@wrongstack/core 0.310.1 → 0.313.1

package/dist/chunk-SN2DQRL6.js

@@ -0,0 +1,1172 @@
+import {
+  buildWin32CmdShimInvocation
+} from "./chunk-LHOA5DWA.js";
+import {
+  SKILL_LIMITS
+} from "./chunk-XEBHSJLT.js";
+import {
+  atomicWrite
+} from "./chunk-7ZHZE5EO.js";
+import {
+  isValidSkillNameFormat,
+  parseSkillFrontmatter,
+  validateSkillName
+} from "./chunk-WEBMSQP2.js";
+import {
+  ERROR_CODES,
+  FetchError,
+  FsError,
+  ParseError,
+  WrongStackError
+} from "./chunk-WOEZV3Q4.js";
+import {
+  toErrorMessage
+} from "./chunk-TBRL2RCC.js";
+import {
+  expectDefined
+} from "./chunk-PFZO3C6H.js";
+
+// src/skills/registry/github-direct-adapter.ts
+var githubDirectAdapter = {
+  id: "github",
+  displayName: "GitHub (direct)",
+  async search(_query, _opts = {}) {
+    return { adapterId: "github", results: [], hasMore: false };
+  },
+  resolveInstallRef(registryId) {
+    const trimmed = registryId.trim();
+    if (!trimmed.includes("/")) {
+      return trimmed;
+    }
+    return trimmed;
+  }
+};
+
+// src/skills/registry/skills-sh-adapter.ts
+var DEFAULT_SKILLS_SH_URL = "https://skills.sh";
+var SEARCH_TIMEOUT_MS = 15e3;
+var MAX_PAGE_SIZE = 50;
+var defaultFetcher = async (url) => {
+  let res;
+  try {
+    res = await fetch(url, {
+      signal: AbortSignal.timeout(SEARCH_TIMEOUT_MS),
+      headers: {
+        Accept: "application/json",
+        "User-Agent": "wrongstack-skill-installer"
+      },
+      redirect: "follow"
+    });
+  } catch (err) {
+    throw new FetchError({
+      message: `Network error querying skill registry: ${err instanceof Error ? err.message : String(err)}`,
+      status: 0,
+      context: { url, op: "skills.sh.search" },
+      cause: err
+    });
+  }
+  if (!res.ok) {
+    throw new FetchError({
+      message: `Skill registry returned ${res.status} ${res.statusText}`,
+      status: res.status,
+      context: { url, op: "skills.sh.search" }
+    });
+  }
+  try {
+    return await res.json();
+  } catch (err) {
+    throw new ParseError({
+      message: `Skill registry response was not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+      source: "skills.sh.search",
+      context: { url },
+      cause: err
+    });
+  }
+};
+function createSkillsShAdapter(opts = {}) {
+  const baseUrl = (opts.baseUrl ?? DEFAULT_SKILLS_SH_URL).replace(/\/+$/, "");
+  const fetcher = opts.fetcher ?? defaultFetcher;
+  const id = "skills.sh";
+  return {
+    id,
+    displayName: "skills.sh",
+    async search(query, sopts = {}) {
+      const page = Math.max(1, sopts.page ?? 1);
+      const pageSize = Math.min(MAX_PAGE_SIZE, Math.max(1, sopts.pageSize ?? 20));
+      const q = query.trim();
+      if (!q) return { adapterId: id, results: [], hasMore: false };
+      const url = `${baseUrl}/api/skills?query=${encodeURIComponent(q)}&page=${page}&pageSize=${pageSize}&sortBy=installs`;
+      const raw = await fetcher(url);
+      const results = parseResults(raw, url);
+      return {
+        adapterId: id,
+        results,
+        hasMore: results.length === pageSize
+      };
+    },
+    resolveInstallRef(registryId) {
+      const trimmed = registryId.trim();
+      if (!trimmed) {
+        throw new ParseError({
+          message: "Empty skills.sh registry id.",
+          source: "skills.sh.resolveInstallRef"
+        });
+      }
+      const atIdx = trimmed.indexOf("@");
+      const repoPart = atIdx > 0 ? trimmed.slice(0, atIdx) : trimmed;
+      const segs = repoPart.split("/").filter(Boolean);
+      if (segs.length !== 2) {
+        throw new ParseError({
+          message: `Invalid skills.sh id "${registryId}". Expected "<owner>/<repo>" or "<owner>/<repo>@<ref>".`,
+          source: "skills.sh.resolveInstallRef",
+          context: { registryId }
+        });
+      }
+      return trimmed;
+    }
+  };
+}
+function parseResults(raw, url) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new ParseError({
+      message: "Skill registry response was not a JSON object.",
+      source: "skills.sh.search",
+      context: { url }
+    });
+  }
+  const results = raw.results;
+  if (!Array.isArray(results)) {
+    return [];
+  }
+  const out = [];
+  for (let i = 0; i < results.length; i++) {
+    const entry = results[i];
+    if (!entry || typeof entry !== "object") continue;
+    const name = strField(entry, "name") ?? strField(entry, "slug");
+    const description = strField(entry, "description") ?? "";
+    const owner = strField(entry, "owner") ?? strField(entry, "author");
+    const repo = strField(entry, "repo") ?? strField(entry, "repository");
+    if (!name || !owner || !repo) continue;
+    const ref = strField(entry, "ref") ?? strField(entry, "branch") ?? strField(entry, "tag");
+    const installRef = ref ? `${owner}/${repo}@${ref}` : `${owner}/${repo}`;
+    out.push({
+      id: strField(entry, "id") ?? `${owner}/${repo}`,
+      name,
+      description,
+      author: owner,
+      installs: numField(entry, "installs") ?? numField(entry, "installCount"),
