@zoralabs/cli 1.4.0 → 1.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zoralabs/cli",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Zora CLI tool",
   "type": "module",
   "bin": {
@@ -34,6 +34,9 @@
     "viem": "2.22.12",
     "@zoralabs/coins-sdk": "0.7.0"
   },
+  "optionalDependencies": {
+    "@xmtp/node-sdk-lowglibc": "npm:@xmtp/node-sdk@6.1.0-nightly.20260617.1e1a195"
+  },
   "devDependencies": {
     "@types/node": "^22.13.0",
     "@types/react": "^19.2.14",
@@ -50,8 +53,10 @@
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
-    "build": "pnpm run patch:xmtp-binding && tsup",
-    "build:js": "pnpm run patch:xmtp-binding && tsup",
+    "generate:skills": "node scripts/generate-skill-content.mjs",
+    "generate:skills:check": "node scripts/generate-skill-content.mjs --check",
+    "build": "pnpm run generate:skills && pnpm run patch:xmtp-binding && tsup",
+    "build:js": "pnpm run generate:skills && pnpm run patch:xmtp-binding && tsup",
     "check": "tsc --noEmit",
     "zora": "tsx src/index.tsx",
     "test": "vitest run",
@@ -61,12 +66,12 @@
     "gen:card-fonts": "python3 scripts/gen-card-fonts.py",
     "gen:card-wasm": "node scripts/gen-card-wasm.mjs",
     "gen:card-assets": "pnpm run gen:card-fonts && pnpm run gen:card-wasm",
-    "build:binary": "pnpm run patch:xmtp-binding && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora",
+    "build:binary": "pnpm run generate:skills && pnpm run patch:xmtp-binding && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora",
     "build:binary:all": "pnpm run build:binary:mac-arm64 && pnpm run build:binary:mac-x64 && pnpm run build:binary:linux-x64 && pnpm run build:binary:linux-arm64 && pnpm run build:binary:windows-x64",
-    "build:binary:mac-arm64": "pnpm run patch:xmtp-binding && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-darwin-arm64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-darwin-arm64",
-    "build:binary:mac-x64": "pnpm run patch:xmtp-binding && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-darwin-x64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-darwin-x64",
-    "build:binary:linux-x64": "V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-linux-x64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-linux-x64",
-    "build:binary:linux-arm64": "V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-linux-arm64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-linux-arm64",
-    "build:binary:windows-x64": "V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-windows-x64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-windows-x64.exe"
+    "build:binary:mac-arm64": "pnpm run generate:skills && pnpm run patch:xmtp-binding && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-darwin-arm64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-darwin-arm64",
+    "build:binary:mac-x64": "pnpm run generate:skills && pnpm run patch:xmtp-binding && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-darwin-x64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-darwin-x64",
+    "build:binary:linux-x64": "pnpm run generate:skills && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-linux-x64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-linux-x64",
+    "build:binary:linux-arm64": "pnpm run generate:skills && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-linux-arm64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-linux-arm64",
+    "build:binary:windows-x64": "pnpm run generate:skills && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-windows-x64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-windows-x64.exe"
   }
 }

package/scripts/generate-skill-content.mjs

@@ -0,0 +1,98 @@
+/**
+ * Embeds skill content into the CLI bundle.
+ *
+ * Skills are authored as Markdown in this package (the core skill at SKILL.md,
+ * strategy skills under skills/<name>/SKILL.md). The CLI installs them by writing
+ * the content to the agent's skills directory. Rather than fetch that content from
+ * a remote server at install time (unverifiable, and it drifts from the published
+ * CLI), we embed it into the bundle as string literals. This way the content is
+ * identical to the reviewed source at the commit the CLI was built from, ships
+ * inside both the npm tarball and the compiled standalone binary, and needs no
+ * network access or integrity check to install.
+ *
+ * The generated module is committed so dev (`tsx`), tests, and review all see
+ * exactly what ships. CI runs this with --check to fail if it is out of date.
+ *
+ * Usage:
+ *   node scripts/generate-skill-content.mjs          # write src/generated/skill-content.ts
+ *   node scripts/generate-skill-content.mjs --check  # exit non-zero if out of date (CI)
+ */
+
+import { readFileSync, writeFileSync, readdirSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = join(__dirname, "..");
+const CORE_SKILL_PATH = join(PKG_ROOT, "SKILL.md");
+const SKILLS_DIR = join(PKG_ROOT, "skills");
+const OUT_PATH = join(PKG_ROOT, "src", "generated", "skill-content.ts");
+
+// The core skill (the `cli` entry in SKILLS) lives at the package root; every
+// other skill is a folder under skills/ containing a SKILL.md.
