@wrongstack/core 0.284.0 → 0.285.0

package/dist/skills/limits.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Centralized skill system limits.
+ *
+ * Before this file existed, the magic numbers below were scattered across five
+ * modules (`skill-installer`, `github-fetcher`, `skill` tool, system-prompt
+ * builder, skill-loader), sometimes duplicated (e.g. per-skill body cap was
+ * defined independently in the builder and the tool). Centralizing them here
+ * keeps the budget model coherent — change one, change everywhere — and makes
+ * the trade-offs visible in one place.
+ *
+ * Values are frozen at their pre-centralization defaults so this is a pure
+ * refactor (no behavior change).
+ */
+export declare const SKILL_LIMITS: {
+    /**
+     * Per-skill body cap when injecting a full skill body into the system prompt
+     * (eager mode), and when returning a skill body from the `skill` tool.
+     * ~4k tokens. Oversized bodies are truncated at a paragraph boundary.
+     *
+     * Consumers: `system-prompt-builder.capSkillBody`, `skill` tool body return.
+     */
+    readonly MAX_SKILL_BODY_CHARS: 16000;
+    /**
+     * Per-resource cap when the `skill` tool loads a bundled file
+     * (`scripts/`, `references/`, `assets/`). ~8k tokens.
+     *
+     * Consumer: `skill` tool `loadResource`.
+     */
+    readonly MAX_RESOURCE_CHARS: 32000;
+    /**
+     * Maximum number of bundled resource paths the `skill` tool lists in one
+     * response. Caps a pathological skill (huge `assets/` tree) from blowing up
+     * the tool result.
+     *
+     * Consumer: `skill` tool resource listing.
+     */
+    readonly MAX_LISTED_RESOURCES: 100;
+    /**
+     * Max size of a single installed skill file (SKILL.md or a bundled resource).
+     * Guards against a malicious registry skill shipping a multi-MB blob that
+     * then flows into the prompt. 100KB.
+     *
+     * Consumer: `SkillInstaller.install` / `importFromDir`.
+     */
+    readonly MAX_SKILL_FILE_SIZE: number;
+    /**
+     * Max size of a GitHub tarball downloaded by the skill installer. Guards
+     * against a repo accidentally (or maliciously) shipping a giant tarball that
+     * would be extracted into a temp dir. 50MB.
+     *
+     * Consumer: `downloadGitHubTarball`.
+     */
+    readonly MAX_TARBALL_SIZE: number;
+    /**
+     * Default total char budget for skill bodies injected in eager mode when
+     * `config.skills.eagerMaxChars` is unset. ~6k tokens. Skills are injected
+     * highest-priority first; once the budget is exhausted the remaining skills
+     * are listed as a manifest the agent loads via the `skill` tool. Set very
+     * high to effectively disable budgeting.
+     *
+     * Consumer: `DefaultSystemPromptBuilder.buildMemoryAndSkills` (default for
+     * `skillEagerMaxChars`).
+     */
+    readonly EAGER_DEFAULT_MAX_CHARS: 24000;
+    /**
+     * Auto-compact body limits (the token-saving fallback used when a skill has
+     * no hand-crafted `SKILL.save.md`). The Overview and Rules sections are
+     * extracted and trimmed to these char budgets, then the total is capped.
+     *
+     * Consumer: `DefaultSkillLoader.compactSkillBody`.
+     */
+    readonly COMPACT_OVERVIEW_MAX: 200;
+    readonly COMPACT_RULES_MAX: 350;
+    readonly COMPACT_TOTAL_MAX: 450;
+    /**
+     * Max length of a skill name (agentskills.io spec). Enforced by the
+     * frontmatter validator's format regex plus this length bound.
+     *
+     * Consumer: `isValidSkillNameFormat`.
+     */
+    readonly SKILL_NAME_MAX_LEN: 64;
+    /**
+     * Soft line limit for a SKILL.md body, per the bundled `skill-creator` rule.
+     * Not enforced in code (a skill can exceed it) — surfaced by `/skill-gen
+     * validate` and the `skill-creator` skill as guidance to move deep material
+     * into `references/`.
+     *
+     * Consumer: `skill-creator` skill, `/skill-gen validate` advisory.
+     */
+    readonly SKILL_BODY_LINE_LIMIT: 500;
+};
+//# sourceMappingURL=limits.d.ts.map

