agenthub-multiagent-mcp 1.44.0 → 1.45.0

package/dist/skillPackInstaller.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skillPackInstaller.test.d.ts","sourceRoot":"","sources":["../src/skillPackInstaller.test.ts"],"names":[],"mappings":""}

package/dist/skillPackInstaller.test.js

@@ -0,0 +1,167 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { gzipSync } from "node:zlib";
+import { installPackFromArchive } from "./skillPackInstaller.js";
+function sha256(s) {
+    return createHash("sha256").update(s).digest("hex");
+}
+// Build a plain USTAR header for one regular file.
+function tarHeader(name, size) {
+    const h = Buffer.alloc(512);
+    h.write(name, 0, "utf8");
+    h.write("0000644\0", 100);
+    h.write("0000000\0", 108);
+    h.write("0000000\0", 116);
+    h.write(size.toString(8).padStart(11, "0") + "\0", 124);
+    h.write("00000000000\0", 136); // mtime
+    h.write("ustar\0", 257);
+    h.write("00", 263);
+    h[156] = "0".charCodeAt(0); // typeflag = regular file
+    // checksum: spaces in the field, sum bytes, write 6 octal digits + NUL + space
+    for (let i = 148; i < 156; i++)
+        h[i] = 0x20;
+    let sum = 0;
+    for (let i = 0; i < 512; i++)
+        sum += h[i];
+    h.write(sum.toString(8).padStart(6, "0") + "\0 ", 148);
+    return h;
+}
+function makeTarGz(files) {
+    const blocks = [];
+    for (const f of files) {
+        const content = Buffer.from(f.content, "utf8");
+        blocks.push(tarHeader(f.name, content.length));
+        const padded = Buffer.alloc(Math.ceil(content.length / 512) * 512);
+        content.copy(padded);
+        blocks.push(padded);
+    }
+    blocks.push(Buffer.alloc(512));
+    blocks.push(Buffer.alloc(512));
+    return gzipSync(Buffer.concat(blocks));
+}
+function manifestFor(files) {
+    return files.map((f) => ({
+        path: f.name,
+        sha256: sha256(f.content),
+        size: Buffer.byteLength(f.content),
+    }));
+}
+describe("installPackFromArchive", () => {
+    let home;
+    const PATH_A = "skills/demo/SKILL.md";
+    const PATH_B = "skills/demo/references/r.md";
+    beforeEach(() => {
+        home = mkdtempSync(join(tmpdir(), "packinstall-"));
+    });
+    afterEach(() => {
+        rmSync(home, { recursive: true, force: true });
+    });
+    function targetOf(path) {
+        return join(home, ".claude", path);
+    }
+    it("installs all files on a pristine machine", async () => {
+        const files = [
+            { name: PATH_A, content: "# A v1" },
+            { name: PATH_B, content: "ref v1" },
+        ];
+        const report = await installPackFromArchive({
+            pack: "demo",
+            version: "1.0.0",
+            manifest: manifestFor(files),
+            archive: makeTarGz(files),
+            targetHome: home,
+        });
+        expect(report.counts.installed).toBe(2);
+        expect(readFileSync(targetOf(PATH_A), "utf8")).toBe("# A v1");
+        expect(readFileSync(targetOf(PATH_B), "utf8")).toBe("ref v1");
+        // Record written.
+        expect(existsSync(join(home, ".claude", "skills", ".packs", "demo.json"))).toBe(true);
+    });
+    it("is a no-op on re-install of the same version", async () => {
+        const files = [{ name: PATH_A, content: "# A v1" }];
+        const opts = {
+            pack: "demo",
+            version: "1.0.0",
+            manifest: manifestFor(files),
+            archive: makeTarGz(files),
+            targetHome: home,
+        };
+        await installPackFromArchive(opts);
+        const second = await installPackFromArchive(opts);
+        expect(second.counts.skipped_current).toBe(1);
+        expect(second.counts.installed).toBe(0);
+    });
+    it("updates a file we previously installed when the version changes", async () => {
+        const v1 = [{ name: PATH_A, content: "# A v1" }];
+        await installPackFromArchive({
+            pack: "demo", version: "1.0.0",
+            manifest: manifestFor(v1), archive: makeTarGz(v1), targetHome: home,
+        });
+        const v2 = [{ name: PATH_A, content: "# A v2" }];
+        const report = await installPackFromArchive({
+            pack: "demo", version: "2.0.0",
+            manifest: manifestFor(v2), archive: makeTarGz(v2), targetHome: home,
+        });
+        expect(report.counts.updated).toBe(1);
+        expect(readFileSync(targetOf(PATH_A), "utf8")).toBe("# A v2");
+    });
+    it("never clobbers a user-modified file unless forced", async () => {
+        const v1 = [{ name: PATH_A, content: "# A v1" }];
+        await installPackFromArchive({
+            pack: "demo", version: "1.0.0",
+            manifest: manifestFor(v1), archive: makeTarGz(v1), targetHome: home,
+        });
+        // User edits the file.
+        writeFileSync(targetOf(PATH_A), "# A user-edited");
+        const v2 = [{ name: PATH_A, content: "# A v2" }];
+        const skip = await installPackFromArchive({
+            pack: "demo", version: "2.0.0",
+            manifest: manifestFor(v2), archive: makeTarGz(v2), targetHome: home,
+        });
+        expect(skip.counts.skipped_user_modified).toBe(1);
+        expect(readFileSync(targetOf(PATH_A), "utf8")).toBe("# A user-edited");
+        const forced = await installPackFromArchive({
+            pack: "demo", version: "2.0.0", force: true,
+            manifest: manifestFor(v2), archive: makeTarGz(v2), targetHome: home,
+        });
+        expect(forced.counts.overwritten_force).toBe(1);
+        expect(readFileSync(targetOf(PATH_A), "utf8")).toBe("# A v2");
+    });
+    it("rejects a file whose archive bytes don't match the manifest hash", async () => {
+        const files = [{ name: PATH_A, content: "real content" }];
+        const manifest = manifestFor(files);
+        manifest[0].sha256 = sha256("tampered"); // mismatch
+        const report = await installPackFromArchive({
+            pack: "demo", version: "1.0.0",
+            manifest, archive: makeTarGz(files), targetHome: home,
+        });
+        expect(report.counts.error).toBe(1);
+        expect(report.actions[0].message).toContain("integrity");
+        expect(existsSync(targetOf(PATH_A))).toBe(false);
+    });
+    it("rejects an unsafe (path-traversal) manifest entry", async () => {
+        const files = [{ name: PATH_A, content: "ok" }];
+        const manifest = manifestFor(files);
+        manifest.push({ path: "../../evil.sh", sha256: sha256("x"), size: 1 });
+        const report = await installPackFromArchive({
+            pack: "demo", version: "1.0.0",
+            manifest, archive: makeTarGz(files), targetHome: home,
+        });
+        expect(report.counts.error).toBe(1);
+        expect(report.actions.find((a) => a.path === "../../evil.sh")?.message).toContain("unsafe");
+    });
+    it("dry-run writes nothing", async () => {
+        const files = [{ name: PATH_A, content: "# A" }];
+        const report = await installPackFromArchive({
+            pack: "demo", version: "1.0.0", dryRun: true,
+            manifest: manifestFor(files), archive: makeTarGz(files), targetHome: home,
+        });
+        expect(report.counts.would_install).toBe(1);
+        expect(existsSync(targetOf(PATH_A))).toBe(false);
+        expect(existsSync(join(home, ".claude", "skills", ".packs", "demo.json"))).toBe(false);
+    });
+});
+//# sourceMappingURL=skillPackInstaller.test.js.map