+const CORE_SKILL_NAME = "cli";
+
+function collectContent() {
+  const content = {};
+  content[CORE_SKILL_NAME] = readFileSync(CORE_SKILL_PATH, "utf8");
+
+  const dirs = readdirSync(SKILLS_DIR, { withFileTypes: true })
+    .filter((e) => e.isDirectory())
+    .map((e) => e.name)
+    .sort();
+
+  for (const name of dirs) {
+    content[name] = readFileSync(join(SKILLS_DIR, name, "SKILL.md"), "utf8");
+  }
+  return content;
+}
+
+function render(content) {
+  const entries = Object.keys(content)
+    .map(
+      (name) => `  ${JSON.stringify(name)}: ${JSON.stringify(content[name])},`,
+    )
+    .join("\n");
+
+  return (
+    "// AUTO-GENERATED by scripts/generate-skill-content.mjs. Do not edit by hand.\n" +
+    "// Run `pnpm --filter @zoralabs/cli generate:skills` after editing any SKILL.md.\n" +
+    "// Source of truth: SKILL.md (the `cli` skill) and skills/<name>/SKILL.md.\n" +
+    "\n" +
+    "export const SKILL_CONTENT: Record<string, string> = {\n" +
+    entries +
+    "\n};\n"
+  );
+}
+
+function main() {
+  const check = process.argv.includes("--check");
+  const generated = render(collectContent());
+
+  if (check) {
+    let current = "";
+    try {
+      current = readFileSync(OUT_PATH, "utf8");
+    } catch {
+      console.error(
+        "skill-content.ts is missing. Run `pnpm --filter @zoralabs/cli generate:skills`.",
+      );
+      process.exit(1);
+    }
+    if (current !== generated) {
+      console.error(
+        "skill-content.ts is out of date with the SKILL.md sources.\n" +
+          "Run `pnpm --filter @zoralabs/cli generate:skills` and commit the result.",
+      );
+      process.exit(1);
+    }
+    console.log("skill-content.ts is up to date.");
+    return;
+  }
+
+  mkdirSync(dirname(OUT_PATH), { recursive: true });
+  writeFileSync(OUT_PATH, generated);
+  console.log(`Wrote ${OUT_PATH}`);
+}
+
+main();

package/scripts/generate-skill-hashes.ts

@@ -1,210 +0,0 @@
-/**
- * Generates SHA-256 integrity hashes for all skills.
- *
- * Usage:
- *   npx tsx scripts/generate-skill-hashes.ts          # Print hashes to console
- *   npx tsx scripts/generate-skill-hashes.ts --write  # Update skills.ts directly
- *   npx tsx scripts/generate-skill-hashes.ts --check  # Check if hashes are up-to-date (CI)
- */
-
-import { createHash } from "node:crypto";
-import { readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const SKILLS_TS_PATH = join(__dirname, "../src/commands/skills.ts");
-
-const SKILLS_URL = "https://agents.zora.com/skill";
-
-const computeIntegrity = (content: string): string => {
-  const hash = createHash("sha256").update(content, "utf8").digest("base64");
-  return `sha256-${hash}`;
-};
-
-/**
- * Parse skill names from skills.ts to avoid import dependency chain.
- * Single source of truth - names are extracted from the SKILLS array.
