codeply-cli 0.2.0 → 0.3.1

package/lib/session-db.js

@@ -0,0 +1,220 @@
+/**
+ * SQLite-backed session store. Replaces rewriting one big JSON file on every
+ * save: each session and each message is a row, and a save only writes the rows
+ * whose content changed. Messages are searchable across every session.
+ *
+ * Driver order (first that loads wins), all with the same sync API:
+ *   1. node:sqlite        (Node 22.5+, built in, nothing to install)
+ *   2. better-sqlite3     (optional dependency; Electron 29 needs this one)
+ * When neither loads, openSessionDb() returns null and the caller keeps its
+ * JSON file, so a machine without SQLite never loses anything.
+ *
+ * Shape it stores (same as the old JSON store):
+ *   { sessions: [{ id, title, cwd, messages: [...], alwaysAllowed, createdAt, updatedAt, ...extra }],
+ *     <any other top-level key>: value }
+ */
+const fs = require('fs');
+const path = require('path');
+
+const SCHEMA_VERSION = 1;
+
+function loadDriver(modulePaths) {
+  try {
+    const { DatabaseSync } = require('node:sqlite');
+    if (DatabaseSync) return { kind: 'node:sqlite', open: (f) => new DatabaseSync(f) };
+  } catch {}
+  try {
+    let mod;
+    try { mod = require('better-sqlite3'); }
+    catch (e) {
+      if (!modulePaths || !modulePaths.length) throw e;
+      mod = require(require.resolve('better-sqlite3', { paths: modulePaths }));
+    }
+    return { kind: 'better-sqlite3', open: (f) => new mod(f) };
+  } catch {}
+  return null;
+}
+
+const CORE_SESSION_KEYS = new Set(['id', 'title', 'cwd', 'messages', 'alwaysAllowed', 'createdAt', 'updatedAt']);
+
+/**
+ * @param {string} file  database path (created if missing)
+ * @param {{ modulePaths?: string[], driver?: 'node:sqlite'|'better-sqlite3' }} [opts]
+ * @returns {null | { kind:string, file:string, isEmpty():boolean, load():object, save(store:object):void, search(q:string, limit?:number):object[], close():void }}
+ */
+function openSessionDb(file, opts = {}) {
+  const driver = loadDriver(opts.modulePaths);
+  if (!driver || (opts.driver && driver.kind !== opts.driver)) return null;
+  let db;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    db = driver.open(file);
+    db.exec('PRAGMA journal_mode = WAL');
+    db.exec('PRAGMA synchronous = NORMAL');
+    db.exec('PRAGMA foreign_keys = ON');
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS kv (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS sessions (
+        id TEXT PRIMARY KEY,
+        title TEXT,
+        cwd TEXT,
+        always_allowed TEXT,
+        extra TEXT,
+        created_at INTEGER,
+        updated_at INTEGER,
+        position INTEGER NOT NULL DEFAULT 0
+      );
+      CREATE TABLE IF NOT EXISTS messages (
+        session_id TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
+        idx INTEGER NOT NULL,
+        kind TEXT,
+        body TEXT,
+        data TEXT NOT NULL,
+        PRIMARY KEY (session_id, idx)
+      );
+      CREATE INDEX IF NOT EXISTS sessions_updated ON sessions(updated_at DESC);
+    `);
+    db.prepare('INSERT OR IGNORE INTO meta (key, value) VALUES (?, ?)').run('schema', String(SCHEMA_VERSION));
+  } catch {
+    try { db && db.close(); } catch {}
+    return null;
+  }
+
+  const q = {
+    countSessions: db.prepare('SELECT COUNT(*) AS n FROM sessions'),
+    countKv: db.prepare('SELECT COUNT(*) AS n FROM kv'),
+    allSessions: db.prepare('SELECT * FROM sessions ORDER BY position ASC'),
+    sessionMessages: db.prepare('SELECT data FROM messages WHERE session_id = ? ORDER BY idx ASC'),
+    allKv: db.prepare('SELECT key, value FROM kv'),
+    upsertSession: db.prepare(`INSERT INTO sessions (id, title, cwd, always_allowed, extra, created_at, updated_at, position)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET title=excluded.title, cwd=excluded.cwd, always_allowed=excluded.always_allowed,
+        extra=excluded.extra, created_at=excluded.created_at, updated_at=excluded.updated_at, position=excluded.position`),
+    deleteSession: db.prepare('DELETE FROM sessions WHERE id = ?'),
+    listSessionIds: db.prepare('SELECT id FROM sessions'),
+    upsertMessage: db.prepare(`INSERT INTO messages (session_id, idx, kind, body, data) VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(session_id, idx) DO UPDATE SET kind=excluded.kind, body=excluded.body, data=excluded.data`),
+    trimMessages: db.prepare('DELETE FROM messages WHERE session_id = ? AND idx >= ?'),
+    upsertKv: db.prepare('INSERT INTO kv (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value'),
+    deleteKv: db.prepare('DELETE FROM kv WHERE key = ?'),
+    search: db.prepare(`SELECT m.session_id AS sessionId, m.idx AS idx, m.kind AS kind, m.body AS body, s.title AS title, s.cwd AS cwd, s.updated_at AS updatedAt
+      FROM messages m JOIN sessions s ON s.id = m.session_id
+      WHERE m.body LIKE ? ESCAPE '\\' ORDER BY s.updated_at DESC, m.idx ASC LIMIT ?`),
+  };
+
