cognova 0.1.10 → 0.2.2

package/app/pages/skills/library.vue

@@ -0,0 +1,209 @@
+<script setup lang="ts">
+import type { SkillCatalogItem } from '~~/shared/types'
+
+definePageMeta({
+  layout: 'dashboard',
+  middleware: 'auth'
+})
+
+const toast = useToast()
+const skills = ref<SkillCatalogItem[]>([])
+const loading = ref(true)
+const installing = ref<string | null>(null)
+const search = ref('')
+const activeTag = ref<string | null>(null)
+
+// Collect all unique tags across skills
+const allTags = computed(() => {
+  const tagSet = new Set<string>()
+  for (const s of skills.value) {
+    for (const t of s.tags) tagSet.add(t)
+  }
+  return [...tagSet].sort()
+})
+
+const filteredSkills = computed(() => {
+  let result = skills.value
+
+  if (activeTag.value) {
+    result = result.filter(s => s.tags.includes(activeTag.value!))
+  }
+
+  if (search.value.trim()) {
+    const q = search.value.toLowerCase()
+    result = result.filter(s =>
+      s.name.toLowerCase().includes(q)
+      || s.description.toLowerCase().includes(q)
+      || s.author.toLowerCase().includes(q)
+    )
+  }
+
+  return result
+})
+
+function toggleTag(tag: string) {
+  activeTag.value = activeTag.value === tag ? null : tag
+}
+
+async function loadLibrary() {
+  loading.value = true
+  try {
+    const res = await $fetch<{ data: SkillCatalogItem[] }>('/api/skills/library')
+    skills.value = res.data
+  } catch {
+    toast.add({ title: 'Failed to load skills library', color: 'error' })
+  } finally {
+    loading.value = false
+  }
+}
+
+async function handleInstall(name: string) {
+  installing.value = name
+  try {
+    await $fetch('/api/skills/library/install', {
+      method: 'POST',
+      body: { name }
+    })
+    toast.add({ title: `Installed ${name}`, color: 'success' })
+    await loadLibrary()
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : 'Failed to install skill'
+    toast.add({ title: message, color: 'error' })
+  } finally {
+    installing.value = null
+  }
+}
+
+async function handleUpdate(name: string) {
+  installing.value = name
+  try {
+    // Remove existing first
+    await $fetch(`/api/skills/${name}/files/delete`, {
+      method: 'POST',
+      body: { path: '.' }
+    }).catch(() => {})
+
+    await $fetch('/api/skills/library/install', {
+      method: 'POST',
+      body: { name }
+    })
+    toast.add({ title: `Updated ${name}`, color: 'success' })
+    await loadLibrary()
+  } catch {
+    toast.add({ title: `Failed to update ${name}`, color: 'error' })
+  } finally {
+    installing.value = null
+  }
+}
+
+onMounted(() => loadLibrary())
+</script>
+
+<template>
+  <div class="flex flex-1 min-w-0">
+    <UDashboardPanel
+      id="skills-library"
+      grow
+    >
+      <template #header>
+        <UDashboardNavbar title="Skills Library">
+          <template #right>
+            <UInput
+              v-model="search"
+              icon="i-lucide-search"
+              placeholder="Search library..."
+              size="sm"
+              class="w-48"
+            />
+            <NuxtLink to="/skills">
+              <UButton
+                icon="i-lucide-arrow-left"
+                variant="ghost"
+                color="neutral"
+                size="sm"
+              >
+                My Skills
+              </UButton>
+            </NuxtLink>
+          </template>
+        </UDashboardNavbar>
+      </template>
+
+      <template #body>
+        <div class="p-4">
+          <!-- Tag filter bar -->
+          <div
+            v-if="allTags.length > 0 && !loading"
+            class="flex flex-wrap gap-1.5 mb-4"
+          >
+            <UButton
+              v-for="tag in allTags"
+              :key="tag"
+              size="xs"
+              :variant="activeTag === tag ? 'solid' : 'outline'"
+              :color="tag === 'official' ? 'primary' : 'neutral'"
+              @click="toggleTag(tag)"
+            >
+              {{ tag }}
+            </UButton>
+          </div>
+
+          <!-- Loading -->
+          <div
+            v-if="loading"
+            class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3"
+          >
+            <div
+              v-for="i in 6"
+              :key="i"
+              class="p-4 rounded-lg border border-default bg-elevated/50"
+            >
+              <USkeleton class="h-4 w-24 mb-2" />
+              <USkeleton class="h-3 w-full mb-1" />
+              <USkeleton class="h-3 w-2/3" />
+            </div>
+          </div>
+
+          <!-- Empty -->
+          <div
+            v-else-if="skills.length === 0"
+            class="flex flex-col items-center justify-center py-16 text-dimmed"
+          >
+            <UIcon
+              name="i-lucide-library"
+              class="size-12 mb-4"
+            />
+            <p class="text-lg font-medium">
+              No community skills available
+            </p>
+            <p class="text-sm mt-1">
+              The skills registry is empty or hasn't synced yet.
+            </p>
+          </div>
+
+          <!-- No results -->
+          <div
+            v-else-if="filteredSkills.length === 0"
+            class="text-center py-12 text-muted text-sm"
+          >
+            No skills matching {{ activeTag ? `"${activeTag}"` : '' }} {{ search ? `"${search}"` : '' }}
+          </div>
+
+          <!-- Grid -->
+          <div
+            v-else
+            class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3"
+          >
+            <SkillsLibraryCard
+              v-for="skill in filteredSkills"
+              :key="skill.name"
+              :skill="skill"
+              @install="handleInstall"
+              @update="handleUpdate"
+            />
+          </div>
+        </div>
+      </template>
+    </UDashboardPanel>
+  </div>
+</template>

