cognova 0.2.0 → 0.2.2

package/Claude/CLAUDE.md

@@ -26,6 +26,7 @@ Cognova is a self-hosted Nuxt 4 web application for personal knowledge managemen
 | Task Management | `/task` | Create, list, update, complete tasks |
 | Project Management | `/project` | Organize tasks into projects |
 | Memory | `/memory` | Search past decisions, store insights, recall context |
+| Secrets | `/secret` | Store, retrieve, list, delete encrypted API keys and credentials |
 | Environment | `/environment` | Check system status, troubleshoot issues |
 | Skill Creator | `/skill-creator` | Create new Claude Code skills |
 
@@ -103,11 +104,15 @@ Memory is your most important tool. You are stateless between sessions — witho
 **Rule: When in doubt, store it.** A redundant memory is harmless. A forgotten one wastes the user's time.
 
 ### Secrets & Sensitive Data
-- NEVER store passwords, tokens, API keys, or credentials in memory, notes, or conversation
-- NEVER write secrets to files — use the Cognova settings UI or secrets API instead
-- If a user shares a credential in chat, warn them it should be stored as a secret
-- When you need a token for an integration, check the secrets API first before asking the user
+
+**CRITICAL — Zero tolerance for leaked secrets:**
+- NEVER store passwords, tokens, API keys, or credentials in memory, notes, conversation, or any file
+- NEVER write secrets to files — use `/secret set KEY` or the Cognova settings UI instead
+- NEVER embed API keys, tokens, or credentials in SKILL.md files or Python scripts when creating or modifying skills — always use `get_secret()` from `_lib/api.py`
+- If a user shares a credential in chat, warn them and store it via `/secret set KEY` immediately
+- When you need a token for an integration, check with `/secret list` and `/secret get KEY` before asking the user
 - Treat any string that looks like a key, token, or password as sensitive — do not echo it back
+- When creating skills that need external API keys, declare them in `requires-secrets` frontmatter and use `get_secret()` in the script
 
 ### Troubleshooting
 - Use `/environment status` or `/environment health` to diagnose issues

package/Claude/skills/environment/SKILL.md

@@ -2,6 +2,12 @@
 name: environment
 description: Check system status, view configuration, troubleshoot issues with the Cognova installation. Use when diagnosing problems, checking health, or understanding the current setup.
 allowed-tools: Bash, Read
+metadata:
+  version: "1.0.0"
+  requires-secrets: []
+  author: Cognova
+  repository: ""
+  installed-from: ""
 ---
 
 # Environment Skill

package/Claude/skills/memory/SKILL.md

@@ -2,6 +2,12 @@
 name: memory
 description: Access persistent memory across Claude sessions. Search past conversations, recall decisions, store key insights. Use when needing context from previous work or to save important information for future sessions.
 allowed-tools: Bash, Read
+metadata:
+  version: "1.0.0"
+  requires-secrets: []
+  author: Cognova
+  repository: ""
+  installed-from: ""
 ---
 
 # Memory Skill

package/Claude/skills/project/SKILL.md

@@ -2,6 +2,12 @@
 name: project
 description: Manage Cognova projects - create, list, update projects. ALWAYS searches for existing projects before creating new ones. ALWAYS confirms with user before creating, showing potential matches.
 allowed-tools: Bash, Read
+metadata:
+  version: "1.0.0"
+  requires-secrets: []
+  author: Cognova
+  repository: ""
+  installed-from: ""
 ---
 