+  // What the database already holds, so a save only writes what changed.
+  const seenSession = new Map(); // id -> serialized session header
+  const seenMessages = new Map(); // id -> string[] (serialized messages)
+  const seenKv = new Map(); // key -> serialized value
+
+  const tx = (fn) => {
+    db.exec('BEGIN');
+    try { fn(); db.exec('COMMIT'); } catch (e) { try { db.exec('ROLLBACK'); } catch {} throw e; }
+  };
+
+  const bodyOf = (m) => {
+    if (!m || typeof m !== 'object') return '';
+    const t = m.text != null ? m.text : (m.label != null ? m.label : '');
+    return typeof t === 'string' ? t.slice(0, 20000) : '';
+  };
+
+  return {
+    kind: driver.kind,
+    file,
+
+    isEmpty() {
+      return q.countSessions.get().n === 0 && q.countKv.get().n === 0;
+    },
+
+    load() {
+      const store = {};
+      for (const row of q.allKv.all()) {
+        try { store[row.key] = JSON.parse(row.value); seenKv.set(row.key, row.value); } catch {}
+      }
+      store.sessions = q.allSessions.all().map((r, position) => {
+        const messages = q.sessionMessages.all(r.id).map((m) => { try { return JSON.parse(m.data); } catch { return null; } }).filter(Boolean);
+        let extra = {};
+        try { extra = r.extra ? JSON.parse(r.extra) : {}; } catch {}
+        let alwaysAllowed = [];
+        try { alwaysAllowed = r.always_allowed ? JSON.parse(r.always_allowed) : []; } catch {}
+        const s = { ...extra, id: r.id, title: r.title, cwd: r.cwd, messages, alwaysAllowed, createdAt: r.created_at, updatedAt: r.updated_at };
+        seenSession.set(r.id, headerOf(s, position));
+        seenMessages.set(r.id, messages.map((m) => JSON.stringify(m)));
+        return s;
+      });
+      return store;
+    },
+
+    save(store) {
+      const sessions = Array.isArray(store.sessions) ? store.sessions : [];
+      tx(() => {
+        const keep = new Set();
+        sessions.forEach((s, position) => {
+          if (!s || !s.id) return;
+          keep.add(s.id);
+          const header = headerOf(s, position);
+          if (seenSession.get(s.id) !== header) {
+            const extra = {};
+            for (const k of Object.keys(s)) if (!CORE_SESSION_KEYS.has(k)) extra[k] = s[k];
+            q.upsertSession.run(
+              s.id, s.title == null ? null : String(s.title), s.cwd == null ? null : String(s.cwd),
+              JSON.stringify(s.alwaysAllowed || []), JSON.stringify(extra),
+              Number(s.createdAt) || Date.now(), Number(s.updatedAt) || Date.now(), position,
+            );
+            seenSession.set(s.id, header);
+          }
+          const msgs = Array.isArray(s.messages) ? s.messages : [];
+          const prev = seenMessages.get(s.id) || [];
+          const next = new Array(msgs.length);
+          for (let i = 0; i < msgs.length; i++) {
+            const ser = JSON.stringify(msgs[i]);
+            next[i] = ser;
+            if (prev[i] !== ser) q.upsertMessage.run(s.id, i, msgs[i] && msgs[i].kind ? String(msgs[i].kind) : null, bodyOf(msgs[i]), ser);
+          }
+          if (prev.length > msgs.length) q.trimMessages.run(s.id, msgs.length);
+          seenMessages.set(s.id, next);
+        });
+        for (const { id } of q.listSessionIds.all()) {
+          if (!keep.has(id)) { q.deleteSession.run(id); seenSession.delete(id); seenMessages.delete(id); }
+        }
+        const keys = new Set();
+        for (const k of Object.keys(store)) {
+          if (k === 'sessions') continue;
+          keys.add(k);
+          if (store[k] === undefined) continue;
+          const ser = JSON.stringify(store[k]);
+          if (seenKv.get(k) !== ser) { q.upsertKv.run(k, ser); seenKv.set(k, ser); }
+        }
+        for (const k of [...seenKv.keys()]) if (!keys.has(k)) { q.deleteKv.run(k); seenKv.delete(k); }
+      });
+    },
+
+    search(query, limit = 50) {
+      const term = String(query || '').trim();
+      if (!term) return [];
+      const like = `%${term.replace(/[\\%_]/g, (c) => `\\${c}`)}%`;
+      return q.search.all(like, Math.min(Math.max(limit | 0, 1), 200)).map((r) => ({
+        ...r, snippet: snippetAround(r.body, term),
+      }));
+    },
+
+    close() { try { db.exec('PRAGMA wal_checkpoint(TRUNCATE)'); } catch {} try { db.close(); } catch {} },
+  };
+}
+
+function headerOf(s, position) {
+  const extra = {};
+  for (const k of Object.keys(s)) if (!CORE_SESSION_KEYS.has(k)) extra[k] = s[k];
+  return JSON.stringify([s.title, s.cwd, s.alwaysAllowed || [], extra, Number(s.createdAt) || 0, Number(s.updatedAt) || 0, position]);
+}
+
+function snippetAround(text, term) {
+  const t = String(text || '');
+  const at = t.toLowerCase().indexOf(term.toLowerCase());
+  if (at < 0) return t.slice(0, 120);
+  const from = Math.max(0, at - 50);
+  return `${from > 0 ? '...' : ''}${t.slice(from, at + term.length + 70).replace(/\s+/g, ' ')}${at + term.length + 70 < t.length ? '...' : ''}`;
+}
+
+module.exports = { openSessionDb };

