agenthub-multiagent-mcp 1.44.0 → 1.46.0

package/dist/skillPackInstaller.js

@@ -0,0 +1,211 @@
+// Installs an opt-in skill pack (add-skill-packs) into ~/.claude/skills/.
+//
+// Unlike the npm-bundled team skills (skillInstaller.ts), packs are NOT
+// force-installed on startup — only on an explicit skill_pack_install call. The
+// pack arrives as a gzip-tar archive from the AgentHub server; we extract it in
+// memory and apply the same hash-safe semantics per file:
+//   - missing locally                          -> install
+//   - matches the pack's current hash          -> no-op (skipped_current)
+//   - matches a hash we previously installed    -> update (our prior version)
+//   - matches nothing (user edited it)          -> skip, unless force=true
+//
+// "What we previously installed" is tracked in a per-pack record under
+// ~/.claude/skills/.packs/<pack>.json so version upgrades don't require force
+// while still never clobbering a file the user hand-edited.
+import { createHash } from "node:crypto";
+import { gunzipSync } from "node:zlib";
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+function sha256(buf) {
+    return createHash("sha256").update(buf).digest("hex");
+}
+// parseUstar decodes a (already gunzipped) USTAR tar buffer into its regular
+// files. The AgentHub server writes plain USTAR headers (Go archive/tar) and
+// every pack path is < 100 bytes, so no GNU/PAX long-name records appear. If
+// one ever does, fail loud rather than silently mis-parse.
+function parseUstar(buf) {
+    const entries = [];
+    let off = 0;
+    while (off + 512 <= buf.length) {
+        const block = buf.subarray(off, off + 512);
+        // Two consecutive zero blocks mark the end; a single zero block is enough
+        // to stop in practice.
+        if (block.every((b) => b === 0))
+            break;
+        const name = readCString(block, 0, 100);
+        const sizeStr = readCString(block, 124, 12).trim();
+        const size = sizeStr === "" ? 0 : parseInt(sizeStr, 8);
+        if (Number.isNaN(size) || size < 0) {
+            throw new Error(`skill pack: corrupt tar size field for "${name}"`);
+        }
+        const typeflag = String.fromCharCode(block[156]);
+        if (typeflag === "x" || typeflag === "g" || typeflag === "L" || typeflag === "K") {
+            throw new Error(`skill pack: archive uses extended (PAX/GNU) headers which are not supported`);
+        }
+        off += 512;
+        const content = Buffer.from(buf.subarray(off, off + size));
+        off += Math.ceil(size / 512) * 512;
+        // typeflag "0" or NUL = regular file; "5" = directory; others ignored.
+        if (typeflag === "0" || typeflag === "\0" || typeflag === "") {
+            entries.push({ name, content });
+        }
+    }
+    return entries;
+}
+function readCString(block, start, len) {
+    let end = start;
+    const limit = start + len;
+    while (end < limit && block[end] !== 0)
+        end++;
+    return block.toString("utf8", start, end);
+}
+// isSafePackPath rejects anything that could escape ~/.claude/. Pack files must
+// live under the "skills/" install root.
+function isSafePackPath(p) {
+    if (p.startsWith("/") || p.includes("..") || p.includes("\0"))
+        return false;
+    if (p.includes("\\"))
+        return false; // archive paths are forward-slash only
+    return p.startsWith("skills/");
+}
+function recordPath(claudeDir, pack) {
+    return join(claudeDir, "skills", ".packs", `${pack}.json`);
+}
+async function readRecord(claudeDir, pack) {
+    try {
+        const raw = await readFile(recordPath(claudeDir, pack), "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === "object" && parsed.files)
+            return parsed;
+    }
+    catch {
+        // missing/corrupt → treat as no prior install
+    }
+    return { version: "", files: {} };
+}
+function emptyCounts() {
+    return {
+        installed: 0,
+        updated: 0,
+        skipped_current: 0,
+        skipped_user_modified: 0,
+        overwritten_force: 0,
+        would_install: 0,
+        would_update: 0,
+        would_overwrite: 0,
+        error: 0,
+    };
+}
+/**
+ * installPackFromArchive applies a downloaded pack to ~/.claude/skills/.
+ * Hash-safe and idempotent. Returns a per-file action report.