package/app/pages/view/[uuid].vue

@@ -60,18 +60,19 @@ watch(viewSource, v => viewSourceMode.value = v)
 
 // Copy content to clipboard
 const toast = useToast()
+const { copy } = useCopyToClipboard()
 async function copyContent() {
   const content = data.value?.data?.content
   if (!content) return
 
-  try {
-    await navigator.clipboard.writeText(content)
+  const ok = await copy(content)
+  if (ok) {
     toast.add({
       title: 'Copied to clipboard',
       icon: 'i-lucide-check',
       color: 'success'
     })
-  } catch {
+  } else {
     toast.add({
       title: 'Failed to copy',
       icon: 'i-lucide-x',

package/dist/cli/index.js

@@ -154,11 +154,6 @@ var require_src = __commonJS({
   }
 });
 
-// src/index.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join11, dirname as dirname2 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-
 // src/commands/init.ts
 import { execSync as execSync5 } from "child_process";
 import { join as join7 } from "path";
@@ -1357,6 +1352,14 @@ var __dirname = dirname(__filename);
 function getPackageDir() {
   return join(__dirname, "..", "..");
 }
+function getPackageVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(join(getPackageDir(), "package.json"), "utf-8"));
+    return pkg.version || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
 function getClaudeDir() {
   return join(homedir(), ".claude");
 }
@@ -1694,6 +1697,7 @@ You run as a persistent service managed by PM2. Your conversations are streamed
 | Task Management | \`/task\` | Create, list, update, complete tasks |
 | Project Management | \`/project\` | Organize tasks into projects |
 | Memory | \`/memory\` | Search past decisions, store insights |
+| Secrets | \`/secret\` | Store, retrieve, list, delete encrypted API keys and credentials |
 | Environment | \`/environment\` | Check system status, troubleshoot issues |
 | Skill Creator | \`/skill-creator\` | Create new Claude Code skills |
 
@@ -1749,11 +1753,15 @@ Memory is your most important tool. You are stateless between sessions \u2014 wi
 **Rule: When in doubt, store it.** A redundant memory is harmless. A forgotten one wastes ${p.userName}'s time.
 