package/lib/share.js

@@ -0,0 +1,168 @@
+/**
+ * Turn a chat into something you can hand to someone else: a Markdown file, a
+ * self-contained HTML page, or a secret GitHub gist. Everything is cleaned
+ * first: keys and tokens are masked and your home folder and project path are
+ * replaced, so a shared chat does not leak the machine it came from.
+ */
+const os = require('os');
+const path = require('path');
+
+const SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /\b(?:sk|pk|rk)-[A-Za-z0-9_-]{16,}/g,
+  /\bsk-ant-[A-Za-z0-9_-]{16,}/g,
+  /\bgh[pousr]_[A-Za-z0-9]{30,}/g,
+  /\bgithub_pat_[A-Za-z0-9_]{30,}/g,
+  /\bxox[abprs]-[A-Za-z0-9-]{10,}/g,
+  /\bAKIA[0-9A-Z]{16}\b/g,
+  /\bAIza[0-9A-Za-z_-]{30,}/g,
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+  /(\bBearer\s+)[A-Za-z0-9._~+/=-]{20,}/gi,
+  /((?:api[_-]?key|secret|token|password|passwd)["']?\s*[:=]\s*["']?)[^\s"',;]{8,}/gi,
+];
+
+function escapeRe(s) { return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); }
+
+/** Cleans one string for sharing. `cwd` is the project folder, if known. */
+function scrub(text, cwd) {
+  let s = String(text == null ? '' : text);
+  for (const re of SECRET_PATTERNS) s = s.replace(re, (m, pre) => (typeof pre === 'string' ? `${pre}[hidden]` : '[hidden]'));
+  const paths = [];
+  if (cwd) paths.push([cwd, '<project>']);
+  const home = os.homedir();
+  if (home && home.length > 3) paths.push([home, '~']);
+  for (const [from, to] of paths) {
+    for (const v of new Set([from, from.replace(/\\/g, '/')])) s = s.replace(new RegExp(escapeRe(v), 'gi'), to);
+  }
+  return s;
+}
+
+/** The parts of a stored chat that belong in a shared copy. */
+function collect(session, opts = {}) {
+  const cwd = session.cwd || '';
+  const clean = (t) => scrub(t, cwd);
+  const items = [];
+  for (const m of session.messages || []) {
+    if (m.kind === 'user') items.push({ type: 'user', text: clean(m.text), images: (m.images || []).length });
+    else if (m.kind === 'assistant' && m.text && !m.interim) items.push({ type: 'assistant', text: clean(m.text) });
+    else if (m.kind === 'assistant' && m.text && opts.includeNarration) items.push({ type: 'narration', text: clean(m.text) });
+    else if (m.kind === 'reasoning' && m.text && opts.includeThinking) items.push({ type: 'thinking', text: clean(m.text) });
+    else if (m.kind === 'tool') items.push({ type: 'tool', name: m.name, label: clean(m.label || ''), ok: m.ok !== false });
+    else if (m.kind === 'question') items.push({ type: 'question', question: clean(m.question), answer: m.answer ? clean(m.answer) : '' });
+    else if (m.kind === 'notice' && m.level === 'error') items.push({ type: 'error', text: clean(m.text) });
+  }
+  return { title: clean(session.title || 'Chat'), project: cwd ? path.basename(cwd) : '', when: session.updatedAt || session.createdAt || null, items };
+}
+
+function toMarkdown(session, opts) {
+  const c = collect(session, opts);
+  const out = [`# ${c.title}`, ''];
+  const meta = [c.project && `Project: ${c.project}`, c.when && new Date(c.when).toISOString().slice(0, 10), 'Made with Codeply Craft'].filter(Boolean);
+  out.push(`_${meta.join(' - ')}_`, '');
+  let tools = [];
+  const flush = () => { if (tools.length) { out.push(...tools, ''); tools = []; } };
+  for (const it of c.items) {
+    if (it.type === 'tool') { tools.push(`- \`${it.name}\` ${it.label}${it.ok ? '' : ' (failed)'}`.trimEnd()); continue; }
+    flush();
