@web42/cli 0.1.4 → 0.1.6

package/dist/generated/embedded-skills.d.ts

@@ -0,0 +1,9 @@
+export interface EmbeddedFile {
+    path: string;
+    content: string;
+}
+export interface EmbeddedSkill {
+    name: string;
+    files: EmbeddedFile[];
+}
+export declare const EMBEDDED_SKILLS: EmbeddedSkill[];

package/dist/generated/embedded-skills.js

@@ -0,0 +1,28 @@
+// AUTO-GENERATED by scripts/embed-skills.ts — do not edit manually
+export const EMBEDDED_SKILLS = [
+    {
+        name: "web42-publish-prep",
+        files: [
+            {
+                path: "_meta.json",
+                content: "{\n  \"name\": \"web42-publish-prep\",\n  \"tagline\": \"Prepare your agent for the Web42 marketplace\",\n  \"description\": \"Guides agents through the full publish lifecycle: init, manifest enrichment, README writing, file auditing, and validation before pushing to the Web42 marketplace.\",\n  \"category\": \"development\",\n  \"tags\": [\"web42\", \"marketplace\", \"publishing\", \"cli\", \"agent-packaging\"],\n  \"version\": \"1.0.0\",\n  \"license\": \"MIT\",\n  \"pricing\": \"free\",\n  \"support_url\": \"https://github.com/web42-ai/web42-marketplace/issues\",\n  \"homepage\": \"https://web42.ai/docs/publishing\",\n  \"requiredConfigPaths\": [],\n  \"primaryCredential\": null,\n  \"requires\": {\n    \"anyBins\": [\"web42\"]\n  }\n}\n",
+            },
+            {
+                path: "assets/readme-template.md",
+                content: "# {Agent Name}\n\n<!-- \n  This is a starting point, not a form. Rewrite it, restructure it, make it yours.\n  The marketplace renders full Markdown — use it. GIFs, videos, screenshots, emoji, whatever tells your story.\n-->\n\n{A bold opening line. What changes for the user when they have you? Don't describe yourself — describe the outcome.}\n\n<!-- Optional: embed a GIF or demo video here -->\n<!-- ![Demo](https://your-demo-url.gif) -->\n\n---\n\n## What I Do\n\n{2–3 sentences, max. What's your superpower? Write this like you're explaining to a friend, not a spec sheet.}\n\n## Try Me\n\n{3–5 concrete scenarios. Not features — experiences. Make the reader feel what it's like to work with you.}\n\n- **\"Draft my weekly standup notes from yesterday's git commits and Slack threads.\"**\n- **\"Summarize this 40-page PDF into a one-page brief I can send to my team.\"**\n- **\"Monitor my inbox and ping me only when something actually matters.\"**\n\n<!-- Replace these with real scenarios that match what you actually do. -->\n\n## Quickstart\n\n```bash\nweb42 openclaw install @{author}/{name}\n```\n\n{One sentence on what happens after install. Does the agent need a restart? A quick config? A first conversation?}\n\n## Configuration\n\n{List any API keys, tokens, or setup the user needs to provide. Be specific about where to find each one.}\n\n| Variable | What It Is | Where to Get It |\n|----------|-----------|-----------------|\n| `EXAMPLE_API_KEY` | Access token for Example API | [Example Dashboard → Settings → API](https://example.com/settings) |\n\n<!-- Remove this section entirely if the agent needs no configuration. -->\n\n---\n\n<!-- \n  Optional sections you might add:\n  - \"How I Work\" (high-level, no secrets — just enough to build trust)\n  - \"Limitations\" (honesty builds credibility)\n  - \"Changelog\" (what's new in this version)\n  - \"Credits\" (shoutouts, inspirations)\n  \n  Or make up your own sections. There are no rules here.\n-->\n",
+            },
+            {
+                path: "references/file-hygiene.md",