+      stars: numField(entry, "stars") ?? numField(entry, "starCount"),
+      securityScore: numField(entry, "securityScore") ?? numField(entry, "score"),
+      updatedAt: strField(entry, "updatedAt") ?? strField(entry, "updated_at"),
+      installRef
+    });
+  }
+  return out;
+}
+function strField(rec, key) {
+  const v = rec[key];
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function numField(rec, key) {
+  const v = rec[key];
+  if (typeof v === "number" && Number.isFinite(v)) return v;
+  if (typeof v === "string" && /^\d+(\.\d+)?$/.test(v.trim())) {
+    const n = Number(v);
+    if (Number.isFinite(n)) return n;
+  }
+  return void 0;
+}
+
+// src/skills/skill-generator.ts
+import { spawn } from "node:child_process";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+async function validateSkillNameAvailable(name, loader) {
+  const formatViolations = validateSkillName(name);
+  const conflicts = loader ? (await loader.listEntries()).filter((e) => e.name === name) : [];
+  const formatOk = formatViolations.length === 0;
+  const collisionBlocks = conflicts.some((c) => c.source === "project" || c.source === "user");
+  return {
+    ok: formatOk && !collisionBlocks,
+    formatViolations,
+    conflicts
+  };
+}
+function generateSkillSkeleton(opts) {
+  const name = opts.name.trim();
+  if (!isValidSkillNameFormat(name)) {
+    throw new WrongStackError({
+      message: `Cannot generate skeleton: invalid skill name "${name}". Names must be kebab-case (a-z0-9 and hyphens), \u226464 chars.`,
+      code: ERROR_CODES.VALIDATION_ERROR,
+      subsystem: "general",
+      context: { name }
+    });
+  }
+  const description = opts.description.trim();
+  const triggers = (opts.triggerKeywords ?? []).map((k) => k.trim()).filter(Boolean).map((k) => `"${k}"`).join(", ");
+  const triggerLine = triggers ? `
+  Triggers: user says ${triggers}.` : "";
+  const version = opts.version?.trim() || "1.0.0";
+  const title = name.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+  return `---
+name: ${name}
+description: |
+  ${description || `Use this skill when <trigger situation>.`}${triggerLine}
+version: ${version}
+---
+
+# ${title}
+
+## Overview
+
+${description || "One-line description of what this skill does."}
+
+## Rules
+
+1. Rule one
+2. Rule two
+
+## Patterns
+
+### Do
+
+\`\`\`ts
+// good example
+\`\`\`
+
+### Don't
+
+\`\`\`ts
+// bad example
+\`\`\`
+
+## Skills in scope
+
+- \`other-skill\` \u2014 for delegation when this skill needs help
+`;
+}
+function extractSkillFromPrompt(prompt) {
+  const text = prompt.trim();
+  if (!text) {
+    return { suggestedName: "", description: "", body: "", triggerKeywords: [] };
+  }
+  const headingMatch = text.match(/^#{1,6}\s+(.+?)\s*$/m);
+  const firstLine = text.split("\n").find((l) => l.trim().length > 0)?.trim() ?? text;
+  const titleSource = headingMatch?.[1] ?? firstLine.replace(/^#+\s*/, "");
+  const suggestedName = toKebab(titleSource).slice(0, SKILL_LIMITS.SKILL_NAME_MAX_LEN);
+  const paragraphs = text.split(/\n\s*\n/).map((p) => p.trim()).filter(Boolean);
+  const description = paragraphs[0]?.replace(/^#{1,6}\s+/m, "").trim() ?? titleSource;
+  const body = paragraphs.slice(1).join("\n\n");
+  const quoted = [...text.matchAll(/"([^"]{2,40})"/g)].map((m) => m[1]).filter((q) => typeof q === "string").map((q) => q.toLowerCase());
+  const titleWords = titleSource.split(/\W+/).map((w) => w.toLowerCase()).filter((w) => w.length > 3 && !STOPWORDS.has(w));
+  const triggerKeywords = dedupe([...quoted, ...titleWords]).slice(0, 8);
+  return { suggestedName, description, body, triggerKeywords };
+}
+async function openInEditor(filePath, env = process.env) {
+  const editor = env["VISUAL"]?.trim() && env["VISUAL"] || env["EDITOR"]?.trim() && env["EDITOR"] || defaultEditor();
+  if (!editor) {
+    throw new WrongStackError({
+      message: "No editor found. Set the EDITOR or VISUAL environment variable (e.g. `export EDITOR=code` or `export EDITOR=vim`).",
+      code: ERROR_CODES.VALIDATION_ERROR,
+      subsystem: "general",
+      context: { filePath }
+    });
+  }
+  const shell = process.platform === "win32";
+  const parts = editor.split(/\s+/).filter(Boolean);
+  if (parts.length === 0) {
+    throw new WrongStackError({
+      message: "Resolved editor command is empty.",
+      code: ERROR_CODES.VALIDATION_ERROR,
+      subsystem: "general",
+      context: { filePath }
+    });
+  }
+  const editorArgs = [...parts.slice(1), filePath];
+  const child = shell ? (() => {
+    const inv = buildWin32CmdShimInvocation(parts[0], editorArgs);
+    return spawn(inv.command, inv.args, {
+      stdio: "ignore",
+      detached: true,
+      windowsVerbatimArguments: inv.windowsVerbatimArguments,
+      // Suppresses the console flash the cmd.exe wrapper would otherwise
+      // show before the editor appears. Repo convention — see
+      // `core/tests/architecture/spawn-convention.test.ts`.
