@xopcai/xopc 0.0.110 → 0.0.112

package/dist/src/agent/skills/filesystem-watcher.js

@@ -0,0 +1,182 @@
+import { resolveStateDir } from "../../config/paths-state.js";
+import { init_paths, resolveSkillsDir } from "../../config/paths.js";
+import { createLogger } from "../../utils/logger/index.js";
+import { init_logger } from "../../utils/logger.js";
+import { createSkillConfigManager } from "./config.js";
+import { isManagedSkillTransientDirName } from "./managed-store.js";
+import path from "node:path";
+import chokidar from "chokidar";
+//#region src/agent/skills/filesystem-watcher.ts
+init_paths();
+init_logger();
+const log = createLogger("SkillFilesystemWatcher");
+const DEFAULT_DEBOUNCE_MS = 1e3;
+const WATCH_DEPTH = 8;
+const IGNORED_SEGMENTS = new Set([
+	".git",
+	"node_modules",
+	"dist",
+	"build",
+	".next",
+	".nuxt",
+	".venv",
+	"venv",
+	"__pycache__",
+	".cache",
+	".mypy_cache",
+	".pytest_cache"
+]);
+function normalizePath(p) {
+	return path.resolve(p);
+}
+function pathSegments(p) {
+	return p.split(/[\\/]+/).filter(Boolean);
+}
+function hasIgnoredSegment(p) {
+	return pathSegments(p).some((segment) => IGNORED_SEGMENTS.has(segment) || isManagedSkillTransientDirName(segment));
+}
+function isSameOrInside(parent, child) {
+	const rel = path.relative(parent, child);
+	return rel === "" || !!rel && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function isWorkspaceSkillPath(workspaceRoot, candidate) {
+	const skillsRoot = path.join(workspaceRoot, "skills");
+	return candidate === workspaceRoot || isSameOrInside(skillsRoot, candidate);
+}
+function isWorkspaceSkillsRoot(workspaceRoot, candidate) {
+	return candidate === path.join(workspaceRoot, "skills");
+}
+function isSkillMdPath(candidate) {
+	return path.basename(candidate).toLowerCase() === "skill.md";
+}
+function readWatcherConfig() {
+	const cfg = createSkillConfigManager(resolveStateDir()).load();
+	const rawDebounce = cfg.load?.watchDebounceMs;
+	return {
+		enabled: cfg.load?.watch !== false,
+		debounceMs: typeof rawDebounce === "number" && Number.isFinite(rawDebounce) ? Math.max(0, rawDebounce) : DEFAULT_DEBOUNCE_MS
+	};
+}
+var SkillFilesystemWatcher = class {
+	targets = /* @__PURE__ */ new Map();
+	onChange;
+	disposed = false;
+	constructor(options) {
+		this.onChange = options.onChange;
+		this.watchGlobalSkillsDir();
+	}
+	watchGlobalSkillsDir() {
+		this.watchRoot(resolveSkillsDir(), "global");
+	}
+	watchWorkspace(workspaceDir) {
+		const resolved = normalizePath(workspaceDir);
+		if (!resolved) return;
+		this.watchRoot(resolved, "workspace");
+	}
+	refreshPrimaryWorkspace(workspaceDir) {
+		this.watchGlobalSkillsDir();
+		this.watchWorkspace(workspaceDir);
+	}
+	dispose() {
+		this.disposed = true;
+		for (const target of this.targets.values()) {
+			if (target.timer) clearTimeout(target.timer);
+			target.watcher.close().catch((err) => {
+				log.warn({
+					err,
+					root: target.root
+				}, "Skill watcher close failed");
+			});
+		}
+		this.targets.clear();
+	}
+	watchRoot(root, kind) {
+		if (this.disposed) return;
+		const { enabled, debounceMs } = readWatcherConfig();
+		const resolvedRoot = normalizePath(root);
+		const key = `${kind}:${resolvedRoot}`;
+		if (!enabled) {
+			this.unwatch(key);
+			return;
+		}
+		if (this.targets.get(key)) return;
+		const ignored = (watchPath, stats) => {
+			const candidate = normalizePath(watchPath);
+			if (candidate === resolvedRoot) return false;
+			if (hasIgnoredSegment(candidate)) return true;
+			if (kind === "workspace" && !isWorkspaceSkillPath(resolvedRoot, candidate)) return true;
+			if (kind === "workspace" && isWorkspaceSkillsRoot(resolvedRoot, candidate)) return false;
+			if (!stats) return false;
+			if (stats?.isDirectory?.()) return false;
+			return !isSkillMdPath(candidate);
+		};
+		const watcher = chokidar.watch(resolvedRoot, {
+			ignoreInitial: true,
+			followSymlinks: false,
+			depth: WATCH_DEPTH,
+			awaitWriteFinish: {
+				stabilityThreshold: debounceMs,
+				pollInterval: 100
+			},
+			ignored
+		});
+		const target = {
+			key,
+			root: resolvedRoot,
+			kind,
+			watcher
+		};
+		const schedule = (changedPath) => this.scheduleRefresh(target, changedPath);
+		watcher.on("addDir", schedule);
+		watcher.on("add", schedule);
+		watcher.on("change", schedule);
+		watcher.on("unlink", schedule);
+		watcher.on("unlinkDir", schedule);
+		watcher.on("error", (err) => {
+			log.warn({
+				err,
+				root: resolvedRoot,
+				kind
+			}, "Skill watcher error");
+		});
+		this.targets.set(key, target);
+		log.info({
+			root: resolvedRoot,
+			kind
+		}, "Watching skill filesystem");
+	}
+	unwatch(key) {
+		const target = this.targets.get(key);
+		if (!target) return;
+		if (target.timer) clearTimeout(target.timer);
+		target.watcher.close().catch((err) => {
+			log.warn({
+				err,
+				root: target.root
+			}, "Skill watcher close failed");
+		});
+		this.targets.delete(key);
+	}
+	scheduleRefresh(target, changedPath) {
+		const { enabled, debounceMs } = readWatcherConfig();
+		if (!enabled) {
+			this.unwatch(target.key);
+			return;
+		}
+		target.pendingPath = changedPath ?? target.pendingPath;
+		if (target.timer) clearTimeout(target.timer);
+		target.timer = setTimeout(() => {
+			target.timer = void 0;
+			const pendingPath = target.pendingPath;
+			target.pendingPath = void 0;
+			this.onChange({
+				reason: "watch",
+				changedPath: pendingPath
+			});
+		}, debounceMs);
+	}
+};
+//#endregion
+export { SkillFilesystemWatcher };
+
+//# sourceMappingURL=filesystem-watcher.js.map

package/dist/src/agent/skills/filesystem-watcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-watcher.js","names":[],"sources":["../../../../src/agent/skills/filesystem-watcher.ts"],"sourcesContent":["import path from 'node:path';\n\nimport chokidar, { type FSWatcher } from 'chokidar';\n\nimport { resolveSkillsDir, resolveStateDir } from '../../config/paths.js';\nimport { createLogger } from '../../utils/logger.js';\nimport { createSkillConfigManager } from './config.js';\nimport { isManagedSkillTransientDirName } from './managed-store.js';\n\nconst log = createLogger('SkillFilesystemWatcher');\n\nexport interface SkillFilesystemWatcherOptions {\n  onChange: (event: { reason: 'watch'; changedPath?: string }) => void;\n}\n\ntype WatchTarget = {\n  key: string;\n  root: string;\n  kind: 'global' | 'workspace';\n  watcher: FSWatcher;\n  timer?: NodeJS.Timeout;\n  pendingPath?: string;\n};\n\nconst DEFAULT_DEBOUNCE_MS = 1000;\nconst WATCH_DEPTH = 8;\nconst IGNORED_SEGMENTS = new Set([\n  '.git',\n  'node_modules',\n  'dist',\n  'build',\n  '.next',\n  '.nuxt',\n  '.venv',\n  'venv',\n  '__pycache__',\n  '.cache',\n  '.mypy_cache',\n  '.pytest_cache',\n]);\n\nfunction normalizePath(p: string): string {\n  return path.resolve(p);\n}\n\nfunction pathSegments(p: string): string[] {\n  return p.split(/[\\\\/]+/).filter(Boolean);\n}\n\nfunction hasIgnoredSegment(p: string): boolean {\n  return pathSegments(p).some(\n    (segment) => IGNORED_SEGMENTS.has(segment) || isManagedSkillTransientDirName(segment),\n  );\n}\n\nfunction isSameOrInside(parent: string, child: string): boolean {\n  const rel = path.relative(parent, child);\n  return rel === '' || (!!rel && !rel.startsWith('..') && !path.isAbsolute(rel));\n}\n\nfunction isWorkspaceSkillPath(workspaceRoot: string, candidate: string): boolean {\n  const skillsRoot = path.join(workspaceRoot, 'skills');\n  return candidate === workspaceRoot || isSameOrInside(skillsRoot, candidate);\n}\n\nfunction isWorkspaceSkillsRoot(workspaceRoot: string, candidate: string): boolean {\n  return candidate === path.join(workspaceRoot, 'skills');\n}\n\nfunction isSkillMdPath(candidate: string): boolean {\n  return path.basename(candidate).toLowerCase() === 'skill.md';\n}\n\nfunction readWatcherConfig(): { enabled: boolean; debounceMs: number } {\n  const cfg = createSkillConfigManager(resolveStateDir()).load();\n  const rawDebounce = cfg.load?.watchDebounceMs;\n  return {\n    enabled: cfg.load?.watch !