- */
-function parseSkillNamesFromFile(): string[] {
-  const content = readFileSync(SKILLS_TS_PATH, "utf8");
-  const names: string[] = [];
-
-  // Match all name: "skillname" patterns within the SKILLS array
-  const namePattern = /name:\s*"([^"]+)"/g;
-  let match;
-  while ((match = namePattern.exec(content)) !== null) {
-    names.push(match[1]);
-  }
-
-  if (names.length === 0) {
-    throw new Error("No skill names found in skills.ts");
-  }
-
-  return names;
-}
-
-/**
- * Parse current hashes from skills.ts
- */
-function getCurrentHashes(): Map<string, string> {
-  const content = readFileSync(SKILLS_TS_PATH, "utf8");
-  const hashes = new Map<string, string>();
-  const skillNames = parseSkillNamesFromFile();
-
-  for (const name of skillNames) {
-    // Use lazy matching to find the integrity field for each skill
-    const pattern = new RegExp(
-      `name:\\s*"${name}"[\\s\\S]*?integrity:\\s*"([^"]*)"`,
-    );
-    const match = content.match(pattern);
-    if (match) {
-      hashes.set(name, match[1]);
-    }
-  }
-
-  return hashes;
-}
-
-async function fetchAllHashes(): Promise<Map<string, string>> {
-  const hashes = new Map<string, string>();
-  const skillNames = parseSkillNamesFromFile();
-
-  for (const name of skillNames) {
-    const url = `${SKILLS_URL}/${name}.md`;
-    const response = await fetch(url);
-    if (!response.ok) {
-      throw new Error(`Failed to fetch ${name}: HTTP ${response.status}`);
-    }
-    const content = await response.text();
-    hashes.set(name, computeIntegrity(content));
-  }
-
-  return hashes;
-}
-
-function updateSkillsFile(hashes: Map<string, string>): boolean {
-  const content = readFileSync(SKILLS_TS_PATH, "utf8");
-  let updated = content;
-  let changed = false;
-  const errors: string[] = [];
-
-  for (const [name, hash] of hashes) {
-    // First, verify this skill has an integrity field by checking
-    // that we can find it within its own object block (before the next skill)
-    // Find the position of this skill's name
-    const namePattern = new RegExp(`name:\\s*"${name}"`);
-    const nameMatch = namePattern.exec(updated);
-    if (!nameMatch) {
-      errors.push(`Skill "${name}" not found in skills.ts`);
-      continue;
-    }
-
-    const namePos = nameMatch.index;
-
-    // Find the next skill's name (if any) to bound our search
-    const remainingContent = updated.slice(namePos + nameMatch[0].length);
-    const nextSkillMatch = /name:\s*"[^"]+"/.exec(remainingContent);
-    const searchBound = nextSkillMatch
-      ? namePos + nameMatch[0].length + nextSkillMatch.index
-      : updated.length;
-
-    // Extract the bounded region for this skill
-    const skillRegion = updated.slice(namePos, searchBound);
-
-    // Check if integrity field exists in this skill's region
-    const integrityInRegion = /integrity:\s*"[^"]*"/.exec(skillRegion);
-    if (!integrityInRegion) {
-      errors.push(
-        `Skill "${name}" is missing integrity field - add 'integrity: "sha256-PLACEHOLDER"' to the skill definition`,
-      );
-      continue;
-    }
-
-    // Now safely replace the integrity value within the bounded region
-    const updatedRegion = skillRegion.replace(
-      /(integrity:\s*)"[^"]*"/,
-      `$1"${hash}"`,
-    );
-
-    if (updatedRegion !== skillRegion) {
-      changed = true;
-      updated = updated.slice(0, namePos) + updatedRegion + updated.slice(searchBound);
-    }
-  }
-
-  if (errors.length > 0) {
-    console.error("\nErrors found:");
-    for (const err of errors) {
-      console.error(`  - ${err}`);
-    }
-    process.exit(1);
-  }
-
-  if (changed) {
-    writeFileSync(SKILLS_TS_PATH, updated);
-  }
-
-  return changed;
-}
-
-async function main() {
-  const args = process.argv.slice(2);
-  const writeMode = args.includes("--write");
-  const checkMode = args.includes("--check");
-
-  console.log("Fetching skills from production...\n");
-
-  let remoteHashes: Map<string, string>;
-  try {
-    remoteHashes = await fetchAllHashes();
-  } catch (err) {
-    console.error("Failed to fetch skills:", err);
-    process.exit(1);
-  }
-
-  if (checkMode) {
-    const currentHashes = getCurrentHashes();
-    let hasChanges = false;
-
-    for (const [name, remoteHash] of remoteHashes) {
-      const currentHash = currentHashes.get(name);
-      if (currentHash !== remoteHash) {
-        console.log(`${name}: CHANGED`);
-        console.log(`  Current:  ${currentHash}`);
-        console.log(`  Expected: ${remoteHash}\n`);
-        hasChanges = true;
-      }
-    }
-
-    if (hasChanges) {
-      console.log("Skill hashes are out of date. Run with --write to update.");
-      process.exit(1);
-    } else {
-      console.log("All skill hashes are up to date.");
-      process.exit(0);
-    }
-  }
-
-  if (writeMode) {
-    const changed = updateSkillsFile(remoteHashes);
-    if (changed) {
-      console.log("Updated skills.ts with new hashes:");
-      for (const [name, hash] of remoteHashes) {
-        console.log(`  ${name}: ${hash}`);
-      }
-    } else {
-      console.log("No changes needed - hashes are already up to date.");
-    }
-  } else {
-    console.log("Generated hashes (run with --write to update skills.ts):\n");
-    for (const [name, hash] of remoteHashes) {
-      console.log(`  ${name}: ${hash}`);
-    }
-  }
-}
-
-main().catch((err) => {
-  console.error("Fatal error:", err);
-  process.exit(1);
-});