+      windowsHide: true
+    });
+  })() : spawn(parts[0], editorArgs, {
+    stdio: "ignore",
+    detached: true,
+    windowsHide: true
+  });
+  child.unref();
+}
+async function writeSkeletonSkill(skillsDir, body, opts = {}) {
+  const fm = parseSkillFrontmatter(body);
+  const name = fm.name;
+  if (!name || !isValidSkillNameFormat(name)) {
+    throw new WrongStackError({
+      message: "Skeleton body has no valid `name` in its frontmatter.",
+      code: ERROR_CODES.VALIDATION_ERROR,
+      subsystem: "general"
+    });
+  }
+  const skillDir = path.join(skillsDir, name);
+  const skillFile = path.join(skillDir, "SKILL.md");
+  if (!opts.overwrite) {
+    try {
+      await fs.access(skillFile);
+      throw new WrongStackError({
+        message: `A skill already exists at ${skillFile}. Use --force to overwrite.`,
+        code: ERROR_CODES.VALIDATION_ERROR,
+        subsystem: "general",
+        context: { skillFile }
+      });
+    } catch (err) {
+      if (err instanceof WrongStackError) throw err;
+    }
+  }
+  await fs.mkdir(skillDir, { recursive: true });
+  await fs.writeFile(skillFile, body, "utf8");
+  return skillFile;
+}
+function bodyLineAdvisory(body) {
+  const lines = body.split("\n").length;
+  return { lines, over: lines > SKILL_LIMITS.SKILL_BODY_LINE_LIMIT };
+}
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "and",
+  "for",
+  "with",
+  "that",
+  "this",
+  "from",
+  "your",
+  "have",
+  "will",
+  "are",
+  "was",
+  "were",
+  "been",
+  "into",
+  "when",
+  "use",
+  "skill",
+  "about"
+]);
+function toKebab(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, SKILL_LIMITS.SKILL_NAME_MAX_LEN) || "skill";
+}
+function dedupe(arr) {
+  return [...new Set(arr)];
+}
+function defaultEditor() {
+  if (process.platform === "win32") return "notepad";
+  if (process.platform === "darwin") return "open";
+  return void 0;
+}
+
+// src/skills/github-fetcher.ts
+import { createWriteStream } from "node:fs";
+import * as fs2 from "node:fs/promises";
+import * as os from "node:os";
+import * as path2 from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGunzip } from "node:zlib";
+function parseSkillRef(input) {
+  const trimmed = input.trim().replace(/^https?:\/\/github\.com\//, "").replace(/\.git$/, "");
+  const atIdx = trimmed.indexOf("@");
+  let refPath;
+  let ref;
+  if (atIdx > 0) {
+    refPath = trimmed.slice(0, atIdx);
+    ref = trimmed.slice(atIdx + 1);
+  } else {
+    refPath = trimmed;
+    ref = "main";
+  }
+  const parts = refPath.split("/").filter(Boolean);
+  if (parts.length < 2) {
+    throw new WrongStackError({
+      message: `Invalid skill reference "${input}". Expected format: user/repo or user/repo@ref`,
+      code: ERROR_CODES.UNKNOWN,
+      subsystem: "general",
+      context: { input }
+    });
+  }
+  return { owner: expectDefined(parts[0]), repo: expectDefined(parts[1]), ref };
+}
+async function writeBoundedGzipStream(source, outputPath, maxBytes, maxCompressedBytes = SKILL_LIMITS.MAX_TARBALL_SIZE) {
+  let compressedBytes = 0;
+  let writtenBytes = 0;
+  await pipeline(
+    source,
+    async function* (chunks) {
+      for await (const chunk of chunks) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        compressedBytes += buffer.byteLength;
+        if (compressedBytes > maxCompressedBytes) {
+          throw new WrongStackError({
+            message: `Compressed tarball too large. Max: ${maxCompressedBytes / 1024 / 1024}MB`,
+            code: ERROR_CODES.UNKNOWN,
+            subsystem: "general",
+            context: { compressedBytes, maxBytes: maxCompressedBytes }
+          });
+        }
+        yield buffer;
+      }
+    },
+    createGunzip(),
+    async function* (chunks) {
+      for await (const chunk of chunks) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        writtenBytes += buffer.byteLength;
+        if (writtenBytes > maxBytes) {
+          throw new WrongStackError({
+            message: `Uncompressed tarball too large. Max: ${maxBytes / 1024 / 1024}MB`,
+            code: ERROR_CODES.UNKNOWN,
+            subsystem: "general",
+            context: { uncompressedBytes: writtenBytes, maxBytes }
+          });
+        }
+        yield buffer;
+      }
+    },
+    createWriteStream(outputPath, { flags: "wx" })
+  );
+  return writtenBytes;
+}
+function resolveGitHubToken(env = process.env) {
+  const raw = env["WRONGSTACK_GITHUB_TOKEN"] ?? env["GITHUB_TOKEN"] ?? env["GH_TOKEN"];
+  if (!raw) return void 0;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+async function downloadGitHubTarball(parsed) {
+  const url = `https://api.github.com/repos/${parsed.owner}/${parsed.repo}/tarball/${parsed.ref}`;
+  const token = resolveGitHubToken();
+  const headers = {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "wrongstack-skill-installer"