+ */
+export async function installPackFromArchive(opts) {
+    const force = opts.force ?? false;
+    const dryRun = opts.dryRun ?? false;
+    const home = opts.targetHome ?? homedir();
+    const claudeDir = join(home, ".claude");
+    const report = {
+        pack: opts.pack,
+        version: opts.version,
+        actions: [],
+        counts: emptyCounts(),
+    };
+    const push = (a) => {
+        report.actions.push(a);
+        report.counts[a.action]++;
+    };
+    // Decompress + index the archive by path.
+    let files;
+    try {
+        const tar = gunzipSync(opts.archive);
+        const entries = parseUstar(tar);
+        files = new Map(entries.map((e) => [e.name, e.content]));
+    }
+    catch (err) {
+        throw new Error(`skill pack ${opts.pack}: ${err.message}`);
+    }
+    const prior = await readRecord(claudeDir, opts.pack);
+    const newRecord = { version: opts.version, files: {} };
+    for (const mf of opts.manifest) {
+        const path = mf.path;
+        if (!isSafePackPath(path)) {
+            push({ path, action: "error", message: "unsafe path rejected" });
+            continue;
+        }
+        const content = files.get(path);
+        if (!content) {
+            push({ path, action: "error", message: "file missing from archive" });
+            continue;
+        }
+        const bundleHash = sha256(content);
+        if (bundleHash !== mf.sha256) {
+            push({ path, action: "error", message: "archive hash mismatch (integrity)" });
+            continue;
+        }
+        const priorHashes = prior.files[path] ?? [];
+        // Record the current hash for next time regardless of the action taken.
+        newRecord.files[path] = dedupeAppend(priorHashes, bundleHash);
+        const target = join(claudeDir, path);
+        let userBuf = null;
+        try {
+            userBuf = await readFile(target);
+        }
+        catch {
+            userBuf = null;
+        }
+        if (userBuf === null) {
+            if (dryRun) {
+                push({ path, action: "would_install" });
+            }
+            else {
+                await mkdir(dirname(target), { recursive: true });
+                await writeFile(target, content);
+                push({ path, action: "installed" });
+            }
+            continue;
+        }
+        const userHash = sha256(userBuf);
+        if (userHash === bundleHash) {
+            push({ path, action: "skipped_current" });
+            continue;
+        }
+        if (priorHashes.includes(userHash)) {
+            if (dryRun) {
+                push({ path, action: "would_update" });
+            }
+            else {
+                await writeFile(target, content);
+                push({ path, action: "updated" });
+            }
+            continue;
+        }
+        if (force) {
+            if (dryRun) {
+                push({ path, action: "would_overwrite" });
+            }
+            else {
+                await writeFile(target, content);
+                push({ path, action: "overwritten_force" });
+            }
+            continue;
+        }
+        push({ path, action: "skipped_user_modified" });
+    }
+    if (!dryRun) {
+        await persistRecord(claudeDir, opts.pack, newRecord);
+    }
+    return report;
+}
+function dedupeAppend(hashes, hash) {
+    if (hashes.includes(hash))
+        return hashes;
+    return [...hashes, hash];
+}
+async function persistRecord(claudeDir, pack, rec) {
+    const p = recordPath(claudeDir, pack);
+    await mkdir(dirname(p), { recursive: true });
+    await writeFile(p, JSON.stringify(rec, null, 2));
+}
+//# sourceMappingURL=skillPackInstaller.js.map

package/dist/skillPackInstaller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skillPackInstaller.js","sourceRoot":"","sources":["../src/skillPackInstaller.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,gFAAgF;AAChF,gFAAgF;AAChF,0DAA0D;AAC1D,0DAA0D;AAC1D,0EAA0E;AAC1E,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,uEAAuE;AACvE,8EAA8E;AAC9E,4DAA4D;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsC1C,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAOD,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,2DAA2D;AAC3D,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QAC3C,0EAA0E;QAC1E,uBAAuB;QACvB,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM;QAEvC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAEjD,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,GAAG,IAAI,GAAG,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;QAC3D,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;QAEnC,uEAAuE;QACvE,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa,EAAE,GAAW;IAC5D,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,MAAM,KAAK,GAAG,KAAK,GAAG,GAAG,CAAC;IAC1B,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,CAAC;IAC9C,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