 # Project Management Skill

package/Claude/skills/secret/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: secret
+description: Manage encrypted secrets for API keys, tokens, and credentials. Use when the user needs to store, retrieve, list, or delete sensitive values.
+allowed-tools: Bash, Read
+metadata:
+  version: "1.0.0"
+  requires-secrets: []
+  author: Cognova
+  repository: ""
+  installed-from: ""
+---
+
+# Secrets Management Skill
+
+Manage encrypted secrets stored in Cognova. Use this for API keys, tokens, webhook URLs, and any sensitive credentials that skills or integrations need.
+
+## Commands
+
+### List all secrets
+
+```bash
+python3 ~/.claude/skills/secret/secret.py list
+```
+
+Shows all stored secret keys with descriptions and last updated timestamps. Values are NOT shown.
+
+### Get a secret value
+
+```bash
+python3 ~/.claude/skills/secret/secret.py get <KEY>
+```
+
+Retrieves the decrypted value of a secret. **Do NOT echo the value back to the user** — confirm it was retrieved successfully without displaying it.
+
+Example:
+```bash
+python3 ~/.claude/skills/secret/secret.py get OPENAI_API_KEY
+```
+
+### Store a secret
+
+```bash
+python3 ~/.claude/skills/secret/secret.py set <KEY> --value <VALUE> [--description <DESC>]
+```
+
+Creates or updates an encrypted secret. Key names should use `SCREAMING_SNAKE_CASE`.
+
+Examples:
+```bash
+python3 ~/.claude/skills/secret/secret.py set DISCORD_WEBHOOK_URL --value "https://discord.com/api/webhooks/..." --description "Discord notifications webhook"
+python3 ~/.claude/skills/secret/secret.py set OPENAI_API_KEY --value "sk-..." --description "OpenAI API key for GPT integration"
+```
+
+### Delete a secret
+
+```bash
+python3 ~/.claude/skills/secret/secret.py delete <KEY>
+```
+
+Permanently removes an encrypted secret.
+
+## Natural Language Patterns
+
+When users say things like:
+- "Store this API key..." -> Use `set`
+- "Save my token for..." -> Use `set`
+- "What secrets do I have?" -> Use `list`
+- "Get my Discord webhook" -> Use `get`
+- "Remove the old API key" -> Use `delete`
+- "I need to add a key for..." -> Use `set`
+
+## Key Naming Convention
+
+Use `SCREAMING_SNAKE_CASE` for all secret keys:
+- `GOOGLE_API_KEY`
+- `DISCORD_WEBHOOK_URL`
+- `OPENAI_API_KEY`
+- `GITHUB_TOKEN`
+
+## Security Rules
+
+1. **Never echo secret values** — After `get`, confirm success without displaying the value
+2. **Never store secrets elsewhere** — No memory, no notes, no files, no conversation logs
+3. **Always use this skill** — When a user provides a credential, store it here immediately
+4. **Warn on exposure** — If a user pastes a key/token in chat, warn them and offer to store it