package/dist/skills/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/skills/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY;IACvB;;;;;;OAMG;aACH,oBAAoB,EAAE,KAAM;IAE5B;;;;;OAKG;aACH,kBAAkB,EAAE,KAAM;IAE1B;;;;;;OAMG;aACH,oBAAoB,EAAE,GAAG;IAEzB;;;;;;OAMG;aACH,mBAAmB;IAEnB;;;;;;OAMG;aACH,gBAAgB;IAEhB;;;;;;;;;OASG;aACH,uBAAuB,EAAE,KAAM;IAE/B;;;;;;OAMG;aACH,oBAAoB,EAAE,GAAG;aACzB,iBAAiB,EAAE,GAAG;aACtB,iBAAiB,EAAE,GAAG;IAEtB;;;;;OAKG;aACH,kBAAkB,EAAE,EAAE;IAEtB;;;;;;;OAOG;aACH,qBAAqB,EAAE,GAAG;CAClB,CAAC"}

package/dist/skills/manifest-store.d.ts

@@ -0,0 +1,42 @@
+export interface InstalledSkillEntry {
+    name: string;
+    /** Source identifier, e.g. "github:user/repo" */
+    source: string;
+    /** Git ref that was installed (branch, tag, commit) */
+    ref: string;
+    /** Installation scope */
+    scope: 'project' | 'user';
+    /** Project hash — only set when scope=project */
+    projectHash?: string | undefined;
+    /** ISO 8601 timestamp */
+    installedAt: string;
+    /** List of files that were installed (relative to skill dir) */
+    files: string[];
+    /**
+     * When the install was resolved through a registry (e.g. `skills.sh`), the
+     * adapter id + registry id that mapped to the GitHub `source`. Absent for
+     * direct `user/repo` installs.
+     */
+    registryFrom?: {
+        adapterId: string;
+        registryId: string;
+    } | undefined;
+}
+export interface ManifestData {
+    skills: InstalledSkillEntry[];
+}
+export declare class SkillManifestStore {
+    private readonly manifestPath;
+    private cache?;
+    constructor(manifestPath: string);
+    read(): Promise<ManifestData>;
+    write(data: ManifestData): Promise<void>;
+    addEntry(entry: InstalledSkillEntry): Promise<void>;
+    removeEntry(name: string, scope: 'project' | 'user'): Promise<boolean>;
+    findByName(name: string): Promise<InstalledSkillEntry[]>;
+    findBySource(source: string): Promise<InstalledSkillEntry[]>;
+    listAll(): Promise<InstalledSkillEntry[]>;
+    /** Invalidate the in-memory cache (e.g. after external file changes). */
+    invalidateCache(): void;
+}
+//# sourceMappingURL=manifest-store.d.ts.map

package/dist/skills/manifest-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-store.d.ts","sourceRoot":"","sources":["../../src/skills/manifest-store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;IAC1B,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACtE;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,mBAAmB,EAAE,CAAC;CAC/B;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,KAAK,CAAC,CAA2B;IAEzC,YAAY,YAAY,EAAE,MAAM,EAE/B;IAEK,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,CAclC;IAEK,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7C;IAEK,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMxD;IAEK,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3E;IAEK,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAG7D;IAEK,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAGjE;IAEK,OAAO,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAG9C;IAED,yEAAyE;IACzE,eAAe,IAAI,IAAI,CAEtB;CACF"}

