create-yss-spec 2.1.5 → 2.1.6

package/template/scripts/sync-skills

@@ -1,154 +1,9 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require "digest"
-require "fileutils"
-require "json"
-require "pathname"
-
-ROOT = Pathname.new(__dir__).join("..").realpath
-SOURCE_ROOT = ROOT.join(".agents/skills")
-LOCK_PATH = ROOT.join("skills-lock.json")
-PROJECTION_ROOTS = %w[
-  .claude/skills
-  .codex/skills
-  .hermes/skills
-  .pi/skills
-  .qoder/skills
-  .trae/skills
-].freeze
-OBSOLETE_SKILLS = %w[
-  to-prd
-  to-issues
-  design-an-interface
-  qa
-  request-refactor-plan
-  ubiquitous-language
-  edit-article
-  obsidian-vault
-  writing-great-skills
-  code-review-process
-  yss-domain-modeling
-  yss-dir
-  yss-duckdb
-  yss-file
-  yss-filerunner
-  yss-mail
-  yss-mapper-dynamic
-  yss-quality
-  yss-sql-condition
-  yss-sql-tpl
-  yss-openapi
-].freeze
-
-def skill_names(root)
-  root.children.select(&:directory?).map { |item| item.basename.to_s }.sort
-end
-
-def shared_skill_names
-  manifest = JSON.parse(LOCK_PATH.read)
-  shared = manifest.dig("skills", "shared")
-  return shared.keys.sort if manifest["version"] == 3 && shared.is_a?(Hash)
-
-  skill_names(SOURCE_ROOT) - OBSOLETE_SKILLS
-rescue JSON::ParserError, Errno::ENOENT
-  warn "skills-lock.json 无法解析；请先运行 scripts/update-skill-lock"
-  exit 1
-end
-
-def tree_hash(root)
-  digest = Digest::SHA256.new
-  root.glob("**/*", File::FNM_DOTMATCH)
-      .reject { |item| item.directory? || item.basename.to_s == ".DS_Store" }
-      .reject do |item|
-        relative = item.relative_path_from(root)
-        relative.each_filename.include?("__pycache__") ||
-          %w[.pyc .pyo].include?(item.extname)
-      end
-      .sort_by { |item| item.relative_path_from(root).to_s }
-      .each do |item|
-    relative = item.relative_path_from(root).to_s
-    digest << relative << "\0" << item.binread << "\0"
-  end
-  digest.hexdigest
-end
-
-def validate_target!(target)
-  expanded = target.expand_path
-  expected_prefix = ROOT.join(".").expand_path.to_s + File::SEPARATOR
-  return if expanded.to_s.start_with?(expected_prefix) && expanded.basename.to_s == "skills"
-
-  warn "refusing unsafe projection target: #{target}"
-  exit 2
-end
-
-def tracked_projection?(target)
-  relative = target.relative_path_from(ROOT).to_s
-  !IO.popen(["git", "ls-files", "-z", "--", relative], &:read).empty?
-end
-
-check_only = ARGV.include?("--check")
-shared = shared_skill_names
-missing_from_source = shared.reject { |skill_name| SOURCE_ROOT.join(skill_name).directory? }
-unless missing_from_source.empty?
-  warn "锁文件声明的共享 skills 缺少权威内容: #{missing_from_source.join(', ')}"
-  exit 1
-end
-obsolete_in_source = shared & OBSOLETE_SKILLS
-unless obsolete_in_source.empty?
-  warn "obsolete skills remain in canonical root: #{obsolete_in_source.join(', ')}"
-  exit 1
-end
-
-drift = []
-
-PROJECTION_ROOTS.each do |relative_root|
-  projection_root = ROOT.join(relative_root)
-  validate_target!(projection_root)
-  FileUtils.mkdir_p(projection_root) unless check_only
-
-  shared.each do |skill_name|
-    source = SOURCE_ROOT.join(skill_name)
-    target = projection_root.join(skill_name)
-
-    if check_only
-      if target.symlink?
-        drift << "projection target mismatch: #{target.relative_path_from(ROOT)}" unless target.exist? && target.realpath == source.realpath
-      elsif !target.directory?
-        drift << "missing projection: #{target.relative_path_from(ROOT)}"
-      elsif tree_hash(source) != tree_hash(target)
-        drift << "projection drift: #{target.relative_path_from(ROOT)}"
-      end
-      next
-    end
-
-    if target.symlink?