package/Claude/skills/secret/secret.py

@@ -0,0 +1,146 @@
+#!/usr/bin/env python3
+"""Manage encrypted secrets in Cognova."""
+
+import argparse
+import sys
+from pathlib import Path
+
+# Add parent directory for _lib imports
+sys.path.insert(0, str(Path(__file__).parent.parent))
+from _lib.api import get, post, put, delete, get_secret
+
+
+def cmd_list(args):
+    """List all stored secrets."""
+    success, data = get("/secrets")
+    if not success:
+        print(f"Error: {data}")
+        sys.exit(1)
+
+    secrets = data if isinstance(data, list) else []
+    if not secrets:
+        print("No secrets stored.")
+        print("\nUse: python3 secret.py set KEY --value VALUE")
+        return
+
+    # Calculate column widths
+    key_width = max(len(s.get("key", "")) for s in secrets)
+    key_width = max(key_width, 3)
+
+    print(f"{'Key':<{key_width}}  {'Description':<40}  {'Updated'}")
+    print(f"{'-' * key_width}  {'-' * 40}  {'-' * 19}")
+
+    for s in secrets:
+        key = s.get("key", "")
+        desc = s.get("description", "") or ""
+        updated = s.get("updatedAt", s.get("createdAt", ""))[:19] if s.get("updatedAt") or s.get("createdAt") else ""
+        # Truncate description if too long
+        if len(desc) > 40:
+            desc = desc[:37] + "..."
+        print(f"{key:<{key_width}}  {desc:<40}  {updated}")
+
+    print(f"\n{len(secrets)} secret(s) stored.")
+
+
+def cmd_get(args):
+    """Get a secret value."""
+    success, value = get_secret(args.key)
+    if not success:
+        print(f"Error: {value}")
+        print(f"\nSecret '{args.key}' not found. Use 'list' to see available secrets.")
+        sys.exit(1)
+
+    if args.raw:
+        # Raw output for piping to other commands
+        print(value, end="")
+    else:
+        print(f"Secret '{args.key}' retrieved successfully.")
+        print(f"Value: {value}")
+
+
+def cmd_set(args):
+    """Create or update a secret."""
+    if not args.value:
+        print("Error: --value is required")
+        sys.exit(1)
+
+    data = {
+        "key": args.key,
+        "value": args.value,
+    }
+    if args.description:
+        data["description"] = args.description
+
+    # Try to check if it exists first
+    check_success, _ = get_secret(args.key)
+
+    if check_success:
+        # Update existing
+        success, result = put(f"/secrets/{args.key}", data)
+        action = "updated"
+    else:
+        # Create new
+        success, result = post("/secrets", data)
+        action = "created"
+
+    if not success:
+        print(f"Error: {result}")
+        sys.exit(1)
+
+    print(f"Secret '{args.key}' {action} successfully.")
+    if args.description:
+        print(f"Description: {args.description}")
+
+
+def cmd_delete(args):
+    """Delete a secret."""
+    success, result = delete(f"/secrets/{args.key}")
+    if not success:
+        print(f"Error: {result}")
+        sys.exit(1)
+
+    print(f"Secret '{args.key}' deleted successfully.")
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Manage encrypted secrets in Cognova"
+    )
+    subparsers = parser.add_subparsers(dest="command", help="Command to run")
+
+    # list
+    subparsers.add_parser("list", help="List all secrets")
+
+    # get
+    get_parser = subparsers.add_parser("get", help="Get a secret value")
+    get_parser.add_argument("key", help="Secret key name")
+    get_parser.add_argument("--raw", action="store_true", help="Output raw value only")
+
+    # set
+    set_parser = subparsers.add_parser("set", help="Create or update a secret")
+    set_parser.add_argument("key", help="Secret key name (SCREAMING_SNAKE_CASE)")
+    set_parser.add_argument("--value", required=True, help="Secret value")
+    set_parser.add_argument("--description", help="Description of what this secret is for")
+
+    # delete
+    del_parser = subparsers.add_parser("delete", help="Delete a secret")
+    del_parser.add_argument("key", help="Secret key name")
+
+    args = parser.parse_args()
+
+    if not args.command:
+        parser.print_help()
+        sys.exit(1)
+
+    commands = {
+        "list": cmd_list,
+        "get": cmd_get,
+        "set": cmd_set,
+        "delete": cmd_delete,
+    }
+
+    commands[args.command](args)
+
+
+if __name__ == "__main__":
+    main()

package/Claude/skills/skill-creator/SKILL.md

@@ -3,6 +3,12 @@ name: skill-creator
 description: Assists users in creating new Claude Code skills. Uses web search to find latest conventions and suggests alternative approaches (existing MCPs, plugins) when appropriate.
 allowed-tools: Bash, Read, Write, WebSearch, WebFetch
 disable-model-invocation: true
+metadata:
+  version: "1.0.0"
+  requires-secrets: []
+  author: Cognova
+  repository: ""
+  installed-from: ""
 ---
 
 # Skill Creator
@@ -11,6 +17,8 @@ Assists in creating new Claude Code skills for Cognova or personal use.
 
 ## Process
 
+> **CRITICAL: Skills must NEVER contain hardcoded secrets.** Always use `get_secret()` from `_lib/api.py` for API keys, tokens, and credentials. If the user provides a key/token during skill creation, store it via `/secret set KEY` first, then reference it by key name in the script. Declare required secrets in `metadata.requires-secrets` frontmatter.
+
 When a user asks to create a new skill:
 