 ### Secrets & Sensitive Data
-- NEVER store passwords, tokens, API keys, or credentials in memory, notes, or conversation
-- NEVER write secrets to files \u2014 use the Cognova settings UI or secrets API instead
-- If ${p.userName} shares a credential in chat, warn them it should be stored as a secret
-- When you need a token for an integration, check the secrets API first before asking ${p.userName}
+
+**CRITICAL \u2014 Zero tolerance for leaked secrets:**
+- NEVER store passwords, tokens, API keys, or credentials in memory, notes, conversation, or any file
+- NEVER write secrets to files \u2014 use \`/secret set KEY\` or the Cognova settings UI instead
+- NEVER embed API keys, tokens, or credentials in SKILL.md files or Python scripts when creating or modifying skills \u2014 always use \`get_secret()\` from \`_lib/api.py\`
+- If ${p.userName} shares a credential in chat, warn them and store it via \`/secret set KEY\` immediately
+- When you need a token for an integration, check with \`/secret list\` and \`/secret get KEY\` before asking ${p.userName}
 - Treat any string that looks like a key, token, or password as sensitive \u2014 do not echo it back
+- When creating skills that need external API keys, declare them in \`metadata.requires-secrets\` frontmatter and use \`get_secret()\` in the script
 
 ### Troubleshooting
 - Use \`/environment status\` or \`/environment health\` to diagnose issues
@@ -2205,7 +2213,7 @@ async function init() {
   s.start("Installing Claude Code configuration");
   await installClaudeConfig(config);
   s.stop("Claude config installed to ~/.claude/");
-  writeMetadata(resolvedInstallDir, vault.path, "0.1.0");
+  writeMetadata(resolvedInstallDir, vault.path, getPackageVersion());
   R2.step(import_picocolors5.default.bold("Setup"));
   s.start("Installing dependencies");
   execSync5("pnpm install", { cwd: resolvedInstallDir, stdio: "pipe" });
@@ -2387,8 +2395,10 @@ async function update() {
       process.exit(1);
     }
   }
-  if (!updateFailed)
+  if (!updateFailed) {
+    writeMetadata(installDir, metadata.vaultPath, latestVersion);
     cleanupBackup(backupDir);
+  }
   if (updateFailed) {
     Le("Update failed. Previous version has been restored. Try again later.");
     process.exit(1);
@@ -2612,18 +2622,8 @@ async function reset() {
 }
 
 // src/index.ts
-var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname2 = dirname2(__filename2);
-function getVersion() {
-  try {
-    const pkg = JSON.parse(readFileSync4(join11(__dirname2, "..", "..", "package.json"), "utf-8"));
-    return pkg.version || "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-}
 var HELP_TEXT = `
-  cognova v${getVersion()} \u2014 Personal knowledge management with Claude Code
+  cognova v${getPackageVersion()} \u2014 Personal knowledge management with Claude Code
 
   Usage: cognova <command> [options]
 
@@ -2720,7 +2720,7 @@ var args = process.argv.slice(2);
 var command = args.find((a) => !a.startsWith("-"));
 var flags = new Set(args.filter((a) => a.startsWith("-")));
 if (flags.has("--version") || flags.has("-v")) {
-  console.log(getVersion());
+  console.log(getPackageVersion());
   process.exit(0);
 }
 if (flags.has("--help") || flags.has("-h")) {

package/nuxt.config.ts

@@ -10,6 +10,15 @@ export default defineNuxtConfig({
     enabled: true
   },
 
+  app: {
+    head: {
+      link: [
+        { rel: 'icon', type: 'image/svg+xml', href: '/favicon.svg' },
+        { rel: 'icon', type: 'image/x-icon', href: '/favicon.ico' }
+      ]
+    }
+  },
+
   css: ['~/assets/css/main.css'],
 