-      next if target.exist? && target.realpath == source.realpath
-
-      FileUtils.rm_f(target)
-      FileUtils.ln_s(source.relative_path_from(projection_root), target)
-    elsif !tracked_projection?(target)
-      FileUtils.rm_rf(target)
-      FileUtils.ln_s(source.relative_path_from(projection_root), target)
-    else
-      FileUtils.rm_rf(target)
-      FileUtils.cp_r(source, target, preserve: true)
-    end
-  end
-
-  OBSOLETE_SKILLS.each do |skill_name|
-    target = projection_root.join(skill_name)
-    if check_only
-      drift << "obsolete projection: #{target.relative_path_from(ROOT)}" if target.exist? || target.symlink?
-    else
-      FileUtils.rm_rf(target)
-    end
-  end
-end
-
-unless drift.empty?
-  warn drift.join("\n")
-  exit 1
-end
-
-puts check_only ? "skill projections are synchronized" : "synchronized #{shared.length} shared skills"
+#!/usr/bin/env node
+import { syncSkills } from "./lib/skill-supply-chain.mjs";
+
+try {
+  process.stdout.write(`${syncSkills({ check: process.argv.includes("--check") })}\n`);
+} catch (error) {
+  process.stderr.write(`${error.message}\n`);
+  process.exitCode = 1;
+}

package/template/scripts/update-skill-lock

@@ -1,255 +1,9 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require "digest"
-require "json"
-require "pathname"
-
-ROOT = Pathname.new(__dir__).join("..").realpath
-LOCK_PATH = ROOT.join("skills-lock.json")
-SHARED_ROOT = ROOT.join(".agents/skills")
-PROJECTION_ROOTS = %w[
-  .claude/skills
-  .codex/skills
-  .hermes/skills
-  .pi/skills
-  .qoder/skills
-  .trae/skills
-].freeze
-OBSOLETE_SKILLS = %w[
-  to-prd
-  to-issues
-  design-an-interface
-  qa
-  request-refactor-plan
-  ubiquitous-language
-  edit-article
-  obsidian-vault
-  writing-great-skills
-  code-review-process
-  yss-domain-modeling
-  yss-dir
-  yss-duckdb
-  yss-file
-  yss-filerunner
-  yss-mail
-  yss-mapper-dynamic
-  yss-quality
-  yss-sql-condition
-  yss-sql-tpl
-  yss-openapi
-].freeze
-LOCK_GROUPS = %w[shared platform].freeze
-GIT_WORKTREE = system(
-  "git",
-  "rev-parse",
-  "--is-inside-work-tree",
-  out: File::NULL,
-  err: File::NULL
-)
-
-def tracked_skill_names(relative_root)
-  return [] unless GIT_WORKTREE
-
-  IO.popen(
-    ["git", "ls-files", "-z", "--", relative_root],
-    err: File::NULL,
-    &:read
-  ).split("\0").map { |item| item.split("/")[2] }.compact.uniq
-end
-
-def skill_names(root)
-  return [] unless root.directory?
-
-  root.children.select(&:directory?).map { |item| item.basename.to_s }.sort
-end
-
-def tree_hash(root)
-  digest = Digest::SHA256.new
-  root.glob("**/*", File::FNM_DOTMATCH)
-      .reject do |item|
-        relative = item.relative_path_from(root)
-        item.directory? ||
-          item.basename.to_s == ".DS_Store" ||
-          relative.each_filename.include?("__pycache__") ||
-          %w[.pyc .pyo].include?(item.extname)
-      end
-      .sort_by { |item| item.relative_path_from(root).to_s }
-      .each do |item|
-    relative = item.relative_path_from(root).to_s
-    digest << relative << "\0" << item.binread << "\0"
-  end
-  digest.hexdigest
-end
-
-def old_metadata
-  return {} unless LOCK_PATH.file?
-
-  parsed = JSON.parse(LOCK_PATH.read)
-  skills = parsed.fetch("skills", {})
-  return skills unless (skills.keys & LOCK_GROUPS).any?
-
-  shared = skills.fetch("shared", {})
-  platform = skills.fetch("platform", {}).values.reduce({}) { |all, group| all.merge(group) }
-  legacy = skills.reject { |name, _| LOCK_GROUPS.include?(name) }
-
-  # Before the v3 manifest became canonical, Matt entries lived beside the
-  # shared/platform groups. Prefer those entries during migration because a
-  # manual upstream install may have refreshed their source path/hash while
-  # the nested copy is still stale.
-  shared.merge(legacy).merge(platform)
-rescue JSON::ParserError
-  {}
-end
-
-def legacy_shared_names
-  return [] unless LOCK_PATH.file?
-
-  parsed = JSON.parse(LOCK_PATH.read)
-  return [] unless parsed["version"] == 3
-
-  skills = parsed.fetch("skills", {})
-  (skills.keys - LOCK_GROUPS - OBSOLETE_SKILLS).sort
-rescue JSON::ParserError
-  []
-end
-
-def existing_shared_names
-  return nil unless LOCK_PATH.file?
