autohand-cli 0.8.0 → 0.8.3

package/dist/{chunk-IQ5RXU6O.js → chunk-QEGOB6QV.js}

@@ -1,7 +1,7 @@
 import {
   __commonJS,
   __toESM
-} from "./chunk-JSBRDJBE.js";
+} from "./chunk-QGM4M3NI.js";
 
 // node_modules/cli-spinners/spinners.json
 var require_spinners = __commonJS({

package/dist/{chunk-JSBRDJBE.js → chunk-QGM4M3NI.js}

@@ -4,7 +4,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJS = (cb, mod) => function __require() {
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
 var __copyProps = (to, from, except, desc) => {
@@ -25,6 +31,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 export {
+  __require,
   __commonJS,
   __toESM
 };

package/dist/{chunk-EF4LKUQY.js → chunk-QNGEW5TC.js}

@@ -1,6 +1,6 @@
 import {
   t
-} from "./chunk-HFMLWH7B.js";
+} from "./chunk-APIXPPMT.js";
 
 // src/commands/memory.ts
 import chalk from "chalk";

package/dist/{chunk-QT2VZNFA.js → chunk-QXH5RCFI.js}

@@ -1,6 +1,6 @@
 import {
   t
-} from "./chunk-HFMLWH7B.js";
+} from "./chunk-APIXPPMT.js";
 
 // src/commands/import.ts
 var metadata = {
@@ -9,7 +9,7 @@ var metadata = {
   implemented: true
 };
 async function execute(args) {
-  const { runImport } = await import("./import-EAAX5HJR.js");
+  const { runImport } = await import("./import-W7SVLSTC.js");
   const source = args[0];
   const flags = args.slice(1);
   const all = flags.includes("--all");