   mdc: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cognova",
   "type": "module",
-  "version": "0.1.10",
+  "version": "0.2.2",
   "description": "Personal knowledge management system with Claude Code integration",
   "repository": {
     "type": "git",

package/server/api/dashboard/overview.get.ts

@@ -0,0 +1,133 @@
+import { eq, isNull, and, inArray, gte, desc, sql, ne } from 'drizzle-orm'
+import { getDb, schema } from '~~/server/db'
+import { requireDb } from '~~/server/utils/db-guard'
+import type { DashboardOverview } from '~~/shared/types'
+
+export default defineEventHandler(async (event) => {
+  requireDb(event)
+
+  const db = getDb()
+  const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000)
+
+  const [taskCounts, upcomingTasks, recentConversations, recentDocuments, usageAgg] = await Promise.all([
+    // Task counts: todo + in_progress (not deleted)
+    db.select({
+      status: schema.tasks.status,
+      count: sql<number>`count(*)::int`
+    })
+      .from(schema.tasks)
+      .where(and(
+        isNull(schema.tasks.deletedAt),
+        inArray(schema.tasks.status, ['todo', 'in_progress'])
+      ))
+      .groupBy(schema.tasks.status),
+
+    // Top 5 upcoming tasks (not done, not deleted)
+    db.select({
+      id: schema.tasks.id,
+      title: schema.tasks.title,
+      status: schema.tasks.status,
+      priority: schema.tasks.priority,
+      dueDate: schema.tasks.dueDate,
+      projectName: schema.projects.name,
+      projectColor: schema.projects.color
+    })
+      .from(schema.tasks)
+      .leftJoin(schema.projects, eq(schema.tasks.projectId, schema.projects.id))
+      .where(and(
+        isNull(schema.tasks.deletedAt),
+        ne(schema.tasks.status, 'done')
+      ))
+      .orderBy(
+        sql`${schema.tasks.dueDate} ASC NULLS LAST`,
+        desc(schema.tasks.priority)
+      )
+      .limit(5),
+
+    // Last 3 conversations
+    db.select({
+      id: schema.conversations.id,
+      sessionId: schema.conversations.sessionId,
+      title: schema.conversations.title,
+      messageCount: schema.conversations.messageCount,
+      startedAt: schema.conversations.startedAt
+    })
+      .from(schema.conversations)
+      .orderBy(desc(schema.conversations.startedAt))
+      .limit(3),
+
+    // Last 3 documents (not deleted)
+    db.select({
+      id: schema.documents.id,
+      title: schema.documents.title,
+      path: schema.documents.path,
+      modifiedAt: schema.documents.modifiedAt,
+      projectName: schema.projects.name,
+      projectColor: schema.projects.color
+    })
+      .from(schema.documents)
+      .leftJoin(schema.projects, eq(schema.documents.projectId, schema.projects.id))
+      .where(isNull(schema.documents.deletedAt))
+      .orderBy(desc(schema.documents.modifiedAt))
+      .limit(3),
+
+    // 7-day usage summary
+    db.select({
+      totalCost: sql<number>`coalesce(sum(${schema.tokenUsage.costUsd}), 0)::real`,
+      totalCalls: sql<number>`count(*)::int`,
+      totalInputTokens: sql<number>`coalesce(sum(${schema.tokenUsage.inputTokens}), 0)::int`,
+      totalOutputTokens: sql<number>`coalesce(sum(${schema.tokenUsage.outputTokens}), 0)::int`
+    })
+      .from(schema.tokenUsage)
+      .where(gte(schema.tokenUsage.createdAt, sevenDaysAgo))
+  ])
+
+  // Build task counts
+  let todoCount = 0
+  let inProgressCount = 0
+  for (const row of taskCounts) {
+    if (row.status === 'todo') todoCount = row.count
+    else if (row.status === 'in_progress') inProgressCount = row.count
+  }
+
+  const usageRow = usageAgg[0]
+
+  const overview: DashboardOverview = {
+    tasks: {
+      todoCount,
+      inProgressCount,
+      upcoming: upcomingTasks.map(t => ({
+        id: t.id,
+        title: t.title,
+        status: t.status as DashboardOverview['tasks']['upcoming'][0]['status'],
+        priority: t.priority,
+        dueDate: t.dueDate?.toISOString() ?? null,
+        projectName: t.projectName ?? null,
+        projectColor: t.projectColor ?? null
+      }))
+    },
+    conversations: recentConversations.map(c => ({
+      id: c.id,
+      sessionId: c.sessionId,
+      title: c.title ?? null,
+      messageCount: c.messageCount,
+      startedAt: c.startedAt.toISOString()
+    })),
+    documents: recentDocuments.map(d => ({
+      id: d.id,
+      title: d.title,
+      path: d.path,
+      modifiedAt: d.modifiedAt?.toISOString() ?? null,
+      projectName: d.projectName ?? null,
+      projectColor: d.projectColor ?? null
+    })),
+    usage: {
+      totalCost7d: usageRow?.totalCost ?? 0,
+      totalCalls7d: usageRow?.totalCalls ?? 0,
+      totalInputTokens7d: usageRow?.totalInputTokens ?? 0,
+      totalOutputTokens7d: usageRow?.totalOutputTokens ?? 0
+    }
+  }
+
+  return { data: overview }
+})

package/server/api/skills/[name]/files/create.post.ts

@@ -0,0 +1,45 @@
+import { mkdir, writeFile, stat } from 'fs/promises'
+import { join, normalize } from 'path'
+import { getSkillsDir, getInactiveSkillsDir } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async (event) => {
+  const name = getRouterParam(event, 'name')
+  if (!name)
+    throw createError({ statusCode: 400, message: 'Skill name required' })
+
+  const body = await readBody<{ path: string, type: 'file' | 'directory' }>(event)
+  if (!body?.path)
+    throw createError({ statusCode: 400, message: 'Path is required' })
+
+  const skillDir = await findSkillDir(name)
+  if (!skillDir)
+    throw createError({ statusCode: 404, message: `Skill '${name}' not found` })
+
+  const targetPath = normalize(join(skillDir, body.path))
+  if (!targetPath.startsWith(skillDir))
+    throw createError({ statusCode: 403, message: 'Path traversal not allowed' })
+
+  const existing = await stat(targetPath).catch(() => null)
+  if (existing)
+    throw createError({ statusCode: 409, message: 'Already exists' })
+
+  if (body.type === 'directory') {
+    await mkdir(targetPath, { recursive: true })
+  } else {
+    await writeFile(targetPath, '', 'utf-8')
+  }
+
+  return { data: { path: body.path, type: body.type || 'file' } }
+})
+
+async function findSkillDir(name: string): Promise<string | null> {
+  const activeDir = join(getSkillsDir(), name)
+  const activeStat = await stat(activeDir).catch(() => null)
+  if (activeStat?.isDirectory()) return activeDir
+
+  const inactiveDir = join(getInactiveSkillsDir(), name)
+  const inactiveStat = await stat(inactiveDir).catch(() => null)
+  if (inactiveStat?.isDirectory()) return inactiveDir
+
+  return null
+}

package/server/api/skills/[name]/files/delete.post.ts

@@ -0,0 +1,45 @@
+import { rm, stat } from 'fs/promises'
+import { join, normalize } from 'path'
+import { getSkillsDir, getInactiveSkillsDir } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async (event) => {
+  const name = getRouterParam(event, 'name')
+  if (!name)
+    throw createError({ statusCode: 400, message: 'Skill name required' })
+
+  const body = await readBody<{ path: string }>(event)
+  if (!body?.path)
+    throw createError({ statusCode: 400, message: 'Path is required' })
+
+  const skillDir = await findSkillDir(name)
+  if (!skillDir)
+    throw createError({ statusCode: 404, message: `Skill '${name}' not found` })
+
+  const targetPath = normalize(join(skillDir, body.path))
+  if (!targetPath.startsWith(skillDir))
+    throw createError({ statusCode: 403, message: 'Path traversal not allowed' })
+
+  // Prevent deleting SKILL.md
+  if (body.path === 'SKILL.md')
+    throw createError({ statusCode: 403, message: 'Cannot delete SKILL.md' })
+
+  const targetStat = await stat(targetPath).catch(() => null)
+  if (!targetStat)
+    throw createError({ statusCode: 404, message: 'File not found' })
+
+  await rm(targetPath, { recursive: true })
+
+  return { data: { path: body.path, deleted: true } }
+})
+
+async function findSkillDir(name: string): Promise<string | null> {
+  const activeDir = join(getSkillsDir(), name)
+  const activeStat = await stat(activeDir).catch(() => null)
+  if (activeStat?.isDirectory()) return activeDir
+
+  const inactiveDir = join(getInactiveSkillsDir(), name)
+  const inactiveStat = await stat(inactiveDir).catch(() => null)
+  if (inactiveStat?.isDirectory()) return inactiveDir
+
+  return null
+}

package/server/api/skills/[name]/files/index.get.ts

@@ -0,0 +1,28 @@
+import { stat } from 'fs/promises'
+import { join } from 'path'
+import { getSkillsDir, getInactiveSkillsDir, buildSkillFileTree } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async (event) => {
+  const name = getRouterParam(event, 'name')
+  if (!name)
+    throw createError({ statusCode: 400, message: 'Skill name required' })
+
+  const skillDir = await findSkillDir(name)
+  if (!skillDir)
+    throw createError({ statusCode: 404, message: `Skill '${name}' not found` })
+
+  const files = await buildSkillFileTree(skillDir)
+  return { data: files }
+})
+
+async function findSkillDir(name: string): Promise<string | null> {
+  const activeDir = join(getSkillsDir(), name)
+  const activeStat = await stat(activeDir).catch(() => null)
+  if (activeStat?.isDirectory()) return activeDir
+
+  const inactiveDir = join(getInactiveSkillsDir(), name)
+  const inactiveStat = await stat(inactiveDir).catch(() => null)
+  if (inactiveStat?.isDirectory()) return inactiveDir
+
+  return null
+}

package/server/api/skills/[name]/files/read.post.ts

@@ -0,0 +1,41 @@
+import { readFile, stat } from 'fs/promises'
+import { join, normalize } from 'path'
+import { getSkillsDir, getInactiveSkillsDir } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async (event) => {
+  const name = getRouterParam(event, 'name')
+  if (!name)
+    throw createError({ statusCode: 400, message: 'Skill name required' })
+
+  const body = await readBody<{ path: string }>(event)
+  if (!body?.path)
+    throw createError({ statusCode: 400, message: 'File path is required' })
+
+  const skillDir = await findSkillDir(name)
+  if (!skillDir)
+    throw createError({ statusCode: 404, message: `Skill '${name}' not found` })
+
+  // Prevent path traversal
+  const filePath = normalize(join(skillDir, body.path))
+  if (!filePath.startsWith(skillDir))
+    throw createError({ statusCode: 403, message: 'Path traversal not allowed' })
+
+  const fileStat = await stat(filePath).catch(() => null)
+  if (!fileStat?.isFile())
+    throw createError({ statusCode: 404, message: 'File not found' })
+
+  const content = await readFile(filePath, 'utf-8')
+  return { data: { path: body.path, content } }
+})
+
+async function findSkillDir(name: string): Promise<string | null> {
+  const activeDir = join(getSkillsDir(), name)
+  const activeStat = await stat(activeDir).catch(() => null)
+  if (activeStat?.isDirectory()) return activeDir
+
+  const inactiveDir = join(getInactiveSkillsDir(), name)
+  const inactiveStat = await stat(inactiveDir).catch(() => null)
+  if (inactiveStat?.isDirectory()) return inactiveDir
+
+  return null
+}