+                content: "# File Hygiene Checklist\n\nBefore packing, audit the workspace for files that should not ship to buyers. The CLI's pack command automatically excludes some patterns, but manual review catches everything else.\n\n## Automatically Excluded by the CLI\n\nThese patterns are hardcoded in the pack command and will never appear in the `.web42/` artifact:\n\n| Pattern | Reason |\n|---------|--------|\n| `auth-profiles.json` | Platform authentication credentials |\n| `MEMORY.md` | Creator's long-term memory — personal context |\n| `memory/**` | Daily memory logs — personal context |\n| `sessions/**` | Session history — personal context |\n| `.git/**` | Version control internals |\n| `node_modules/**` | Dependencies (not portable) |\n| `.DS_Store` | macOS filesystem metadata |\n| `*.log` | Log files |\n| `openclaw.json` | Platform config (contains agent bindings, channel secrets) |\n| `.openclaw/credentials/**` | Platform credentials |\n| `.web42/**` | Previous pack artifacts |\n| `.web42ignore` | Pack ignore config (meta, not content) |\n| `manifest.json` | Shipped separately as structured data |\n| `USER.md` | Always rewritten with a blank template on install |\n\n## Files to Flag for Manual Review\n\nThese are NOT auto-excluded but often contain content that should not ship:\n\n### Personal Data\n\n- **`HEARTBEAT.md`** — If it contains creator-specific tasks, reminders, or routines. Reset to the scaffold default (empty with comments) unless the tasks are part of the agent's intended behavior.\n- **`SOUL.md`** — If it references the creator by name, contains personal preferences, or has inside jokes. Generalize to describe the agent's intended persona, not the creator's personality.\n- **`IDENTITY.md`** — If it contains the creator's chosen name/emoji/avatar. The buyer's agent should form its own identity. Reset to the scaffold template or write a persona description that fits the agent's purpose.\n- **`TOOLS.md`** — If it contains the creator's SSH hosts, camera names, device nicknames, etc. Reset to the scaffold template with example placeholders.\n\n### Secrets and Credentials\n\n- **`.env` / `.env.local`** — Should never be in the workspace root. If present, flag immediately.\n- **`.web42.config.json`** — Contains config variable values from the creator's install. Must not ship.\n- **Hardcoded API keys in skill files** — The CLI strips known patterns (`sk-...`, `ghp_...`, bearer tokens), but custom keys may slip through. Grep for suspicious patterns: long hex/base64 strings, `token`, `secret`, `password`, `apikey`.\n\n### Development Artifacts\n\n- **`.vscode/` / `.cursor/` / `.idea/`** — IDE configuration. Not relevant to buyers.\n- **`__pycache__/` / `*.pyc`** — Python bytecode.\n- **`Thumbs.db`** — Windows thumbnail cache.\n- **`*.bak` / `*.swp` / `*.tmp`** — Editor backup/swap files.\n- **`test/` / `tests/` / `__tests__/`** — Test files, unless they are part of the agent's functionality.\n- **Build outputs** — `dist/`, `build/`, `out/` directories.\n\n### Large or Binary Files\n\n- The pack command skips files larger than 1 MB.\n- Binary files (images, compiled executables) are skipped automatically (UTF-8 decode failure).\n- If the agent needs images (e.g., for the README cover), use `coverImage` in the manifest or host them externally.\n\n## Using `.web42ignore`\n\nCreate a `.web42ignore` file in the workspace root to exclude additional patterns. Syntax follows `.gitignore`:\n\n```\n# Exclude test fixtures\ntests/**\nfixtures/**\n\n# Exclude draft documents\ndrafts/**\n\n# Exclude local scripts not part of the agent\nscripts/local-*.sh\n```\n\nThe `.web42ignore` file itself is automatically excluded from the artifact.\n\n## Verification\n\nAfter auditing, always run:\n\n```\nweb42 pack --dry-run\n```\n\nThis prints every file that would be included. Review the list for:\n\n1. **Unexpected files** — anything you don't recognize or didn't intend to ship\n2. **File count** — a typical agent has 5–30 files. Hundreds of files suggests something is wrong.\n3. **Sensitive content** — spot-check a few files for leaked secrets or personal data\n",
+            },
+            {
+                path: "references/manifest-fields.md",