package/dist/skills/registry/github-direct-adapter.d.ts

@@ -0,0 +1,17 @@
+/**
+ * GitHub-direct registry adapter.
+ *
+ * This is the original pre-registry install path wrapped in the adapter
+ * interface: the user types `user/repo[@ref]` directly. It does NOT search
+ * (GitHub code search is a separate API with its own auth/rate-limit story and
+ * isn't a skill catalog), so `search()` returns an empty result. Its job is
+ * solely to make `user/repo` flow through the same `<adapterId>:<registryId>`
+ * resolution as the skills.sh adapter — except here the "registry id" IS the
+ * install ref already.
+ *
+ * Registered as the fallback adapter so `/skill-install user/repo` keeps
+ * working unchanged when no `<adapterId>:` prefix is given.
+ */
+import type { SkillRegistryAdapter } from './registry-adapter.js';
+export declare const githubDirectAdapter: SkillRegistryAdapter;
+//# sourceMappingURL=github-direct-adapter.d.ts.map

package/dist/skills/registry/github-direct-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-direct-adapter.d.ts","sourceRoot":"","sources":["../../../src/skills/registry/github-direct-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAGV,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,mBAAmB,EAAE,oBAqBjC,CAAC"}

package/dist/skills/registry/registry-adapter.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Skill registry adapter contract.
+ *
+ * A registry is a searchable catalog of skills that resolves to a concrete
+ * install target (a GitHub `user/repo[@ref]`). Two adapters ship out of the
+ * box:
+ *
+ *   - `githubDirectAdapter`  — no search; `user/repo` is typed directly. This
+ *                              is the original pre-registry install path.
+ *   - `skillsShAdapter`     — searches the skills.sh marketplace
+ *                              (https://skills.sh/api/skills), which indexes
+ *                              34k+ skills from 2.8k+ repos and computes a
+ *                              per-skill security score (0–100).
+ *
+ * The adapter layer keeps the installer registry-agnostic: it asks each
+ * adapter to resolve a `<adapterId>:<registryId>` ref to a `user/repo@ref`
+ * and reuses the existing GitHub tarball path. New registries (an internal
+ * company hub, ags, …) are added by implementing this interface and passing
+ * them to the `SkillInstaller`.
+ */
+/**
+ * One hit from a registry search. Fields are optional where the underlying
+ * registry doesn't guarantee them — every adapter normalizes to this shape.
+ */
+export interface RegistrySkillSummary {
+    /** Registry-native id (used as `<adapterId>:<id>` in `/skill-install`). */
+    id: string;
+    /** Skill name (kebab-case, as it will appear once installed). */
+    name: string;
+    /** Short description / trigger line. */
+    description: string;
+    /** Author / owner (often the GitHub owner). */
+    author?: string | undefined;
+    /** Install count, if the registry reports it. */
+    installs?: number | undefined;
+    /** Star count, if the registry reports it. */
+    stars?: number | undefined;
+    /**
+     * Security score 0–100 (skills.sh computes this; ags uses the same scale).
+     * Lower = riskier. Below 30 the install command prompts for confirmation.
+     */
+    securityScore?: number | undefined;
+    /** ISO timestamp of the skill's last update, if known. */
+    updatedAt?: string | undefined;
+    /**
+     * The `user/repo[@ref]` the installer passes to `downloadGitHubTarball`.
+     * Always present for real registry hits — it's the whole point of resolving.
+     */
+    installRef: string;
+}
+export interface RegistrySearchOptions {
+    /** 1-indexed page (default 1). */
+    page?: number | undefined;
+    /** Page size (default 20; registries may cap this). */
+    pageSize?: number | undefined;
+}
+export interface RegistrySearchResult {
+    /** Which adapter produced these results. */
+    adapterId: string;
+    results: RegistrySkillSummary[];
+    /** True when the registry indicates more pages exist. */
+    hasMore?: boolean | undefined;
+}
+/**
+ * A searchable skill catalog that resolves to a GitHub install target.
+ *
+ * `search` is optional in spirit (the github-direct adapter doesn't search),
+ * but the interface requires it so callers can fan out uniformly — adapters
+ * that can't search simply return `[]`.
+ */
+export interface SkillRegistryAdapter {
+    /** Stable id used in `<adapterId>:<registryId>` refs (e.g. `'skills.sh'`). */
+    readonly id: string;
+    /** Human label for UI (e.g. `'skills.sh'`). */
+    readonly displayName: string;
+    /** Search the catalog. Return `[]` if the adapter doesn't support search. */
+    search(query: string, opts?: RegistrySearchOptions): Promise<RegistrySearchResult>;
+    /**
+     * Resolve a registry-native id to a `user/repo[@ref]` install ref. Should
+     * validate the id shape and throw on an id this adapter can't resolve.
+     */
+    resolveInstallRef(registryId: string): string;
+}
+//# sourceMappingURL=registry-adapter.d.ts.map

