homedir as homedir2 } from "os";
+import { basename as basename2, resolve as resolve3 } from "path";
+function expandHome(path) {
+  return path.replace(/^~(?=$|[\\/])/, homedir2());
+}
+function text(t) {
+  return { content: [{ type: "text", text: t }] };
+}
+function registerSkillTools(server2, apiClient2, { localFiles }) {
+  const fileSchema = z13.object({
+    path: z13.string().describe('Path inside the skill folder, forward slashes, e.g. "references/guide.md"'),
+    content: z13.string().describe("The file's full text, exactly as it is")
+  });
+  server2.registerTool(
+    "publish_skill",
+    {
+      title: "Publish Skill",
+      description: localFiles ? "Publish a Claude Code skill folder (SKILL.md plus its references and scripts) to SystemDox so it can be installed on any computer. Pass `directory` (e.g. ~/.claude/skills/<name>): the server reads the files itself, byte for byte. Publishing a name again makes a new version. Never retype the files into `files` when the folder is on this computer." : "Publish a Claude Code skill (SKILL.md plus its references and scripts) to SystemDox so it can be installed on any computer. Pass every file of the folder in `files`, exactly as it is. Publishing a name again makes a new version.",
+      inputSchema: {
+        ...localFiles ? {
+          directory: z13.string().optional().describe("The skill folder on this computer, holding SKILL.md at its root")
+        } : {},
+        files: z13.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the skill folder"),
+        name: z13.string().optional().describe("The skill's name; defaults to SKILL.md's frontmatter name and must match it"),
+        spaceId: z13.string().optional().describe("Space for a NEW skill (default: your default space)")
+      },
+      annotations: { readOnlyHint: false }
+    },
+    async (args2) => {
+      let files;
+      let name;
+      let skipped = [];
+      if (localFiles && args2.directory) {
+        ({ name, files, skipped } = await readSkillDirectory(expandHome(args2.directory)));
+      } else if (args2.files?.length) {
+        files = args2.files;
+        const entry = files.find((f) => f.path === ENTRY_FILE);
+        name = entry ? frontmatterName(entry.content) : void 0;
+      } else {
+        throw new Error(localFiles ? "Pass `directory` (or `files`)." : "Pass `files`.");
+      }
+      name = args2.name ?? name;
+      if (!name) throw new Error(`${ENTRY_FILE} has no frontmatter name; pass \`name\`.`);
+      const saved = await apiClient2.post(
+        `${SKILLS}/${encodeURIComponent(name)}/versions`,
+        { files, ...args2.spaceId ? { spaceId: args2.spaceId } : {} }
+      );
+      apiClient2.invalidateCache(SKILLS);
+      return text(
+        `Published **${saved.name}** version ${saved.version} (${saved.fileCount} file(s), ${saved.totalBytes} bytes).
+Install it anywhere with: npx -y @systemdox/mcp-server install-skill ${saved.name}` + (skipped.length ? `
+Left out (hidden files are never part of a skill): ${skipped.join(", ")}` : "")
+      );
+    }
+  );
+  server2.registerTool(
+    "list_skills",
+    {
+      title: "List Skills",
+      description: "List the Claude Code skills published to SystemDox that you can install: name, description, latest version. Use install_skill to install one.",
+      inputSchema: {},
+      annotations: { readOnlyHint: true }
+    },
+    async () => {
+      const { skills } = await apiClient2.get(SKILLS);
+      if (!skills.length) {
+        return text(
+          `No skills published yet. Publish one with publish_skill; they appear at ${configLink("/docs/skills", await workspaceBase(apiClient2))}`
+        );
+      }
+      return text(
+        `${skills.length} skill(s):
+
+` + skills.map((s) => `- **${s.name}** (version ${s.latestVersion}, updated ${s.updatedAt.slice(0, 10)}): ${s.description}`).join("\n")
+      );
+    }
+  );
+  server2.registerTool(
+    "install_skill",
+    {
+      title: "Install Skill",
+      description: localFiles ? "Install a skill published to SystemDox onto this computer (default ~/.claude/skills/<name>/). Refuses, naming the files, when a file there was edited since it was installed, unless overwrite is true. Never runs anything." : "Fetch a skill published to SystemDox so you can install it: returns every file and the folder to write them into (default ~/.claude/skills/<name>/). Write each file exactly, then the manifest it shows.",
+      inputSchema: {