package/dist/chunk-R33VKSH5.cjs

@@ -0,0 +1,348 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _chunkZYQMLKOKcjs = require('./chunk-ZYQMLKOK.cjs');
+
+
+
+var _chunkSEKD5FH3cjs = require('./chunk-SEKD5FH3.cjs');
+
+
+var _chunk7BTSG4MEcjs = require('./chunk-7BTSG4ME.cjs');
+
+// src/skills/communityInstaller.ts
+var _crypto = require('crypto'); var _crypto2 = _interopRequireDefault(_crypto);
+var _path = require('path'); var _path2 = _interopRequireDefault(_path);
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+
+// src/skills/LearnClient.ts
+
+var DEFAULT_LIMIT = 5;
+var LearnClient = class {
+  search(registry, query, limit = DEFAULT_LIMIT) {
+    if (!query.trim()) return [];
+    const lowerQuery = query.toLowerCase();
+    const matched = registry.skills.filter((skill) => {
+      const searchText = [
+        skill.name,
+        skill.description,
+        skill.category,
+        ...skill.tags || [],
+        ...skill.languages || [],
+        ...skill.frameworks || []
+      ].join(" ").toLowerCase();
+      return searchText.includes(lowerQuery);
+    });
+    matched.sort((a, b) => (_nullishCoalesce(b.downloadCount, () => ( 0))) - (_nullishCoalesce(a.downloadCount, () => ( 0))));
+    return matched.slice(0, limit);
+  }
+  trending(registry, limit = 10) {
+    const sorted = [...registry.skills].sort((a, b) => {
+      const featuredDiff = Number(Boolean(b.isFeatured)) - Number(Boolean(a.isFeatured));
+      if (featuredDiff !== 0) return featuredDiff;
+      return (_nullishCoalesce(b.downloadCount, () => ( 0))) - (_nullishCoalesce(a.downloadCount, () => ( 0)));
+    });
+    return sorted.slice(0, limit);
+  }
+  findBySlug(registry, slug) {
+    let searchName = slug;
+    let searchAuthor;
+    if (slug.startsWith("@")) {
+      const parts = slug.slice(1).split("/");
+      if (parts.length === 2) {
+        searchAuthor = parts[0].toLowerCase();
+        searchName = parts[1].toLowerCase();
+      }
+    }
+    const lower = searchName.toLowerCase();
+    return registry.skills.find((s) => {
+      const nameMatch = s.id.toLowerCase() === lower || s.name.toLowerCase() === lower;
+      if (!nameMatch) return false;
+      if (searchAuthor && _optionalChain([s, 'access', _ => _.author, 'optionalAccess', _2 => _2.toLowerCase, 'call', _3 => _3()]) !== searchAuthor) return false;
+      return true;
+    }) || null;
+  }
+  filterLearnedSkills(skills) {
+    return skills.filter(
+      (s) => s.metadata && s.metadata["agentskill-slug"]
+    );
+  }
+  checkUpdates(installedSkills, registry, getShaForSkill) {
+    const updates = [];
+    for (const skill of installedSkills) {
+      const slug = _optionalChain([skill, 'access', _4 => _4.metadata, 'optionalAccess', _5 => _5["agentskill-slug"]]);
+      const localSha = _optionalChain([skill, 'access', _6 => _6.metadata, 'optionalAccess', _7 => _7["agentskill-sha"]]);
+      if (!slug || !localSha) continue;
+      const registrySkill = registry.skills.find(
+        (s) => s.id === slug || s.name === slug
+      );
+      if (!registrySkill) continue;
+      const remoteSha = getShaForSkill(registrySkill.id);
+      if (remoteSha && remoteSha !== localSha) {
+        updates.push({
+          name: skill.name,
+          slug,
+          localSha,
+          remoteSha
+        });
+      }
+    }
+    return updates;
+  }
+  static computeContentSha(content) {
+    return _crypto.createHash.call(void 0, "sha256").update(content).digest("hex").slice(0, 7);
+  }
+};
+
+// src/skills/SkillSecurityScanner.ts
+var THREAT_RULES = [
+  // Command injection
+  { category: "command-injection", pattern: /rm\s+-rf\b/i, severity: 15 },
+  { category: "command-injection", pattern: /curl\s+.*\|\s*bash/i, severity: 20 },
+  { category: "command-injection", pattern: /wget\s+.*\|\s*bash/i, severity: 20 },
+  { category: "command-injection", pattern: /\beval\s*\(/i, severity: 15 },
+  { category: "command-injection", pattern: /\bexec\s*\(/i, severity: 12 },
+  { category: "command-injection", pattern: /\bsudo\b/i, severity: 15 },
+  { category: "command-injection", pattern: /chmod\s+777\b/i, severity: 12 },
+  // Data exfiltration
+  { category: "data-exfiltration", pattern: /process\.env\b/i, severity: 10 },
+  { category: "data-exfiltration", pattern: /\bcredentials?\b/i, severity: 8 },
+  { category: "data-exfiltration", pattern: /\bapi[_-]?key\b/i, severity: 8 },
+  { category: "data-exfiltration", pattern: /\bsecret[_-]?key\b/i, severity: 10 },