== false,\n    debounceMs:\n      typeof rawDebounce === 'number' && Number.isFinite(rawDebounce)\n        ? Math.max(0, rawDebounce)\n        : DEFAULT_DEBOUNCE_MS,\n  };\n}\n\nexport class SkillFilesystemWatcher {\n  private readonly targets = new Map<string, WatchTarget>();\n  private readonly onChange: SkillFilesystemWatcherOptions['onChange'];\n  private disposed = false;\n\n  constructor(options: SkillFilesystemWatcherOptions) {\n    this.onChange = options.onChange;\n    this.watchGlobalSkillsDir();\n  }\n\n  watchGlobalSkillsDir(): void {\n    this.watchRoot(resolveSkillsDir(), 'global');\n  }\n\n  watchWorkspace(workspaceDir: string): void {\n    const resolved = normalizePath(workspaceDir);\n    if (!resolved) return;\n    this.watchRoot(resolved, 'workspace');\n  }\n\n  refreshPrimaryWorkspace(workspaceDir: string): void {\n    this.watchGlobalSkillsDir();\n    this.watchWorkspace(workspaceDir);\n  }\n\n  dispose(): void {\n    this.disposed = true;\n    for (const target of this.targets.values()) {\n      if (target.timer) clearTimeout(target.timer);\n      void target.watcher.close().catch((err) => {\n        log.warn({ err, root: target.root }, 'Skill watcher close failed');\n      });\n    }\n    this.targets.clear();\n  }\n\n  private watchRoot(root: string, kind: WatchTarget['kind']): void {\n    if (this.disposed) return;\n    const { enabled, debounceMs } = readWatcherConfig();\n    const resolvedRoot = normalizePath(root);\n    const key = `${kind}:${resolvedRoot}`;\n\n    if (!enabled) {\n      this.unwatch(key);\n      return;\n    }\n\n    const existing = this.targets.get(key);\n    if (existing) return;\n\n    const ignored = (watchPath: string, stats?: { isDirectory?: () => boolean }) => {\n      const candidate = normalizePath(watchPath);\n      if (candidate === resolvedRoot) return false;\n      if (hasIgnoredSegment(candidate)) return true;\n\n      if (kind === 'workspace' && !isWorkspaceSkillPath(resolvedRoot, candidate)) {\n        return true;\n      }\n\n      if (kind === 'workspace' && isWorkspaceSkillsRoot(resolvedRoot, candidate)) return false;\n      if (!stats) return false;\n      if (stats?.isDirectory?.()) return false;\n      return !isSkillMdPath(candidate);\n    };\n\n    const watcher = chokidar.watch(resolvedRoot, {\n      ignoreInitial: true,\n      followSymlinks: false,\n      depth: WATCH_DEPTH,\n      awaitWriteFinish: {\n        stabilityThreshold: debounceMs,\n        pollInterval: 100,\n      },\n      ignored,\n    });\n\n    const target: WatchTarget = { key, root: resolvedRoot, kind, watcher };\n    const schedule = (changedPath?: string) => this.scheduleRefresh(target, changedPath);\n\n    watcher.on('addDir', schedule);\n    watcher.on('add', schedule);\n    watcher.on('change', schedule);\n    watcher.on('unlink', schedule);\n    watcher.on('unlinkDir', schedule);\n    watcher.on('error', (err) => {\n      log.warn({ err, root: resolvedRoot, kind }, 'Skill watcher error');\n    });\n\n    this.targets.set(key, target);\n    log.info({ root: resolvedRoot, kind }, 'Watching skill filesystem');\n  }\n\n  private unwatch(key: string): void {\n    const target = this.targets.get(key);\n    if (!target) return;\n    if (target.timer) clearTimeout(target.timer);\n    void target.watcher.close().catch((err) => {\n      log.warn({ err, root: target.root }, 'Skill watcher close failed');\n    });\n    this.targets.delete(key);\n  }\n\n  private scheduleRefresh(target: WatchTarget, changedPath?: string): void {\n    const { enabled, debounceMs } = readWatcherConfig();\n    if (!enabled) {\n      this.unwatch(target.key);\n      return;\n    }\n\n    target.pendingPath = changedPath ?? target.pendingPath;\n    if (target.timer) clearTimeout(target.timer);\n    target.timer = setTimeout(() => {\n      target.timer = undefined;\n      const pendingPath = target.pendingPath;\n      target.pendingPath = undefined;\n      this.onChange({ reason: 'watch', changedPath: pendingPath });\n    }, debounceMs);\n  }\n}\n"],"mappings":";;;;;;;;;YAI0E;aACrB;AAIrD,MAAM,MAAM,aAAa,yBAAyB;AAelD,MAAM,sBAAsB;AAC5B,MAAM,cAAc;AACpB,MAAM,mBAAmB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAS,cAAc,GAAmB;AACxC,QAAO,KAAK,QAAQ,EAAE;;AAGxB,SAAS,aAAa,GAAqB;AACzC,QAAO,EAAE,MAAM,SAAS,CAAC,OAAO,QAAQ;;AAG1C,SAAS,kBAAkB,GAAoB;AAC7C,QAAO,aAAa,EAAE,CAAC,MACpB,YAAY,iBAAiB,IAAI,QAAQ,IAAI,+BAA+B,QAAQ,CACtF;;AAGH,SAAS,eAAe,QAAgB,OAAwB;CAC9D,MAAM,MAAM,KAAK,SAAS,QAAQ,MAAM;AACxC,QAAO,QAAQ,MAAO,CAAC,CAAC,OAAO,CAAC,IAAI,WAAW,KAAK,IAAI,CAAC,KAAK,WAAW,IAAI;;AAG/E,SAAS,qBAAqB,eAAuB,WAA4B;CAC/E,MAAM,aAAa,KAAK,KAAK,eAAe,SAAS;AACrD,QAAO,cAAc,iBAAiB,eAAe,YAAY,UAAU;;AAG7E,SAAS,sBAAsB,eAAuB,WAA4B;AAChF,QAAO,cAAc,KAAK,KAAK,eAAe,SAAS;;AAGzD,SAAS,cAAc,WAA4B;AACjD,QAAO,KAAK,SAAS,UAAU,CAAC,aAAa,KAAK;;AAGpD,SAAS,oBAA8D;CACrE,MAAM,MAAM,yBAAyB,iBAAiB,CAAC,CAAC,MAAM;CAC9D,MAAM,cAAc,IAAI,MAAM;AAC9B,QAAO;EACL,SAAS,IAAI,MAAM,UAAU;EAC7B,YACE,OAAO,gBAAgB,YAAY,OAAO,SAAS,YAAY,GAC3D,KAAK,IAAI,GAAG,YAAY,GACxB;EACP;;AAGH,IAAa,yBAAb,MAAoC;CAClC,0BAA2B,IAAI,KAA0B;CACzD;CACA,WAAmB;CAEnB,YAAY,SAAwC;AAClD,OAAK,WAAW,QAAQ;AACxB,OAAK,sBAAsB;;CAG7B,uBAA6B;AAC3B,OAAK,UAAU,kBAAkB,EAAE,SAAS;;CAG9C,eAAe,cAA4B;EACzC,MAAM,WAAW,cAAc,aAAa;AAC5C,MAAI,CAAC,SAAU;AACf,OAAK,UAAU,UAAU,YAAY;;CAGvC,wBAAwB,cAA4B;AAClD,OAAK,sBAAsB;AAC3B,OAAK,eAAe,aAAa;;CAGnC,UAAgB;AACd,OAAK,WAAW;AAChB,OAAK,MAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AAC1C,OAAI,OAAO,MAAO,cAAa,OAAO,MAAM;AACvC,UAAO,QAAQ,OAAO,CAAC,OAAO,QAAQ;AACzC,QAAI,KAAK;KAAE;KAAK,MAAM,OAAO;KAAM,EAAE,6BAA6B;KAClE;;AAEJ,OAAK,QAAQ,OAAO;;CAGtB,UAAkB,MAAc,MAAiC;AAC/D,MAAI,KAAK,SAAU;EACnB,MAAM,EAAE,SAAS,eAAe,mBAAmB;EACnD,MAAM,eAAe,cAAc,KAAK;EACxC,MAAM,MAAM,GAAG,KAAK,GAAG;AAEvB,MAAI,CAAC,SAAS;AACZ,QAAK,QAAQ,IAAI;AACjB;;AAIF,MADiB,KAAK,QAAQ,IAAI,IACtB,CAAE;EAEd,MAAM,WAAW,WAAmB,UAA4C;GAC9E,MAAM,YAAY,cAAc,UAAU;AAC1C,OAAI,cAAc,aAAc,QAAO;AACvC,OAAI,kBAAkB,UAAU,CAAE,QAAO;AAEzC,OAAI,SAAS,eAAe,CAAC,qBAAqB,cAAc,UAAU,CACxE,QAAO;AAGT,OAAI,SAAS,eAAe,sBAAsB,cAAc,UAAU,CAAE,QAAO;AACnF,OAAI,CAAC,MAAO,QAAO;AACnB,OAAI,OAAO,eAAe,CAAE,QAAO;AACnC,UAAO,CAAC,cAAc,UAAU;;EAGlC,MAAM,UAAU,SAAS,MAAM,cAAc;GAC3C,eAAe;GACf,gBAAgB;GAChB,OAAO;GACP,kBAAkB;IAChB,oBAAoB;IACpB,cAAc;IACf;GACD;GACD,CAAC;EAEF,MAAM,SAAsB;GAAE;GAAK,MAAM;GAAc;GAAM;GAAS;EACtE,MAAM,YAAY,gBAAyB,KAAK,gBAAgB,QAAQ,YAAY;AAEpF,UAAQ,GAAG,UAAU,SAAS;AAC9B,UAAQ,GAAG,OAAO,SAAS;AAC3B,UAAQ,GAAG,UAAU,SAAS;AAC9B,UAAQ,GAAG,UAAU,SAAS;AAC9B,UAAQ,GAAG,aAAa,SAAS;AACjC,UAAQ,GAAG,UAAU,QAAQ;AAC3B,OAAI,KAAK;IAAE;IAAK,MAAM;IAAc;IAAM,EAAE,sBAAsB;IAClE;AAEF,OAAK,QAAQ,IAAI,KAAK,OAAO;AAC7B,MAAI,KAAK;GAAE,MAAM;GAAc;GAAM,EAAE,4BAA4B;;CAGrE,QAAgB,KAAmB;EACjC,MAAM,SAAS,KAAK,QAAQ,IAAI,IAAI;AACpC,MAAI,CAAC,OAAQ;AACb,MAAI,OAAO,MAAO,cAAa,OAAO,MAAM;AACvC,SAAO,QAAQ,OAAO,CAAC,OAAO,QAAQ;AACzC,OAAI,KAAK;IAAE;IAAK,MAAM,OAAO;IAAM,EAAE,6BAA6B;IAClE;AACF,OAAK,QAAQ,OAAO,IAAI;;CAG1B,gBAAwB,QAAqB,aAA4B;EACvE,MAAM,EAAE,SAAS,eAAe,mBAAmB;AACnD,MAAI,CAAC,SAAS;AACZ,QAAK,QAAQ,OAAO,IAAI;AACxB;;AAGF,SAAO,cAAc,eAAe,OAAO;AAC3C,MAAI,OAAO,MAAO,cAAa,OAAO,MAAM;AAC5C,SAAO,QAAQ,iBAAiB;AAC9B,UAAO,QAAQ,KAAA;GACf,MAAM,cAAc,OAAO;AAC3B,UAAO,cAAc,KAAA;AACrB,QAAK,SAAS;IAAE,QAAQ;IAAS,aAAa;IAAa,CAAC;KAC3D,WAAW"}

package/dist/src/agent/skills/hub-hash.js

@@ -1,6 +1,6 @@
-import { join, relative } from "node:path";
-import { createReadStream, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
+import { createReadStream, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
 //#region src/agent/skills/hub-hash.ts
 /**
 * Deterministic content hash for a skill directory (for hub lock / drift detection).