+                content: "# manifest.json Field Reference\n\nThe manifest describes your agent package. Format version is always `\"agentpkg/1\"`.\n\n## Required Fields\n\n### `name` (string)\n\nThe package identifier. Appears in install commands and URLs.\n\n- **Constraints:** 1–100 characters. Lowercase alphanumeric with hyphens only. Must start with a letter or number. Regex: `^[a-z0-9][a-z0-9-]*$`\n- **Good:** `support-bot`, `code-reviewer`, `daily-digest`\n- **Bad:** `My_Agent`, `Support Bot`, `-agent`\n- **Guidance:** Pick something short, memorable, and descriptive of what the agent does. This becomes the slug in `@author/name`.\n\n### `description` (string)\n\nA short pitch for the agent. Shown in search results and the marketplace listing.\n\n- **Constraints:** 1–500 characters.\n- **Good:** \"Drafts weekly team reports from your CRM data and posts them to Slack every Monday.\"\n- **Bad:** \"An AI agent.\" / \"This agent uses GPT-4 to process natural language queries against a database.\"\n- **Guidance:** Lead with the benefit to the user. What problem disappears? Avoid technical jargon about how it works internally.\n\n### `version` (string)\n\nSemantic version of the package.\n\n- **Constraints:** Must match `MAJOR.MINOR.PATCH` (e.g., `1.0.0`).\n- **Guidance:** Start at `1.0.0` for first publish. Bump `PATCH` for fixes, `MINOR` for new capabilities, `MAJOR` for breaking changes to config or behavior.\n\n### `author` (string)\n\nYour Web42 username. Set automatically by `web42 init` from your auth credentials.\n\n- **Constraints:** Non-empty string.\n- **Guidance:** Don't edit manually — it's populated from `web42 auth whoami`.\n\n## Optional Fields\n\n### `platform` (string)\n\nTarget agent platform.\n\n- **Values:** Currently only `\"openclaw\"`.\n- **Guidance:** Set during `web42 init` based on the platform prompt.\n\n### `skills` (array)\n\nList of skills the agent provides. Each entry has `name` (string) and `description` (string).\n\n- **Auto-detected** from `skills/*/SKILL.md` during init and pack.\n- **Guidance:** Don't edit manually. Add skills by creating `skills/<name>/SKILL.md` in your workspace. Internal skills (with `internal: true` in frontmatter) are automatically excluded.\n\n### `plugins` (string array)\n\nReserved for future use.\n\n- **Default:** `[]`\n- **Guidance:** Leave empty for now.\n\n### `modelPreferences` (object)\n\nPreferred LLM models for this agent.\n\n- **Fields:** `primary` (string, optional), `fallback` (string, optional)\n- **Example:** `{ \"primary\": \"claude-sonnet-4-20250514\" }`\n- **Guidance:** Set `primary` to the model the agent is designed and tested for. The `fallback` is used if the primary is unavailable. During install, the CLI will prompt buyers for the corresponding provider API key.\n\n### `tags` (string array)\n\nSearchable labels for marketplace discoverability.\n\n- **Default:** `[]`\n- **Good:** `[\"support\", \"crm\", \"slack\", \"weekly-reports\"]`\n- **Bad:** `[\"ai\", \"agent\", \"good\"]` (too generic)\n- **Guidance:** 3–6 tags. Think about what a buyer would search for. Mix category terms (\"support\", \"finance\") with capability terms (\"slack-integration\", \"pdf-generation\").\n\n### `coverImage` (string)\n\nPath to a cover image file, relative to workspace root.\n\n- **Guidance:** Optional but recommended. A good cover image dramatically improves click-through on the marketplace. Use a 1200x630 or 1200x1200 image.\n\n### `demoVideoUrl` (string)\n\nURL to a demo video.\n\n- **Constraints:** Must be a valid URL.\n- **Guidance:** A 1–3 minute video showing the agent in action converts far better than text alone. Host on YouTube, Loom, or similar.\n\n### `configVariables` (array)\n\nSecrets and configuration values that buyers provide during install.\n\n- **Each entry:** `{ key, label, description?, required, default? }`\n  - `key` — Environment variable name (e.g., `SLACK_BOT_TOKEN`)\n  - `label` — Human-readable name shown in the install prompt (e.g., \"Slack Bot Token\")\n  - `description` — Optional help text explaining where to find this value\n  - `required` — Whether install should block without it\n  - `default` — Optional default value\n- **Auto-detected** from skill files during pack (secrets are stripped and replaced with placeholders).