@theholocron/cli 2.0.2 → 2.1.0

package/dist/cli.mjs

@@ -3676,6 +3676,22 @@ async function runSetup(input) {
 		summary
 	};
 }
+/**
+* Fetch a single SKILL.md from its upstream GitHub source.
+* Verifies the SHA-256 hash when `computedHash` is present in the lock entry.
+*/
+async function fetchExternalSkill(entry) {
+	if (entry.sourceType !== "github") throw new Error(`unsupported sourceType: ${entry.sourceType}`);
+	const url = `https://raw.githubusercontent.com/${entry.source}/HEAD/${entry.skillPath}`;
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`HTTP ${res.status} fetching ${url}`);
+	const content = await res.text();
+	if (entry.computedHash) {
+		const actual = createHash("sha256").update(content).digest("hex");
+		if (actual !== entry.computedHash) throw new Error(`hash mismatch for ${entry.source}/${entry.skillPath}: expected ${entry.computedHash}, got ${actual}`);
+	}
+	return content;
+}
 const AGENTS_SKILLS_ROOT = ".agents/skills";
 /** Relative path of the agent-specific symlink. undefined = unsupported agent. */
 const AGENT_SYMLINK_PATHS = { claude: (name) => `.claude/skills/${name}` };
@@ -3723,9 +3739,42 @@ async function installSkills({ agent, skills, repoRoot }) {
 		await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
 		installed.push(name);
 	}
-	if (installed.length > 0 || stale.length > 0 || missing.length > 0) await updateSkillsGitignore(gitignorePath, existingContent, [...installed, ...missing], symlinkFn);
+	const externalFailed = [];
+	if (missing.length > 0) {
+		let lock = null;
+		try {
+			lock = JSON.parse(await readFile(join(skillsRoot, "skills-lock.json"), "utf8"));
+		} catch {}
+		if (lock?.skills) for (const name of [...missing]) {
+			const entry = lock.skills[name];
+			if (!entry) continue;
+			try {
+				const content = await fetchExternalSkill(entry);
+				const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
+				await mkdir(agentsDir, { recursive: true });
+				await writeFile(join(agentsDir, "SKILL.md"), content);
+				const symlinkPath = join(repoRoot, symlinkFn(name));
+				await mkdir(dirname(symlinkPath), { recursive: true });
+				try {
+					await unlink(symlinkPath);
+				} catch {}
+				await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
+				missing.splice(missing.indexOf(name), 1);
+				installed.push(name);
+			} catch {
+				missing.splice(missing.indexOf(name), 1);
+				externalFailed.push(name);
+			}
+		}
+	}
+	if (installed.length > 0 || stale.length > 0 || missing.length > 0 || externalFailed.length > 0) await updateSkillsGitignore(gitignorePath, existingContent, [
+		...installed,
+		...missing,
+		...externalFailed
+	], symlinkFn);
 	const parts = [`installed ${installed.length}`];
 	if (stale.length > 0) parts.push(`pruned: ${stale.join(", ")}`);
+	if (externalFailed.length > 0) parts.push(`fetch failed: ${externalFailed.join(", ")}`);
 	if (missing.length > 0) parts.push(`unknown: ${missing.join(", ")}`);
 	return parts.join("; ");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "description": "The Holocron CLI — a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/cli#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",