package/dist/src/agent/skills/hub-lock.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/skills/hub-lock.ts
 /**

package/dist/src/agent/skills/hub-pull.js

@@ -1,12 +1,11 @@
-import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { getSkillsLockEntry, recordSkillsHubInstall } from "./hub-lock.js";
-import { installSkillFromZip, isValidSkillId } from "./managed-store.js";
+import { installSkillFromZip, isValidSkillId, prepareManagedSkillTempDir, promoteManagedSkillTempDir } from "./managed-store.js";
 import { computeSkillTreeHashSync } from "./hub-hash.js";
-import { tmpdir } from "node:os";
-import { basename, join, normalize, resolve, sep } from "node:path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, join, normalize, resolve } from "node:path";
+import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 import { fetch } from "undici";
@@ -14,7 +13,6 @@ import { fetch } from "undici";
 /**
 * CLI / hub: install or update skills from git or archive (zip / tar.gz) into ~/.xopc/skills.
 */
-init_paths();
 function classifyHubSource(raw) {
 	const s = raw.trim();
 	const lower = s.toLowerCase();
@@ -70,42 +68,38 @@ async function copySkillTreeToManaged(skillRoot, ctx) {
 	const targetId = ctx.skillId?.trim() || inferSkillIdFromSkillMd(skillRoot);
 	if (!targetId) throw new Error("Could not determine skill id: pass --id <name> (must match managed id rules)");
 	if (!isValidSkillId(targetId)) throw new Error(`Invalid skill id "${targetId}" (letters, digits, ._-; max 63 chars after first)`);
-	const rootDir = resolveSkillsDir();
-	mkdirSync(rootDir, { recursive: true });
-	const dest = join(rootDir, targetId);
-	const destResolved = resolve(dest);
-	const rootResolved = resolve(rootDir);
-	if (!destResolved.startsWith(rootResolved + sep) && destResolved !== rootResolved) throw new Error("Invalid destination path");
-	if (existsSync(dest)) {
-		if (!ctx.force) throw new Error(`Skill "${targetId}" already exists. Use --force to replace.`);
-		rmSync(dest, {
-			recursive: true,
-			force: true
+	const { destDir, tempDir } = prepareManagedSkillTempDir(targetId);
+	try {
+		if (existsSync(destDir) && !ctx.force) throw new Error(`Skill "${targetId}" already exists. Use --force to replace.`);
+		cpSync(skillRoot, tempDir, { recursive: true });
+		if (!existsSync(join(tempDir, "SKILL.md"))) throw new Error("Installed tree is missing SKILL.md");
+		await runScan(tempDir, ctx.strictScan);
+		const promoted = promoteManagedSkillTempDir({
+			skillId: targetId,
+			tempDir,
+			overwrite: ctx.force
 		});
-	}
-	cpSync(skillRoot, dest, { recursive: true });
-	if (!existsSync(join(dest, "SKILL.md"))) {
-		rmSync(dest, {
+		const hash = computeSkillTreeHashSync(promoted.path);
+		recordSkillsHubInstall(targetId, {
+			kind: ctx.kind,
+			source: ctx.source,
+			ref: ctx.kind === "git" ? ctx.ref : void 0,
+			subpath: ctx.kind === "git" ? ctx.subpath : void 0
+		}, hash);
+		return {
+			skillId: targetId,
+			path: promoted.path,
+			contentHash: hash,
+			kind: ctx.kind,
+			source: ctx.source
+		};
+	} catch (err) {
+		rmSync(tempDir, {
 			recursive: true,
 			force: true
 		});
-		throw new Error("Installed tree is missing SKILL.md");
+		throw err;
 	}
-	const hash = computeSkillTreeHashSync(dest);
-	recordSkillsHubInstall(targetId, {
-		kind: ctx.kind,
-		source: ctx.source,
-		ref: ctx.kind === "git" ? ctx.ref : void 0,
-		subpath: ctx.kind === "git" ? ctx.subpath : void 0
-	}, hash);
-	await runScan(dest, ctx.strictScan);
-	return {
-		skillId: targetId,
-		path: dest,
-		contentHash: hash,
-		kind: ctx.kind,
-		source: ctx.source
-	};
 }
 async function pullSkillFromZipBuffer(buf, sourceLabel, options) {
 	const r = installSkillFromZip(buf, {

package/dist/src/agent/skills/hub-pull.js.map

@@ -1 +1 @@
-{"version":3,"file":"hub-pull.js","names":[],"sources":["../../../../src/agent/skills/hub-pull.ts"],"sourcesContent":["/**\n * CLI / hub: install or update skills from git or archive (zip / tar.gz) into ~/.xopc/skills.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport {\n  cpSync,\n  existsSync,\n  mkdtempSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  rmSync,\n  statSync,\n  writeFileSync,\n} from 'node:fs';\nimport { basename, join, normalize, resolve, sep } from 'node:path';\nimport { tmpdir } from 'node:os';\nimport { fileURLToPath } from 'node:url';\n\nimport { fetch } from 'undici';\n\nimport { parseFrontmatter } from '../../markdown/frontmatter.js';\nimport { resolveSkillsDir } from '../../config/paths.js';\nimport { computeSkillTreeHashSync } from './hub-hash.js';\nimport { getSkillsLockEntry, recordSkillsHubInstall } from './hub-lock.js';\nimport type { SkillHubKind } from './hub-lock.js';\nimport { installSkillFromZip, isValidSkillId } from './managed-store.js';\nimport { formatScanSummary, scanSkillDirectory } from './scanner.js';\n\nexport interface HubPullOptions {\n  skillId?: string;\n  ref?: string;\n  subpath?: string;\n  force?: boolean;\n  /** When true, critical scanner findings fail the install. */\n  strictScan?: boolean;\n}\n\nexport interface HubPullResult {\n  skillId: string;\n  path: string;\n  contentHash: string;\n  kind: SkillHubKind;\n  source: string;\n}\n\nexport function classifyHubSource(raw: string): 'git' | 'archive' {\n  const s = raw.trim();\n  const lower = s.toLowerCase();\n\n  try {\n    if (s.startsWith('file:')) {\n      const p = fileURLToPath(s);\n      const pl = p.toLowerCase();\n      if (pl.endsWith('.zip')) return 'archive';\n      if (pl.endsWith('.tar.gz') || pl.endsWith('.tgz')) return 'archive';\n      return 'git';\n    }\n  } catch {\n    // ignore invalid file URL\n  }\n\n  if (/^[a-zA-Z]:[\\\\/]/.test(s) || (s.startsWith('/') && !s.startsWith('//'))) {\n    if (lower.endsWith('.zip')) return 'archive';\n    if (lower.endsWith('.tar.gz') || lower.endsWith('.tgz')) return 'archive';\n    return 'git';\n  }\n\n  try {\n    const u = new URL(s);\n    const path = u.pathname.toLowerCase();\n    if (path.endsWith('.zip')) return 'archive';\n    if (path.endsWith('.tar.gz') || path.endsWith('.tgz')) return 'archive';\n  } catch {\n    // not a URL\n  }\n\n  if (lower.endsWith('.zip')) return 'archive';\n  if (lower.endsWith('.tar.gz') || lower.endsWith('.tgz')) return 'archive';\n  return 'git';\n}\n\nexport function findSkillRoot(repoRoot: string, subpath?: string): string {\n  const sub = subpath?.trim()\n    ? normalize(subpath.trim()).replace(/^[/\\\\]+/, '')\n    : '';\n  const base = sub ? resolve(repoRoot, sub) : resolve(repoRoot);\n  if (!existsSync(base)) {\n    throw new Error(`Path not found in source: ${sub || '.'