package/dist/skillPackInstaller.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skillPackInstaller.test.js","sourceRoot":"","sources":["../src/skillPackInstaller.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAa,UAAU,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,SAAS,MAAM,CAAC,CAAkB;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,mDAAmD;AACnD,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ;IACvC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;IACtD,+EAA+E;IAC/E,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;QAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5C,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS,CAAC,KAA0C;IAC3D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,KAA0C;IAC7D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;KACnC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,IAAY,CAAC;IACjB,MAAM,MAAM,GAAG,sBAAsB,CAAC;IACtC,MAAM,MAAM,GAAG,6BAA6B,CAAC;IAE7C,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,SAAS,QAAQ,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,KAAK,GAAG;YACZ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;YACnC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;SACpC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC;YAC5B,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,kBAAkB;QAClB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC;YAC5B,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,IAAI;SACjB,CAAC;QACF,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,MAAM,sBAAsB,CAAC;YAC3B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;SACpE,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;SACpE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,MAAM,sBAAsB,CAAC;YAC3B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;SACpE,CAAC,CAAC;QACH,uBAAuB;QACvB,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAEnD,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;YACxC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;SACpE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI;YAC3C,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;SACpE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;QACpD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI;YAC5C,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI;SAC1E,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAqD,MAAM,cAAc,CAAC;AACrG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AA8B/D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,cAAc,EAAE,MAAM,WAAW,CAAC;CACnC;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAwJD,wBAAgB,aAAa,IAAI,IAAI,EAAE,CA0+EtC;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAg1ElB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAqD,MAAM,cAAc,CAAC;AACrG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AA+B/D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,cAAc,EAAE,MAAM,WAAW,CAAC;CACnC;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAwJD,wBAAgB,aAAa,IAAI,IAAI,EAAE,CAmgFtC;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAi6ElB"}