+    if (it.type === 'user') out.push('## You', '', it.text + (it.images ? `\n\n_(${it.images} image${it.images === 1 ? '' : 's'} not included)_` : ''), '');
+    else if (it.type === 'assistant') out.push('## Codeply', '', it.text, '');
+    else if (it.type === 'narration') out.push(`> ${it.text.replace(/\n/g, '\n> ')}`, '');
+    else if (it.type === 'thinking') out.push('<details><summary>Thinking</summary>', '', it.text, '', '</details>', '');
+    else if (it.type === 'question') out.push(`> Asked: ${it.question}${it.answer ? ` - answered: ${it.answer}` : ''}`, '');
+    else if (it.type === 'error') out.push(`> Error: ${it.text}`, '');
+  }
+  flush();
+  return out.join('\n').replace(/\n{3,}/g, '\n\n');
+}
+
+const esc = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+
+/** A small, safe Markdown subset: everything is escaped first, then fences, code, bold, links, lists. */
+function inline(escaped) {
+  return escaped
+    .replace(/`([^`\n]+)`/g, '<code>$1</code>')
+    .replace(/\*\*([^*\n]+)\*\*/g, '<strong>$1</strong>')
+    .replace(/\[([^\]\n]+)\]\((https?:\/\/[^\s)]+)\)/g, '<a href="$2" rel="noopener noreferrer nofollow">$1</a>');
+}
+
+function mdBlock(text) {
+  const parts = String(text).split(/```/);
+  let html = '';
+  parts.forEach((part, i) => {
+    if (i % 2 === 1) {
+      const nl = part.indexOf('\n');
+      const lang = nl === -1 ? '' : part.slice(0, nl).trim();
+      const code = nl === -1 ? part : part.slice(nl + 1);
+      html += `<pre${lang ? ` data-lang="${esc(lang.slice(0, 20))}"` : ''}><code>${esc(code.replace(/\n$/, ''))}</code></pre>`;
+      return;
+    }
+    let list = null;
+    const closeList = () => { if (list) { html += `</${list}>`; list = null; } };
+    for (const line of part.split('\n')) {
+      const e = esc(line);
+      let m;
+      if ((m = /^\s*[-*]\s+(.*)$/.exec(e))) { if (list !== 'ul') { closeList(); html += '<ul>'; list = 'ul'; } html += `<li>${inline(m[1])}</li>`; }
+      else if ((m = /^\s*\d+[.)]\s+(.*)$/.exec(e))) { if (list !== 'ol') { closeList(); html += '<ol>'; list = 'ol'; } html += `<li>${inline(m[1])}</li>`; }
+      else if ((m = /^#{1,6}\s+(.*)$/.exec(e))) { closeList(); html += `<p><strong>${inline(m[1])}</strong></p>`; }
+      else if (e.trim()) { closeList(); html += `<p>${inline(e)}</p>`; }
+      else closeList();
+    }
+    closeList();
+  });
+  return html;
+}
+
+const CSS = `:root{color-scheme:light dark;--bg:#fff;--fg:#1d1d1f;--mut:#6e6e73;--card:#f5f5f7;--line:#e5e5ea;--acc:#5b5bd6}
+@media(prefers-color-scheme:dark){:root{--bg:#141416;--fg:#ececf0;--mut:#9a9aa3;--card:#1f1f23;--line:#2c2c31;--acc:#8b8bf0}}
+*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--fg);font:15px/1.6 system-ui,-apple-system,Segoe UI,sans-serif}
+main{max-width:760px;margin:0 auto;padding:32px 20px 64px}h1{font-size:22px;margin:0 0 4px}.meta{color:var(--mut);font-size:13px;margin-bottom:28px}
+.turn{margin:18px 0}.who{font-size:12px;font-weight:600;letter-spacing:.04em;text-transform:uppercase;color:var(--mut);margin-bottom:4px}
+.user .body{background:var(--card);border:1px solid var(--line);border-radius:12px;padding:10px 14px}.assistant .who{color:var(--acc)}
+.body p{margin:.5em 0}.body ul,.body ol{margin:.5em 0;padding-left:1.4em}code{font:13px/1.5 ui-monospace,SFMono-Regular,Consolas,monospace;background:var(--card);border-radius:4px;padding:1px 5px}
+pre{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:12px 14px;overflow:auto;margin:.7em 0}pre code{background:none;padding:0}