}`);\n  }\n  if (existsSync(join(base, 'SKILL.md'))) {\n    return base;\n  }\n  const entries = readdirSync(base, { withFileTypes: true }).filter((e) => e.isDirectory());\n  if (entries.length === 1) {\n    const one = join(base, entries[0].name);\n    if (existsSync(join(one, 'SKILL.md'))) {\n      return one;\n    }\n  }\n  throw new Error(\n    'Could not locate SKILL.md (expected at root, under --path, or in a single child folder)',\n  );\n}\n\nfunction inferSkillIdFromSkillMd(skillRoot: string): string {\n  const raw = readFileSync(join(skillRoot, 'SKILL.md'), 'utf-8');\n  const { frontmatter } = parseFrontmatter(raw);\n  const n = String(frontmatter.name || '').trim();\n  if (n && isValidSkillId(n)) {\n    return n;\n  }\n  const dirName = basename(skillRoot);\n  if (isValidSkillId(dirName)) {\n    return dirName;\n  }\n  return '';\n}\n\nasync function runScan(dir: string, strict: boolean | undefined): Promise<void> {\n  const summary = await scanSkillDirectory(dir);\n  const label = basename(dir);\n  if (summary.critical > 0 && strict) {\n    throw new Error(\n      `Security scan reported ${summary.critical} critical finding(s). ${formatScanSummary(summary, label)}`,\n    );\n  }\n  if (summary.critical > 0 || summary.warn > 0) {\n    console.warn(formatScanSummary(summary, label));\n  }\n}\n\nasync function copySkillTreeToManaged(\n  skillRoot: string,\n  ctx: HubPullOptions & { kind: SkillHubKind; source: string },\n): Promise<HubPullResult> {\n  const targetId = ctx.skillId?.trim() || inferSkillIdFromSkillMd(skillRoot);\n  if (!targetId) {\n    throw new Error('Could not determine skill id: pass --id <name> (must match managed id rules)');\n  }\n  if (!isValidSkillId(targetId)) {\n    throw new Error(`Invalid skill id \"${targetId}\" (letters, digits, ._-; max 63 chars after first)`);\n  }\n\n  const rootDir = resolveSkillsDir();\n  mkdirSync(rootDir, { recursive: true });\n  const dest = join(rootDir, targetId);\n  const destResolved = resolve(dest);\n  const rootResolved = resolve(rootDir);\n  if (!destResolved.startsWith(rootResolved + sep) && destResolved !== rootResolved) {\n    throw new Error('Invalid destination path');\n  }\n\n  if (existsSync(dest)) {\n    if (!ctx.force) {\n      throw new Error(`Skill \"${targetId}\" already exists. Use --force to replace.`);\n    }\n    rmSync(dest, { recursive: true, force: true });\n  }\n\n  cpSync(skillRoot, dest, { recursive: true });\n\n  if (!existsSync(join(dest, 'SKILL.md'))) {\n    rmSync(dest, { recursive: true, force: true });\n    throw new Error('Installed tree is missing SKILL.md');\n  }\n\n  const hash = computeSkillTreeHashSync(dest);\n  recordSkillsHubInstall(\n    targetId,\n    {\n      kind: ctx.kind,\n      source: ctx.source,\n      ref: ctx.kind === 'git' ? ctx.ref : undefined,\n      subpath: ctx.kind === 'git' ? ctx.subpath : undefined,\n    },\n    hash,\n  );\n  await runScan(dest, ctx.strictScan);\n\n  return {\n    skillId: targetId,\n    path: dest,\n    contentHash: hash,\n    kind: ctx.kind,\n    source: ctx.source,\n  };\n}\n\nasync function pullSkillFromZipBuffer(\n  buf: Buffer,\n  sourceLabel: string,\n  options: HubPullOptions,\n): Promise<HubPullResult> {\n  const r = installSkillFromZip(buf, {\n    skillId: options.skillId,\n    overwrite: options.force ?? false,\n  });\n  const hash = computeSkillTreeHashSync(r.path);\n  recordSkillsHubInstall(r.skillId, { kind: 'archive', source: sourceLabel }, hash);\n  await runScan(r.path, options.strictScan);\n  return {\n    skillId: r.skillId,\n    path: r.path,\n    contentHash: hash,\n    kind: 'archive',\n    source: sourceLabel,\n  };\n}\n\nasync function pullSkillFromTarFile(\n  archivePath: string,\n  sourceLabel: string,\n  options: HubPullOptions,\n): Promise<HubPullResult> {\n  const tmpRoot = mkdtempSync(join(tmpdir(), 'xopc-tar-'));\n  try {\n    execFileSync('tar', ['-xzf', archivePath, '-C', tmpRoot], {\n      stdio: 'pipe',\n      encoding: 'utf-8',\n    });\n    const skillRoot = findSkillRoot(tmpRoot);\n    return await copySkillTreeToManaged(skillRoot, { ...options, kind: 'archive', source: sourceLabel });\n  } finally {\n    rmSync(tmpRoot, { recursive: true, force: true });\n  }\n}\n\nasync function pullSkillFromLocalPath(absPath: string, options: HubPullOptions): Promise<HubPullResult> {\n  const resolved = resolve(absPath);\n  if (!existsSync(resolved)) {\n    throw new Error(`Not found: ${resolved}`);\n  }\n  const st = statSync(resolved);\n  if (!st.isFile()) {\n    throw new Error('Expected a path to a .zip or .tar.gz file (directories are not supported here)');\n  }\n  const lower = resolved.toLowerCase();\n  if (lower.endsWith('.zip')) {\n    const buf = readFileSync(resolved);\n    return pullSkillFromZipBuffer(buf, resolved, options);\n  }\n  if (lower.endsWith('.tar.gz') || lower.endsWith('.tgz')) {\n    return pullSkillFromTarFile(resolved, resolved, options);\n  }\n  throw new Error('Unsupported file type (expected .zip, .tar.gz, or .tgz)');\n}\n\nasync function pullSkillFromGit(url: string, options: HubPullOptions): Promise<HubPullResult> {\n  const tmpRoot = mkdtempSync(join(tmpdir(), 'xopc-hub-'));\n  const cloneDir = join(tmpRoot, 'clone');\n  try {\n    const args = ['clone', '--depth', '1'];\n    if (options.ref?.trim()) {\n      args.push('--branch', options.ref.trim());\n    }\n    args.push(url, cloneDir);\n    try {\n      execFileSync('git', args, { stdio: 'pipe', encoding: 'utf-8' });\n    } catch {\n      if (options.ref?.trim()) {\n        execFileSync('git', ['clone', '--depth', '1', url, cloneDir], {\n          stdio: 'pipe',\n          encoding: 'utf-8',\n        });\n      } else {\n        throw new Error(`git clone failed for ${url}`);\n      }\n    }\n    const skillRoot = findSkillRoot(cloneDir, options.subpath);\n    return await copySkillTreeToManaged(skillRoot, { ...options, kind: 'git', source: url });\n  } catch (e) {\n    const msg = e instanceof Error ? e.message : String(e);\n    if (msg.includes('ENOENT') || msg.includes('git clone failed')) {\n      throw new Error(\n        `Git operation failed (${msg}). Ensure git is installed and the repository URL is valid.`,\n      );\n    }\n    throw e;\n  } finally {\n    rmSync(tmpRoot, { recursive: true, force: true });\n  }\n}\n\n/**\n * Install or replace a skill from a git URL, http(s) archive URL, file:// URL, or local archive path.\n */\nexport async function pullSkillFromSource(\n  source: string,\n  options: HubPullOptions = {},\n): Promise<HubPullResult> {\n  const trimmed = source.trim();\n  if (!trimmed) {\n    throw new Error('Missing source URL or path');\n  }\n\n  if (trimmed.startsWith('file:')) {\n    return pullSkillFromLocalPath(fileURLToPath(trimmed), options);\n  }\n\n  if (!/^[a-zA-Z][a-zA-Z+.-]*:\\/\\//.test(trimmed) && existsSync(trimmed)) {\n    return pullSkillFromLocalPath(resolve(trimmed), options);\n  }\n\n  const kind = classifyHubSource(trimmed);\n  if (kind === 'archive') {\n    const res = await fetch(trimmed);\n    if (!res.ok) {\n      throw new Error(`HTTP ${res.status} while fetching archive`);\n    }\n    const buf = Buffer.from(await res.arrayBuffer());\n    const lower = trimmed.toLowerCase();\n    if (lower.endsWith('.tar.gz') || lower.endsWith('.tgz')) {\n      const tmpRoot = mkdtempSync(join(tmpdir(), 'xopc-fetch-tar-'));\n      const f = join(tmpRoot, 'archive.tgz');\n      try {\n        mkdirSync(tmpRoot, { recursive: true });\n        writeFileSync(f, buf);\n        return await pullSkillFromTarFile(f, trimmed, options);\n      } finally {\n        rmSync(tmpRoot, { recursive: true, force: true });\n      }\n    }\n    return pullSkillFromZipBuffer(buf, trimmed, options);\n  }\n\n  return pullSkillFromGit(trimmed, options);\n}\n\n/** Re-install from the source recorded in ~/.xopc/skills-lock.json for this skill id. */\nexport async function updateSkillFromLock(\n  skillId: string,\n  options: Pick<HubPullOptions, 'strictScan'> = {},\n): Promise<HubPullResult> {\n  const e = getSkillsLockEntry(skillId);\n  if (!e) {\n    throw new Error(\n      `No hub lock entry for \"${skillId}\". Install with: xopc skills pull <git-or-archive-url>`,\n    );\n  }\n  return pullSkillFromSource(e.source, {\n    skillId,\n    ref: e.ref,\n    