-
-  parsed = JSON.parse(LOCK_PATH.read)
-  shared = parsed.dig("skills", "shared")
-  return shared.keys.sort if parsed["version"] == 3 && shared.is_a?(Hash)
-
-  nil
-rescue JSON::ParserError
-  nil
-end
-
-def existing_platform_inventory
-  return nil unless LOCK_PATH.file?
-
-  parsed = JSON.parse(LOCK_PATH.read)
-  platform = parsed.dig("skills", "platform")
-  return nil unless parsed["version"] == 3 && platform.is_a?(Hash)
-
-  platform.transform_values { |skills| skills.keys.sort }
-rescue JSON::ParserError
-  nil
-end
-
-def metadata_for(skill_name, skill_path, target_root, previous, canonical_root: false)
-  old = previous.fetch(skill_name, {})
-  recorded_skill_path = old.fetch("skillPath", skill_path)
-  if canonical_root && recorded_skill_path.match?(%r{\A\.(?:claude|codex|hermes|pi|qoder|trae)/skills/})
-    recorded_skill_path = skill_path
-  end
-  metadata = {
-    "source" => old.fetch("source", "project"),
-    "sourceType" => old.fetch("sourceType", "local"),
-    "skillPath" => recorded_skill_path,
-    "effectiveHash" => tree_hash(target_root)
-  }
-  upstream_hash = old["upstreamHash"] || old["computedHash"]
-  metadata["upstreamHash"] = upstream_hash if upstream_hash
-  metadata
-end
-
-previous = old_metadata
-add_names = ARGV.grep(/\A--add=/).map { |item| item.split("=", 2).last }
-remove_names = ARGV.grep(/\A--remove=/).map { |item| item.split("=", 2).last }
-platform_additions = ARGV.grep(/\A--add-platform=/).map do |item|
-  item.split("=", 2).last.split(":", 2)
-end
-shared_names = existing_shared_names || skill_names(SHARED_ROOT)
-shared_names = ((shared_names + legacy_shared_names + add_names).uniq - remove_names - OBSOLETE_SKILLS).sort
-
-missing_shared = shared_names.reject { |skill_name| SHARED_ROOT.join(skill_name).directory? }
-unless missing_shared.empty?
-  warn "锁文件声明的共享 skills 缺少权威内容: #{missing_shared.join(', ')}"
-  exit 1
-end
-
-tracked_shared_names = tracked_skill_names(".agents/skills")
-unlocked_tracked = tracked_shared_names - shared_names - OBSOLETE_SKILLS
-unless unlocked_tracked.empty?
-  warn "发现未登记到 skills-lock.json 的已跟踪共享 skills: #{unlocked_tracked.sort.join(', ')}"
-  warn "确认新增后运行 scripts/update-skill-lock --add=<skill-name>"
-  exit 1
-end
-
-all_targets = [".agents/skills", *PROJECTION_ROOTS]
-
-shared = shared_names.to_h do |skill_name|
-  skill_root = SHARED_ROOT.join(skill_name)
-  metadata = metadata_for(
-    skill_name,
-    ".agents/skills/#{skill_name}/SKILL.md",
-    skill_root,
-    previous,
-    canonical_root: true
-  )
-  metadata["targets"] = all_targets
-  [skill_name, metadata]
-end
-
-existing_platform = existing_platform_inventory
-platform = {}
-PROJECTION_ROOTS.each do |relative_root|
-  target_root = ROOT.join(relative_root)
-  default_names = skill_names(target_root) - shared_names
-  platform_names = existing_platform ? existing_platform.fetch(relative_root, []) : default_names
-  additions = platform_additions.select { |root_name, _| root_name == relative_root }.map(&:last)
-  platform_names = ((platform_names + additions).uniq - remove_names - shared_names - OBSOLETE_SKILLS).sort
-
-  missing_platform = platform_names.reject { |skill_name| target_root.join(skill_name).directory? }
-  unless missing_platform.empty?
-    warn "锁文件声明的平台 skills 缺少内容 (#{relative_root}): #{missing_platform.join(', ')}"
-    exit 1
-  end
-
-  tracked_platform_names = tracked_skill_names(relative_root)
-  unlocked_platform = tracked_platform_names - shared_names - platform_names - OBSOLETE_SKILLS
-  unless unlocked_platform.empty?
-    warn "发现未登记的平台 skills (#{relative_root}): #{unlocked_platform.sort.join(', ')}"
-    warn "确认新增后运行 scripts/update-skill-lock --add-platform=#{relative_root}:<skill-name>"
-    exit 1
-  end
-
-  next if platform_names.empty?