+.tools{margin:6px 0;padding:0;list-style:none;color:var(--mut);font-size:13px}.tools li{padding:1px 0}.tools .bad{color:#d1453b}.note{color:var(--mut);font-size:14px;border-left:3px solid var(--line);padding-left:10px;margin:10px 0}
+.err{color:#d1453b}footer{margin-top:40px;color:var(--mut);font-size:12px}a{color:var(--acc)}details{color:var(--mut);font-size:13px}`;
+
+function toHtml(session, opts) {
+  const c = collect(session, opts);
+  const meta = [c.project && esc(c.project), c.when && new Date(c.when).toISOString().slice(0, 10)].filter(Boolean).join(' &middot; ');
+  let body = '';
+  let tools = [];
+  const flush = () => { if (tools.length) { body += `<ul class="tools">${tools.join('')}</ul>`; tools = []; } };
+  for (const it of c.items) {
+    if (it.type === 'tool') { tools.push(`<li${it.ok ? '' : ' class="bad"'}><code>${esc(it.name)}</code> ${esc(it.label)}${it.ok ? '' : ' (failed)'}</li>`); continue; }
+    flush();
+    if (it.type === 'user') body += `<div class="turn user"><div class="who">You</div><div class="body">${mdBlock(it.text)}${it.images ? `<p class="note">${it.images} image${it.images === 1 ? '' : 's'} not included</p>` : ''}</div></div>`;
+    else if (it.type === 'assistant') body += `<div class="turn assistant"><div class="who">Codeply</div><div class="body">${mdBlock(it.text)}</div></div>`;
+    else if (it.type === 'narration') body += `<div class="note">${mdBlock(it.text)}</div>`;
+    else if (it.type === 'thinking') body += `<details><summary>Thinking</summary>${mdBlock(it.text)}</details>`;
+    else if (it.type === 'question') body += `<div class="note">Asked: ${esc(it.question)}${it.answer ? ` &middot; answered: ${esc(it.answer)}` : ''}</div>`;
+    else if (it.type === 'error') body += `<div class="note err">${esc(it.text)}</div>`;
+  }
+  flush();
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="robots" content="noindex"><title>${esc(c.title)}</title><style>${CSS}</style></head><body><main><h1>${esc(c.title)}</h1><div class="meta">${meta}</div>${body}<footer>Made with Codeply Craft</footer></main></body></html>`;
+}
+
+/** Uploads the chat as a secret gist. Returns {ok, url} or {ok:false, error}. */
+async function createGist(session, token, { fetchImpl = fetch, apiUrl = 'https://api.github.com', isPublic = false, ...opts } = {}) {
+  if (!token) return { ok: false, error: 'No GitHub token.' };
+  const c = collect(session, opts);
+  const base = (c.title.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 40)) || 'chat';
+  let res;
+  try {
+    res = await fetchImpl(`${apiUrl.replace(/\/$/, '')}/gists`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json', 'Content-Type': 'application/json', 'User-Agent': 'codeply-craft' },
+      body: JSON.stringify({ description: `${c.title} (Codeply Craft)`.slice(0, 200), public: !!isPublic, files: { [`${base}.md`]: { content: toMarkdown(session, opts) } } }),
+    });
+  } catch (e) { return { ok: false, error: `Could not reach GitHub: ${e.message}` }; }
+  let json = null;
+  try { json = JSON.parse(await res.text()); } catch {}
+  if (!res.ok) {
+    const scopeHint = res.status === 404 || res.status === 403 ? ' Reconnect GitHub in Connect Apps so Craft can create gists.' : '';
+    return { ok: false, error: `GitHub said ${res.status}${json && json.message ? `: ${json.message}` : ''}.${scopeHint}` };
+  }
+  return { ok: true, url: json.html_url, public: !!isPublic };
+}
+
+module.exports = { scrub, collect, toMarkdown, toHtml, createGist };