package/dist/skills/registry/registry-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-adapter.d.ts","sourceRoot":"","sources":["../../../src/skills/registry/registry-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,yDAAyD;IACzD,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6EAA6E;IAC7E,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnF;;;OAGG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/C"}

package/dist/skills/registry/skills-sh-adapter.d.ts

@@ -0,0 +1,13 @@
+import type { SkillRegistryAdapter } from './registry-adapter.js';
+/** Default skills.sh base URL. Override via `config.skills.registryUrl`. */
+export declare const DEFAULT_SKILLS_SH_URL = "https://skills.sh";
+/** Injectable fetcher (mirrors the `prompt-installer` JsonFetcher pattern). */
+export type SkillsShFetcher = (url: string) => Promise<unknown>;
+export interface SkillsShAdapterOptions {
+    /** Base URL (no trailing slash). Defaults to {@link DEFAULT_SKILLS_SH_URL}. */
+    baseUrl?: string | undefined;
+    /** Injectable fetcher for tests. */
+    fetcher?: SkillsShFetcher | undefined;
+}
+export declare function createSkillsShAdapter(opts?: SkillsShAdapterOptions): SkillRegistryAdapter;
+//# sourceMappingURL=skills-sh-adapter.d.ts.map

package/dist/skills/registry/skills-sh-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-sh-adapter.d.ts","sourceRoot":"","sources":["../../../src/skills/registry/skills-sh-adapter.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAIV,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAE/B,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAKzD,+EAA+E;AAC/E,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AA6ChE,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,oCAAoC;IACpC,OAAO,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CACvC;AAED,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,sBAA2B,GAAG,oBAAoB,CAwD7F"}