package/dist/tools/index.js

@@ -8,6 +8,7 @@ import * as brainCapture from "../hooks/brainCapture.js";
 import { getBrain } from "../brain/backend.js";
 import open from "open";
 import { registerOpenSpecVizTools, handleOpenSpecVizToolCall } from "./openspec-viz/index.js";
+import { installPackFromArchive } from "../skillPackInstaller.js";
 import { getServerTime, useTimeInjection } from "../lib/server-time.js";
 import { ENG_IC_CHARTER } from "../employee.js";
 /**
@@ -843,6 +844,29 @@ export function registerTools() {
                 },
             },
         },
+        {
+            name: "skill_pack_list",
+            description: "List the opt-in skill packs the AgentHub server offers (e.g. cybersecurity, brag) with this agent's install status and whether install is permitted. Skill packs are NOT installed automatically — use skill_pack_install to opt in. Destructive packs require the matching skill-pack:<name> capability.",
+            inputSchema: {
+                type: "object",
+                properties: {},
+            },
+        },
+        {
+            name: "skill_pack_install",
+            description: "Install an opt-in skill pack into ~/.claude/skills/. Hash-safe (never overwrites files you've edited unless force=true). Destructive packs (e.g. cybersecurity, which ships offensive PoC scripts) require the skill-pack:<name> capability attached to this agent. Returns a per-file install report.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    pack: { type: "string", description: "Pack name, e.g. \"cybersecurity\" or \"brag\" (see skill_pack_list)" },
+                    force: {
+                        type: "boolean",
+                        description: "Overwrite locally-modified pack files (default false)",
+                    },
+                },
+                required: ["pack"],
+            },
+        },
         {
             name: "api_search",
             description: "Search the API knowledge graph — endpoints (REST/MCP/GraphQL/gRPC) extracted from indexed repos across the org. Use this BEFORE building a new endpoint to check if it already exists or to match a sibling project's contract. Org-wide read.",
@@ -3800,6 +3824,82 @@ export async function handleToolCall(name, args, client, context) {
                 message: `Filed bug ${result.key} (${result.severity}/${result.bug_state}): ${args.title}`,
             };
         }
+        case "skill_pack_list": {
+            try {
+                const { packs } = await client.listSkillPacks();
+                const lines = packs.map((p) => {
+                    const gate = p.requires_capability
+                        ? p.permitted
+                            ? "permitted"
+                            : `needs capability ${p.capability}`
+                        : "ungated";
+                    return `${p.name} v${p.version} (${p.tier}, ${p.skill_count} skills) — ${gate}`;
+                });
+                return {
+                    ok: true,
+                    packs,
+                    message: packs.length === 0
+                        ? "No skill packs available."
+                        : `Available skill packs:\n${lines.join("\n")}`,
+                };
+            }
+            catch (err) {
+                const e = err;
+                // Most likely the master switch is off (503 skill_packs_disabled).
+                return {
+                    ok: false,
+                    error: "skill_packs_unavailable",
+                    message: e.message,
+                };
+            }
+        }
+        case "skill_pack_install": {
+            const pack = args.pack?.trim();
+            if (!pack) {
+                return { ok: false, error: "invalid_args", message: "pack is required" };
+            }
+            const force = args.force === true;
+            // Download the archive first — the server enforces the master switch and
+            // (for destructive packs) the capability gate here, returning a coded
+            // error before sending any bytes.
+            let archive;
+            try {
+                archive = await client.fetchSkillPackArchive(pack);
+            }
+            catch (err) {
+                const e = err;
+                if (e.code === "skill_pack_capability_required") {
+                    return {
+                        ok: false,
+                        error: e.code,
+                        message: `Installing "${pack}" requires the skill-pack:${pack} capability. Request it via capability_request, then retry.`,
+                    };
+                }
+                if (e.code === "skill_packs_disabled" || e.code === "skill_pack_not_found") {
+                    return { ok: false, error: e.code, message: e.message };
+                }
+                throw err;
+            }
+            const manifest = await client.getSkillPackManifest(pack);
+            const report = await installPackFromArchive({
+                pack,
+                version: manifest.version,
+                manifest: manifest.files,
+                archive,
+                force,
+            });
+            const c = report.counts;
+            const summary = `${pack} v${manifest.version}: ${c.installed} installed, ${c.updated} updated, ` +
+                `${c.skipped_current} unchanged, ${c.skipped_user_modified} skipped (user-modified), ` +
+                `${c.overwritten_force} overwritten, ${c.error} errors.`;
+            return {
+                ok: c.error === 0,
+                pack,
+                version: manifest.version,
+                counts: c,
+                message: summary,
+            };
+        }
         case "ticket_get": {
             const workingDir = context.getWorkingDir();
             const agentState = state.loadState(workingDir);