,gFAAgF;AAChF,yCAAyC;AACzC,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,uCAAuC;IAC3E,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAQD,SAAS,UAAU,CAAC,SAAiB,EAAE,IAAY;IACjD,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,IAAY;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;QAC7C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;QACV,eAAe,EAAE,CAAC;QAClB,qBAAqB,EAAE,CAAC;QACxB,iBAAiB,EAAE,CAAC;QACpB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC;QACf,eAAe,EAAE,CAAC;QAClB,KAAK,EAAE,CAAC;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAwB;IAExB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAExC,MAAM,MAAM,GAAsB;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,WAAW,EAAE;KACtB,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAiB,EAAE,EAAE;QACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,0CAA0C;IAC1C,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,SAAS,GAAe,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAEnE,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,UAAU,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;YAC7B,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,wEAAwE;QACxE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACjC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACtC,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACjC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACpC,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACjC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC9C,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAgB,EAAE,IAAY;IAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,OAAO,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,IAAY,EAAE,GAAe;IAC3E,MAAM,CAAC,GAAG,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/skillPackInstaller.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skillPackInstaller.test.d.ts.map

package/dist/skillPackInstaller.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skillPackInstaller.test.d.ts","sourceRoot":"","sources":["../src/skillPackInstaller.test.ts"],"names":[],"mappings":""}

package/dist/skillPackInstaller.test.js

@@ -0,0 +1,167 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { gzipSync } from "node:zlib";
+import { installPackFromArchive } from "./skillPackInstaller.js";
+function sha256(s) {
+    return createHash("sha256").update(s).digest("hex");
+}
+// Build a plain USTAR header for one regular file.
+function tarHeader(name, size) {
+    const h = Buffer.alloc(512);
+    h.write(name, 0, "utf8");
+    h.write("0000644\0", 100);
+    h.write("0000000\0", 108);
+    h.write("0000000\0", 116);
+    h.write(size.toString(8).padStart(11, "0") + "\0", 124);
+    h.write("00000000000\0", 136); // mtime
+    h.write("ustar\0", 257);
+    h.write("00", 263);
+    h[156] = "0".charCodeAt(0); // typeflag = regular file
+    // checksum: spaces in the field, sum bytes, write 6 octal digits + NUL + space
+    for (let i = 148; i < 156; i++)
+        h[i] = 0x20;
+    let sum = 0;
+    for (let i = 0; i < 512; i++)
+        sum += h[i];
+    h.write(sum.toString(8).padStart(6, "0") + "\0 ", 148);
+    return h;
+}
+function makeTarGz(files) {
+    const blocks = [];
+    for (const f of files) {
+        const content = Buffer.from(f.content, "utf8");
+        blocks.push(tarHeader(f.name, content.length));
+        const padded = Buffer.alloc(Math.ceil(content.length / 512) * 512);
+        content.copy(padded);
+        blocks.push(padded);
+    }
+    blocks.push(Buffer.alloc(512));
+    blocks.push(Buffer.alloc(512));
+    return gzipSync(Buffer.concat(blocks));
+}
+function manifestFor(files) {
+    return files.map((f) => ({
+        path: f.name,
+        sha256: sha256(f.content),
+        size: Buffer.byteLength(f.content),
+    }));
+}
+describe("installPackFromArchive", () => {
+    let home;
+    const PATH_A = "skills/demo/SKILL.md";
+    const PATH_B = "skills/demo/references/r.md";
+    beforeEach(() => {
+        home = mkdtempSync(join(tmpdir(), "packinstall-"));
+    });
+    afterEach(() => {
+        rmSync(home, { recursive: true, force: true });
+    });
+    function targetOf(path) {
+        return join(home, ".claude", path);
+    }
+    it("installs all files on a pristine machine", async () => {
+        const files = [
+            { name: PATH_A, content: "# A v1" },
+            { name: PATH_B, content: "ref v1" },
+        ];
+        const report = await installPackFromArchive({
+            pack: "demo",
+            version: "1.0.0",
+            manifest: manifestFor(files),
+            archive: makeTarGz(files),
+            targetHome: home,
+        });
+        expect(report.counts.installed).toBe(2);
+        expect(readFileSync(targetOf(PATH_A), "utf8")).toBe("# A v1");
+        expect(readFileSync(targetOf(PATH_B), "utf8")).toBe("ref v1");
+        // Record written.
+        expect(existsSync(join(home, ".claude", "skills", ".packs", "demo.json"))).toBe(true);
+    });
+    it("is a no-op on re-install of the same version", async () => {
+        const files = [{ name: PATH_A, content: "# A v1" }];
+        const opts = {
+            pack: "demo",
+            version: "1.0.0",
+            manifest: manifestFor(files),
+            archive: makeTarGz(files),
+            targetHome: home,
+        };
+        await installPackFromArchive(opts);
+        const second = await installPackFromArchive(opts);
+        expect(second.counts.skipped_current).toBe(1);
+        expect(second.counts.installed).toBe(0);
+    });
+    it("updates a file we previously installed when the version changes", async () => {
+        const v1 = [{ name: PATH_A, content: "# A v1" }];
+        await installPackFromArchive({
+            pack: "demo", version: "1.0.0",
+            manifest: manifestFor(v1), archive: makeTarGz(v1), targetHome: home,
+        });
+        const v2 = [{ name: PATH_A, content: "# A v2" }];
+        const report = await installPackFromArchive({
+            pack: "demo", version: "2.0.0",
+            manifest: manifestFor(v2), archive: makeTarGz(v2), targetHome: home,
+        });
+        expect(report.counts.updated).toBe(1);
+        expect(readFileSync(targetOf(PATH_A), "utf8")).toBe("# A v2");
+    });
+    it("never clobbers a user-modified file unless forced", async () => {
+        const v1 = [{ name: PATH_A, content: "# A v1" }];
+        await installPackFromArchive({
+            pack: "demo", version: "1.0.0",
+            manifest: manifestFor(v1), archive: makeTarGz(v1), targetHome: home,
+        });
+        // User edits the file.
+        writeFileSync(targetOf(PATH_A), "# A user-edited");
+        const v2 = [{ name: PATH_A, content: "# A v2" }];
+        const skip = await installPackFromArchive({
+            pack: "demo", version: "2.0.0",
+            manifest: manifestFor(v2), archive: makeTarGz(v2), targetHome: home,
+        });
+        expect(skip.counts.skipped_user_modified).toBe(1);
+        expect(readFileSync(targetOf(PATH_A), "utf8")).toBe("# A user-edited");
+        const forced = await installPackFromArchive({
+            pack: "demo", version: "2.0.0", force: true,
+            manifest: manifestFor(v2), archive: makeTarGz(v2), targetHome: home,
+        });
+        expect(forced.counts.overwritten_force).toBe(1);
+        expect(readFileSync(targetOf(PATH_A), "utf8")).toBe("# A v2");
+    });
+    it("rejects a file whose archive bytes don't match the manifest hash", async () => {
+        const files = [{ name: PATH_A, content: "real content" }];
+        const manifest = manifestFor(files);
+        manifest[0].sha256 = sha256("tampered"); // mismatch
+        const report = await installPackFromArchive({
+            pack: "demo", version: "1.0.0",
+            manifest, archive: makeTarGz(files), targetHome: home,
+        });
+        expect(report.counts.error).toBe(1);
+        expect(report.actions[0].message).toContain("integrity");
+        expect(existsSync(targetOf(PATH_A))).toBe(false);
+    });
+    it("rejects an unsafe (path-traversal) manifest entry", async () => {
+        const files = [{ name: PATH_A, content: "ok" }];
+        const manifest = manifestFor(files);
+        manifest.push({ path: "../../evil.sh", sha256: sha256("x"), size: 1 });
+        const report = await installPackFromArchive({
+            pack: "demo", version: "1.0.0",
+            manifest, archive: makeTarGz(files), targetHome: home,
+        });
+        expect(report.counts.error).toBe(1);
+        expect(report.actions.find((a) => a.path === "../../evil.sh")?.message).toContain("unsafe");
+    });
+    it("dry-run writes nothing", async () => {
+        const files = [{ name: PATH_A, content: "# A" }];
+        const report = await installPackFromArchive({
+            pack: "demo", version: "1.0.0", dryRun: true,
+            manifest: manifestFor(files), archive: makeTarGz(files), targetHome: home,
+        });
+        expect(report.counts.would_install).toBe(1);
+        expect(existsSync(targetOf(PATH_A))).toBe(false);
+        expect(existsSync(join(home, ".claude", "skills", ".packs", "demo.json"))).toBe(false);
+    });
+});
+//# sourceMappingURL=skillPackInstaller.test.js.map

package/dist/skillPackInstaller.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skillPackInstaller.test.js","sourceRoot":"","sources":["../src/skillPackInstaller.