package/dist/skills/skill-generator.d.ts

@@ -0,0 +1,82 @@
+import type { SkillEntry, SkillLoader } from '../types/skill.js';
+/** Result of validating a proposed skill name. */
+export interface SkillNameValidation {
+    /** Whether the name is valid kebab-case AND free of collisions. */
+    ok: boolean;
+    /** Format violations (empty when the name is valid kebab-case). */
+    formatViolations: string[];
+    /** Existing skills with the same name (empty when there's no collision). */
+    conflicts: SkillEntry[];
+}
+/**
+ * Validate a proposed skill name: format (kebab-case, ≤64 chars) plus collision
+ * check against every skill the loader can see (project, user, foreign,
+ * bundled). A collision isn't fatal — project skills intentionally shadow
+ * lower layers — so `ok` is true when the only collision is with a foreign or
+ * bundled skill (intended shadowing), but `conflicts` is still populated so the
+ * user can decide. A collision with another project or user skill of the same
+ * name does fail (`ok: false`), since that would silently overwrite it.
+ */
+export declare function validateSkillNameAvailable(name: string, loader?: SkillLoader): Promise<SkillNameValidation>;
+export interface SkillSkeletonOptions {
+    name: string;
+    description: string;
+    /** Trigger keywords for the `Triggers:` line. */
+    triggerKeywords?: string[] | undefined;
+    /** Optional version (default `1.0.0`). */
+    version?: string | undefined;
+}
+/**
+ * Generate a SKILL.md body (with frontmatter) following the agentskills.io
+ * format and the `skill-creator` skill's recommended skeleton. Deterministic:
+ * the same inputs always produce the same output, and the result round-trips
+ * through `parseSkillFrontmatter` (so what we write is what the loader reads).
+ *
+ * The body is a skeleton — the user fills in Rules/Patterns/etc. The
+ * `skill-creator` skill is the right tool for the open-ended authoring; this
+ * is the scaffold.
+ */
+export declare function generateSkillSkeleton(opts: SkillSkeletonOptions): string;
+/** Result of extracting a skill draft from a free-form prompt. */
+export interface ExtractedSkillDraft {
+    /** Suggested name (kebab-case) derived from the prompt, or empty. */
+    suggestedName: string;
+    /** Description (first paragraph of the prompt). */
+    description: string;
+    /** Remaining prompt text, used as the skill body. */
+    body: string;
+    /** Trigger keywords extracted from the prompt. */
+    triggerKeywords: string[];
+}
+/**
+ * Heuristically extract a skill draft from a free-form prompt. No LLM — just
+ * light structure detection:
+ *   - First non-empty paragraph → `description`.
+ *   - A `# heading` or the first line → suggested kebab-case `suggestedName`.
+ *   - Remaining text → `body`.
+ *   - Quoted tokens and the heading words → `triggerKeywords`.
+ *
+ * The output is a starting point the user (or the skill-creator wizard) refines.
+ */
+export declare function extractSkillFromPrompt(prompt: string): ExtractedSkillDraft;
+/**
+ * Open a file in the user's editor (`$VISUAL` → `$EDITOR` → platform default).
+ * Detached + unref'd so the editor outlives the WrongStack process. Throws a
+ * `WrongStackError` when no editor can be resolved.
+ */
+export declare function openInEditor(filePath: string, env?: NodeJS.ProcessEnv): Promise<void>;
+/**
+ * Write a skeleton skill to `<skillsDir>/<name>/SKILL.md`. Returns the written
+ * path. Used by `/skill-gen skeleton` and `/skill-gen from-prompt`. Refuses to
+ * overwrite an existing SKILL.md unless `overwrite` is set — a guard against
+ * clobbering a hand-edited skill.
+ */
+export declare function writeSkeletonSkill(skillsDir: string, body: string, opts?: {
+    overwrite?: boolean | undefined;
+}): Promise<string>;
+/** Soft length advisory for a SKILL.md body (the `skill-creator` 500-line rule). */
+export declare function bodyLineAdvisory(body: string): {
+    lines: number;
+    over: boolean;
+};
+//# sourceMappingURL=skill-generator.d.ts.map

package/dist/skills/skill-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-generator.d.ts","sourceRoot":"","sources":["../../src/skills/skill-generator.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIjE,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,mEAAmE;IACnE,EAAE,EAAE,OAAO,CAAC;IACZ,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,SAAS,EAAE,UAAU,EAAE,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACvC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CA2DxE;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAqC1E;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAAO,GAC7C,OAAO,CAAC,MAAM,CAAC,CA8BjB;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAG/E"}