 ### 1. Understand the Requirement
@@ -193,6 +201,28 @@ my_var = os.environ.get('MY_CUSTOM_VAR', 'default')
 | `user-invocable` | false | Claude-only, hidden from user menu |
 | `context` | fork | Run in subagent |
 | `agent` | Explore, Plan, general-purpose | Agent type for subagent |
+| `metadata` | object | Custom metadata (version, author, etc.) |
+
+#### Metadata Fields
+
+Nest under `metadata:` in frontmatter:
+
+```yaml
+metadata:
+  version: "1.0.0"
+  requires-secrets: ["API_KEY_NAME"]
+  author: Your Name
+  repository: ""
+  installed-from: ""
+```
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `version` | string | Semantic version |
+| `requires-secrets` | string[] | Secret keys the skill needs (fetched via `get_secret()`) |
+| `author` | string | Skill author name |
+| `repository` | string | Source repository URL |
+| `installed-from` | string | Library name if installed from community |
 
 ### 7. Skill Locations
 

package/Claude/skills/task/SKILL.md

@@ -2,6 +2,12 @@
 name: task
 description: Manage Cognova tasks - create, list, update, complete tasks. Use when the user wants to track work items, todos, or action items. Can search for and associate tasks with projects.
 allowed-tools: Bash, Read
+metadata:
+  version: "1.0.0"
+  requires-secrets: []
+  author: Cognova
+  repository: ""
+  installed-from: ""
 ---
 
 # Task Management Skill

package/app/components/skills/Card.vue

@@ -0,0 +1,82 @@
+<script setup lang="ts">
+import type { SkillListItem } from '~~/shared/types'
+
+const props = defineProps<{
+  skill: SkillListItem
+}>()
+
+const emit = defineEmits<{
+  toggle: [name: string]
+}>()
+
+const toggling = ref(false)
+
+async function handleToggle() {
+  toggling.value = true
+  emit('toggle', props.skill.name)
+  toggling.value = false
+}
+</script>
+
+<template>
+  <NuxtLink
+    :to="`/skills/${skill.name}`"
+    class="block p-4 rounded-lg border border-default bg-elevated/50 hover:bg-elevated transition-colors"
+  >
+    <div class="flex items-start justify-between gap-3">
+      <div class="flex-1 min-w-0">
+        <div class="flex items-center gap-2 mb-1">
+          <span class="font-medium text-sm truncate">{{ skill.name }}</span>
+          <UBadge
+            v-if="skill.core"
+            variant="subtle"
+            color="primary"
+            size="xs"
+          >
+            Core
+          </UBadge>
+          <UBadge
+            v-if="!skill.active"
+            variant="subtle"
+            color="neutral"
+            size="xs"
+          >
+            Disabled
+          </UBadge>
+        </div>
+        <p class="text-xs text-muted line-clamp-2">
+          {{ skill.description }}
+        </p>
+      </div>
+
+      <USwitch
+        v-if="!skill.core"
+        :model-value="skill.active"
+        size="sm"
+        :loading="toggling"
+        @update:model-value="handleToggle"
+        @click.prevent.stop
+      />
+    </div>
+
+    <div class="flex items-center gap-2 mt-3">
+      <UBadge
+        v-if="skill.version"
+        variant="soft"
+        color="neutral"
+        size="xs"
+      >
+        v{{ skill.version }}
+      </UBadge>
+      <UBadge
+        v-if="skill.author"
+        variant="soft"
+        color="neutral"
+        size="xs"
+      >
+        {{ skill.author }}
+      </UBadge>
+      <span class="text-xs text-dimmed ml-auto">{{ skill.fileCount }} file{{ skill.fileCount !== 1 ? 's' : '' }}</span>
+    </div>
+  </NuxtLink>
+</template>