+  { category: "data-exfiltration", pattern: /\.ssh\/id_rsa\b/i, severity: 15 },
+  // Encoded payloads
+  { category: "encoded-payload", pattern: /\batob\s*\(/i, severity: 12 },
+  { category: "encoded-payload", pattern: /Buffer\.from\s*\(/i, severity: 8 },
+  // Network calls
+  { category: "network-calls", pattern: /\bfetch\s*\(\s*["'`]https?:\/\//i, severity: 10 },
+  { category: "network-calls", pattern: /\bwget\s+https?:\/\//i, severity: 12 },
+  { category: "network-calls", pattern: /\bcurl\s+https?:\/\//i, severity: 8 },
+  { category: "network-calls", pattern: /http\.request\s*\(/i, severity: 10 },
+  { category: "network-calls", pattern: /XMLHttpRequest/i, severity: 10 }
+];
+var SAFE_THRESHOLD = 50;
+var BLOCKED_THRESHOLD = 30;
+var SkillSecurityScanner = class {
+  /**
+   * Scan skill content for security threats.
+   * Returns a score (0-100) and list of matched threats.
+   */
+  scan(content) {
+    if (!content.trim()) {
+      return { score: 100, threats: [], safe: true, blocked: false };
+    }
+    const lines = content.split("\n");
+    const threats = [];
+    let deductions = 0;
+    for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+      const lineContent = lines[lineIndex];
+      for (const rule of THREAT_RULES) {
+        if (rule.pattern.test(lineContent)) {
+          threats.push({
+            category: rule.category,
+            pattern: rule.pattern.source,
+            line: lineIndex + 1,
+            context: lineContent.trim()
+          });
+          deductions += rule.severity;
+        }
+      }
+    }
+    const score = Math.max(0, 100 - deductions);
+    return {
+      score,
+      threats,
+      safe: score >= SAFE_THRESHOLD,
+      blocked: score < BLOCKED_THRESHOLD
+    };
+  }
+};
+
+// src/skills/communityInstaller.ts
+async function fetchRegistryWithFallback(cache, fetcher) {
+  const cached = await cache.getRegistry();
+  if (cached) return cached;
+  try {
+    const registry = await fetcher.fetchRegistry();
+    await cache.setRegistry(registry);
+    return registry;
+  } catch (e2) {
+    return cache.getRegistryIgnoreTTL();
+  }
+}
+async function installSkillWithSecurity(ctx, skill, cache, fetcher, scope = "user") {
+  const targetDir = scope === "project" ? _path2.default.join(ctx.workspaceRoot, _chunkSEKD5FH3cjs.PROJECT_DIR_NAME, "skills") : _chunkSEKD5FH3cjs.AUTOHAND_PATHS.skills;
+  const installed = await ctx.skillsRegistry.isSkillInstalled(skill.id, targetDir);
+  if (installed) {
+    return _chunk7BTSG4MEcjs.t.call(void 0, "commands.learn.alreadyInstalled", { name: skill.name });
+  }
+  let files = await cache.getSkillDirectory(skill.id);
+  if (!files) {
+    try {
+      files = await fetcher.fetchSkillDirectory(skill);
+      await cache.setSkillDirectory(skill.id, files);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "Unknown error";
+      return _chalk2.default.red(`Failed to fetch skill files: ${msg}`);
+    }
+  }
+  const scanner = new SkillSecurityScanner();
+  const allContent = Array.from(files.values()).join("\n");
+  const scanResult = scanner.scan(allContent);
+  if (scanResult.blocked) {
+    const lines = [];
+    lines.push(_chalk2.default.red(_chunk7BTSG4MEcjs.t.call(void 0, "commands.learn.securityBlocked", { score: String(scanResult.score) })));
+    lines.push("");
+    for (const threat of scanResult.threats) {
+      lines.push(_chalk2.default.red(`  [${threat.category}] Line ${threat.line}: ${threat.context}`));
+    }
+    if (ctx.isNonInteractive) {
+      return lines.join("\n");
+    }
+    lines.push("");
+    const override = await _chunkZYQMLKOKcjs.showConfirm.call(void 0, {
+      title: _chunk7BTSG4MEcjs.t.call(void 0, "commands.learn.securityOverride"),
+      defaultValue: false
+    });
+    if (!override) {
+      return lines.join("\n");
+    }
+  } else if (!scanResult.safe) {
+    console.log(_chalk2.default.yellow(_chunk7BTSG4MEcjs.t.call(void 0, "commands.learn.securityWarning", { score: String(scanResult.score) })));
+    for (const threat of scanResult.threats) {
+      console.log(_chalk2.default.yellow(`  [${threat.category}] Line ${threat.line}: ${threat.context}`));
+    }
+  }
+  if (ctx.hookManager) {
+    const hookResults = await ctx.hookManager.executeHooks("pre-learn", {
+      tool: "learn",
+      args: { slug: skill.id, name: skill.name, scope }
+    });
+    const blocked = hookResults.some((r) => r.blockingError);