subpath: e.subpath,\n    force: true,\n    strictScan: options.strictScan,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;YAuByD;AAwBzD,SAAgB,kBAAkB,KAAgC;CAChE,MAAM,IAAI,IAAI,MAAM;CACpB,MAAM,QAAQ,EAAE,aAAa;AAE7B,KAAI;AACF,MAAI,EAAE,WAAW,QAAQ,EAAE;GAEzB,MAAM,KADI,cAAc,EACZ,CAAC,aAAa;AAC1B,OAAI,GAAG,SAAS,OAAO,CAAE,QAAO;AAChC,OAAI,GAAG,SAAS,UAAU,IAAI,GAAG,SAAS,OAAO,CAAE,QAAO;AAC1D,UAAO;;SAEH;AAIR,KAAI,kBAAkB,KAAK,EAAE,IAAK,EAAE,WAAW,IAAI,IAAI,CAAC,EAAE,WAAW,KAAK,EAAG;AAC3E,MAAI,MAAM,SAAS,OAAO,CAAE,QAAO;AACnC,MAAI,MAAM,SAAS,UAAU,IAAI,MAAM,SAAS,OAAO,CAAE,QAAO;AAChE,SAAO;;AAGT,KAAI;EAEF,MAAM,OAAO,IADC,IAAI,EACJ,CAAC,SAAS,aAAa;AACrC,MAAI,KAAK,SAAS,OAAO,CAAE,QAAO;AAClC,MAAI,KAAK,SAAS,UAAU,IAAI,KAAK,SAAS,OAAO,CAAE,QAAO;SACxD;AAIR,KAAI,MAAM,SAAS,OAAO,CAAE,QAAO;AACnC,KAAI,MAAM,SAAS,UAAU,IAAI,MAAM,SAAS,OAAO,CAAE,QAAO;AAChE,QAAO;;AAGT,SAAgB,cAAc,UAAkB,SAA0B;CACxE,MAAM,MAAM,SAAS,MAAM,GACvB,UAAU,QAAQ,MAAM,CAAC,CAAC,QAAQ,WAAW,GAAG,GAChD;CACJ,MAAM,OAAO,MAAM,QAAQ,UAAU,IAAI,GAAG,QAAQ,SAAS;AAC7D,KAAI,CAAC,WAAW,KAAK,CACnB,OAAM,IAAI,MAAM,6BAA6B,OAAO,MAAM;AAE5D,KAAI,WAAW,KAAK,MAAM,WAAW,CAAC,CACpC,QAAO;CAET,MAAM,UAAU,YAAY,MAAM,EAAE,eAAe,MAAM,CAAC,CAAC,QAAQ,MAAM,EAAE,aAAa,CAAC;AACzF,KAAI,QAAQ,WAAW,GAAG;EACxB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAG,KAAK;AACvC,MAAI,WAAW,KAAK,KAAK,WAAW,CAAC,CACnC,QAAO;;AAGX,OAAM,IAAI,MACR,0FACD;;AAGH,SAAS,wBAAwB,WAA2B;CAE1D,MAAM,EAAE,gBAAgB,iBADZ,aAAa,KAAK,WAAW,WAAW,EAAE,QACV,CAAC;CAC7C,MAAM,IAAI,OAAO,YAAY,QAAQ,GAAG,CAAC,MAAM;AAC/C,KAAI,KAAK,eAAe,EAAE,CACxB,QAAO;CAET,MAAM,UAAU,SAAS,UAAU;AACnC,KAAI,eAAe,QAAQ,CACzB,QAAO;AAET,QAAO;;AAGT,eAAe,QAAQ,KAAa,QAA4C;CAC9E,MAAM,UAAU,MAAM,mBAAmB,IAAI;CAC7C,MAAM,QAAQ,SAAS,IAAI;AAC3B,KAAI,QAAQ,WAAW,KAAK,OAC1B,OAAM,IAAI,MACR,0BAA0B,QAAQ,SAAS,wBAAwB,kBAAkB,SAAS,MAAM,GACrG;AAEH,KAAI,QAAQ,WAAW,KAAK,QAAQ,OAAO,EACzC,SAAQ,KAAK,kBAAkB,SAAS,MAAM,CAAC;;AAInD,eAAe,uBACb,WACA,KACwB;CACxB,MAAM,WAAW,IAAI,SAAS,MAAM,IAAI,wBAAwB,UAAU;AAC1E,KAAI,CAAC,SACH,OAAM,IAAI,MAAM,+EAA+E;AAEjG,KAAI,CAAC,eAAe,SAAS,CAC3B,OAAM,IAAI,MAAM,qBAAqB,SAAS,oDAAoD;CAGpG,MAAM,UAAU,kBAAkB;AAClC,WAAU,SAAS,EAAE,WAAW,MAAM,CAAC;CACvC,MAAM,OAAO,KAAK,SAAS,SAAS;CACpC,MAAM,eAAe,QAAQ,KAAK;CAClC,MAAM,eAAe,QAAQ,QAAQ;AACrC,KAAI,CAAC,aAAa,WAAW,eAAe,IAAI,IAAI,iBAAiB,aACnE,OAAM,IAAI,MAAM,2BAA2B;AAG7C,KAAI,WAAW,KAAK,EAAE;AACpB,MAAI,CAAC,IAAI,MACP,OAAM,IAAI,MAAM,UAAU,SAAS,2CAA2C;AAEhF,SAAO,MAAM;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;;AAGhD,QAAO,WAAW,MAAM,EAAE,WAAW,MAAM,CAAC;AAE5C,KAAI,CAAC,WAAW,KAAK,MAAM,WAAW,CAAC,EAAE;AACvC,SAAO,MAAM;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;AAC9C,QAAM,IAAI,MAAM,qCAAqC;;CAGvD,MAAM,OAAO,yBAAyB,KAAK;AAC3C,wBACE,UACA;EACE,MAAM,IAAI;EACV,QAAQ,IAAI;EACZ,KAAK,IAAI,SAAS,QAAQ,IAAI,MAAM,KAAA;EACpC,SAAS,IAAI,SAAS,QAAQ,IAAI,UAAU,KAAA;EAC7C,EACD,KACD;AACD,OAAM,QAAQ,MAAM,IAAI,WAAW;AAEnC,QAAO;EACL,SAAS;EACT,MAAM;EACN,aAAa;EACb,MAAM,IAAI;EACV,QAAQ,IAAI;EACb;;AAGH,eAAe,uBACb,KACA,aACA,SACwB;CACxB,MAAM,IAAI,oBAAoB,KAAK;EACjC,SAAS,QAAQ;EACjB,WAAW,QAAQ,SAAS;EAC7B,CAAC;CACF,MAAM,OAAO,yBAAyB,EAAE,KAAK;AAC7C,wBAAuB,EAAE,SAAS;EAAE,MAAM;EAAW,QAAQ;EAAa,EAAE,KAAK;AACjF,OAAM,QAAQ,EAAE,MAAM,QAAQ,WAAW;AACzC,QAAO;EACL,SAAS,EAAE;EACX,MAAM,EAAE;EACR,aAAa;EACb,MAAM;EACN,QAAQ;EACT;;AAGH,eAAe,qBACb,aACA,aACA,SACwB;CACxB,MAAM,UAAU,YAAY,KAAK,QAAQ,EAAE,YAAY,CAAC;AACxD,KAAI;AACF,eAAa,OAAO;GAAC;GAAQ;GAAa;GAAM;GAAQ,EAAE;GACxD,OAAO;GACP,UAAU;GACX,CAAC;AAEF,SAAO,MAAM,uBADK,cAAc,QACa,EAAE;GAAE,GAAG;GAAS,MAAM;GAAW,QAAQ;GAAa,CAAC;WAC5F;AACR,SAAO,SAAS;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;;;AAIrD,eAAe,uBAAuB,SAAiB,SAAiD;CACtG,MAAM,WAAW,QAAQ,QAAQ;AACjC,KAAI,CAAC,WAAW,SAAS,CACvB,OAAM,IAAI,MAAM,cAAc,WAAW;AAG3C,KAAI,CADO,SAAS,SACb,CAAC,QAAQ,CACd,OAAM,IAAI,MAAM,iFAAiF;CAEnG,MAAM,QAAQ,SAAS,aAAa;AACpC,KAAI,MAAM,SAAS,OAAO,CAExB,QAAO,uBADK,aAAa,SACQ,EAAE,UAAU,QAAQ;AAEvD,KAAI,MAAM,SAAS,UAAU,IAAI,MAAM,SAAS,OAAO,CACrD,QAAO,qBAAqB,UAAU,UAAU,QAAQ;AAE1D,OAAM,IAAI,MAAM,0DAA0D;;AAG5E,eAAe,iBAAiB,KAAa,SAAiD;CAC5F,MAAM,UAAU,YAAY,KAAK,QAAQ,EAAE,YAAY,CAAC;CACxD,MAAM,WAAW,KAAK,SAAS,QAAQ;AACvC,KAAI;EACF,MAAM,OAAO;GAAC;GAAS;GAAW;GAAI;AACtC,MAAI,QAAQ,KAAK,MAAM,CACrB,MAAK,KAAK,YAAY,QAAQ,IAAI,MAAM,CAAC;AAE3C,OAAK,KAAK,KAAK,SAAS;AACxB,MAAI;AACF,gBAAa,OAAO,MAAM;IAAE,OAAO;IAAQ,UAAU;IAAS,CAAC;UACzD;AACN,OAAI,QAAQ,KAAK,MAAM,CACrB,cAAa,OAAO;IAAC;IAAS;IAAW;IAAK;IAAK;IAAS,EAAE;IAC5D,OAAO;IACP,UAAU;IACX,CAAC;OAEF,OAAM,IAAI,MAAM,wBAAwB,MAAM;;AAIlD,SAAO,MAAM,uBADK,cAAc,UAAU,QAAQ,QACL,EAAE;GAAE,GAAG;GAAS,MAAM;GAAO,QAAQ;GAAK,CAAC;UACjF,GAAG;EACV,MAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;AACtD,MAAI,IAAI,SAAS,SAAS,IAAI,IAAI,SAAS,mBAAmB,CAC5D,OAAM,IAAI,MACR,yBAAyB,IAAI,6DAC9B;AAEH,QAAM;WACE;AACR,SAAO,SAAS;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;;;;;;AAOrD,eAAsB,oBACpB,QACA,UAA0B,EAAE,EACJ;CACxB,MAAM,UAAU,OAAO,MAAM;AAC7B,KAAI,CAAC,QACH,OAAM,IAAI,MAAM,6BAA6B;AAG/C,KAAI,QAAQ,WAAW,QAAQ,CAC7B,QAAO,uBAAuB,cAAc,QAAQ,EAAE,QAAQ;AAGhE,KAAI,CAAC,6BAA6B,KAAK,QAAQ,IAAI,WAAW,QAAQ,CACpE,QAAO,uBAAuB,QAAQ,QAAQ,EAAE,QAAQ;AAI1D,KADa,kBAAkB,QACvB,KAAK,WAAW;EACtB,MAAM,MAAM,MAAM,MAAM,QAAQ;AAChC,MAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,QAAQ,IAAI,OAAO,yBAAyB;EAE9D,MAAM,MAAM,OAAO,KAAK,MAAM,IAAI,aAAa,CAAC;EAChD,MAAM,QAAQ,QAAQ,aAAa;AACnC,MAAI,MAAM,SAAS,UAAU,IAAI,MAAM,SAAS,OAAO,EAAE;GACvD,MAAM,UAAU,YAAY,KAAK,QAAQ,EAAE,kBAAkB,CAAC;GAC9D,MAAM,IAAI,KAAK,SAAS,cAAc;AACtC,OAAI;AACF,cAAU,SAAS,EAAE,WAAW,MAAM,CAAC;AACvC,kBAAc,GAAG,IAAI;AACrB,WAAO,MAAM,qBAAqB,GAAG,SAAS,QAAQ;aAC9C;AACR,WAAO,SAAS;KAAE,WAAW;KAAM,OAAO;KAAM,CAAC;;;AAGrD,SAAO,uBAAuB,KAAK,SAAS,QAAQ;;AAGtD,QAAO,iBAAiB,SAAS,QAAQ;;;AAI3C,eAAsB,oBACpB,SACA,UAA8C,EAAE,EACxB;CACxB,MAAM,IAAI,mBAAmB,QAAQ;AACrC,KAAI,CAAC,EACH,OAAM,IAAI,MACR,0BAA0B,QAAQ,wDACnC;AAEH,QAAO,oBAAoB,EAAE,QAAQ;EACnC;EACA,KAAK,EAAE;EACP,SAAS,EAAE;EACX,OAAO;EACP,YAAY,QAAQ;EACrB,CAAC"}
+{"version":3,"file":"hub-pull.js","names":[],"sources":["../../../../src/agent/skills/hub-pull.ts"],"sourcesContent":["/**\n * CLI / hub: install or update skills from git or archive (zip / tar.gz) into ~/.xopc/skills.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport {\n  cpSync,\n  existsSync,\n  mkdtempSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  rmSync,\n  statSync,\n  writeFileSync,\n} from 'node:fs';\nimport { basename, join, normalize, resolve } from 'node:path';\nimport { tmpdir } from 'node:os';\nimport { fileURLToPath } from 'node:url';\n\nimport { fetch } from 'undici';\n\nimport { parseFrontmatter } from '../../markdown/frontmatter.js';\nimport { computeSkillTreeHashSync } from './hub-hash.js';\nimport { getSkillsLockEntry, recordSkillsHubInstall } from './hub-lock.js';\nimport type { SkillHubKind } from './hub-lock.js';\nimport {\n  installSkillFromZip,\n  isValidSkillId,\n  prepareManagedSkillTempDir,\n  promoteManagedSkillTempDir,\n} from './managed-store.js';\nimport { formatScanSummary, scanSkillDirectory } from './scanner.js';\n\nexport interface HubPullOptions {\n  skillId?: string;\n  ref?: string;\n  subpath?: string;\n  force?: boolean;\n  /** When true, critical scanner findings fail the install. */\n  strictScan?: boolean;\n}\n\nexport interface HubPullResult {\n  skillId: string;\n  path: string;\n  contentHash: string;\n  kind: SkillHubKind;\n  source: string;\n}\n\nexport function classifyHubSource(raw: string): 'git' | 'archive' {\n  const s = raw.trim();\n  const lower = s.toLowerCase();\n\n  try {\n    if (s.startsWith('file:')) {\n      const p = fileURLToPath(s);\n      const pl = p.toLowerCase();\n      if (pl.endsWith('.zip')) return 'archive';\n      if (pl.endsWith('.tar.gz') || pl.endsWith('.tgz')) return 'archive';\n      return 'git';\n    }\n  } catch {\n    // ignore invalid file URL\n  }\n\n  if (/^[a-zA-Z]:[\\\\/]/.test(s) || (s.startsWith('/') && !s.startsWith('//'))) {\n    if (lower.endsWith('.zip')) return 'archive';\n    if (lower.endsWith('.tar.gz') || lower.endsWith('.tgz')) return 'archive';\n    return 'git';\n  }\n\n  try {\n    const u = new URL(s);\n    const path = u.pathname.toLowerCase();\n    if (path.endsWith('.zip')) return 'archive';\n    if (path.endsWith('.tar.gz') || path.endsWith('.tgz')) return 'archive';\n  } catch {\n    // not a URL\n  }\n\n  if (lower.endsWith('.zip')) return 'archive';\n  if (lower.endsWith('.tar.gz') || lower.endsWith('.tgz')) return 'archive';\n  return 'git';\n}\n\nexport function findSkillRoot(repoRoot: string, subpath?: string): string {\n  const sub = subpath?.trim()\n    ? normalize(subpath.trim()).replace(/^[/\\\\]+/, '')\n    : '';\n  const base = sub ? resolve(repoRoot, sub) : resolve(repoRoot);\n  if (!existsSync(base)) {\n    throw new Error(`Path not found in source: ${sub || '.'