package/lib/skills.js

@@ -3,42 +3,44 @@
  *
  * A skill is a directory with a SKILL.md: YAML frontmatter (`name`,
  * `description`) followed by a markdown body of instructions. This is the same
- * convention Claude Code and affaan-m/ECC use — see skills/SOURCE.md for where
+ * convention Claude Code and affaan-m/ECC use - see skills/SOURCE.md for where
  * the bundled set came from and why the format was copied rather than invented.
  *
- * Two-level progressive disclosure — this matters at 281 skills:
+ * Two-level progressive disclosure - this matters at 281 skills:
  *
  *   1. Per-skill: buildSystemPrompt() only ever injects a skill's NAME and a
- *      capped one-line description. The full body — which can run to several
- *      KB with reference files — loads on demand via <codeply:use_skill>. The
+ *      capped one-line description. The full body - which can run to several
+ *      KB with reference files - loads on demand via <codeply:use_skill>. The
  *      alternative, concatenating every skill's full body into the system
  *      prompt always, would resend ~3.4MB per request for the bundled set
  *      alone.
  *
  *   2. Across the library: even name+description for all 281 is ~44KB
- *      (~11,000 tokens) — resent on every step of every turn, that alone would
+ *      (~11,000 tokens) - resent on every step of every turn, that alone would
  *      make the skill library cost more than it saves. So the system prompt by
  *      default only lists a curated subset (DAILY_SKILLS below, ~2KB) covering
  *      general coding work; the complete 281 are still fully installed and
  *      usable, just one cheap `list_skills` action away instead of force-fed
- *      into every request. DAILY_SKILLS is not a cut Codeply invented — it's
+ *      into every request. DAILY_SKILLS is not a cut Codeply invented - it's
  *      ECC's own `.agents/skills/` curation of its 281-skill `skills/`
  *      library (see skills/SOURCE.md), reused rather than re-decided.
  *
- * Two sources, later wins on a name collision:
- *   built-in   <repo>/skills/<name>/SKILL.md      — vendored, ships with Codeply
- *   user       ~/.codeply/skills/<name>/SKILL.md  — `codeply skill install`
+ * Three sources, later wins on a name collision:
+ *   plugin     <plugin>/skills/<name>/SKILL.md    - `codeply plugin install`
+ *   built-in   <repo>/skills/<name>/SKILL.md      - vendored, ships with Codeply
+ *   user       ~/.codeply/skills/<name>/SKILL.md  - `codeply skill install`
  */
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const plugins = require('./plugins.js');
 
 const BUILTIN_DIR = path.join(__dirname, '..', 'skills');
 const USER_DIR = path.join(os.homedir(), '.codeply', 'skills');
 
 const MAX_BODY_CHARS = 8000; // fed to the model on demand; keep one skill from eating the whole budget
 