-
-  platform[relative_root] = platform_names.to_h do |skill_name|
-    skill_root = target_root.join(skill_name)
-    metadata = metadata_for(
-      skill_name,
-      "#{relative_root}/#{skill_name}/SKILL.md",
-      skill_root,
-      previous
-    )
-    metadata["targets"] = [relative_root]
-    [skill_name, metadata]
-  end
-end
-
-manifest = {
-  "version" => 3,
-  "generatedBy" => "scripts/update-skill-lock",
-  "canonicalRoot" => ".agents/skills",
-  "projectionRoots" => PROJECTION_ROOTS,
-  "skills" => {
-    "shared" => shared,
-    "platform" => platform
-  }
+#!/usr/bin/env node
+import { updateSkillLock } from "./lib/skill-supply-chain.mjs";
+
+try {
+  process.stdout.write(`${updateSkillLock()}\n`);
+} catch (error) {
+  process.stderr.write(`${error.message}\n`);
+  process.exitCode = 1;
 }
-rendered = JSON.pretty_generate(manifest) + "\n"
-
-if ARGV.include?("--check")
-  unless LOCK_PATH.file? && LOCK_PATH.read == rendered
-    warn "skills-lock.json is stale; run scripts/update-skill-lock"
-    exit 1
-  end
-  puts "skills-lock.json matches distributed skills"
-else
-  LOCK_PATH.write(rendered)
-  puts "updated skills-lock.json with #{shared.length} shared skills and #{platform.values.sum(&:length)} platform skills"
-end

package/template/scripts/vendor/NOTICES.md

@@ -0,0 +1,45 @@
+# Node vendor notices
+
+These generated Node runtime bundles contain the following packages:
+
+- @nodable/entities@3.0.0
+  - license: MIT
+  - integrity: sha512-8L9xFeTYKhm49xfIypoe2W5wV1m/3Z58kT+7kR9A8OyFxcPduI4VmxaUMQyKYrRjUoLLSXv6EKKID5Tvj9cUVw==
+  - source: git+https://github.com/nodable/val-parsers.git
+- anynum@1.0.1
+  - license: MIT
+  - integrity: sha512-N6//FLET/tXYNM/F6ABca1oH6fWB+KlTt909Le28WMDBk8oaT4vY17DCrwg2MvmuqUKt3Ni4N5dGJ/EoBgcO6A==
+  - source: https://github.com/NaturalIntelligence/anynum
+- fast-xml-builder@1.3.1
+  - license: MIT
+  - integrity: sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==
+  - source: git+https://github.com/NaturalIntelligence/fast-xml-builder.git
+- fast-xml-parser@5.11.0
+  - license: MIT
+  - integrity: sha512-9IGxMqvqLOnqP+Egi1nqDHKv5k8aZ7r9n558enxcucmyVGEBNPAU+MOg/8jPIS7rO7sSq4gFm1/nHtiaubMruw==
+  - source: git+https://github.com/NaturalIntelligence/fast-xml-parser.git
+- is-unsafe@2.0.0
+  - license: MIT
+  - integrity: sha512-2LdV822R+wmI86unXA93WCFpL6g+av8ynWk0nrHyJqGop5VoocYsSLFgN8jrfalT6iGeLNM4KXuVSsULP53kEA==
+  - source: https://github.com/NaturalIntelligence/is-unsafe
+- path-expression-matcher@1.6.2
+  - license: MIT
+  - integrity: sha512-enSlaiat05iasnzmgNxRj8reFdj3puY2QpNgP1aPIaVfT6nn9ICuPoFlKHk8EN22HcwewshO+mN2DGbkCEOtqQ==
+  - source: https://github.com/NaturalIntelligence/path-expression-matcher
+- strnum@2.4.2
+  - license: MIT
+  - integrity: sha512-rDG3Ah4TV0k1hWvLSzkZtMmLN9+eS+h3knq4MP6A42Y3Yh5qGNnOUs1jJkoSr8FG5dsL28c7KgkIBzSEykqtuw==
+  - source: https://github.com/NaturalIntelligence/strnum
+- xml-naming@0.3.0
+  - license: MIT
+  - integrity: sha512-ghig2TBE/H11aOVgmahA3MhimvkBr6JIYknH/Dhdk10nXwdbIqBJsbfMxpvFPG8bAw77gN29aQWvKpmVoPlvPQ==
+  - source: https://github.com/NaturalIntelligence/xml-naming
+- yaml@2.9.0
+  - license: ISC
+  - integrity: sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==
+  - source: github:eemeli/yaml
+
+## Bundle SHA-256
+
+- yaml.mjs: sha256:58c510627769ef4e75e90bcf410d63ba33e64b46bc9cfc53149839d5ccb1709b
+- xml.mjs: sha256:bab9b35f123c30198a7597422ca0baa9f207c0e536b41f2c478c6fd6b7fdfc79