+        name: z13.string().describe("The skill's name"),
+        version: z13.number().int().positive().optional().describe("A version number (default: the latest)"),
+        target: z13.string().optional().describe("Folder to install into, e.g. a repo's .claude/skills/<name>"),
+        ...localFiles ? { overwrite: z13.boolean().optional().describe("Replace files edited since they were installed") } : {}
+      },
+      annotations: { readOnlyHint: !localFiles }
+    },
+    async (args2) => {
+      const version = await apiClient2.getFresh(
+        `${SKILLS}/${encodeURIComponent(args2.name)}/versions/${args2.version ?? "latest"}`
+      );
+      if (localFiles) {
+        const dest2 = args2.target ? expandHome(args2.target) : defaultSkillDir(version.name);
+        if (basename2(resolve3(dest2)) !== version.name) {
+          throw new Error(`target must be a folder named ${version.name} (e.g. .claude/skills/${version.name}); got ${dest2}`);
+        }
+        const result = await installSkill(version, dest2, { overwrite: args2.overwrite });
+        return text(describeInstall(version.name, result));
+      }
+      const dest = args2.target ?? `~/.claude/skills/${version.name}`;
+      const manifest = {
+        name: version.name,
+        version: version.version,
+        installedAt: "<now, ISO 8601>",
+        files: Object.fromEntries(version.files.map((f) => [f.path, f.sha256]))
+      };
+      const body = version.files.map((f) => {
+        const fence = fenceFor(f.content);
+        return `### ${f.path}
+
+${fence}
+${f.content}${f.content.endsWith("\n") ? "" : "\n"}${fence}`;
+      }).join("\n\n");
+      return text(
+        `Skill **${version.name}** version ${version.version}: write these ${version.files.length} file(s) into ${dest}/ exactly as shown (the content between the fences), creating folders as needed. If a file there differs from ${MANIFEST_FILE}'s hash for it, it was edited: ask before replacing it. Then write ${MANIFEST_FILE} with this content, and tell the user to start a new Claude Code session.
+
+### ${MANIFEST_FILE}
+
+\`\`\`json
+${JSON.stringify(manifest, null, 2)}
+\`\`\`
+
+${body}`
+      );
+    }
+  );
+}
+var SKILLS;
+var init_skills2 = __esm({
+  "src/tools/skills.ts"() {
+    "use strict";
+    init_config_links();
+    init_skills();
+    SKILLS = "/v1/standards/skills";
+  }
+});
+
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-function createServer(apiClient2) {
+function createServer(apiClient2, { localFiles = false } = {}) {
   const server2 = new McpServer({
     name: "systemdox-mcp-server",
     version: SERVER_VERSION
@@ -1980,6 +2413,7 @@ function createServer(apiClient2) {
   registerReportDecision(server2, apiClient2);
   registerCreateProjectRule(server2, apiClient2);
   registerCreatePromptTemplate(server2, apiClient2);
+  registerSkillTools(server2, apiClient2, { localFiles });
   return server2;
 }
 var SERVER_VERSION;
@@ -2000,7 +2434,8 @@ var init_server = __esm({
     init_create_project_rule();
     init_get_prompt_templates();
     init_create_prompt_template();
-    SERVER_VERSION = true ? "0.1.41" : "0.0.0-dev";
+    init_skills2();
+    SERVER_VERSION = true ? "0.1.43" : "0.0.0-dev";
   }
 });
 
@@ -2027,24 +2462,24 @@ var init_index = __esm({
     init_server();
     config = loadConfig();
     apiClient = new SystemDoxApiClient(config);
-    server = createServer(apiClient);
+    server = createServer(apiClient, { localFiles: true });
     main();
   }
 });
 
 // src/cli.ts
 init_config();
-import { readFile, writeFile, chmod } from "fs/promises";
-import { existsSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
+import { readFile as readFile2, writeFile as writeFile2, chmod } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join2 } from "path";
 import { createInterface } from "readline";
 function prompt(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
+  return new Promise((resolve4) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve(answer.trim());
+      resolve4(answer.trim());
     });
   });
 }
@@ -2064,45 +2499,45 @@ async function validateApiKey(apiKey, apiUrl) {
 }
 function findConfigTargets() {
   const targets = [];
-  const projectMcp = join(process.cwd(), ".mcp.json");
+  const projectMcp = join2(process.cwd(), ".mcp.json");
   targets.push({
     name: "Claude Code (project)",
     path: projectMcp,
     detected: true
     // Always available
   });
-  const claudeUser = join(homedir(), ".claude.json");