+  };
+  if (token) headers["Authorization"] = `Bearer ${token}`;
+  let response;
+  try {
+    response = await fetch(url, {
+      signal: AbortSignal.timeout(3e4),
+      headers,
+      redirect: "follow"
+    });
+  } catch (err) {
+    throw new FetchError({
+      message: `Network error fetching ${parsed.owner}/${parsed.repo}: ${err instanceof Error ? err.message : String(err)}`,
+      status: 0,
+      context: { owner: parsed.owner, repo: parsed.repo, ref: parsed.ref, op: "tarball" },
+      cause: err
+    });
+  }
+  if (!response.ok) {
+    if (response.status === 404) {
+      throw new WrongStackError({
+        message: `Repository not found: ${parsed.owner}/${parsed.repo}` + (parsed.ref !== "main" ? ` (ref: ${parsed.ref})` : "") + (token ? "" : ". If this is a private repo, set GITHUB_TOKEN (or GH_TOKEN)."),
+        code: ERROR_CODES.UNKNOWN,
+        subsystem: "general",
+        context: { owner: parsed.owner, repo: parsed.repo, ref: parsed.ref, status: 404 }
+      });
+    }
+    if (response.status === 403) {
+      const remaining = response.headers.get("x-ratelimit-remaining");
+      const isRateLimited = remaining === "0";
+      throw new WrongStackError({
+        message: isRateLimited ? `GitHub API rate limit exceeded. Set GITHUB_TOKEN (or GH_TOKEN) to use the higher authenticated limit.` : `Access denied: ${parsed.owner}/${parsed.repo}. The repository may be private (set GITHUB_TOKEN to install private repos) or rate-limited.`,
+        code: ERROR_CODES.UNKNOWN,
+        subsystem: "general",
+        context: {
+          owner: parsed.owner,
+          repo: parsed.repo,
+          status: 403,
+          rateLimited: isRateLimited,
+          hasToken: Boolean(token)
+        }
+      });
+    }
+    throw new WrongStackError({
+      message: `GitHub API error (${response.status}): ${response.statusText}`,
+      code: ERROR_CODES.UNKNOWN,
+      subsystem: "general",
+      context: { owner: parsed.owner, repo: parsed.repo, status: response.status }
+    });
+  }
+  const contentLength = response.headers.get("content-length");
+  if (contentLength && Number.parseInt(contentLength, 10) > SKILL_LIMITS.MAX_TARBALL_SIZE) {
+    throw new WrongStackError({
+      message: `Tarball too large (${(Number.parseInt(contentLength, 10) / 1024 / 1024).toFixed(1)}MB). Max: ${SKILL_LIMITS.MAX_TARBALL_SIZE / 1024 / 1024}MB`,
+      code: ERROR_CODES.UNKNOWN,
+      subsystem: "general",
+      context: {
+        owner: parsed.owner,
+        repo: parsed.repo,
+        contentLengthBytes: Number.parseInt(contentLength, 10),
+        maxBytes: SKILL_LIMITS.MAX_TARBALL_SIZE
+      }
+    });
+  }
+  const tempDir = await fs2.mkdtemp(path2.join(os.tmpdir(), "wskill-"));
+  try {
+    if (!response.body) {
+      throw new WrongStackError({
+        message: "Empty response body from GitHub API",
+        code: ERROR_CODES.UNKNOWN,
+        subsystem: "general",
+        context: { owner: parsed.owner, repo: parsed.repo }
+      });
+    }
+    const nodeStream = Readable.fromWeb(response.body);
+    const tarPath = path2.join(tempDir, ".wrongstack-download.tar");
+    await writeBoundedGzipStream(nodeStream, tarPath, SKILL_LIMITS.MAX_UNCOMPRESSED_TARBALL_SIZE);
+    const tarBuf = await fs2.readFile(tarPath);
+    try {
+      await extractTar(tarBuf, tempDir);
+    } finally {
+      await fs2.rm(tarPath, { force: true });
+    }
+    return { tempDir };
+  } catch (err) {
+    await fs2.rm(tempDir, { recursive: true, force: true }).catch(() => {
+    });
+    throw err;
+  }
+}
+function readTarSize(buf, start) {
+  const first = buf[start] ?? 0;
+  if ((first & 128) !== 0) {
+    if (first === 255) {
+      throw new Error("tar: negative base-256 size field");
+    }
+    let value = first & 127;
+    for (let i = start + 1; i < start + 12; i++) {
+      value = value * 256 + (buf[i] ?? 0);
+      if (!Number.isSafeInteger(value)) {
+        throw new Error("tar: base-256 size exceeds the safe integer range");
+      }
+    }
+    return value;
+  }
+  const text = readTarString(buf, start, 12).trim();
+  if (text === "") return 0;
+  if (!/^[0-7]+$/.test(text)) {
+    throw new Error(`tar: unparseable size field ${JSON.stringify(text)}`);
+  }
+  const parsed = Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) {
+    throw new Error("tar: size field out of range");
+  }
+  return parsed;
+}
+function readTarString(buf, start, maxLen) {
+  let end = start;
+  while (end < start + maxLen && end < buf.length && buf[end] !== 0) {
+    end++;
+  }
+  return buf.subarray(start, end).toString("utf8");
+}
+function stripTopDir(p) {
+  const idx = p.indexOf("/");
+  if (idx === -1) return "";
+  return p.slice(idx + 1);
+}
+async function extractTar(buf, destDir) {
+  let offset = 0;
+  while (offset + 512 <= buf.length) {
+    const header = buf.subarray(offset, offset + 512);
+    if (header.every((b) => b === 0)) break;
+    const name = readTarString(buf, offset, 100);
+    const prefix = readTarString(buf, offset + 345, 155);
+    const size = readTarSize(buf, offset + 124);
+    const typeflag = buf[offset + 156] ?? 0;
+    const fullPath = prefix ? `${prefix}/${name}` : name;
+    const relPath = stripTopDir(fullPath);
+    if (relPath && relPath !== "." && relPath !== "..") {
+      const destPath = path2.join(destDir, relPath);
+      const resolvedDest = path2.resolve(destPath);
+      const resolvedRoot = path2.resolve(destDir);
+      if (resolvedDest !== resolvedRoot && !resolvedDest.startsWith(resolvedRoot + path2.sep)) {
+        offset += 512 + Math.ceil(size / 512) * 512;
+        continue;
+      }
+      if (typeflag === 53 || typeflag === 0) {
+        if (relPath.endsWith("/") || typeflag === 53) {
+          await fs2.mkdir(destPath, { recursive: true });
+        }
+      }
+      if ((typeflag === 48 || typeflag === 0 || typeflag === 0) && size > 0) {
+        const dir = path2.dirname(destPath);
+        await fs2.mkdir(dir, { recursive: true });
+        const dataStart = offset + 512;
+        const dataEnd = dataStart + size;
+        if (dataEnd > buf.length) break;
+        await fs2.writeFile(destPath, buf.subarray(dataStart, dataEnd));
+      }
+    }
+    offset += 512 + Math.ceil(size / 512) * 512;
+  }
+}
+
+// src/skills/manifest-store.ts
+import * as fs3 from "node:fs/promises";
+import * as path3 from "node:path";
+var SkillManifestStore = class {
+  manifestPath;
+  cache;
+  constructor(manifestPath) {
+    this.manifestPath = manifestPath;
+  }
+  async read() {
+    if (this.cache) return this.cache;
+    try {
+      const raw = await fs3.readFile(this.manifestPath, "utf8");
+      const data = JSON.parse(raw);
+      if (!Array.isArray(data.skills)) {
+        this.cache = { skills: [] };
+      } else {
+        this.cache = data;
+      }
+    } catch {
+      this.cache = { skills: [] };
+    }
+    return this.cache;
+  }
+  async write(data) {
+    const dir = path3.dirname(this.manifestPath);
+    await fs3.mkdir(dir, { recursive: true });
+    await atomicWrite(this.manifestPath, JSON.stringify(data, null, 2) + "\n");
+    this.cache = data;
+  }
+  async addEntry(entry) {
+    const data = await this.read();
+    data.skills = data.skills.filter((s) => !(s.name === entry.name && s.scope === entry.scope));
+    data.skills.push(entry);
+    await this.write(data);
+  }
+  async removeEntry(name, scope) {
+    const data = await this.read();
+    const before = data.skills.length;
+    data.skills = data.skills.filter((s) => !(s.name === name && s.scope === scope));
+    if (data.skills.length === before) return false;
+    await this.write(data);
+    return true;
+  }
+  async findByName(name) {
+    const data = await this.read();
+    return data.skills.filter((s) => s.name === name);
+  }
+  async findBySource(source) {
+    const data = await this.read();
+    return data.skills.filter((s) => s.source === source);
+  }
+  async listAll() {
+    const data = await this.read();
+    return data.skills;
+  }
+  /** Invalidate the in-memory cache (e.g. after external file changes). */
+  invalidateCache() {
+    this.cache = void 0;
+  }
+};
+
+// src/skills/skill-installer.ts
+import * as fs4 from "node:fs/promises";
+import * as path4 from "node:path";
+function isInside(resolved, destDir) {
+  const root = path4.resolve(destDir);
+  return resolved === root || resolved.startsWith(root + path4.sep);
+}
+var MAX_SKILL_FILE_SIZE = SKILL_LIMITS.MAX_SKILL_FILE_SIZE;
+var SkillInstaller = class {
+  opts;
+  manifest;
+  adapters;
+  constructor(opts) {
+    this.opts = opts;
+    this.manifest = new SkillManifestStore(opts.manifestPath);
+    this.adapters = opts.registryAdapters?.length ? opts.registryAdapters : [githubDirectAdapter];
+  }
+  /**
+   * Install skills from a skill reference.
+   *
+   * Accepts two ref formats:
+   *   - `user/repo[@ref]`               — direct GitHub install (original path)
+   *   - `<adapterId>:<registryId>`      — registry-resolved (e.g.
+   *                                       `skills.sh:owner/repo@v1`); the
+   *                                       adapter resolves it to a `user/repo`
+   *                                       ref and the install proceeds as above.
+   *
+   * Supports both single-skill repos (SKILL.md at root) and multi-skill repos
+   * (skills/ subdirectory). The manifest records the GitHub source as
+   * `github:owner/repo` (so `/skill-update` keeps working) plus the originating
+   * registry in `registryFrom` when the install came through a registry.
+   */
+  async install(refInput, opts) {
+    const resolved = this.resolveRef(refInput);
+    const parsed = parseSkillRef(resolved.installRef);
+    const scope = opts?.global ? "user" : "project";
+    const targetDir = scope === "project" ? this.opts.projectSkillsDir : this.opts.globalSkillsDir;
+    const source = `github:${parsed.owner}/${parsed.repo}`;
+    this.opts.log?.(
+      resolved.fromRegistry ? `Resolving ${refInput} \u2192 ${resolved.installRef} (${resolved.adapterId}), downloading...` : `Downloading ${parsed.owner}/${parsed.repo}@${parsed.ref}...`
+    );
+    const { tempDir } = await downloadGitHubTarball(parsed);
+    try {
+      const skills = await this.detectSkills(tempDir);
+      if (skills.length === 0) {
+        throw new WrongStackError({
+          message: "No skills found in repository. Expected SKILL.md at root or skills/ subdirectory.",
+          code: ERROR_CODES.VALIDATION_ERROR,
+          subsystem: "general",
+          context: { owner: parsed.owner, repo: parsed.repo, ref: parsed.ref }
+        });
+      }
+      const results = [];
+      for (const skill of skills) {
+        const existing = await this.manifest.findByName(skill.name);
+        const existingInScope = existing.find((e) => e.scope === scope);
+        if (existingInScope) {
+          this.opts.log?.(`Overwriting existing skill "${skill.name}" (${scope})...`);
+          await this.removeSkillFiles(skill.name, scope);
+        }
+        const destDir = path4.join(targetDir, skill.name);
+        await fs4.mkdir(destDir, { recursive: true });
+        const copiedFiles = [];
+        for (const file of skill.files) {
+          const srcPath = path4.join(skill.baseDir, file);
+          const destPath = path4.join(destDir, file);
+          const resolved2 = path4.resolve(destPath);
+          if (!isInside(resolved2, destDir)) {
+            throw new FsError({
+              message: `Path traversal detected in skill file: ${file}`,
+              code: ERROR_CODES.FS_DELETE_FAILED,
+              path: destPath,
+              context: { reason: "path_traversal", skillName: skill.name }
+            });
+          }
+          const stat2 = await fs4.stat(srcPath);
+          if (stat2.size > MAX_SKILL_FILE_SIZE) {
+            throw new FsError({
+              message: `Skill file "${file}" is too large (${(stat2.size / 1024).toFixed(1)}KB). Max: ${MAX_SKILL_FILE_SIZE / 1024}KB`,
+              code: ERROR_CODES.FS_WRITE_FAILED,
+              path: srcPath,
+              context: { skillName: skill.name, fileSize: stat2.size, maxSize: MAX_SKILL_FILE_SIZE }
+            });
+          }
+          await fs4.mkdir(path4.dirname(destPath), { recursive: true });
+          await fs4.copyFile(srcPath, destPath);
+          copiedFiles.push(file);
+        }
+        const entry = {
+          name: skill.name,
+          source,
+          ref: parsed.ref,
+          scope,
+          projectHash: scope === "project" ? this.opts.projectHash : void 0,
+          installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          files: copiedFiles,
+          // When the install came through a registry (e.g. skills.sh), record
+          // which adapter + registry id resolved to this GitHub repo, so the
+          // source is traceable. `source` stays `github:owner/repo` for
+          // backward compat with `/skill-update`.
+          ...resolved.fromRegistry ? { registryFrom: { adapterId: resolved.adapterId, registryId: resolved.registryId } } : {}
+        };
+        await this.manifest.addEntry(entry);
+        results.push({
+          name: skill.name,
+          path: destDir,
+          scope,
+          source,
+          ref: parsed.ref,
+          skillCount: 1
+        });
+      }
+      this.invalidateLoaderCache();
+      return results;
+    } finally {
+      await fs4.rm(tempDir, { recursive: true, force: true }).catch(() => {
+      });
+    }
+  }
+  /**
+   * Import skills from a local directory (e.g. `.claude/skills`) into the
+   * project or user skills dir, optionally as symlinks. Used by `/skill-import`
+   * to take ownership of foreign skills so they can be edited/committed.
+   * Each direct subdirectory containing a valid `SKILL.md` is copied verbatim.
+   */
+  async importFromDir(srcDir, opts) {
+    const scope = opts?.global ? "user" : "project";
+    const targetDir = scope === "project" ? this.opts.projectSkillsDir : this.opts.globalSkillsDir;
+    let entries;
+    try {
+      entries = await fs4.readdir(srcDir, { withFileTypes: true });
+    } catch {
+      throw new WrongStackError({
+        message: `Source directory not found or not readable: ${srcDir}`,
+        code: ERROR_CODES.VALIDATION_ERROR,
+        subsystem: "general",
+        context: { srcDir }
+      });
+    }
+    const results = [];
+    for (const e of entries) {
+      if (!await entryIsDirectory(srcDir, e)) continue;
+      const skillMdPath = path4.join(srcDir, e.name, "SKILL.md");
+      let content;
+      try {
+        content = await fs4.readFile(skillMdPath, "utf8");
+      } catch {
+        continue;
+      }
+      const fm = parseSkillFrontmatter(content);
+      if (!fm.name || !fm.description || !isValidSkillNameFormat(fm.name)) continue;
+      const existing = await this.manifest.findByName(fm.name);
+      if (existing.find((x) => x.scope === scope)) {
+        await this.removeSkillFiles(fm.name, scope);
+      }
+      const destDir = path4.join(targetDir, fm.name);
+      await fs4.mkdir(destDir, { recursive: true });
+      const srcSkillDir = path4.join(srcDir, e.name);
+      const files = await collectFiles(srcSkillDir, srcSkillDir);
+      const copiedFiles = [];
+      for (const file of files) {
+        const srcPath = path4.join(srcSkillDir, file);
+        const destPath = path4.join(destDir, file);
+        const resolved = path4.resolve(destPath);
+        if (!isInside(resolved, destDir)) {
+          throw new FsError({
+            message: `Path traversal detected in skill file: ${file}`,
+            code: ERROR_CODES.FS_DELETE_FAILED,
+            path: destPath,
+            context: { reason: "path_traversal", skillName: fm.name }
+          });
+        }
+        await fs4.mkdir(path4.dirname(destPath), { recursive: true });
+        if (opts?.link) {
+          try {
+            await fs4.symlink(srcPath, destPath);
+          } catch (err) {
+            await fs4.copyFile(srcPath, destPath);
+            this.opts.log?.(`symlink failed for ${file} (${toErrorMessage(err)}); copied instead`);
+          }
+        } else {
+          await fs4.copyFile(srcPath, destPath);
+        }
+        copiedFiles.push(file);
+      }
+      await this.manifest.addEntry({
+        name: fm.name,
+        source: `import:${srcDir}`,
+        ref: "-",
+        scope,
+        projectHash: scope === "project" ? this.opts.projectHash : void 0,
+        installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        files: copiedFiles
+      });
+      results.push({
+        name: fm.name,
+        path: destDir,
+        scope,
+        source: `import:${srcDir}`,
+        ref: "-",
+        skillCount: 1
+      });
+    }
+    this.invalidateLoaderCache();
+    return results;
+  }
+  /**
+   * Update installed skills.