+    if (blocked) {
+      return _chalk2.default.yellow(_chunk7BTSG4MEcjs.t.call(void 0, "commands.learn.hookBlocked"));
+    }
+  }
+  const skillMd = files.get("SKILL.md");
+  if (skillMd) {
+    const enriched = injectLearnMetadata(skillMd, skill);
+    files.set("SKILL.md", enriched);
+  }
+  const importResult = await ctx.skillsRegistry.importCommunitySkillDirectory(
+    skill.id,
+    files,
+    targetDir
+  );
+  if (!importResult.success) {
+    return _chalk2.default.red(_nullishCoalesce(importResult.error, () => ( "Failed to install skill")));
+  }
+  if (ctx.hookManager) {
+    await ctx.hookManager.executeHooks("post-learn", {
+      tool: "learn",
+      args: { slug: skill.id, name: skill.name, scope },
+      path: importResult.path,
+      success: true
+    });
+  }
+  ctx.skillsRegistry.trackSkillEvent({
+    skillName: skill.name,
+    source: "community",
+    activationType: "explicit",
+    action: "install"
+  });
+  return _chalk2.default.green(_chunk7BTSG4MEcjs.t.call(void 0, "commands.learn.installed", { name: skill.name }));
+}
+function injectLearnMetadata(skillMd, skill) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const sha = LearnClient.computeContentSha(skillMd);
+  const metadataEntries = [
+    `agentskill-slug: ${skill.id}`,
+    `agentskill-owner: ${_nullishCoalesce(skill.author, () => ( "community"))}`,
+    `agentskill-sha: ${sha}`,
+    `agentskill-installed: ${now}`,
+    `agentskill-source: github-registry`
+  ];
+  if (skillMd.startsWith("---")) {
+    const endIndex = skillMd.indexOf("---", 3);
+    if (endIndex !== -1) {
+      const frontmatter = skillMd.slice(0, endIndex);
+      const rest = skillMd.slice(endIndex);
+      if (frontmatter.includes("metadata:")) {
+        const injected = metadataEntries.map((e) => `  ${e}`).join("\n");
+        return frontmatter + injected + "\n" + rest;
+      }
+      const metadataBlock2 = "metadata:\n" + metadataEntries.map((e) => `  ${e}`).join("\n") + "\n";
+      return frontmatter + metadataBlock2 + rest;
+    }
+  }
+  const metadataBlock = "---\nmetadata:\n" + metadataEntries.map((e) => `  ${e}`).join("\n") + "\n---\n";
+  return metadataBlock + skillMd;
+}
+function computeProjectHash(analysis) {
+  const serialized = JSON.stringify({
+    languages: analysis.languages.slice().sort(),
+    frameworks: analysis.frameworks.slice().sort(),
+    patterns: analysis.patterns.slice().sort(),
+    packageManager: analysis.packageManager
+  });
+  return _crypto2.default.createHash("sha256").update(serialized).digest("hex").slice(0, 7);
+}
+function injectGeneratedMetadata(content, skillName, projectHash) {
+  const metadataLines = [
+    `  agentskill-slug: ${skillName}`,
+    `  agentskill-source: llm-generated`,
+    `  agentskill-generated-at: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `  agentskill-project-hash: ${projectHash}`
+  ].join("\n");
+  if (content.startsWith("---")) {
+    if (content.includes("metadata:")) {
+      return content.replace(/metadata:/, `metadata:
+${metadataLines}`);
+    }
+    const endIndex = content.indexOf("---", 3);
+    if (endIndex !== -1) {
+      return content.slice(0, endIndex) + `metadata:
+${metadataLines}
+` + content.slice(endIndex);
+    }
+  }
+  return `---
+name: ${skillName}
+metadata:
+${metadataLines}
+---
+
+${content}`;
+}
+
+
+
+
+
+
+
+
+exports.LearnClient = LearnClient; exports.fetchRegistryWithFallback = fetchRegistryWithFallback; exports.installSkillWithSecurity = installSkillWithSecurity; exports.injectLearnMetadata = injectLearnMetadata; exports.computeProjectHash = computeProjectHash; exports.injectGeneratedMetadata = injectGeneratedMetadata;
+/**
+ * @license
+ * Copyright 2025 Autohand AI LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * LearnClient - Search, version-check, and filtering logic for /learn command.
+ * Wraps GitHubRegistryFetcher with learn-specific behavior.
+ */
+/**
+ * @license
+ * Copyright 2025 Autohand AI LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * SkillSecurityScanner - Client-side threat pattern scanning for community skills.
+ * Provides the second layer of security (after server-side scoring in the registry).
+ */
+/**
+ * @license
+ * Copyright 2025 Autohand AI LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Shared community skill install utilities.
+ * Used by both /skills (registry install) and /learn (LLM-generated install).
+ */