+  const claudeUser = join2(homedir3(), ".claude.json");
   targets.push({
     name: "Claude Code (user \u2014 all projects)",
     path: claudeUser,
     detected: true
     // Always available
   });
-  const cursorProject = join(process.cwd(), ".cursor", "mcp.json");
-  const cursorDir = join(process.cwd(), ".cursor");
+  const cursorProject = join2(process.cwd(), ".cursor", "mcp.json");
+  const cursorDir = join2(process.cwd(), ".cursor");
   targets.push({
     name: "Cursor (project)",
     path: cursorProject,
-    detected: existsSync(cursorDir)
+    detected: existsSync2(cursorDir)
   });
-  const vscodeProject = join(process.cwd(), ".vscode", "mcp.json");
-  const vscodeDir = join(process.cwd(), ".vscode");
+  const vscodeProject = join2(process.cwd(), ".vscode", "mcp.json");
+  const vscodeDir = join2(process.cwd(), ".vscode");
   targets.push({
     name: "VS Code (project)",
     path: vscodeProject,
-    detected: existsSync(vscodeDir)
+    detected: existsSync2(vscodeDir)
   });
-  const cursorGlobal = join(homedir(), ".cursor", "mcp.json");
+  const cursorGlobal = join2(homedir3(), ".cursor", "mcp.json");
   targets.push({
     name: "Cursor (global)",
     path: cursorGlobal,
-    detected: existsSync(join(homedir(), ".cursor"))
+    detected: existsSync2(join2(homedir3(), ".cursor"))
   });
   return targets;
 }
 async function readOrCreateConfig(path) {
   try {
-    const content = await readFile(path, "utf-8");
+    const content = await readFile2(path, "utf-8");
     return JSON.parse(content);
   } catch {
     return { mcpServers: {} };
@@ -2110,11 +2545,11 @@ async function readOrCreateConfig(path) {
 }
 async function writeConfig(path, config2) {
   const dir = path.substring(0, path.lastIndexOf("/"));
-  if (!existsSync(dir)) {
-    const { mkdir } = await import("fs/promises");
-    await mkdir(dir, { recursive: true });
+  if (!existsSync2(dir)) {
+    const { mkdir: mkdir2 } = await import("fs/promises");
+    await mkdir2(dir, { recursive: true });
   }
-  await writeFile(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
+  await writeFile2(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
   try {
     await chmod(path, 384);
   } catch {
@@ -2192,7 +2627,7 @@ async function setup() {
     console.log(`  Configured: ${target.name}`);
   }
   console.log(
-    "\n  Done! Restart your AI coding tool to activate the SystemDox MCP server.\n  The server provides 14 tools: get_context, get_checks,\n  get_project_rules, get_prompt_templates, get_specs, get_docs,\n  get_tech_stack, get_planning_context, get_plan_board, create_check,\n  create_project_rule, create_prompt_template, update_spec,\n  report_decision.\n\n  get_guardrails and create_guardrail remain registered as deprecated\n  aliases of get_checks and create_check \u2014 existing configs keep working.\n"
+    "\n  Done! Restart your AI coding tool to activate the SystemDox MCP server.\n  The server provides 17 tools: get_context, get_checks,\n  get_project_rules, get_prompt_templates, get_specs, get_docs,\n  get_tech_stack, get_planning_context, get_plan_board, create_check,\n  create_project_rule, create_prompt_template, update_spec,\n  report_decision, publish_skill, list_skills, install_skill.\n\n  get_guardrails and create_guardrail remain registered as deprecated\n  aliases of get_checks and create_check \u2014 existing configs keep working.\n"
   );
 }
 var args = process.argv.slice(2);
@@ -2204,6 +2639,10 @@ if (command === "setup") {
 `);
     process.exit(1);
   });
+} else if (command === "install-skill") {
+  Promise.resolve().then(() => (init_install_skill(), install_skill_exports)).then(
+    ({ runInstallSkill: runInstallSkill2 }) => runInstallSkill2(args.slice(1), { out: console.log, err: console.error })
+  ).then((code) => process.exit(code));
 } else if (command === "--help" || command === "-h") {
   console.log(`
   SystemDox MCP Server
@@ -2211,6 +2650,9 @@ if (command === "setup") {
   Usage:
     systemdox-mcp-server          Start the MCP server (stdio transport)
     systemdox-mcp-server setup    Configure the MCP server in your AI coding tool
+    systemdox-mcp-server install-skill <name> [--version n] [--target dir] [--overwrite]
+                                  Install a skill published to SystemDox
+                                  (default folder: ~/.claude/skills/<name>)
     systemdox-mcp-server --help   Show this help message
 
   Environment variables: