@xiashe/skill 0.1.2 → 0.1.4

package/bin/xiashe-skill.mjs

@@ -6,13 +6,13 @@ import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
-const VERSION = '0.1.2';
+const VERSION = '0.1.4';
 const COMMAND_NAME = process.env.XIASHE_SKILL_CLI_NAME || 'xiashe-skill';
 const PRODUCT_NAME = process.env.XIASHE_SKILL_PRODUCT_NAME || (COMMAND_NAME === 'agentpie-skill' ? 'AgentPie' : 'XiaShe');
 const REGISTRY_PROVIDER = process.env.XIASHE_SKILL_REGISTRY_PROVIDER || (COMMAND_NAME === 'agentpie-skill' ? 'agentpie' : 'xiashe');
 const DEFAULT_BASE_URL = process.env.XIASHE_SKILL_DEFAULT_BASE_URL || (COMMAND_NAME === 'agentpie-skill'
-  ? 'https://api.agentpie.app'
-  : 'https://api.xiashe.chat');
+  ? 'https://actions.agentpie.app'
+  : 'https://actions.xiashe.chat');
 const MANIFEST_FILE = process.env.XIASHE_SKILL_MANIFEST_FILE || (COMMAND_NAME === 'agentpie-skill'
   ? 'agentpie.skill.json'
   : 'xiashe.skill.json');
@@ -75,6 +75,8 @@ Options:
   --package-url <url>         Deprecated alias for --source-url.
   --out <path>                Output prompt or snippet file.
   --out-dir <path>            Output directory for setup artifacts. Defaults to ${WORK_DIR}/.
+  --embed-skill-md            Also write a clearly marked registry section into SKILL.md.
+  --no-skill-md               Do not write registry text into SKILL.md. Red hub embeds by default.
   --no-snippet                Setup should skip writing the runtime analytics snippet.
   --no-track                  Setup should skip sending upload_prompt_generated.
   --dry-run                   Print planned event payloads without network writes.
@@ -91,7 +93,7 @@ function fail(message, code = 1) {
 
 function parseArgs(argv) {
   const args = { _: [], json: false, dryRun: false };
-  const booleanFlags = new Set(['no-snippet', 'no-track']);
+  const booleanFlags = new Set(['embed-skill-md', 'no-skill-md', 'no-snippet', 'no-track']);
   for (let i = 0; i < argv.length; i += 1) {
     const value = argv[i];
     if (value === '--help' || value === '-h') {
@@ -442,6 +444,55 @@ function publicDisclosure(inspected, registryUrl) {
   ];
 }
 
+function skillMdRegistryBlock(inspected, hub) {
+  const registry = inspected.registry || {};
+  const registryUrl = registry.registryUrl || DEFAULT_REGISTRY_URL;
+  const publicToken = registry.publicToken || '<public token from registry manifest>';
+  const marker = `${REGISTRY_PROVIDER}-registry`;
+  return [
+    `<!-- ${marker}:start -->`,
+    `## ${PRODUCT_NAME} Registry / Analytics`,
+    '',
+    `This Skill is explicitly registered by its creator with ${PRODUCT_NAME} for public attribution and aggregated analytics.`,
+    '',
+    `- Registry provider: ${REGISTRY_PROVIDER}`,
+    `- Skill key: ${inspected.skillKey}`,
+    `- Target hub: ${hub}`,
+    `- Registry event endpoint: ${registryUrl}`,
+    `- Public write token: ${publicToken}`,
+    `- Event schema version: ${registry.eventSchemaVersion || EVENT_SCHEMA_VERSION}`,
+    `- Source fingerprint: ${inspected.package.sha256}`,
+    '',
+    'Analytics boundary:',
+    '- The public token can only submit allowed aggregate analytics events. It cannot read creator data or administer the account.',
+    '- Events should include only public metadata: hub, sourceSurface, campaign, scenario, anonymous installationId, invocationId, and status.',
+    '- Do not send user prompts, private files, credentials, environment variables, account tokens, raw business content, or personal identifiers.',
+    '- The creator can rotate/revoke the token or disable analytics from the dashboard.',
+    '',
+    'Recommended runtime events, if the target platform supports callbacks:',
+    '- `runtime_install_seen` when a stable anonymous installation is first observed.',
+    '- `skill_invoked` when a Skill invocation starts.',
+    '- `skill_completed` when an invocation completes.',
+    '- `skill_failed` when an invocation fails.',
+    '',
+    `<!-- ${marker}:end -->`
+  ].join('\n');
+}
+
+async function writeSkillMdRegistryBlock(root, inspected, hub) {
+  const skillMdPath = path.join(root, 'SKILL.md');
+  const existing = existsSync(skillMdPath)
+    ? await readFile(skillMdPath, 'utf8')
+    : `# ${inspected.name}\n\n${inspected.description || ''}\n`;
+  const block = skillMdRegistryBlock(inspected, hub);
+  const pattern = /<!-- (?:xiashe|agentpie)-registry:start -->[\s\S]*?<!-- (?:xiashe|agentpie)-registry:end -->/m;
+  const next = pattern.test(existing)
+    ? existing.replace(pattern, block)
+    : `${existing.trimEnd()}\n\n${block}\n`;
+  await writeFile(skillMdPath, next, { mode: 0o600 });
+  return skillMdPath;
+}
+
 async function readPlatformPrompt(flags) {
   const promptPath = normalizeText(flags['platform-prompt-file'], 1000);
   if (!promptPath) return '';
@@ -721,6 +772,10 @@ async function setupAgentWorkflow(root, flags) {
   const promptPath = path.join(outDir, `upload-${safeSkillKey(hub)}.md`);
   const promptResult = await writePrompt(absoluteRoot, { ...flags, hub, out: promptPath });
   const inspectedAfterManifest = await inspectSkill(absoluteRoot, flags);
+  const shouldEmbedSkillMd = Boolean(flags['embed-skill-md']) || (hub === 'red' && !flags['no-skill-md']);
+  const skillMdPath = shouldEmbedSkillMd
+    ? await writeSkillMdRegistryBlock(absoluteRoot, inspectedAfterManifest, hub)
+    : null;
   const disclosurePath = path.join(outDir, 'REGISTRY_DISCLOSURE.md');
   await writeFile(
     disclosurePath,
@@ -761,6 +816,7 @@ async function setupAgentWorkflow(root, flags) {
     hub,
     manifestPath: manifestResult.manifestPath,
     promptPath: typeof promptResult === 'string' ? promptPath : promptResult.outPath,
+    skillMdPath,
     disclosurePath,
     snippetPath: snippetResult ? snippetResult.outPath : null,
     promptEvent,
@@ -768,6 +824,9 @@ async function setupAgentWorkflow(root, flags) {
     next: [
       `Open ${path.relative(absoluteRoot, promptPath)} and merge it with the official ${hub} upload prompt/CLI flow.`,
       `If ${hub} provides its own upload prompt or CLI, treat that official flow as authoritative.`,
+      skillMdPath
+        ? `Registry disclosure was also embedded into ${path.relative(absoluteRoot, skillMdPath)} for restrictive hubs.`
+        : `If the hub rejects extra files, rerun with --embed-skill-md to place registry disclosure inside SKILL.md.`,
       `Use ${path.relative(absoluteRoot, disclosurePath)} as the read-only analytics disclosure for platform review.`,
       'Do not upload secrets, .env files, browser data, SSH keys, node_modules, dist, build, or unrelated local files.',
       `If the Skill is published, record the public URL with: ${COMMAND_NAME} track . --event hub_upload_succeeded --hub ${hub} --platform-skill-url <url>`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/skill",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
   "bin": {
     "xiashe-skill": "bin/xiashe-skill.mjs"