package/app/components/skills/CreateModal.vue

@@ -0,0 +1,156 @@
+<script setup lang="ts">
+const props = defineProps<{
+  open: boolean
+}>()
+
+const emit = defineEmits<{
+  'update:open': [value: boolean]
+  'created': [name: string]
+}>()
+
+const router = useRouter()
+const toast = useToast()
+
+const mode = ref<'blank' | 'generate'>('blank')
+const name = ref('')
+const description = ref('')
+const loading = ref(false)
+
+function resetForm() {
+  mode.value = 'blank'
+  name.value = ''
+  description.value = ''
+  loading.value = false
+}
+
+function close() {
+  emit('update:open', false)
+  resetForm()
+}
+
+async function handleCreate() {
+  if (!name.value.trim()) return
+
+  loading.value = true
+  try {
+    if (mode.value === 'blank') {
+      await $fetch('/api/skills/create', {
+        method: 'POST',
+        body: { name: name.value.trim(), description: description.value.trim() || undefined }
+      })
+      toast.add({ title: `Skill '${name.value}' created`, color: 'success' })
+      emit('created', name.value.trim())
+      close()
+      router.push(`/skills/${name.value.trim()}`)
+    } else {
+      if (!description.value.trim()) {
+        toast.add({ title: 'Description is required for AI generation', color: 'warning' })
+        loading.value = false
+        return
+      }
+      const res = await $fetch<{ data: { name: string, costUsd: number } }>('/api/skills/generate', {
+        method: 'POST',
+        body: { name: name.value.trim(), description: description.value.trim() }
+      })
+      toast.add({
+        title: `Skill '${name.value}' generated`,
+        description: `Cost: $${res.data.costUsd.toFixed(4)} — created in inactive state for review`,
+        color: 'success'
+      })
+      emit('created', name.value.trim())
+      close()
+      router.push(`/skills/${name.value.trim()}`)
+    }
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : 'Failed to create skill'
+    toast.add({ title: message, color: 'error' })
+  } finally {
+    loading.value = false
+  }
+}
+</script>
+
+<template>
+  <UModal
+    :open="props.open"
+    @update:open="emit('update:open', $event)"
+  >
+    <template #header>
+      <span class="font-semibold">Create Skill</span>
+    </template>
+
+    <template #body>
+      <div class="space-y-4">
+        <div class="flex gap-2">
+          <UButton
+            :variant="mode === 'blank' ? 'solid' : 'outline'"
+            color="neutral"
+            size="sm"
+            icon="i-lucide-file-plus"
+            @click="mode = 'blank'"
+          >
+            Blank Skill
+          </UButton>
+          <UButton
+            :variant="mode === 'generate' ? 'solid' : 'outline'"
+            color="neutral"
+            size="sm"
+            icon="i-lucide-sparkles"
+            @click="mode = 'generate'"
+          >
+            AI Generate
+          </UButton>
+        </div>
+
+        <UFormField label="Name">
+          <UInput
+            v-model="name"
+            placeholder="my-skill"
+            :disabled="loading"
+            class="w-full"
+          />
+        </UFormField>
+
+        <UFormField
+          label="Description"
+          :required="mode === 'generate'"
+        >
+          <UTextarea
+            v-model="description"
+            :placeholder="mode === 'generate' ? 'Describe what this skill should do...' : 'Optional description'"
+            :rows="3"
+            :disabled="loading"
+            class="w-full"
+          />
+        </UFormField>
+
+        <p
+          v-if="mode === 'generate'"
+          class="text-xs text-muted"
+        >
+          AI-generated skills are created in an inactive state so you can review them before enabling.
+        </p>
+      </div>
+    </template>
+
+    <template #footer>
+      <div class="flex justify-end gap-2">
+        <UButton
+          variant="ghost"
+          color="neutral"
+          :disabled="loading"
+          @click="close"
+        >
+          Cancel
+        </UButton>
+        <UButton
+          :loading="loading"
+          :disabled="!name.trim()"
+          @click="handleCreate"
+        >
+          {{ mode === 'generate' ? 'Generate' : 'Create' }}
+        </UButton>
+      </div>
+    </template>
+  </UModal>
+</template>