\n- **Guidance:** For each config variable, make the `label` and `description` crystal clear. A buyer who has never seen your agent should understand exactly what to provide and where to get it.\n\n## Example Manifest\n\n```json\n{\n  \"format\": \"agentpkg/1\",\n  \"platform\": \"openclaw\",\n  \"name\": \"weekly-digest\",\n  \"description\": \"Summarizes your team's CRM activity and posts a digest to Slack every Monday morning.\",\n  \"version\": \"1.0.0\",\n  \"author\": \"alice\",\n  \"skills\": [\n    { \"name\": \"crm-reader\", \"description\": \"Query CRM data for weekly activity\" },\n    { \"name\": \"slack-poster\", \"description\": \"Post formatted messages to Slack channels\" }\n  ],\n  \"plugins\": [],\n  \"modelPreferences\": { \"primary\": \"claude-sonnet-4-20250514\" },\n  \"tags\": [\"crm\", \"slack\", \"weekly-reports\", \"productivity\"],\n  \"coverImage\": \"assets/cover.png\",\n  \"demoVideoUrl\": \"https://www.youtube.com/watch?v=example\",\n  \"configVariables\": [\n    {\n      \"key\": \"CRM_API_KEY\",\n      \"label\": \"CRM API Key\",\n      \"description\": \"Found in your CRM dashboard under Settings > API\",\n      \"required\": true\n    },\n    {\n      \"key\": \"SLACK_BOT_TOKEN\",\n      \"label\": \"Slack Bot Token\",\n      \"description\": \"Create a Slack app at api.slack.com and copy the Bot User OAuth Token\",\n      \"required\": true\n    }\n  ]\n}\n```\n",
+            },
+            {
+                path: "SKILL.md",
+                content: "---\nname: web42-publish-prep\ndescription: \"This skill should be used when the user asks to 'prepare my agent for Web42', 'publish to Web42', 'set up web42 CLI', 'create a manifest', 'write an agent README', 'clean up files before pushing', 'init web42', or needs help packaging an agent project for the Web42 marketplace. Guides the full lifecycle from init through push-ready state.\"\ninternal: true\nmetadata:\n  clawdbot:\n    emoji: \"📦\"\n    requires:\n      anyBins: [\"web42\"]\n    os: [\"linux\", \"darwin\", \"win32\"]\n---\n\n# Web42 Publish Prep\n\nPrepare an agent project for publishing to the Web42 marketplace. This skill covers the full lifecycle: initializing the project, populating the manifest, writing a compelling README, and auditing workspace files so only the right content ships to users.\n\n## When to Activate\n\nActivate when the user wants to get their agent ready for the Web42 marketplace — whether starting from scratch or cleaning up an existing project before push.\n\n## Prerequisites\n\n- The Web42 CLI must be installed (`npx web42-cli` or globally via `npm i -g web42-cli`).\n- The user must be authenticated (`web42 auth login`). Verify with `web42 auth whoami`.\n- The workspace must contain a supported platform config (currently OpenClaw — `openclaw.json`).\n\nIf any prerequisite is missing, guide the user through resolving it before proceeding.\n\n## Workflow\n\n### Phase 1 — Initialize the Project\n\nCheck whether `manifest.json` already exists in the workspace root.\n\n- **If missing:** Run `web42 init` interactively. The CLI prompts for platform, description, version, and detects skills from `skills/*/SKILL.md`.\n- **If present:** Read and validate the existing manifest against the field reference in `references/manifest-fields.md`. Report any missing or invalid fields.\n\nAfter init, verify that the scaffolded platform files exist (`AGENTS.md`, `IDENTITY.md`, `SOUL.md`, `TOOLS.md`, `HEARTBEAT.md`, `BOOTSTRAP.md`, `USER.md`). If the user already customized these, do not overwrite — just confirm they are present.\n\n### Phase 2 — Enrich the Manifest\n\nRead the current `manifest.json` and walk through each field with the user. Consult `references/manifest-fields.md` for the full field reference.\n\nKey actions:\n\n1. **`name`** — Confirm it is lowercase-hyphenated and reflects the agent's purpose. Suggest alternatives if generic.