package/dist/skills/skill-installer.d.ts

@@ -0,0 +1,124 @@
+import type { SkillLoader } from '../types/skill.js';
+import { type InstalledSkillEntry } from './manifest-store.js';
+import type { RegistrySearchOptions, RegistrySearchResult, SkillRegistryAdapter } from './registry/registry-adapter.js';
+export interface SkillInstallerOptions {
+    /** Path to the manifest file (~/.wrongstack/installed-skills.json) */
+    manifestPath: string;
+    /** Path to project-level skills dir (<project>/.wrongstack/skills/) */
+    projectSkillsDir: string;
+    /** Path to user-global skills dir (~/.wrongstack/skills/) */
+    globalSkillsDir: string;
+    /** Current project hash (for manifest tracking) */
+    projectHash: string;
+    /** Skill loader — cache will be invalidated after mutations */
+    skillLoader?: SkillLoader | undefined;
+    /** Logger for status messages */
+    log?: ((msg: string) => void) | undefined;
+    /**
+     * Skill registries used to resolve `<adapterId>:<registryId>` refs and to
+     * serve `/skill-search`. Defaults to `[githubDirectAdapter]` (the original
+     * direct `user/repo` install path). Add a skills.sh adapter to enable
+     * searching the marketplace and installing registry hits by id.
+     */
+    registryAdapters?: SkillRegistryAdapter[] | undefined;
+}
+export interface InstallResult {
+    name: string;
+    path: string;
+    scope: 'project' | 'user';
+    source: string;
+    ref: string;
+    skillCount: number;
+}
+export interface UpdateResult {
+    updated: Array<{
+        name: string;
+        oldRef: string;
+        newRef: string;
+    }>;
+    unchanged: string[];
+    errors: Array<{
+        name: string;
+        error: string;
+    }>;
+}
+export declare class SkillInstaller {
+    private readonly opts;
+    private readonly manifest;
+    private readonly adapters;
+    constructor(opts: SkillInstallerOptions);
+    /**
+     * Install skills from a skill reference.
+     *
+     * Accepts two ref formats:
+     *   - `user/repo[@ref]`               — direct GitHub install (original path)
+     *   - `<adapterId>:<registryId>`      — registry-resolved (e.g.
+     *                                       `skills.sh:owner/repo@v1`); the
+     *                                       adapter resolves it to a `user/repo`
+     *                                       ref and the install proceeds as above.
+     *
+     * Supports both single-skill repos (SKILL.md at root) and multi-skill repos
+     * (skills/ subdirectory). The manifest records the GitHub source as
+     * `github:owner/repo` (so `/skill-update` keeps working) plus the originating
+     * registry in `registryFrom` when the install came through a registry.
+     */
+    install(refInput: string, opts?: {
+        global?: boolean | undefined;
+    }): Promise<InstallResult[]>;
+    /**
+     * Import skills from a local directory (e.g. `.claude/skills`) into the
+     * project or user skills dir, optionally as symlinks. Used by `/skill-import`
+     * to take ownership of foreign skills so they can be edited/committed.
+     * Each direct subdirectory containing a valid `SKILL.md` is copied verbatim.
+     */
+    importFromDir(srcDir: string, opts?: {
+        global?: boolean | undefined;
+        link?: boolean | undefined;
+    }): Promise<InstallResult[]>;
+    /**
+     * Update installed skills.
+     * - No args: update all
+     * - Name: update that specific skill
+     * - Name + newRef: update to a different ref
+     */
+    update(nameOrRef?: string | undefined, _opts?: {
+        global?: boolean | undefined;
+    } | undefined): Promise<UpdateResult>;
+    /**
+     * Uninstall a skill by name.
+     */
+    uninstall(name: string, opts?: {
+        global?: boolean | undefined;
+    }): Promise<void>;
+    /**
+     * List all installed skills from the manifest.
+     */
+    listInstalled(): Promise<InstalledSkillEntry[]>;
+    /**
+     * Search across all configured registry adapters. Results from each adapter
+     * are merged (deduplicated by `installRef`, adapters earlier in the list win
+     * conflicts). Adapters that don't support search (e.g. github-direct)
+     * contribute nothing.
+     */
+    search(query: string, opts?: RegistrySearchOptions): Promise<RegistrySearchResult[]>;
+    /**
+     * Detect skills in an extracted repository.
+     * Returns an array of detected skills with their files.
+     */
+    private detectSkills;
+    /**
+     * Remove all files for an installed skill.
+     */
+    private removeSkillFiles;
+    /**
+     * Invalidate the skill loader's cache so newly installed skills appear.
+     */
+    private invalidateLoaderCache;
+    /**
+     * Resolve an install ref, dispatching registry-prefixed refs to the matching
+     * adapter. Returns the concrete `user/repo[@ref]` install ref plus provenance
+     * (which adapter resolved it, if any).
+     */
+    private resolveRef;
+}
+//# sourceMappingURL=skill-installer.d.ts.map

package/dist/skills/skill-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installer.d.ts","sourceRoot":"","sources":["../../src/skills/skill-installer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMrD,OAAO,EAAE,KAAK,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAEnF,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAEpB,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,eAAe,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC,iCAAiC;IACjC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC1C;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,EAAE,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAElD,YAAY,IAAI,EAAE,qBAAqB,EAItC;IAED;;;;;;;;;;;;;;OAcG;IACG,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,GACtC,OAAO,CAAC,aAAa,EAAE,CAAC,CAiH1B;IAED;;;;;OAKG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,GAClE,OAAO,CAAC,aAAa,EAAE,CAAC,CAsF1B;IAED;;;;;OAKG;IACG,MAAM,CACV,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,GACnD,OAAO,CAAC,YAAY,CAAC,CAkFvB;IAED;;OAEG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBpF;IAED;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAEpD;IAED;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAkBzF;IAID;;;OAGG;YACW,YAAY;IAsD1B;;OAEG;YACW,gBAAgB;IAM9B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;OAIG;IACH,OAAO,CAAC,UAAU;CAuBnB"}