}`);\n  }\n  if (existsSync(join(base, 'SKILL.md'))) {\n    return base;\n  }\n  const entries = readdirSync(base, { withFileTypes: true }).filter((e) => e.isDirectory());\n  if (entries.length === 1) {\n    const one = join(base, entries[0].name);\n    if (existsSync(join(one, 'SKILL.md'))) {\n      return one;\n    }\n  }\n  throw new Error(\n    'Could not locate SKILL.md (expected at root, under --path, or in a single child folder)',\n  );\n}\n\nfunction inferSkillIdFromSkillMd(skillRoot: string): string {\n  const raw = readFileSync(join(skillRoot, 'SKILL.md'), 'utf-8');\n  const { frontmatter } = parseFrontmatter(raw);\n  const n = String(frontmatter.name || '').trim();\n  if (n && isValidSkillId(n)) {\n    return n;\n  }\n  const dirName = basename(skillRoot);\n  if (isValidSkillId(dirName)) {\n    return dirName;\n  }\n  return '';\n}\n\nasync function runScan(dir: string, strict: boolean | undefined): Promise<void> {\n  const summary = await scanSkillDirectory(dir);\n  const label = basename(dir);\n  if (summary.critical > 0 && strict) {\n    throw new Error(\n      `Security scan reported ${summary.critical} critical finding(s). ${formatScanSummary(summary, label)}`,\n    );\n  }\n  if (summary.critical > 0 || summary.warn > 0) {\n    console.warn(formatScanSummary(summary, label));\n  }\n}\n\nasync function copySkillTreeToManaged(\n  skillRoot: string,\n  ctx: HubPullOptions & { kind: SkillHubKind; source: string },\n): Promise<HubPullResult> {\n  const targetId = ctx.skillId?.trim() || inferSkillIdFromSkillMd(skillRoot);\n  if (!targetId) {\n    throw new Error('Could not determine skill id: pass --id <name> (must match managed id rules)');\n  }\n  if (!isValidSkillId(targetId)) {\n    throw new Error(`Invalid skill id \"${targetId}\" (letters, digits, ._-; max 63 chars after first)`);\n  }\n\n  const { destDir, tempDir } = prepareManagedSkillTempDir(targetId);\n  try {\n    if (existsSync(destDir) && !ctx.force) {\n      throw new Error(`Skill \"${targetId}\" already exists. Use --force to replace.`);\n    }\n\n    cpSync(skillRoot, tempDir, { recursive: true });\n\n    if (!existsSync(join(tempDir, 'SKILL.md'))) {\n      throw new Error('Installed tree is missing SKILL.md');\n    }\n\n    await runScan(tempDir, ctx.strictScan);\n    const promoted = promoteManagedSkillTempDir({\n      skillId: targetId,\n      tempDir,\n      overwrite: ctx.force,\n    });\n    const hash = computeSkillTreeHashSync(promoted.path);\n    recordSkillsHubInstall(\n      targetId,\n      {\n        kind: ctx.kind,\n        source: ctx.source,\n        ref: ctx.kind === 'git' ? ctx.ref : undefined,\n        subpath: ctx.kind === 'git' ? ctx.subpath : undefined,\n      },\n      hash,\n    );\n\n    return {\n      skillId: targetId,\n      path: promoted.path,\n      contentHash: hash,\n      kind: ctx.kind,\n      source: ctx.source,\n    };\n  } catch (err) {\n    rmSync(tempDir, { recursive: true, force: true });\n    throw err;\n  }\n}\n\nasync function pullSkillFromZipBuffer(\n  buf: Buffer,\n  sourceLabel: string,\n  options: HubPullOptions,\n): Promise<HubPullResult> {\n  const r = installSkillFromZip(buf, {\n    skillId: options.skillId,\n    overwrite: options.force ?? false,\n  });\n  const hash = computeSkillTreeHashSync(r.path);\n  recordSkillsHubInstall(r.skillId, { kind: 'archive', source: sourceLabel }, hash);\n  await runScan(r.path, options.strictScan);\n  return {\n    skillId: r.skillId,\n    path: r.path,\n    contentHash: hash,\n    kind: 'archive',\n    source: sourceLabel,\n  };\n}\n\nasync function pullSkillFromTarFile(\n  archivePath: string,\n  sourceLabel: string,\n  options: HubPullOptions,\n): Promise<HubPullResult> {\n  const tmpRoot = mkdtempSync(join(tmpdir(), 'xopc-tar-'));\n  try {\n    execFileSync('tar', ['-xzf', archivePath, '-C', tmpRoot], {\n      stdio: 'pipe',\n      encoding: 'utf-8',\n    });\n    const skillRoot = findSkillRoot(tmpRoot);\n    return await copySkillTreeToManaged(skillRoot, { ...options, kind: 'archive', source: sourceLabel });\n  } finally {\n    rmSync(tmpRoot, { recursive: true, force: true });\n  }\n}\n\nasync function pullSkillFromLocalPath(absPath: string, options: HubPullOptions): Promise<HubPullResult> {\n  const resolved = resolve(absPath);\n  if (!existsSync(resolved)) {\n    throw new Error(`Not found: ${resolved}`);\n  }\n  const st = statSync(resolved);\n  if (!st.isFile()) {\n    throw new Error('Expected a path to a .zip or .tar.gz file (directories are not supported here)');\n  }\n  const lower = resolved.toLowerCase();\n  if (lower.endsWith('.zip')) {\n    const buf = readFileSync(resolved);\n    return pullSkillFromZipBuffer(buf, resolved, options);\n  }\n  if (lower.endsWith('.tar.gz') || lower.endsWith('.tgz')) {\n    return pullSkillFromTarFile(resolved, resolved, options);\n  }\n  throw new Error('Unsupported file type (expected .zip, .tar.gz, or .tgz)');\n}\n\nasync function pullSkillFromGit(url: string, options: HubPullOptions): Promise<HubPullResult> {\n  const tmpRoot = mkdtempSync(join(tmpdir(), 'xopc-hub-'));\n  const cloneDir = join(tmpRoot, 'clone');\n  try {\n    const args = ['clone', '--depth', '1'];\n    if (options.ref?.trim()) {\n      args.push('--branch', options.ref.trim());\n    }\n    args.push(url, cloneDir);\n    try {\n      execFileSync('git', args, { stdio: 'pipe', encoding: 'utf-8' });\n    } catch {\n      if (options.ref?.trim()) {\n        execFileSync('git', ['clone', '--depth', '1', url, cloneDir], {\n          stdio: 'pipe',\n          encoding: 'utf-8',\n        });\n      } else {\n        throw new Error(`git clone failed for ${url}`);\n      }\n    }\n    const skillRoot = findSkillRoot(cloneDir, options.subpath);\n    return await copySkillTreeToManaged(skillRoot, { ...options, kind: 'git', source: url });\n  } catch (e) {\n    const msg = e instanceof Error ? e.message : String(e);\n    if (msg.includes('ENOENT') || msg.includes('git clone failed')) {\n      throw new Error(\n        `Git operation failed (${msg}). Ensure git is installed and the repository URL is valid.`,\n      );\n    }\n    throw e;\n  } finally {\n    rmSync(tmpRoot, { recursive: true, force: true });\n  }\n}\n\n/**\n * Install or replace a skill from a git URL, http(s) archive URL, file:// URL, or local archive path.