+   * - No args: update all
+   * - Name: update that specific skill
+   * - Name + newRef: update to a different ref
+   */
+  async update(nameOrRef, _opts) {
+    const result = { updated: [], unchanged: [], errors: [] };
+    const allEntries = await this.manifest.listAll();
+    let targets;
+    if (nameOrRef) {
+      const byName = allEntries.filter((e) => e.name === nameOrRef);
+      if (byName.length > 0) {
+        targets = byName;
+      } else {
+        try {
+          const parsed = parseSkillRef(nameOrRef);
+          const source = `github:${parsed.owner}/${parsed.repo}`;
+          targets = allEntries.filter((e) => e.source === source);
+          if (targets.length === 0) {
+            result.errors.push({
+              name: nameOrRef,
+              error: `No installed skills found matching "${nameOrRef}"`
+            });
+            return result;
+          }
+        } catch {
+          result.errors.push({
+            name: nameOrRef,
+            error: `Invalid reference: ${nameOrRef}`
+          });
+          return result;
+        }
+      }
+    } else {
+      targets = allEntries;
+    }
+    const bySource = /* @__PURE__ */ new Map();
+    for (const entry of targets) {
+      const key = `${entry.source}@${entry.ref}`;
+      if (!bySource.has(key)) bySource.set(key, []);
+      bySource.get(key)?.push(entry);
+    }
+    for (const [, entries] of bySource) {
+      const first = expectDefined(entries[0]);
+      const scope = first.scope;
+      const isGlobal = scope === "user";
+      try {
+        const sourceRepo = first.source.replace("github:", "");
+        let refToInstall = first.ref;
+        if (nameOrRef && !allEntries.find((e) => e.name === nameOrRef)) {
+          try {
+            const parsed = parseSkillRef(nameOrRef);
+            refToInstall = parsed.ref;
+          } catch {
+          }
+        }
+        this.opts.log?.(`Updating ${first.source}@${refToInstall}...`);
+        const results = await this.install(`${sourceRepo}@${refToInstall}`, { global: isGlobal });
+        for (const r of results) {
+          result.updated.push({
+            name: r.name,
+            oldRef: first.ref,
+            newRef: refToInstall
+          });
+        }
+      } catch (err) {
+        const msg = toErrorMessage(err);
+        for (const entry of entries) {
+          result.errors.push({ name: entry.name, error: msg });
+        }
+      }
+    }
+    return result;
+  }
+  /**
+   * Uninstall a skill by name.
+   */
+  async uninstall(name, opts) {
+    const scope = opts?.global ? "user" : "project";
+    const entries = await this.manifest.findByName(name);
+    const entry = entries.find((e) => e.scope === scope);
+    if (!entry) {
+      throw new WrongStackError({
+        message: `Skill "${name}" is not installed${scope === "user" ? " (global)" : ""}.`,
+        code: ERROR_CODES.VALIDATION_ERROR,
+        subsystem: "general",
+        context: { skillName: name, scope }
+      });
+    }
+    await this.removeSkillFiles(name, scope);
+    await this.manifest.removeEntry(name, scope);
+    this.invalidateLoaderCache();
+  }
+  /**
+   * List all installed skills from the manifest.
+   */
+  async listInstalled() {
+    return this.manifest.listAll();
+  }
+  /**
+   * Search across all configured registry adapters. Results from each adapter
+   * are merged (deduplicated by `installRef`, adapters earlier in the list win
+   * conflicts). Adapters that don't support search (e.g. github-direct)
+   * contribute nothing.
+   */
+  async search(query, opts) {
+    const settled = await Promise.allSettled(this.adapters.map((a) => a.search(query, opts)));
+    const perAdapter = [];
+    const errors = [];
+    settled.forEach((s, i) => {
+      if (s.status === "fulfilled") perAdapter.push(s.value);
+      else {
+        const id = this.adapters[i]?.id ?? "?";
+        errors.push(`${id}: ${toErrorMessage(s.reason)}`);
+      }
+    });
+    if (errors.length > 0) {
+      this.opts.log?.(`Some registries failed during search: ${errors.join("; ")}`);
+    }
+    return dedupeSearchResults(perAdapter);
+  }
+  // ── Private helpers ──────────────────────────────────────────────
+  /**
+   * Detect skills in an extracted repository.
+   * Returns an array of detected skills with their files.
+   */
+  async detectSkills(baseDir) {
+    const results = [];
+    const rootSkillMd = path4.join(baseDir, "SKILL.md");
+    try {
+      await fs4.access(rootSkillMd);
+      const content = await fs4.readFile(rootSkillMd, "utf8");
+      const fm = parseSkillFrontmatter(content);
+      if (fm.name && fm.description && isValidSkillNameFormat(fm.name)) {
+        results.push({
+          name: fm.name,
+          baseDir,
+          files: ["SKILL.md"]
+        });
+        return results;
+      }
+    } catch {
+    }
+    const skillsDir = path4.join(baseDir, "skills");
+    try {
+      const entries = await fs4.readdir(skillsDir, { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue;
+        const skillFile = path4.join(skillsDir, entry.name, "SKILL.md");
+        try {
+          const content = await fs4.readFile(skillFile, "utf8");
+          const fm = parseSkillFrontmatter(content);
+          if (fm.name && fm.description && isValidSkillNameFormat(fm.name)) {
+            const skillDir = path4.join(skillsDir, entry.name);
+            const files = await collectFiles(skillDir, skillDir);
+            results.push({
+              name: fm.name,
+              baseDir: skillDir,
+              files
+            });
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+    return results;
+  }
+  /**
+   * Remove all files for an installed skill.
+   */
+  /**
+   * Delete an installed skill's directory.
+   *
+   * The containment check is not ceremonial: this is a `recursive: true,
+   * force: true` delete whose target is built from a skill NAME taken from
+   * manifest frontmatter. `path.join` normalises `..`, so a crafted name
+   * escapes `targetDir` and takes the recursive delete with it. This file
+   * already had `isInside` and applied it on the copy path but not here.
+   *
+   * The strict-subdirectory requirement matters separately: `isInside` allows
+   * equality by design, and an empty or `.` name resolves `skillDir` to
+   * `targetDir` itself — deleting every installed skill (WS-097).
+   */
+  async removeSkillFiles(name, scope) {
+    const targetDir = scope === "project" ? this.opts.projectSkillsDir : this.opts.globalSkillsDir;
+    const root = path4.resolve(targetDir);
+    const skillDir = path4.resolve(path4.join(targetDir, name));
+    if (skillDir === root || !isInside(skillDir, root)) {
+      throw new FsError({
+        message: `Refusing to delete skill files outside the skills directory: ${name}`,
+        code: ERROR_CODES.FS_DELETE_FAILED,
+        path: skillDir,
+        context: { reason: "path_traversal", skillName: name, scope }
+      });
+    }
+    await fs4.rm(skillDir, { recursive: true, force: true });
+  }
+  /**
+   * Invalidate the skill loader's cache so newly installed skills appear.
+   */
+  invalidateLoaderCache() {
+    const loader = this.opts.skillLoader;
+    if (loader && typeof loader.invalidateCache === "function") {
+      loader.invalidateCache();
+    }
+  }
+  /**
+   * Resolve an install ref, dispatching registry-prefixed refs to the matching
+   * adapter. Returns the concrete `user/repo[@ref]` install ref plus provenance
+   * (which adapter resolved it, if any).
+   */
+  resolveRef(refInput) {
+    const trimmed = refInput.trim();
+    const colonIdx = trimmed.indexOf(":");
+    if (colonIdx > 0) {
+      const maybeAdapterId = trimmed.slice(0, colonIdx);
+      const adapter = this.adapters.find((a) => a.id === maybeAdapterId);
+      if (adapter) {
+        const registryId = trimmed.slice(colonIdx + 1);
+        const installRef = adapter.resolveInstallRef(registryId);
+        return { installRef, fromRegistry: true, adapterId: adapter.id, registryId };
+      }
+    }
+    return { installRef: trimmed, fromRegistry: false, adapterId: "", registryId: "" };
+  }
+};
+async function entryIsDirectory(dir, entry) {
+  if (entry.isDirectory()) return true;
+  if (entry.isSymbolicLink()) {
+    try {
+      return (await fs4.stat(path4.join(dir, entry.name))).isDirectory();
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+async function collectFiles(dir, baseDir) {
+  const results = [];
+  const entries = await fs4.readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path4.join(dir, entry.name);
+    const relPath = path4.relative(baseDir, fullPath);
+    if (entry.isDirectory()) {
+      if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
+      results.push(...await collectFiles(fullPath, baseDir));
+    } else {
+      results.push(relPath);
+    }
+  }
+  return results;
+}
+function dedupeSearchResults(perAdapter) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const block of perAdapter) {
+    const kept = [];
+    for (const r of block.results) {
+      const key = r.installRef;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      kept.push(r);
+    }
+    if (kept.length > 0 || block.results.length > 0) {
+      out.push({ ...block, results: kept });
+    }
+  }
+  return out;
+}
+
+export {
+  githubDirectAdapter,
+  DEFAULT_SKILLS_SH_URL,
+  createSkillsShAdapter,
+  validateSkillNameAvailable,
+  generateSkillSkeleton,
+  extractSkillFromPrompt,
+  openInEditor,
+  writeSkeletonSkill,
+  bodyLineAdvisory,
+  parseSkillRef,
+  downloadGitHubTarball,
+  SkillManifestStore,
+  SkillInstaller
+};
+//# sourceMappingURL=chunk-SN2DQRL6.js.map