package/dist/storage/annotations-store.d.ts

@@ -0,0 +1,118 @@
+import type { EventBus } from '../kernel/events.js';
+/**
+ * L2-B: AnnotationsStore — sidecar storage for collaboration annotations
+ * (Phase 2 of idea #13 from IDEAS.md).
+ *
+ * Why a sidecar file, not the session JSONL?
+ *
+ *   The session log is an event-sourced append-only journal
+ *   (`packages/core/src/types/session.ts` invariant: events are
+ *   append-only, with `truncateToCheckpoint` only as an explicit
+ *   rewind). Mixing in human-typed annotations would break that
+ *   invariant — the user's note about "this rm looks dangerous"
+ *   is not part of the agent's event history; it is meta-commentary
+ *   on the history.
+ *
+ *   So we keep annotations in a sibling file: one JSON document per
+ *   session, resolved with `sessionScopedPath(sessionDir, sessionId,
+ *   '.annotations.json')`. The shape is a simple versioned array,
+ *   written atomically.
+ *
+ * Concurrency model:
+ *
+ *   The store uses a per-session Promise chain to serialize writes.
+ *   Multiple annotators adding notes at the same time will queue,
+ *   not race. The atomic write itself is the second line of
+ *   defense (in case the chain is bypassed — e.g. two processes
+ *   pointing at the same dir).
+ */
+/** Wire/storage shape for one annotation. */
+export interface Annotation {
+    /** Stable id (UUIDv4-ish). Referenced by resolve/delete. */
+    id: string;
+    /** Session this annotation belongs to. */
+    sessionId: string;
+    /** Index into the session event log the annotation refers to. */
+    atEventIndex: number;
+    /** Participant id of the annotator (matches WSCollabParticipantJoined.participantId). */
+    authorId: string;
+    /** Human-readable role label snapshot for display (e.g. "annotator"). */
+    authorRole: 'annotator';
+    /** The note itself. Trimmed, capped at `MAX_TEXT_LENGTH` on add. */
+    text: string;
+    /** ISO timestamp of creation. */
+    createdAt: string;
+    /** Resolved state. Annotations start unresolved. */
+    resolved: boolean;
+    /** ISO timestamp when resolved (if resolved). */
+    resolvedAt?: string | undefined;
+    /** Participant id of the resolver (if resolved). */
+    resolvedBy?: string | undefined;
+}
+export interface AnnotationsStoreOptions {
+    /** Root sessions directory used with `sessionScopedPath(..., '.annotations.json')`. */
+    dir: string;
+    events?: EventBus;
+    traceId?: string;
+    /**
+     * Override the max annotations per session (default 1000).
+     * Exposed for tests to avoid 1001 sequential disk writes on every eviction test.
+     */
+    maxAnnotations?: number;
+}
+export declare class AnnotationsStore {
+    private readonly dir;
+    private readonly events;
+    private readonly traceId;
+    private readonly maxAnnotations;
+    /** Per-session write queue. Created lazily on first add. */
+    private readonly writeChains;
+    constructor(opts: AnnotationsStoreOptions);
+    /**
+     * Return all annotations for `sessionId` in insertion order
+     * (oldest first). Returns an empty array when no file exists
+     * yet (the normal case for a fresh session) and also degrades
+     * gracefully to `[]` on a read error (permissions, corruption) —
+     * the failure is still surfaced via a `storage.read` event so it
+     * never silently hides I/O problems from observers.
+     */
+    list(sessionId: string): Promise<Annotation[]>;
+    /**
+     * Convenience: only unresolved annotations, newest first — the
+     * common UI rendering for "what still needs attention?".
+     */
+    listOpen(sessionId: string): Promise<Annotation[]>;
+    /**
+     * Add a new annotation. Returns the persisted record (with id
+     * and timestamps filled in). Throws when `text` is empty or
+     * exceeds `MAX_TEXT_LENGTH`.
+     */
+    add(input: {
+        sessionId: string;
+        atEventIndex: number;
+        authorId: string;
+        text: string;
+    }): Promise<Annotation>;
+    /**
+     * Mark an annotation as resolved. Returns the updated record, or
+     * `null` if no annotation with that id exists in this session.
+     * Idempotent: resolving an already-resolved annotation refreshes
+     * `resolvedAt` / `resolvedBy` to the latest call.
+     */
+    resolve(input: {
+        sessionId: string;
+        annotationId: string;
+        resolvedBy: string;
+    }): Promise<Annotation | null>;
+    private filePath;
+    private readFile;
+    private writeFile;
+    /**
+     * Serialize writes per-sessionId. We chain promises instead of
+     * using a Mutex class so the contract is obvious from the
+     * call-site: `enqueue(sid, fn)` runs `fn` after every prior
+     * enqueue for `sid` has settled.
+     */
+    private enqueue;
+}
+//# sourceMappingURL=annotations-store.d.ts.map