\n */\nexport async function pullSkillFromSource(\n  source: string,\n  options: HubPullOptions = {},\n): Promise<HubPullResult> {\n  const trimmed = source.trim();\n  if (!trimmed) {\n    throw new Error('Missing source URL or path');\n  }\n\n  if (trimmed.startsWith('file:')) {\n    return pullSkillFromLocalPath(fileURLToPath(trimmed), options);\n  }\n\n  if (!/^[a-zA-Z][a-zA-Z+.-]*:\\/\\//.test(trimmed) && existsSync(trimmed)) {\n    return pullSkillFromLocalPath(resolve(trimmed), options);\n  }\n\n  const kind = classifyHubSource(trimmed);\n  if (kind === 'archive') {\n    const res = await fetch(trimmed);\n    if (!res.ok) {\n      throw new Error(`HTTP ${res.status} while fetching archive`);\n    }\n    const buf = Buffer.from(await res.arrayBuffer());\n    const lower = trimmed.toLowerCase();\n    if (lower.endsWith('.tar.gz') || lower.endsWith('.tgz')) {\n      const tmpRoot = mkdtempSync(join(tmpdir(), 'xopc-fetch-tar-'));\n      const f = join(tmpRoot, 'archive.tgz');\n      try {\n        mkdirSync(tmpRoot, { recursive: true });\n        writeFileSync(f, buf);\n        return await pullSkillFromTarFile(f, trimmed, options);\n      } finally {\n        rmSync(tmpRoot, { recursive: true, force: true });\n      }\n    }\n    return pullSkillFromZipBuffer(buf, trimmed, options);\n  }\n\n  return pullSkillFromGit(trimmed, options);\n}\n\n/** Re-install from the source recorded in ~/.xopc/skills-lock.json for this skill id. */\nexport async function updateSkillFromLock(\n  skillId: string,\n  options: Pick<HubPullOptions, 'strictScan'> = {},\n): Promise<HubPullResult> {\n  const e = getSkillsLockEntry(skillId);\n  if (!e) {\n    throw new Error(\n      `No hub lock entry for \"${skillId}\". Install with: xopc skills pull <git-or-archive-url>`,\n    );\n  }\n  return pullSkillFromSource(e.source, {\n    skillId,\n    ref: e.ref,\n    subpath: e.subpath,\n    force: true,\n    strictScan: options.strictScan,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmDA,SAAgB,kBAAkB,KAAgC;CAChE,MAAM,IAAI,IAAI,MAAM;CACpB,MAAM,QAAQ,EAAE,aAAa;AAE7B,KAAI;AACF,MAAI,EAAE,WAAW,QAAQ,EAAE;GAEzB,MAAM,KADI,cAAc,EACZ,CAAC,aAAa;AAC1B,OAAI,GAAG,SAAS,OAAO,CAAE,QAAO;AAChC,OAAI,GAAG,SAAS,UAAU,IAAI,GAAG,SAAS,OAAO,CAAE,QAAO;AAC1D,UAAO;;SAEH;AAIR,KAAI,kBAAkB,KAAK,EAAE,IAAK,EAAE,WAAW,IAAI,IAAI,CAAC,EAAE,WAAW,KAAK,EAAG;AAC3E,MAAI,MAAM,SAAS,OAAO,CAAE,QAAO;AACnC,MAAI,MAAM,SAAS,UAAU,IAAI,MAAM,SAAS,OAAO,CAAE,QAAO;AAChE,SAAO;;AAGT,KAAI;EAEF,MAAM,OAAO,IADC,IAAI,EACJ,CAAC,SAAS,aAAa;AACrC,MAAI,KAAK,SAAS,OAAO,CAAE,QAAO;AAClC,MAAI,KAAK,SAAS,UAAU,IAAI,KAAK,SAAS,OAAO,CAAE,QAAO;SACxD;AAIR,KAAI,MAAM,SAAS,OAAO,CAAE,QAAO;AACnC,KAAI,MAAM,SAAS,UAAU,IAAI,MAAM,SAAS,OAAO,CAAE,QAAO;AAChE,QAAO;;AAGT,SAAgB,cAAc,UAAkB,SAA0B;CACxE,MAAM,MAAM,SAAS,MAAM,GACvB,UAAU,QAAQ,MAAM,CAAC,CAAC,QAAQ,WAAW,GAAG,GAChD;CACJ,MAAM,OAAO,MAAM,QAAQ,UAAU,IAAI,GAAG,QAAQ,SAAS;AAC7D,KAAI,CAAC,WAAW,KAAK,CACnB,OAAM,IAAI,MAAM,6BAA6B,OAAO,MAAM;AAE5D,KAAI,WAAW,KAAK,MAAM,WAAW,CAAC,CACpC,QAAO;CAET,MAAM,UAAU,YAAY,MAAM,EAAE,eAAe,MAAM,CAAC,CAAC,QAAQ,MAAM,EAAE,aAAa,CAAC;AACzF,KAAI,QAAQ,WAAW,GAAG;EACxB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAG,KAAK;AACvC,MAAI,WAAW,KAAK,KAAK,WAAW,CAAC,CACnC,QAAO;;AAGX,OAAM,IAAI,MACR,0FACD;;AAGH,SAAS,wBAAwB,WAA2B;CAE1D,MAAM,EAAE,gBAAgB,iBADZ,aAAa,KAAK,WAAW,WAAW,EAAE,QACV,CAAC;CAC7C,MAAM,IAAI,OAAO,YAAY,QAAQ,GAAG,CAAC,MAAM;AAC/C,KAAI,KAAK,eAAe,EAAE,CACxB,QAAO;CAET,MAAM,UAAU,SAAS,UAAU;AACnC,KAAI,eAAe,QAAQ,CACzB,QAAO;AAET,QAAO;;AAGT,eAAe,QAAQ,KAAa,QAA4C;CAC9E,MAAM,UAAU,MAAM,mBAAmB,IAAI;CAC7C,MAAM,QAAQ,SAAS,IAAI;AAC3B,KAAI,QAAQ,WAAW,KAAK,OAC1B,OAAM,IAAI,MACR,0BAA0B,QAAQ,SAAS,wBAAwB,kBAAkB,SAAS,MAAM,GACrG;AAEH,KAAI,QAAQ,WAAW,KAAK,QAAQ,OAAO,EACzC,SAAQ,KAAK,kBAAkB,SAAS,MAAM,CAAC;;AAInD,eAAe,uBACb,WACA,KACwB;CACxB,MAAM,WAAW,IAAI,SAAS,MAAM,IAAI,wBAAwB,UAAU;AAC1E,KAAI,CAAC,SACH,OAAM,IAAI,MAAM,+EAA+E;AAEjG,KAAI,CAAC,eAAe,SAAS,CAC3B,OAAM,IAAI,MAAM,qBAAqB,SAAS,oDAAoD;CAGpG,MAAM,EAAE,SAAS,YAAY,2BAA2B,SAAS;AACjE,KAAI;AACF,MAAI,WAAW,QAAQ,IAAI,CAAC,IAAI,MAC9B,OAAM,IAAI,MAAM,UAAU,SAAS,2CAA2C;AAGhF,SAAO,WAAW,SAAS,EAAE,WAAW,MAAM,CAAC;AAE/C,MAAI,CAAC,WAAW,KAAK,SAAS,WAAW,CAAC,CACxC,OAAM,IAAI,MAAM,qCAAqC;AAGvD,QAAM,QAAQ,SAAS,IAAI,WAAW;EACtC,MAAM,WAAW,2BAA2B;GAC1C,SAAS;GACT;GACA,WAAW,IAAI;GAChB,CAAC;EACF,MAAM,OAAO,yBAAyB,SAAS,KAAK;AACpD,yBACE,UACA;GACE,MAAM,IAAI;GACV,QAAQ,IAAI;GACZ,KAAK,IAAI,SAAS,QAAQ,IAAI,MAAM,KAAA;GACpC,SAAS,IAAI,SAAS,QAAQ,IAAI,UAAU,KAAA;GAC7C,EACD,KACD;AAED,SAAO;GACL,SAAS;GACT,MAAM,SAAS;GACf,aAAa;GACb,MAAM,IAAI;GACV,QAAQ,IAAI;GACb;UACM,KAAK;AACZ,SAAO,SAAS;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;AACjD,QAAM;;;AAIV,eAAe,uBACb,KACA,aACA,SACwB;CACxB,MAAM,IAAI,oBAAoB,KAAK;EACjC,SAAS,QAAQ;EACjB,WAAW,QAAQ,SAAS;EAC7B,CAAC;CACF,MAAM,OAAO,yBAAyB,EAAE,KAAK;AAC7C,wBAAuB,EAAE,SAAS;EAAE,MAAM;EAAW,QAAQ;EAAa,EAAE,KAAK;AACjF,OAAM,QAAQ,EAAE,MAAM,QAAQ,WAAW;AACzC,QAAO;EACL,SAAS,EAAE;EACX,MAAM,EAAE;EACR,aAAa;EACb,MAAM;EACN,QAAQ;EACT;;AAGH,eAAe,qBACb,aACA,aACA,SACwB;CACxB,MAAM,UAAU,YAAY,KAAK,QAAQ,EAAE,YAAY,CAAC;AACxD,KAAI;AACF,eAAa,OAAO;GAAC;GAAQ;GAAa;GAAM;GAAQ,EAAE;GACxD,OAAO;GACP,UAAU;GACX,CAAC;AAEF,SAAO,MAAM,uBADK,cAAc,QACa,EAAE;GAAE,GAAG;GAAS,MAAM;GAAW,QAAQ;GAAa,CAAC;WAC5F;AACR,SAAO,SAAS;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;;;AAIrD,eAAe,uBAAuB,SAAiB,SAAiD;CACtG,MAAM,WAAW,QAAQ,QAAQ;AACjC,KAAI,CAAC,WAAW,SAAS,CACvB,OAAM,IAAI,MAAM,cAAc,WAAW;AAG3C,KAAI,CADO,SAAS,SACb,CAAC,QAAQ,CACd,OAAM,IAAI,MAAM,iFAAiF;CAEnG,MAAM,QAAQ,SAAS,aAAa;AACpC,KAAI,MAAM,SAAS,OAAO,CAExB,QAAO,uBADK,aAAa,SACQ,EAAE,UAAU,QAAQ;AAEvD,KAAI,MAAM,SAAS,UAAU,IAAI,MAAM,SAAS,OAAO,CACrD,QAAO,qBAAqB,UAAU,UAAU,QAAQ;AAE1D,OAAM,IAAI,MAAM,0DAA0D;;AAG5E,eAAe,iBAAiB,KAAa,SAAiD;CAC5F,MAAM,UAAU,YAAY,KAAK,QAAQ,EAAE,YAAY,CAAC;CACxD,MAAM,WAAW,KAAK,SAAS,QAAQ;AACvC,KAAI;EACF,MAAM,OAAO;GAAC;GAAS;GAAW;GAAI;AACtC,MAAI,QAAQ,KAAK,MAAM,CACrB,MAAK,KAAK,YAAY,QAAQ,IAAI,MAAM,CAAC;AAE3C,OAAK,KAAK,KAAK,SAAS;AACxB,MAAI;AACF,gBAAa,OAAO,MAAM;IAAE,OAAO;IAAQ,UAAU;IAAS,CAAC;UACzD;AACN,OAAI,QAAQ,KAAK,MAAM,CACrB,cAAa,OAAO;IAAC;IAAS;IAAW;IAAK;IAAK;IAAS,EAAE;IAC5D,OAAO;IACP,UAAU;IACX,CAAC;OAEF,OAAM,IAAI,MAAM,wBAAwB,MAAM;;AAIlD,SAAO,MAAM,uBADK,cAAc,UAAU,QAAQ,QACL,EAAE;GAAE,GAAG;GAAS,MAAM;GAAO,QAAQ;GAAK,CAAC;UACjF,GAAG;EACV,MAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;AACtD,MAAI,IAAI,SAAS,SAAS,IAAI,IAAI,SAAS,mBAAmB,CAC5D,OAAM,IAAI,MACR,yBAAyB,IAAI,6DAC9B;AAEH,QAAM;WACE;AACR,SAAO,SAAS;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;;;;;;AAOrD,eAAsB,oBACpB,QACA,UAA0B,EAAE,EACJ;CACxB,MAAM,UAAU,OAAO,MAAM;AAC7B,KAAI,CAAC,QACH,OAAM,IAAI,MAAM,6BAA6B;AAG/C,KAAI,QAAQ,WAAW,QAAQ,CAC7B,QAAO,uBAAuB,cAAc,QAAQ,EAAE,QAAQ;AAGhE,KAAI,CAAC,6BAA6B,KAAK,QAAQ,IAAI,WAAW,QAAQ,CACpE,QAAO,uBAAuB,QAAQ,QAAQ,EAAE,QAAQ;AAI1D,KADa,kBAAkB,QACvB,KAAK,WAAW;EACtB,MAAM,MAAM,MAAM,MAAM,QAAQ;AAChC,MAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,QAAQ,IAAI,OAAO,yBAAyB;EAE9D,MAAM,MAAM,OAAO,KAAK,MAAM,IAAI,aAAa,CAAC;EAChD,MAAM,QAAQ,QAAQ,aAAa;AACnC,MAAI,MAAM,SAAS,UAAU,IAAI,MAAM,SAAS,OAAO,EAAE;GACvD,MAAM,UAAU,YAAY,KAAK,QAAQ,EAAE,kBAAkB,CAAC;GAC9D,MAAM,IAAI,KAAK,SAAS,cAAc;AACtC,OAAI;AACF,cAAU,SAAS,EAAE,WAAW,MAAM,CAAC;AACvC,kBAAc,GAAG,IAAI;AACrB,WAAO,MAAM,qBAAqB,GAAG,SAAS,QAAQ;aAC9C;AACR,WAAO,SAAS;KAAE,WAAW;KAAM,OAAO;KAAM,CAAC;;;AAGrD,SAAO,uBAAuB,KAAK,SAAS,QAAQ;;AAGtD,QAAO,iBAAiB,SAAS,QAAQ;;;AAI3C,eAAsB,oBACpB,SACA,UAA8C,EAAE,EACxB;CACxB,MAAM,IAAI,mBAAmB,QAAQ;AACrC,KAAI,CAAC,EACH,OAAM,IAAI,MACR,0BAA0B,QAAQ,wDACnC;AAEH,QAAO,oBAAoB,EAAE,QAAQ;EACnC;EACA,KAAK,EAAE;EACP,SAAS,EAAE;EACX,OAAO;EACP,YAAY,QAAQ;EACrB,CAAC"}

package/dist/src/agent/skills/index.js

@@ -1,7 +1,7 @@