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAa,UAAU,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,SAAS,MAAM,CAAC,CAAkB;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,mDAAmD;AACnD,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ;IACvC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;IACtD,+EAA+E;IAC/E,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;QAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5C,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS,CAAC,KAA0C;IAC3D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,KAA0C;IAC7D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;KACnC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,IAAY,CAAC;IACjB,MAAM,MAAM,GAAG,sBAAsB,CAAC;IACtC,MAAM,MAAM,GAAG,6BAA6B,CAAC;IAE7C,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,SAAS,QAAQ,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,KAAK,GAAG;YACZ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;YACnC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;SACpC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC;YAC5B,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,kBAAkB;QAClB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC;YAC5B,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,IAAI;SACjB,CAAC;QACF,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,MAAM,sBAAsB,CAAC;YAC3B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;SACpE,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;SACpE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,MAAM,sBAAsB,CAAC;YAC3B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;SACpE,CAAC,CAAC;QACH,uBAAuB;QACvB,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAEnD,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;YACxC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;SACpE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI;YAC3C,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;SACpE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;QACpD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;YAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI;YAC5C,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI;SAC1E,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAqD,MAAM,cAAc,CAAC;AACrG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AA8B/D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,cAAc,EAAE,MAAM,WAAW,CAAC;CACnC;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAwJD,wBAAgB,aAAa,IAAI,IAAI,EAAE,CA0+EtC;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAg1ElB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAqD,MAAM,cAAc,CAAC;AACrG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AA+B/D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,cAAc,EAAE,MAAM,WAAW,CAAC;CACnC;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAwJD,wBAAgB,aAAa,IAAI,IAAI,EAAE,CA4hFtC;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CA26ElB"}

package/dist/tools/index.js

@@ -8,6 +8,7 @@ import * as brainCapture from "../hooks/brainCapture.js";
 import { getBrain } from "../brain/backend.js";
 import open from "open";
 import { registerOpenSpecVizTools, handleOpenSpecVizToolCall } from "./openspec-viz/index.js";
+import { installPackFromArchive } from "../skillPackInstaller.js";
 import { getServerTime, useTimeInjection } from "../lib/server-time.js";
 import { ENG_IC_CHARTER } from "../employee.js";
 /**
@@ -735,6 +736,28 @@ export function registerTools() {
                 required: ["to_user", "text"],
             },
         },
+        {
+            name: "slack_upload_file",
+            description: "Upload a file you produced (PDF, CSV, docx, deck, log, etc.) to a Slack channel or a person's DM (employees only, governed). Generate the file locally first, then call this with the target and the file's local path. target is a Slack channel id (C0123ABC), a #channel-name (the bot must be a member), or a user id (U0123ABC) to deliver it as a DM. For delivering into your current task's thread, use deliver_file instead.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    target: {
+                        type: "string",
+                        description: "Where to upload: a channel id (C0123ABC), a #channel-name, or a user id (U0123ABC) for a DM",
+                    },
+                    file_path: {
+                        type: "string",
+                        description: "Absolute local path to the file to upload",
+                    },
+                    comment: {
+                        type: "string",
+                        description: "Optional short message shown with the file",
+                    },
+                },
+                required: ["target", "file_path"],
+            },
+        },
         // Discovery tools
         {
             name: "list_agents",
@@ -843,6 +866,29 @@ export function registerTools() {
                 },
             },
         },
+        {
+            name: "skill_pack_list",
+            description: "List the opt-in skill packs the AgentHub server offers (e.g. cybersecurity, brag) with this agent's install status and whether install is permitted. Skill packs are NOT installed automatically — use skill_pack_install to opt in. Destructive packs require the matching skill-pack:<name> capability.",
+            inputSchema: {
+                type: "object",
+                properties: {},
+            },
+        },
+        {
+            name: "skill_pack_install",
+            description: "Install an opt-in skill pack into ~/.claude/skills/. Hash-safe (never overwrites files you've edited unless force=true). Destructive packs (e.g. cybersecurity, which ships offensive PoC scripts) require the skill-pack:<name> capability attached to this agent. Returns a per-file install report.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    pack: { type: "string", description: "Pack name, e.g. \"cybersecurity\" or \"brag\" (see skill_pack_list)" },