package/dist/storage/annotations-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotations-store.d.ts","sourceRoot":"","sources":["../../src/storage/annotations-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,UAAU,EAAE,WAAW,CAAC;IACxB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAeD,MAAM,WAAW,uBAAuB;IACtC,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAEhE,YAAY,IAAI,EAAE,uBAAuB,EAKxC;IAID;;;;;;;OAOG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CA6BnD;IAED;;;OAGG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAGvD;IAID;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,UAAU,CAAC,CAiGtB;IAED;;;;;OAKG;IACG,OAAO,CAAC,KAAK,EAAE;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAiD7B;IAID,OAAO,CAAC,QAAQ;YAOF,QAAQ;YAuBR,SAAS;IAKvB;;;;;OAKG;IACH,OAAO,CAAC,OAAO;CAWhB"}

package/dist/storage/attachment-store.d.ts

@@ -0,0 +1,31 @@
+import type { AddAttachmentInput, Attachment, AttachmentRef, AttachmentStore } from '../types/attachment.js';
+import type { ContentBlock } from '../types/blocks.js';
+export interface AttachmentStoreOptions {
+    /**
+     * Directory for spooling payloads larger than `spoolThresholdBytes`.
+     * When omitted, all payloads stay in memory.
+     */
+    spoolDir?: string | undefined;
+    spoolThresholdBytes?: number | undefined;
+}
+/**
+ * In-memory attachment store with optional disk spool. Placeholder syntax
+ * is `[<kind> #<seq>]` (seq-keyed) or `[file:<path>]` (path-keyed) where kind
+ * is `pasted` / `image` / `file`. Unknown placeholders are passed through
+ * as-is so users can write that literal text without losing it.
+ */
+export declare class DefaultAttachmentStore implements AttachmentStore {
+    private readonly items;
+    private readonly refs;
+    private nextSeq;
+    private readonly spoolDir;
+    private readonly spoolThreshold;
+    constructor(opts?: AttachmentStoreOptions);
+    add(input: AddAttachmentInput): Promise<AttachmentRef>;
+    get(id: string): Promise<Attachment | undefined>;
+    list(): AttachmentRef[];
+    expand(text: string): Promise<ContentBlock[]>;
+    clear(): Promise<void>;
+    private toBlock;
+}
+//# sourceMappingURL=attachment-store.d.ts.map

package/dist/storage/attachment-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-store.d.ts","sourceRoot":"","sources":["../../src/storage/attachment-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,kBAAkB,EAClB,UAAU,EAEV,aAAa,EACb,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAWD;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,eAAe;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,OAAO,CAAkE;IACjF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,YAAY,IAAI,GAAE,sBAA2B,EAG5C;IAEK,GAAG,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CA6B3D;IAEK,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAErD;IAED,IAAI,IAAI,aAAa,EAAE,CAEtB;IAEK,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA8BlD;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAa3B;YAEa,OAAO;CAkBtB"}