\n2. **`description`** — Must be 1–500 characters. Draft a concise, benefit-oriented description that tells a potential buyer what the agent *does for them*.\n3. **`version`** — Ensure semver format (`MAJOR.MINOR.PATCH`).\n4. **`tags`** — Suggest 3–6 relevant tags for discoverability.\n5. **`skills`** — Auto-detected from `skills/*/SKILL.md`. If none found, ask if skills should be documented.\n6. **`configVariables`** — For each detected secret/config, ensure `label` and `description` are clear enough for a buyer.\n7. **`modelPreferences`** — Set `primary` to the intended model. Optionally set a `fallback`.\n8. **`coverImage`** — Ask if the user has a cover image (path relative to workspace).\n9. **`demoVideoUrl`** — Ask if there is a demo video URL to include.\n\nWrite the updated `manifest.json` only after user confirmation.\n\n### Phase 3 — Write the README\n\nThe README is the storefront — the agent's pitch deck. Read `assets/readme-template.md` for inspiration, then write a README that lets the agent's personality shine.\n\nPrinciples:\n\n- **Lead with outcomes, not internals.** Paint the picture of life *with* this agent.\n- **Show personality.** Write in the agent's own voice — confident, creative, even playful.\n- **Use rich media.** GIFs, demo videos, screenshots, embedded links. The marketplace renders full Markdown.\n- **Give concrete scenarios.** \"Ask me to...\" or \"Imagine you need to...\" — make it visceral.\n- **Include practical info** (install command, required config) but don't let it dominate.\n- **Don't reveal the recipe.** Focus on outcomes, not system prompts or internal file structures.\n\nWrite to `README.md` at workspace root. If one already exists, show a diff and ask before overwriting.\n\n### Phase 4 — Audit Workspace Files\n\nBefore packing, scan the workspace for files that should not ship to buyers. Consult `references/file-hygiene.md` for the full checklist.\n\nCommon issues to flag:\n\n- **Personal data:** `USER.md`, `MEMORY.md`, `memory/` directory, `HEARTBEAT.md` with creator-specific tasks\n- **Secrets:** `.env`, `.env.local`, API keys hardcoded in files, `.web42.config.json`\n- **Development artifacts:** `node_modules/`, `.git/`, IDE configs, build outputs\n- **Platform junk:** `.DS_Store`, `Thumbs.db`, `__pycache__/`\n- **Overly personal SOUL.md or IDENTITY.md:** Suggest generalizing if they reference the creator rather than the agent persona\n\nFor each flagged item:\n\n1. Explain why it might be a problem.\n2. Ask the user whether to remove, reset to scaffold default, or keep it.\n3. If unsure, recommend `web42 pack --dry-run` to preview the bundle.\n\n### Phase 5 — Validate and Preview\n\nRun `web42 pack --dry-run` to show exactly what files will be included. Review together:\n\n- Confirm file count and total size are reasonable.\n- Verify no secrets leaked (the CLI strips known patterns, but manual review catches edge cases).\n- Ensure `README.md` is present (push reads it from workspace root).\n\nWhen clean, inform the user they can publish with `web42 push`. The agent is created **private** by default — remind them to toggle visibility on the marketplace when ready.\n\n## CLI Quick Reference\n\n| Command | Purpose |\n|---------|---------|\n| `web42 auth login` | Authenticate via GitHub OAuth |\n| `web42 auth whoami` | Check current auth status |\n| `web42 init` | Scaffold `manifest.json` + platform files |\n| `web42 pack --dry-run` | Preview packaged files without writing |\n| `web42 pack` | Bundle into `.web42/` directory |\n| `web42 push` | Pack (if needed) and upload to marketplace |\n| `web42 pull` | Fetch latest published files back locally |\n\n## Resources\n\n### References\n- **`references/manifest-fields.md`** — Complete manifest.json field reference with types, constraints, and guidance.\n- **`references/file-hygiene.md`** — Checklist of files and patterns to audit before packing.\n\n### Assets\n- **`assets/readme-template.md`** — Inspirational README template for the marketplace storefront.\n",