+                    force: {
+                        type: "boolean",
+                        description: "Overwrite locally-modified pack files (default false)",
+                    },
+                },
+                required: ["pack"],
+            },
+        },
         {
             name: "api_search",
             description: "Search the API knowledge graph — endpoints (REST/MCP/GraphQL/gRPC) extracted from indexed repos across the org. Use this BEFORE building a new endpoint to check if it already exists or to match a sibling project's contract. Org-wide read.",
@@ -3257,6 +3303,12 @@ export async function handleToolCall(name, args, client, context) {
             const result = await client.employeeSlackDM(args.to_user, args.text);
             return wrapWithPendingItems(client, agentId, result, context);
         }
+        case "slack_upload_file": {
+            if (!agentId)
+                throw new Error("Not registered. Call agent_register first.");
+            const result = await client.uploadSlackFile(args.target, args.file_path, args.comment);
+            return wrapWithPendingItems(client, agentId, result, context);
+        }
         // Discovery
         case "list_agents": {
             const result = await client.listAgents(args.status);
@@ -3800,6 +3852,82 @@ export async function handleToolCall(name, args, client, context) {
                 message: `Filed bug ${result.key} (${result.severity}/${result.bug_state}): ${args.title}`,
             };
         }
+        case "skill_pack_list": {
+            try {
+                const { packs } = await client.listSkillPacks();
+                const lines = packs.map((p) => {
+                    const gate = p.requires_capability
+                        ? p.permitted
+                            ? "permitted"
+                            : `needs capability ${p.capability}`
+                        : "ungated";
+                    return `${p.name} v${p.version} (${p.tier}, ${p.skill_count} skills) — ${gate}`;
+                });
+                return {
+                    ok: true,
+                    packs,
+                    message: packs.length === 0
+                        ? "No skill packs available."
+                        : `Available skill packs:\n${lines.join("\n")}`,
+                };
+            }
+            catch (err) {
+                const e = err;
+                // Most likely the master switch is off (503 skill_packs_disabled).
+                return {
+                    ok: false,
+                    error: "skill_packs_unavailable",
+                    message: e.message,
+                };
+            }
+        }
+        case "skill_pack_install": {
+            const pack = args.pack?.trim();
+            if (!pack) {
+                return { ok: false, error: "invalid_args", message: "pack is required" };
+            }
+            const force = args.force === true;
+            // Download the archive first — the server enforces the master switch and
+            // (for destructive packs) the capability gate here, returning a coded
+            // error before sending any bytes.
+            let archive;
+            try {
+                archive = await client.fetchSkillPackArchive(pack);
+            }
+            catch (err) {
+                const e = err;
+                if (e.code === "skill_pack_capability_required") {
+                    return {
+                        ok: false,
+                        error: e.code,
+                        message: `Installing "${pack}" requires the skill-pack:${pack} capability. Request it via capability_request, then retry.`,
+                    };
+                }
+                if (e.code === "skill_packs_disabled" || e.code === "skill_pack_not_found") {
+                    return { ok: false, error: e.code, message: e.message };
+                }
+                throw err;
+            }
+            const manifest = await client.getSkillPackManifest(pack);
+            const report = await installPackFromArchive({
+                pack,
+                version: manifest.version,
+                manifest: manifest.files,
+                archive,
+                force,
+            });
+            const c = report.counts;
+            const summary = `${pack} v${manifest.version}: ${c.installed} installed, ${c.updated} updated, ` +
+                `${c.skipped_current} unchanged, ${c.skipped_user_modified} skipped (user-modified), ` +
+                `${c.overwritten_force} overwritten, ${c.error} errors.`;
+            return {
+                ok: c.error === 0,
+                pack,
+                version: manifest.version,
+                counts: c,
+                message: summary,
+            };
+        }
         case "ticket_get": {
             const workingDir = context.getWorkingDir();
             const agentState = state.loadState(workingDir);