 import { resolveStateDir } from "../../config/paths-state.js";
+import { init_paths } from "../../config/paths.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_paths } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { findInstallSpec, getDefaultInstallerPreferences, hasBinary, installSkill } from "./installer.js";
 import { applySkillEnvOverrides, createSkillConfigManager, getSkillEnvironment, isSkillEnabled, resolveSkillConfig, validateSkillConfig } from "./config.js";
@@ -11,8 +11,8 @@ import { parseRequiredEnvVarNames } from "./required-env-vars.js";
 import { formatSkillsForPrompt } from "./format-skills-prompt.js";
 import { parseSkillMetadata } from "./parse-skill-metadata.js";
 import { SkillTestFramework, SkillTestRunner, formatTestResults, formatTestResultsJson, formatTestResultsTap } from "./test-framework.js";
-import { basename, dirname, join, relative, sep } from "path";
 import { existsSync, readFileSync, readdirSync } from "fs";
+import { basename, dirname, join, relative, sep } from "path";
 //#region src/agent/skills/index.ts
 init_paths();
 init_logger();
@@ -68,7 +68,11 @@ function shouldIgnore(path, ignoredPaths) {
 }
 function discoverSkills(dir, source) {
 	const skills = [];
-	if (!existsSync(dir)) return skills;
+	const diagnostics = [];
+	if (!existsSync(dir)) return {
+		skills,
+		diagnostics
+	};
 	function scan(currentDir, currentIgnoredPaths) {
 		try {
 			const entries = readdirSync(currentDir, { withFileTypes: true });
@@ -86,16 +90,27 @@ function discoverSkills(dir, source) {
 						for (const rule of subRules) subIgnoredPaths.add(`${skillRelPath}${rule}`);
 					}
 					if (existsSync(skillMdPath) && !shouldIgnore(skillRelPath, currentIgnoredPaths)) {
-						const skill = loadSkillFromFile(skillMdPath, source, dir);
+						const { skill, diagnostic } = loadSkillFromFile(skillMdPath, source, dir);
+						if (diagnostic) diagnostics.push(diagnostic);
 						if (skill) skills.push(skill);
 					}
 					scan(fullPath, subIgnoredPaths);
 				}
 			}
-		} catch {}
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			diagnostics.push({
+				type: "error",
+				message: `Failed to scan skills directory: ${message}`,
+				path: currentDir
+			});
+		}
 	}
 	scan(dir, loadIgnoreRules(dir, dir));
-	return skills;
+	return {
+		skills,
+		diagnostics
+	};
 }
 function deriveDescriptionFromMarkdown(content) {
 	let fallbackHeading = "";
@@ -118,7 +133,15 @@ function loadSkillFromFile(filePath, source, rootDir) {
 		const parentDirName = basename(skillDir);
 		const name = frontmatter.name || parentDirName;
 		const description = frontmatter.description?.trim() || deriveDescriptionFromMarkdown(content);
-		if (!description?.trim()) return null;
+		if (!description?.trim()) return {
+			skill: null,
+			diagnostic: {
+				type: "error",
+				skillName: name,
+				message: `Skill "${name}" is missing a description`,
+				path: filePath
+			}
+		};
 		let category;
 		if (rootDir) {
 			const segments = toPosixPath(relative(rootDir, skillDir)).split("/");
@@ -129,7 +152,7 @@ function loadSkillFromFile(filePath, source, rootDir) {
 		metadata.description ||= description.trim();
 		const toolConditions = parseSkillToolConditions(frontmatter);
 		const requiredEnvVarNames = parseRequiredEnvVarNames(frontmatter);
-		return {
+		return { skill: {
 			name,
 			description: description.trim(),
 			category,
@@ -141,38 +164,55 @@ function loadSkillFromFile(filePath, source, rootDir) {
 			toolConditions,
 			requiredEnvVarNames: requiredEnvVarNames.length > 0 ? requiredEnvVarNames : void 0,
 			content
+		} };
+	} catch (err) {
+		return {
+			skill: null,
+			diagnostic: {
+				type: "error",
+				message: `Failed to load skill file: ${err instanceof Error ? err.message : String(err)}`,
+				path: filePath
+			}
 		};
-	} catch {
-		return null;
 	}
 }
 function loadSkills(options) {
 	const { workspaceDir, builtinDir, extraDirs = [] } = options;
 	const skillMap = /* @__PURE__ */ new Map();
 	const diagnostics = [];
-	if (builtinDir) for (const skill of discoverSkills(builtinDir, "builtin")) {
-		const existing = skillMap.get(skill.name);
-		if (existing) diagnostics.push({
-			type: "collision",
-			skillName: skill.name,
-			message: `Skill "${skill.name}" collision: ${existing.source} overrides ${skill.source}`,
-			path: skill.filePath
-		});
-		else skillMap.set(skill.name, skill);
+	if (builtinDir) {
+		const discovered = discoverSkills(builtinDir, "builtin");
+		diagnostics.push(...discovered.diagnostics);
+		for (const skill of discovered.skills) {
+			const existing = skillMap.get(skill.name);
+			if (existing) diagnostics.push({
+				type: "collision",
+				skillName: skill.name,
+				message: `Skill "${skill.name}" collision: ${existing.source} overrides ${skill.source}`,
+				path: skill.filePath
+			});
+			else skillMap.set(skill.name, skill);
+		}
 	}
 	const globalDirs = [options.globalDir, join(resolveStateDir(), "skills")].filter((d) => !!d && existsSync(d));
-	for (const dir of globalDirs) for (const skill of discoverSkills(dir, "global")) {
-		const existing = skillMap.get(skill.name);
-		if (existing) diagnostics.push({
-			type: "collision",
-			skillName: skill.name,
-			message: `Skill "${skill.name}" collision: ${skill.source} overrides ${existing.source}`,
-			path: skill.filePath
-		});
-		skillMap.set(skill.name, skill);
+	for (const dir of globalDirs) {
+		const discovered = discoverSkills(dir, "global");
+		diagnostics.push(...discovered.diagnostics);
+		for (const skill of discovered.skills) {
+			const existing = skillMap.get(skill.name);
+			if (existing) diagnostics.push({
+				type: "collision",
+				skillName: skill.name,
+				message: `Skill "${skill.name}" collision: ${skill.source} overrides ${existing.source}`,
+				path: skill.filePath
+			});
+			skillMap.set(skill.name, skill);
+		}
 	}
 	if (workspaceDir) {
-		const workspaceSkills = discoverSkills(join(workspaceDir, "skills"), "workspace");
+		const discovered = discoverSkills(join(workspaceDir, "skills"), "workspace");
+		diagnostics.push(...discovered.diagnostics);
+		const workspaceSkills = discovered.skills;
 		for (const skill of workspaceSkills) {
 			const existing = skillMap.get(skill.name);
 			if (existing) diagnostics.push({
@@ -184,15 +224,19 @@ function loadSkills(options) {
 			skillMap.set(skill.name, skill);
 		}
 	}
-	for (const extraDir of extraDirs) if (existsSync(extraDir)) for (const skill of discoverSkills(extraDir, "global")) {
-		const existing = skillMap.get(skill.name);
-		if (existing) diagnostics.push({
-			type: "collision",
-			skillName: skill.name,
-			message: `Skill "${skill.name}" collision: ${existing.source} overrides ${skill.source}`,
-			path: skill.filePath
-		});
-		else skillMap.set(skill.name, skill);
+	for (const extraDir of extraDirs) if (existsSync(extraDir)) {
+		const discovered = discoverSkills(extraDir, "global");
+		diagnostics.push(...discovered.diagnostics);
+		for (const skill of discovered.skills) {
+			const existing = skillMap.get(skill.name);
+			if (existing) diagnostics.push({
+				type: "collision",
+				skillName: skill.name,
+				message: `Skill "${skill.name}" collision: ${existing.source} overrides ${skill.source}`,
+				path: skill.filePath
+			});
+			else skillMap.set(skill.name, skill);
+		}
 	}
 	const skillsConfig = createSkillConfigManager(resolveStateDir()).load();
 	const merged = Array.from(skillMap.values());