+            },
+        ],
+    },
+];

package/dist/utils/bundled-skills.d.ts

@@ -1,7 +1,6 @@
 export interface BundledSkill {
     name: string;
     description: string;
-    sourcePath: string;
 }
 export declare function listBundledSkills(): BundledSkill[];
 export declare function copySkillToWorkspace(skillName: string, cwd: string): boolean;

package/dist/utils/bundled-skills.js

@@ -1,45 +1,29 @@
-import { existsSync, readdirSync, readFileSync, mkdirSync, cpSync } from "fs";
+import { writeFileSync, mkdirSync } from "fs";
 import { join, dirname } from "path";
-import { fileURLToPath } from "url";
 import { parseSkillMd } from "./skill.js";
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const BUNDLED_SKILLS_DIR = join(__dirname, "..", "..", "skills");
+import { EMBEDDED_SKILLS } from "../generated/embedded-skills.js";
 export function listBundledSkills() {
-    if (!existsSync(BUNDLED_SKILLS_DIR))
-        return [];
     const skills = [];
-    try {
-        const entries = readdirSync(BUNDLED_SKILLS_DIR, { withFileTypes: true });
-        for (const entry of entries) {
-            if (!entry.isDirectory())
-                continue;
-            const skillMdPath = join(BUNDLED_SKILLS_DIR, entry.name, "SKILL.md");
-            if (!existsSync(skillMdPath))
-                continue;
-            const content = readFileSync(skillMdPath, "utf-8");
-            const parsed = parseSkillMd(content, entry.name);
-            skills.push({
-                name: parsed.name,
-                description: parsed.description,
-                sourcePath: join(BUNDLED_SKILLS_DIR, entry.name),
-            });
-        }
-    }
-    catch {
-        // Bundled skills directory missing or unreadable
+    for (const skill of EMBEDDED_SKILLS) {
+        const skillMdFile = skill.files.find((f) => f.path === "SKILL.md");
+        if (!skillMdFile)
+            continue;
+        const parsed = parseSkillMd(skillMdFile.content, skill.name);
+        skills.push({ name: parsed.name, description: parsed.description });
     }
     return skills.sort((a, b) => a.name.localeCompare(b.name));
 }
 export function copySkillToWorkspace(skillName, cwd) {
-    const sourcePath = join(BUNDLED_SKILLS_DIR, skillName);
-    if (!existsSync(sourcePath))
+    const skill = EMBEDDED_SKILLS.find((s) => s.name === skillName);
+    if (!skill)
         return false;
-    const targetPath = join(cwd, "skills", skillName);
-    mkdirSync(targetPath, { recursive: true });
-    cpSync(sourcePath, targetPath, {
-        recursive: true,
-        filter: (src) => !src.endsWith("_meta.json"),
-    });
+    const targetDir = join(cwd, "skills", skillName);
+    for (const file of skill.files) {
+        if (file.path === "_meta.json")
+            continue;
+        const filePath = join(targetDir, file.path);
+        mkdirSync(dirname(filePath), { recursive: true });
+        writeFileSync(filePath, file.content, "utf-8");
+    }
     return true;
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CLI_VERSION = "0.1.4";
+export declare const CLI_VERSION = "0.1.6";

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.1.4";
+export const CLI_VERSION = "0.1.6";

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "@web42/cli",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "CLI for the Web42 Agent Marketplace - push, install, and remix OpenClaw agent packages",
   "type": "module",
   "bin": {
     "web42": "./dist/index.js"
   },
   "scripts": {
-    "build": "tsc",
-    "build:binary": "bash scripts/sync-version.sh && bash scripts/build-binaries.sh",
+    "embed-skills": "bun scripts/embed-skills.ts",
+    "build": "npm run embed-skills && tsc",
+    "build:binary": "bash scripts/sync-version.sh && npm run embed-skills && bash scripts/build-binaries.sh",
     "dev": "tsc --watch",
     "start": "node dist/index.js"
   },