-// ECC's own curated subset of its full library — see skills/SOURCE.md. Kept as
+// ECC's own curated subset of its full library - see skills/SOURCE.md. Kept as
 // a name list rather than a directory so a user-installed skill with one of
 // these names (or a future re-vendor that drops/renames one) degrades
 // gracefully instead of erroring.
@@ -53,6 +55,9 @@ const DAILY_SKILLS = new Set([
   'mle-workflow', 'nextjs-turbopack', 'plan-canvas', 'product-capability',
   'security-review', 'strategic-compact', 'tdd-workflow', 'unified-memory',
   'verification-loop', 'video-editing', 'x-api',
+  // Codeply's own visual-quality bar - see the note above use_skill in
+  // lib/agent.mjs's TOOL_REFERENCE for why these are non-speculative triggers.
+  'premium-web-design', 'frontend-design-direction', 'motion-ui', 'frontend-a11y',
 ]);
 
 function listSkillDirs(root, source) {
@@ -69,7 +74,7 @@ function listSkillDirs(root, source) {
 /**
  * Minimal YAML frontmatter reader for exactly the two keys skills use.
  * Handles plain `key: value` and folded/literal block scalars (`key: >-` /
- * `key: |-` etc.) since real skills in the wild use both — a naive
+ * `key: |-` etc.) since real skills in the wild use both - a naive
  * single-line regex silently truncates ~10% of the bundled set's descriptions.
  */
 function parseFrontmatter(text) {
@@ -106,7 +111,7 @@ function parseFrontmatter(text) {
       continue;
     }
 
-    // Strip a matching pair of quotes, nothing fancier — these are simple labels.
+    // Strip a matching pair of quotes, nothing fancier - these are simple labels.
     values[key] = rest.replace(/^["'](.*)["']$/, '$1').trim();
   }
 
@@ -118,9 +123,13 @@ function parseFrontmatter(text) {
 }
 
 /** Every skill available right now, built-in and user, deduped by name. */
-function listSkills() {
+function listSkills(cwd) {
   const found = new Map();
   for (const s of listSkillDirs(BUILTIN_DIR, 'built-in')) found.set(s.name, s);
+  // Plugin skills were installed on purpose, so they are shown like the daily set.
+  for (const { plugin, dir } of plugins.skillDirs(cwd)) {
+    for (const s of listSkillDirs(dir, 'plugin')) found.set(s.name, { ...s, plugin });
+  }
   // User skills are installed deliberately, so a same-named one wins.
   for (const s of listSkillDirs(USER_DIR, 'user')) found.set(s.name, s);
 
@@ -136,9 +145,10 @@ function listSkills() {
       description: description || '(no description)',
       source: s.source,
       dir: s.dir,
-      // A user-installed skill overriding a daily one keeps its daily status —
+      // A user-installed skill overriding a daily one keeps its daily status -
       // the name is still what buildSystemPrompt filters on, not the source.
-      daily: DAILY_SKILLS.has(finalName),
+      daily: DAILY_SKILLS.has(finalName) || s.source === 'plugin',
+      plugin: s.plugin || null,
     });
   }
   return skills.sort((a, b) => a.name.localeCompare(b.name));
@@ -149,7 +159,7 @@ const INDEX_DESC_MAX = 140; // per-skill cap in the always-injected index; use_s
 /**
  * Compact index of skill name + a capped description, one per line.
  *
- * `daily` (default) is what goes in the system prompt on every request — see
+ * `daily` (default) is what goes in the system prompt on every request - see
  * the module doc for why the full 281 is too large to inject unconditionally.
  * `all` is for the list_skills action and `/skill list`, where the cost is
  * paid once, on demand, instead of on every step.
@@ -168,8 +178,8 @@ function formatSkillIndex(skills = listSkills(), { all = false } = {}) {
 }
 
 /** The full body of one skill, truncated to a sane size, or null if unknown. */
-function loadSkillBody(name) {
-  const skill = listSkills().find((s) => s.name === name);
+function loadSkillBody(name, cwd) {
+  const skill = listSkills(cwd).find((s) => s.name === name);
   if (!skill) return null;
 
   let raw;
@@ -186,7 +196,7 @@ function loadSkillBody(name) {
 /**
  * Copy a local directory containing a SKILL.md into the user skill store.
  * Named separately from the GitHub path below because it never touches the
- * network — used by both `codeply skill install <local-dir>` and as the last
+ * network - used by both `codeply skill install <local-dir>` and as the last
  * step after a GitHub download lands in a temp directory.
  */
 function installFromLocalDir(sourceDir, name) {
@@ -254,7 +264,7 @@ async function githubJson(url) {
  * If `subpath` points directly at a skill (a directory whose own SKILL.md
  * lives there), that one skill is installed under `name` (or its own frontmatter
  * name). Otherwise every SKILL.md found anywhere under `subpath` (the whole
- * repo, if none was given) is installed — this is what makes a bare repo URL
+ * repo, if none was given) is installed - this is what makes a bare repo URL
  * like affaan-m/ECC pull in its entire skill library in one command, and also
  * what lets a single-skill link install just that one.
  */
@@ -279,7 +289,7 @@ async function installFromGitHub(source, explicitName) {
       `https://api.github.com/repos/${owner}/${repo}/git/trees/${encodeURIComponent(branch)}?recursive=1`
     );
     if (treeData.truncated) {
-      // GitHub's own recursion cap (huge monorepos) — rare, but better to say
+      // GitHub's own recursion cap (huge monorepos) - rare, but better to say
       // so than to silently install an incomplete skill.
       return { ok: false, error: `${owner}/${repo}@${branch} is too large to list in one call. Point --install at a narrower subpath.` };
     }
@@ -342,6 +352,54 @@ async function installFromGitHub(source, explicitName) {
   return { ok: installed.length > 0, installed, failed, source: `${owner}/${repo}@${branch}` };
 }
 
+// Words too common in both task descriptions and skill blurbs to carry any
+// matching signal ("a page for the app" would otherwise match nearly everything).
+const STOPWORDS = new Set([
+  'a', 'an', 'the', 'and', 'or', 'but', 'for', 'with', 'to', 'of', 'in', 'on',
+  'at', 'is', 'are', 'be', 'this', 'that', 'it', 'as', 'from', 'into', 'about',
+  'i', 'you', 'we', 'my', 'me', 'do', 'does', 'make', 'makes', 'get', 'gets',
+  'up', 'out', 'not', 'need', 'want', 'please', 'can', 'app', 'page', 'file',
+  'code', 'using', 'use', 'so', 'now',
+]);
+
+function tokenize(text) {
+  return (text || '')
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .filter((w) => w.length > 2 && !STOPWORDS.has(w));
+}
+
+/**
+ * Cheap keyword-overlap search over the full skill library, run fresh per
+ * turn against the user's actual request - no extra model call. This is what
+ * lets a niche skill (say, cisco-ios-patterns or blender-motion-state-inspection)
+ * get surfaced automatically instead of depending on the model guessing the
+ * right list_skills query, or on it being one of the ~37 always-shown daily
+ * skills. Scored on token overlap between the query and each skill's
+ * `name + description`, with name hits weighted higher than description hits
+ * since a skill named for exactly the thing being asked is strong signal.
+ */
+function findRelevantSkills(query, skillList = listSkills(), { limit = 6, excludeDaily = false } = {}) {
+  const qTokens = new Set(tokenize(query));
+  if (qTokens.size === 0) return [];
+
+  const scored = [];
+  for (const s of skillList) {
+    if (excludeDaily && s.daily) continue;
+    const nameTokens = tokenize(s.name.replace(/-/g, ' '));
+    const descTokens = tokenize(s.description);
+    let score = 0;
+    for (const t of qTokens) {
+      if (nameTokens.includes(t)) score += 3;
+      else if (descTokens.includes(t)) score += 1;
+    }
+    if (score > 0) scored.push({ skill: s, score });
+  }
+
+  scored.sort((a, b) => b.score - a.score || a.skill.name.localeCompare(b.skill.name));
+  return scored.slice(0, limit).map((x) => x.skill);
+}
+
 function removeSkill(name) {
   const dest = path.join(USER_DIR, name);
   if (!fs.existsSync(dest)) {
@@ -353,6 +411,6 @@ function removeSkill(name) {
 
 module.exports = {
   BUILTIN_DIR, USER_DIR, MAX_BODY_CHARS, DAILY_SKILLS,
-  parseFrontmatter, listSkills, formatSkillIndex, loadSkillBody,
+  parseFrontmatter, listSkills, formatSkillIndex, loadSkillBody, findRelevantSkills,
   installFromLocalDir, installFromGitHub, parseGitHubSource, removeSkill,
 };